PA-820 Decryption Causing Slow Internet at 5000 sessions

Reply
L0 Member

PA-820 Decryption Causing Slow Internet at 5000 sessions

We have been having a issue at our corporate office where users are complaining about slow access to the internet when I have decryption enabled and sessions reach 5000. Around 3000-4000 access is completely fine. I have been monitoring this from the CLI using the command "show session all filter ssl-decrypt yes count yes". Since the 820 is spec'd to handle 12,800 concurrent sessions I don't understand why the issue starts at such a low number of decrypted sessions. 

Highlighted
L7 Applicator

Re: PA-820 Decryption Causing Slow Internet at 5000 sessions

Hi @upmpaloadmin 

Did you configure certificate checks via OCSP? Wjat other features do you have enabled (tp, url, av, vuln, as, ...)? Do you use the firewall also for client to site or site to site VPN connections? What exactly means slow: did you measure website load times? What internet connection do you have for that firewall and is the firewall itself using the same connection or another dedicated one?

Highlighted
L7 Applicator

Re: PA-820 Decryption Causing Slow Internet at 5000 sessions

@upmpaloadmin,

All of the questions that @vsys_remo is asking are important but tend to point towards one simple thing; there is a lot of different options on the firewall that can cause a PA-820 to be overtaxed and users to see increased load times. If you want to detail your configuration a bit more we can tell you if your experience is normal with the amount of features you have enabled and the traffic that we see on our own units, but even then we don't know what your traffic actually looks like.

I would really recommend that you reach out to TAC so they can look over all aspects of your configuration and see if you are actually hitting some sort of bug, or if you are simply over taxing the PA-820 due to the traffic patterns you are attempting to send through the box. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!