GlobalProtect clients experiencing latency delays

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

GlobalProtect clients experiencing latency delays

L4 Transporter

Hello,

 

Clients who are connected via GlobalProtect VPN are experiencing slowness with all their traffic traversing the VPN (ie.. Internet and Server access traffic).

The latency is between 200-400ms for all the traffic regardless of whether its Internet based (to google) or server based (to our corporate servers).

 

Can you suggest any troubleshooting steps for this? Any relevant article to check?

 

Thanks in advance.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

In GlobalProtect client, Details tab.

Check if protocol is SSL or IPSec.

If it is SSL then check if you permit udp 4501 towards GlobalProtect gateway.

Also check that you have "Enable IPSec" checked in GlobalProtect gateway config (Tunnel Settings tab).

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

View solution in original post

12 REPLIES 12

Cyber Elite
Cyber Elite

In GlobalProtect client, Details tab.

Check if protocol is SSL or IPSec.

If it is SSL then check if you permit udp 4501 towards GlobalProtect gateway.

Also check that you have "Enable IPSec" checked in GlobalProtect gateway config (Tunnel Settings tab).

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister

 

So you mean to permit udp 4501 in to the firewall using a security policy permiting it?  I have a rule coming in to the firewall for the global protect client  that has service any and I still get complaints from users that it still too slow.

I looked in network/interfaces/tunnel and I don't see a place in enable ipsec but I do see it enabled when I go to the globalprotect gateway configuration

If you run GlobalProtect on your untrust interface and you don't have block any-any rule added then last interzone-default will permit from untrust to untrust 4501.

If you run GlobalProtect gateway on loopback and then you need to NAT udp 4501 to this loopback.

 

GlobalProtect agent will try IPSec 3 times and then falls back to SSL.

In case SSL it is TCP inside TCP (tcp meltdown and other issues can occure).

 

Enable IPSec is in firewall.

Enable IPSec.PNG

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

If agent view shows IPSec then issue is somewhere else.

 

IPSec.PNG

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister

Yes I have IPSEC enabled in the location in your screenshot.  I am using the SSL protocol to connect.  I must add I did not do the original configuration of the VPN's I have got them to work and now I am working at getting them to work as efficiently as I can.

I didn't find any NATTING concerning the loopbacks used for the VPN's

If GP agent shows SSL as protocol it can't connect with IPSec.

Go to Monitor > Traffic and use filter below.

( port.dst eq 4501 )

 

Do you see it being blocked?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister

 

Port 4501 is not being blocked for legitimate traffic to the loopback for the VPN

Earlier you mentioned you saw no natting but now you mention that GP runs on loopback.

If it runs on loopback there must be DNAT in place.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister

 

Good point I will check again on the natting

@Raido_Rattameister

I also run different portals/gateways on loopbackinterfaces ... but I do not NAT at all in this case. All the loopbacks simply have public IPs so there is no need for DNAT

True it can use external IP but if agent connects overr SSL then most likely it is either Security Policy or NAT that is not configured correctly.

In some rare cases source network but quite rare nowadays.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi there! I know this thread is older...but how do you create a DNAT for 4501 AND 443?

 

For example, I have gateway configured with x.x.x.x:7000

 

I have a DNAT that forwards 7000 to 443.  How do I get it working with 4501? reason I ask is because I want my tunnel to use IPSEC rather than SSL.

 

Thank you!!

  • 1 accepted solution
  • 11169 Views
  • 12 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!