6.1.1 performance issues?

[SDorsey]

Has anyone encountered any throughput issues with 6.1.1? I have NOT had any issues until Friday.

Installed a PAN200 in vwire mode for a client eval / AVR. Their throughput to the internet was 44mbps before PAN. Through the PAN, it as cut down to 8mbps. Removed PAN and it went back up to 44mbps.

With other PAN200s on 6.1.1, I am getting 50+ on them.

In this specific scenario, it is sitting between a Barracuda WCF 410 and an ASA5510. I have placed one before between these two specific devices without issue. The MTU between all devices is the standard 1500.

Thoughts?

[ErwinBuena]

I'm running latest version of PAN6.xx and I have this similar issue when I'm doing testing and found out that the reductions of throughput is related to the way url filtering has been configured specially if you're using speedtest and other sorftware online to test the internet speed connections. Reduction of throughput the way I've observe it during my testing is due to ports being block by PaloAlto used by speedtest to do it calculation.

You can test it by creating a policy with filtering in place and without filtering. Observe the result and see if you can get the 44mb without PAN. The other issue that slow your connections is with the proxy that you used to connect to the internet. You can also disable it on your pc and play around with PAN configuration with or without filtering.

I hope it helps with  your troubleshooting.

[SDorsey]

Thanks for the information!

There is no proxy at this client. I *did* have URL filtering configured to alert on all categories for the sake of this eval. I will tune this down so it only alerts on malicious categories.

[pulukas]

I would test by creating a rule without any profiles for just the speed test site ip address.  If the issue clears, then add the profiles on here in various configurations to see what helps and hurts.