Internet Performance issues

[u7285]

Good Morning Everyone

We recently installed a new PA-500 with OS 3.1.4 loaded. URL Filtering was disabled. After enabling URL filtering internet speed degarded to the point of it takes 10min to open a site like google.... hiting refresh once or twice will open the site imediatly without any problems. Sometimes sites only gets loaded half. After reading multiple discusion I upgraded the OS to 4.0.3. The problem still exists....

Internet bandwidth is not saturated. (first thing i checked)

URL filtering is only set to alert by default onto the Inbound and Outbound policies. The only other policies is to block social networking applications.

What are we doing wrong?

Thank you in advance!

K

[lardsa]

Hello,

I have same problem, but only when SSL decryption is enabled. What about you ?

Regards

[u7285]

Good Morning Lardsa

At the moment it is a mix of sites (SSL and normal HTTP). It is not site specific, thats the weird part of it. I am allmost at the point of removing URL filtering (inluding the license) to see if Internet speeds restores! I hope PA support can asisist before I go to such extreame.

Busy checking on the SSL decryption (thanx)

[lardsa]

Also note that if you have Dynamic URL filtering box enabled in your URL Filtering profile, it can lead to big slowdowns if your PA Management IP is not allowed to get updates from Bightcloud directly (5 seconds timeout). I experienced it myself.

[u7285]

Hi Lardsa

Dynamic URL filtering is not switched on and SSl Dcryption is not configured (unless I am overlooking it)

[migration]

Hi Kobus,

You will see "Dynamic URL Filtering" if it is enabled under the URL Security Profile Object

->Objects Tab

    ->Security Profile

         ->URL Filtering

               ->"URL Object" - there is a tick box there.

It could be possible that the management interface does not have connectivity to get updates.

Marc

[u7285]

Hi Marct

I can confirm that Dynamic URL Filtering is not ticked and I have ensured that my management IP has full internet access. Not using any proxies! Problem still exists.......

Thanx for the assistance anyway

[Laforgepaul]

We have seen this behavior while blocking web advertisements.  Sites were very slow to load, after only alerting on this category, response times returned to normal.

[u7285]

Hi Laforgepaul

I had the same isea, but nothing is being blocked at the moment. All categories are either n allow or alert.

[joshsmtech]

Can you give a little more info in regards to the size of your network behind the PA500? How many web users, etc... We are using a 4020 with URL filtering and don't have any performance issues with about 800 internet users. But I realize a 4020 has quite a bit more horsepower than a PA-500.

Sounds like a call to tech support might be good for this one, If you haven't called them already. Please let us know what you find out. I am considering a PA500 for some of our smaller remote sites so any info / feedback you have would be great.

[frank_henry]

http://kb.mozillazine.org/Error_loading_any_website

"Temporarily turn off ad-blocking.  Extensions and Internet security  software that block advertising or other unwanted content can cause  problems loading webpage content"

I can attest that noscript on FF, preventing scripts/ads to load can slow down and even prevent page load.

Just a thought.

EDIT: This link (at StackOverflow) provides more discussion of Blocking vs NON-Blocking Advertisments.  You may find that blocking some Ad sources are generally problematic; and blocking ads in general for certain sites to be problematic given the above considerations.

http://bit.ly/qhHtQz