topic PA-820 Decryption Causing Slow Internet at 5000 sessions in General Topics

PA-820 Decryption Causing Slow Internet at 5000 sessions

upmpaloadmin — Fri, 17 Jan 2020 21:16:24 GMT

We have been having a issue at our corporate office where users are complaining about slow access to the internet when I have decryption enabled and sessions reach 5000. Around 3000-4000 access is completely fine. I have been monitoring this from the CLI using the command "show session all filter ssl-decrypt yes count yes". Since the 820 is spec'd to handle 12,800 concurrent sessions I don't understand why the issue starts at such a low number of decrypted sessions.

Re: PA-820 Decryption Causing Slow Internet at 5000 sessions

Remo — Sat, 18 Jan 2020 14:41:12 GMT

Hi @upmpaloadmin

Did you configure certificate checks via OCSP? Wjat other features do you have enabled (tp, url, av, vuln, as, ...)? Do you use the firewall also for client to site or site to site VPN connections? What exactly means slow: did you measure website load times? What internet connection do you have for that firewall and is the firewall itself using the same connection or another dedicated one?

Re: PA-820 Decryption Causing Slow Internet at 5000 sessions

BPry — Mon, 20 Jan 2020 04:03:14 GMT

@upmpaloadmin,

All of the questions that @Remo is asking are important but tend to point towards one simple thing; there is a lot of different options on the firewall that can cause a PA-820 to be overtaxed and users to see increased load times. If you want to detail your configuration a bit more we can tell you if your experience is normal with the amount of features you have enabled and the traffic that we see on our own units, but even then we don't know what your traffic actually looks like.

I would really recommend that you reach out to TAC so they can look over all aspects of your configuration and see if you are actually hitting some sort of bug, or if you are simply over taxing the PA-820 due to the traffic patterns you are attempting to send through the box.