topic website slowness with DHCP Cable Modem in General Topics

website slowness with DHCP Cable Modem

danlukas — Fri, 05 Jul 2013 14:37:08 GMT

I recently installed a PA-200 and many websites are either very slow to load or have to be refreshed multiple times in the browser. Tried multiple browsers so not browser specific. Running a PA-200 with DHCP to Time Warner on the Untrusted interface. PA support had me change the MTU size on the untrusted interface to 1452 and also check "Adjust TCP MSS" but I am still seeing the issue. I'm on 5.05 and have url filtering turned off. Any ideas?

thanks

Re: website slowness with DHCP Cable Modem

dpalani — Fri, 05 Jul 2013 15:35:59 GMT

Hi,

Have you directly connected the PA-200 to the cable modem or is there a switch in between ? If there is a switch in between please check the interface configuration on the

palo alto device to be auto auto auto. If there is a mismatch on the switch port to which the PA-200 is connected to you might see this issue. Doing a packet capture on the

firewall and looking at the MSS negotiation will shed more light on this issue.

Deepak

Re: website slowness with DHCP Cable Modem

danlukas — Fri, 05 Jul 2013 17:01:47 GMT

it is directly connected to the cable modem. I had a ASA connected in the same manner and just swapped it with the PAN about a week ago. The trust interrface is connected to a cat 3560.

Re: website slowness with DHCP Cable Modem

dpalani — Fri, 05 Jul 2013 17:06:46 GMT

As a test ping a dns server from the untrust interface, ping from the trust interface on the firewall and then from a host on the internal network.

Compare the ping result to check for discrepancy.

Re: website slowness with DHCP Cable Modem

HULK — Fri, 05 Jul 2013 21:55:16 GMT

Hi,

Could you please take a chapter on your laptop and firewall ingress interface. Compare both the captures and check if there are any TCP re-transmission/TCP NACK.

Thanks

Subhankar

Re: website slowness with DHCP Cable Modem

UhMayYeah — Sat, 06 Jul 2013 07:51:44 GMT

Can you paste the o/p of the following CLI command:

> show interface all

> show running nat-policy

Is Zone-protection enabled on the inside interface?

Re: website slowness with DHCP Cable Modem

danlukas — Sun, 07 Jul 2013 19:10:36 GMT

Here are the 2 outputs:

admin@PA-200> show interface all

total configured hardware interfaces: 5

name id speed/duplex/state mac address

--------------------------------------------------------------------------------

ethernet1/1 16 100/full/up b4:0c:25:22:fa:10

ethernet1/2 17 1000/full/up b4:0c:25:22:fa:11

vlan 1 [n/a]/[n/a]/up b4:0c:25:22:fa:01

loopback 3 [n/a]/[n/a]/up b4:0c:25:22:fa:03

tunnel 4 [n/a]/[n/a]/up b4:0c:25:22:fa:04

aggregation groups: 0

total configured logical interfaces: 5

name id vsys zone forwarding tag address

------------------- ----- ---- ---------------- ------------------------ ------ ------------------

ethernet1/1 16 1 untrust vr:Internal 0 65.30.22.29/19

ethernet1/2 17 1 trust vr:Internal 0 10.1.99.1/24

vlan 1 1 N/A 0 N/A

loopback 3 1 N/A 0 N/A

tunnel 4 1 N/A 0 N/A

admin@PA-200> show running nat-policy

Internet-NAT {

from trust;

source any;

to untrust;

to-interface ethernet1/1 ;

destination any;

service any/any/any;

translate-to "src: ethernet1/1 65.30.22.29(*) (dynamic-ip-and-port) (pool idx: 1)";

terminal no;

}

Re: website slowness with DHCP Cable Modem

UhMayYeah — Sun, 07 Jul 2013 21:29:24 GMT

How may entries do you see in the arp table from ethernet1/1-65.30.22.29/19 ?

Execute CLI command : > show arp ethernet1/1

Check " total ARP entries shown : "

Re: website slowness with DHCP Cable Modem

kprakash — Mon, 08 Jul 2013 13:47:11 GMT

I see that the speed on the eth1/1 is 100 Mbps. Is that the right setting, or can it be hard coded to 1000?

Can you also verify the DNS server settings on the firewall? Is it being inherited from the DHCP server on the modem? If so, can you try with an internal DNS server or a global DNS server like 4.2.2.2 or 8.8.8.8 to see if it makes a difference?

Device---> setup--> services.

BR,

Karthik RP

Re: website slowness with DHCP Cable Modem

danlukas — Mon, 08 Jul 2013 14:09:20 GMT

The cable modem is 10/100 and can't do a 1000. In services I did change DNS to an internal 10. dns server and have the same issue.Support had me change mtu to 1360 but am still showing the same signs. Sites with either a lot of graphics or links are hit and miss like cnn.com. I've even changed the mtu on a couple of mac's with the same results. If i look at the eth1/1 interface it does grab a dns server from the upstream time warner router. I don't know how i can hard code that since it is configed as a dhcp client. Here is the screen shot of that.

Re: website slowness with DHCP Cable Modem

kprakash — Mon, 08 Jul 2013 15:18:30 GMT

The DNS server settings configured under the Device---> setup--> services. , super cedes the DNS server settings received from the DHCP server on the untrust interface.

So you could try with these sever settings to see if it makes a difference ( you can configured your internal DNS server or use the public DNS servers 4.2.2.2 or 8.8.8.8)

Re: website slowness with DHCP Cable Modem

kprakash — Mon, 08 Jul 2013 15:34:25 GMT

I would recommend keeping the MSS to 1360, only if the default route points out on a tunnel interface (accessing internet through an ipsec tunnel, terminating on anther firewall, which then routes the traffic to internet) and users are complaining about slowness in connectivity through the tunnel. Lowering the MSS also affects the traffic, if not flowing through a tunnel. If the default route points out on an ethernet interface, which in our case does on the eth1/1 interface, its recommended that we use MTU as 1500 and MSS as 1460.

BR,

Karthik

Re: website slowness with DHCP Cable Modem

danlukas — Thu, 11 Jul 2013 15:57:51 GMT

I have been seeing a fair amount of errors on the trusted interface eth1/2. A lot of "arp not found" "packets dropped" and "recieved errors". They increment when websites hang.

admin@PA-200> show interface ethernet1/2

--------------------------------------------------------------------------------

Name: ethernet1/2, ID: 17

Link status:

Runtime link speed/duplex/state: 1000/full/up

Configured link speed/duplex/state: auto/auto/auto

MAC address:

Port MAC address b4:0c:25:22:fa:11

Operation mode: layer3

Untagged sub-interface support: no

--------------------------------------------------------------------------------

Name: ethernet1/2, ID: 17

Operation mode: layer3

Virtual router Internal

Interface MTU 1500

Interface IP address: 10.1.99.1/24

Interface management profile: N/A

Service configured:

Zone: trust, virtual system: vsys1

Adjust TCP MSS: no

--------------------------------------------------------------------------------

Physical port counters read from MAC:

--------------------------------------------------------------------------------

rx-broadcast 0

rx-bytes 1689996865

rx-multicast 0

rx-unicast 9681331

tx-broadcast 10843

tx-bytes 8607553337

tx-multicast 0

tx-unicast 10973532

--------------------------------------------------------------------------------

Hardware interface counters read from CPU:

--------------------------------------------------------------------------------

bytes received 1651271541

bytes transmitted 8563280129

packets received 9681331

packets transmitted 10973532

receive errors 122909

packets dropped 0

--------------------------------------------------------------------------------

Logical interface counters read from CPU:

--------------------------------------------------------------------------------

bytes received 1647143807

bytes transmitted 8563280129

packets received 9614787

packets transmitted 10973532

receive errors 0

packets dropped 355102

packets dropped by flow state check 0

forwarding errors 0

no route 17

arp not found 263223

neighbor not found 0

neighbor info pending 0

mac not found 0

packets routed to different zone 0

land attacks 0

ping-of-death attacks 0

teardrop attacks 0

ip spoof attacks 0

mac spoof attacks 0

ICMP fragment 0

layer2 encapsulated packets 0

layer2 decapsulated packets 0

--------------------------------------------------------------------------------

Re: website slowness with DHCP Cable Modem

HULK — Thu, 11 Jul 2013 20:26:08 GMT

Hi,

Could you please update below mentioned command o/p,

admin@55-PA> show arp ethernet1/2

A sample o/p mentioned below:

maximum of entries supported : 32000 >>>>>>>>>>>>>>>>>> please check max supported

default timeout: 1800 seconds

total ARP entries in table : 0 >>>>>>>>>>>>>>>>>>>>>>>> current entries in table

total ARP entries shown : 0 >>>>>>>>>>>>>>> verify it it is close to max value supported

status: s - static, c - complete, e - expiring, i - incomplete

interface ip address hw address port status ttl

--------------------------------------------------------------------------------

Thanks

Subhankar

Re: website slowness with DHCP Cable Modem

scantwell — Mon, 15 Jul 2013 22:40:22 GMT

DanLukas

Do you have a 1 or more routes pointing 0.0.0.0 to your next hop router?

In other words, I have seen people program their own 0.0.0.0/0 route, pointing to their ISP's router.

I am curious if you did the same?

Re: website slowness with DHCP Cable Modem

danlukas — Tue, 16 Jul 2013 13:16:20 GMT

That is what was going on. The checkbox is checked by default when configuring dhcp to get default route from the dhcp server. I had also setup a 0.0.0.0/0 route in my virtual router. Once i removed the 0.0.0.0 route all was good. I figured that out late last week.

Thanks to everyone for all their suggestions

Re: website slowness with DHCP Cable Modem

scantwell — Tue, 16 Jul 2013 15:21:16 GMT

Hi there.

Glad you figured it out.

Can you go back into your post, mark it as Correct, and then highlight my response as the correct answer?

This way, other people that search for similar info see the issue is resolved.

Steve