PA-820 Decryption Causing Slow Internet at 5000 sessions

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

PA-820 Decryption Causing Slow Internet at 5000 sessions

L0 Member

We have been having a issue at our corporate office where users are complaining about slow access to the internet when I have decryption enabled and sessions reach 5000. Around 3000-4000 access is completely fine. I have been monitoring this from the CLI using the command "show session all filter ssl-decrypt yes count yes". Since the 820 is spec'd to handle 12,800 concurrent sessions I don't understand why the issue starts at such a low number of decrypted sessions. 


L7 Applicator

Hi @upmpaloadmin 

Did you configure certificate checks via OCSP? Wjat other features do you have enabled (tp, url, av, vuln, as, ...)? Do you use the firewall also for client to site or site to site VPN connections? What exactly means slow: did you measure website load times? What internet connection do you have for that firewall and is the firewall itself using the same connection or another dedicated one?

Cyber Elite
Cyber Elite


All of the questions that @Remo is asking are important but tend to point towards one simple thing; there is a lot of different options on the firewall that can cause a PA-820 to be overtaxed and users to see increased load times. If you want to detail your configuration a bit more we can tell you if your experience is normal with the amount of features you have enabled and the traffic that we see on our own units, but even then we don't know what your traffic actually looks like.

I would really recommend that you reach out to TAC so they can look over all aspects of your configuration and see if you are actually hitting some sort of bug, or if you are simply over taxing the PA-820 due to the traffic patterns you are attempting to send through the box. 

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!