topic Re: Slow ISP bandwidth through PA-3020 in General Topics

Slow ISP bandwidth through PA-3020

calumetcounty — Mon, 11 Jan 2021 14:52:51 GMT

We upgraded to a 1gb/s internet connection from a 50mb/s on Friday. For some reason we are only seeing a max of maybe 250-300mb/s but in most cases we are at 175mb/s.

We have a PA-3020, with App-ID enabled and Threat. We did our research before upgrading and thought we would see closer to 1gb/s with this firewall.

Any ideas on what we can check for?

When we remove the PA from the mix, we are over 900mb/s.

Re: Slow ISP bandwidth through PA-3020

MP18 — Mon, 11 Jan 2021 15:21:49 GMT

@calumetcounty

Do you have any QoS enabled?

How many max sessions you have?

Regards

Re: Slow ISP bandwidth through PA-3020

calumetcounty — Mon, 11 Jan 2021 15:41:02 GMT

We are a fairly small organization with about 300 staff.

Not quite sure where to look for the max sessions.

As far as qos for inbound/oubound traffic, there is one policy that was added as our Webex experience was poor. The QOS seemed to resolve it.

Found session count. 4780 / 262142

We are using 3% management and 5% dataplane.

Re: Slow ISP bandwidth through PA-3020

BPry — Mon, 11 Jan 2021 18:21:38 GMT

@calumetcounty,

You'll want to take a look at that QoS policy or post the configuration here so that we can take a look at it. You could easily have that misconfigured so that the firewall isn't attempting to use full bandwidth due to QoS.

Re: Slow ISP bandwidth through PA-3020

calumetcounty — Mon, 11 Jan 2021 18:40:51 GMT

The policy is pretty basic, set to real-time with no bandwidth limit. using the default for tunneled traffic.

I removed the policy and tested with Google speed test and the results were the same.

Re: Slow ISP bandwidth through PA-3020

Brandon_Wertz — Wed, 13 Jan 2021 14:38:21 GMT

@calumetcounty Are you doing any SSL decryption?

--edit-- Also try using this site as a confirmation of throughput testing. https://www.thinkbroadband.com/download in the past working with Palo TAC engineering team they recommended using more of a "file transfer" versus the theoretical throughput testing sites.