topic Re: Slow Traffic in General Topics

Slow Traffic

simsim — Thu, 25 Jan 2018 07:22:48 GMT

Hi,
PA in vwire mode , zone client and zone servers

In zone servers there is a print server(windows) and the zone client users pc .

Users are trying heavy duty printing (50-100) pages .

User complaining about slow operations

How can I verify pa is bottleneck or making some issues

data plane is seems to be ok

Thanks

Re: Slow Traffic

Mick_Ball — Thu, 25 Jan 2018 08:39:48 GMT

can i just ask...

where exactly is the printer ?

Re: Slow Traffic

simsim — Thu, 25 Jan 2018 11:20:42 GMT

Hi,

Printer and users are in the clietn zone

Re: Slow Traffic

Mick_Ball — Thu, 25 Jan 2018 11:30:31 GMT

firstly... have you checked the status of the print job on the print server.

it may give some indication..

i would imagine you are looking for some diagnostics on the PA. I would run wireshark on the print server or the printer port to see what the traffic is doing.

you could use the monitor/packet capture on the firewall and filter printer traffic.

somebody else may post with some clever CLI commands..

Re: Slow Traffic

simsim — Sat, 27 Jan 2018 00:37:36 GMT

Hi,

here is the summary of total connections per day from the printer to server

bytes 15.91 G

sessions 29.39 k

Is it quite large in your experience ?

Thanks

Re: Slow Traffic

simsim — Sat, 27 Jan 2018 07:30:48 GMT

Hi,

Is it possible , Pa just monitor and do not take any action against the session .

Thanks

Re: Slow Traffic

Mick_Ball — Sat, 27 Jan 2018 10:06:51 GMT

Sorry @simsim. I cant advise here because all of our clients, printers and servers are on the same Pan interface.

Re: Slow Traffic

simsim — Sat, 27 Jan 2018 14:54:43 GMT

Hi,

What does it mean by same interface ? .Same zone

Thanks

Re: Slow Traffic

Mick_Ball — Sat, 27 Jan 2018 17:37:32 GMT

Yes @simsim, the same zone.

Re: Slow Traffic

simsim — Sat, 27 Jan 2018 17:55:42 GMT

Hi,

The question is out of context , how these servers are protected ?

Thanks

Re: Slow Traffic

Mick_Ball — Sat, 27 Jan 2018 18:57:24 GMT

Protected from what?.

users?

User devices are all domain members and very restricted.... no command prompt, only allowed programmes ( word, excel, ppoint etc,,,). All tied down by group policy.

the internet?

no acces to these servers from rhe internet, unless via reverse proxy, vdi gateways or global protect for domain membership.

Re: Slow Traffic

Brandon_Wertz — Mon, 29 Jan 2018 14:32:06 GMT

I may be totally off base here, but perhaps in this instance the PA is being used to segment printing?

It's been widely publicized that you can use printers to get root access to windows machines using non-privileged accounts. So users would be in one zone and printers in another potentially?

Re: Slow Traffic

Mick_Ball — Mon, 29 Jan 2018 17:43:22 GMT

@Brandon_Wertz, Hi.

I may be totally off base here, but perhaps in this instance the PA is being used to segment printing?

yes fully understood and totally agree.

@simsim is using Vwire for that very purpose,

I was only saying that I cannot assist @simsim any further as we do not use Vwire.

it is not a requirement for us,

sorry for any confusion or mislead...

Mick.

Re: Slow Traffic

OtakarKlier — Mon, 29 Jan 2018 18:00:32 GMT

Hello,

I would try a p[rint job from within the same zone and see if the speed changes, e.g. faster or the same. This would be an indication of potential slow downs caused by the firewall. I also have a similar setup but the print servers are remote and honestly we havent had nay complaints. Perhaps the users are just used to the slower printing?

Regards,