topic Re: PA-200 Slow browsing with url filtering in General Topics

PA-200 Slow browsing with url filtering

myrdin — Tue, 14 Jun 2016 02:10:57 GMT

Hi,

a couple of questions on the matter:

- to get URL reports i need URL Filter on the rule to be on . Is this correct? Or can i have url reports without that enabled?

- with a PA200 with 1 computer connected, with URL fitler when i enter the website, it takes 4-5 seconds to show the page. without url filtering on the rule the page displays immediately. Is this normal? or there is a piece of configuration that i can change to speed this up.

The goal here is NOT to filter the websites but to have a report of websites visited per user or IP. Since the url do not get logged if i dont have the url filter on the rule, i need to fix the issue on the slowness.

Again, these tests i made were with a 50Mbps connection and 1 single computer connected to the palo.

thanks

Re: PA-200 Slow browsing with url filtering

Raido_Rattameister — Tue, 14 Jun 2016 05:12:25 GMT

You need URL profile attached to the policy to see reports.

You can try to set all categories to "alert" in URL filtering profile.

By default all requests that are sent out from firewall (including URL category check) go out from management interface (can be changed).

Can your firewall management interface access internet?

Re: PA-200 Slow browsing with url filtering

ShannonRowe — Tue, 28 Jun 2016 21:46:18 GMT

Performance doesnt sound right. Should not have any user-noticeable delay.

Is it slow if you access the same site multiple times?

PAN maintains a local cache of sites, but has to go out to the PANDB (or BrightCloud) if it does not have a record. Accessing the site multiple times means it will be cached locally for categorization lookup and should have no noticeable performance hit...

We also experience no impact for non-cached sites, but if this is your issue it could be any number of things, upstream from the PAN.

Re: PA-200 Slow browsing with url filtering

myrdin — Thu, 30 Jun 2016 03:58:24 GMT

Sorry for the very late reply and thanks for your answers. I will give it shot.