Getting Low Speed

[HilalWani]

Guys,

My Lan users are getting a slow downloading speed. I have checked the ISP cable directly and there I am getting the accurate speed which is 30Mbps. But when I am connecting the ISP cable to Paloalto after that I am running the speed test it's gives me only 4 Mbps.

I have tested also one pc with no URL filtering or no profiles applied on it, and also gives full internet access but still the same issue.

Is there anyone who can help?

[Gustavo_Aristi]

I would try running a trace route from an affected endpoint and see if the hops make sense.

Also a packet capture from the Palo Alto from such endpoint.

Goals:

Check if there is a resulting "drop" packet capture.

Check the global counters by using the same packet capture filters running the command:

"show counter global filter packet-filter yes delta yes"

This will give you global counters filtered by your packet capture filters. This will very likely point you to the culprit.

I would assume you will see things such as "asymmetric path" drops or "land attack" related drops.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/take-packet-captures

[nikoolayy1]

If you are always using a globalprotect VPN then check if your VPN is using SSL as this has bad performance compared to ipsec:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

How to Confirm if GlobalProtect Tunnel is Using IPSec or SSL? - Knowledge Base - Palo Alto Networks

Also you can check for drops using packet capture and global counters following the article:

LIVEcommunity - Knowledge sharing: Palo Alto checking for drops (rejects ,discards), slowness (laten...

For more globalprotect issues and you don't see anything in the counters and capture then check also the PanGPS and PanGPA logs and you check the article below: 

LIVEcommunity - Knowledge sharing: Globalprotect troubleshooting/investgation. Split tunnel,Globalpr...