Issues with Webpages Hanging

[suaveswede]

Hi All,

I'm new to Palo Alto and have been having issues with content loading on my network.  Across the network, webpages that are being loaded in browser will periodically hang and as soon as the user refreshes them they load right away.  Also video streaming and image viewing applications appear to behave the same way in that a user will try to load content, can't, will restart the application and then the content will load up fine from the internet.  I'm using the VM-100 and have alocated plenty of RAM and CPU for the VM.  Have looked at security policies but they appear to be fine.  Any suggestions on where to look next would be much appreciated.

Thanks!

[rmonvon]

Hi...A couple of things that you can check:

- Ethernet port speed/duplex mismatch

- If you are using URL filtering, FQDN objects, maek sure the DNS server(s) are configured and reachable by the PA.

- Make sure the mgmt port of the PA can get out to the Internet for content updates

Thanks,

[suaveswede]

None of those appear to be an issue.  Maybe MTU setting?

[rmonvon]

You can take a packet capture to see if there are many fragmented packets which would point to MTU.  

Do you have proxy that would affect the cachin of web contents?

Are you seeing similar symptom for other traffic like FTP, SSL, etc? 

[suaveswede]

Just a DNS proxy.  It's most obvious when streaming video or loading images.

[rmonvon]

Just to test if any of your policies may cause this, can you allow a test user full access (src=ip-test-user any any action=allow) with no blocking on any URL categories, etc.  

[suaveswede]

Just tested it out and there seems to be minimal change.  live.paloaltonetworks.com actually is one of the sites that takes forever to load.

[rmonvon]

I suggest the next step may be to contact Support and open a case.  Thanks.

[jvalentine]

A couple of questions:  

Which hypervisor are you using?  

If you're using VMware ESXi/vSphere, are you using Promiscuous mode on the port-groups where your firewall is connected or have you enabled "Use Hypervisor-assigned MAC address" in the firewall?  

[suaveswede · Accepted solution]

Hi All,

I've discovered that having the services in my Security Policies set to "application-default," is what causes the issue.  Defining this myself fixes the issue.

[Brandon_Wertz]

That's odd.  What application needed to use "Any?"

Did you have any deny logs of that application on any port other than the "standard?"  If no logs did you have a clean-up rule that's actually logging the denies?  By default palo's implict deny doesn't log.

[suaveswede]

It caused big problems with Netflix and other streaming services.  Maybe it took too long to look it up in the application-default list?  I'm not sure.  I defined the service ports manually.