PA-820 Decryption Causing Slow Internet at 5000 sessions

[upmpaloadmin]

We have been having a issue at our corporate office where users are complaining about slow access to the internet when I have decryption enabled and sessions reach 5000. Around 3000-4000 access is completely fine. I have been monitoring this from the CLI using the command "show session all filter ssl-decrypt yes count yes". Since the 820 is spec'd to handle 12,800 concurrent sessions I don't understand why the issue starts at such a low number of decrypted sessions. 

[Remo]

Hi @upmpaloadmin 

Did you configure certificate checks via OCSP? Wjat other features do you have enabled (tp, url, av, vuln, as, ...)? Do you use the firewall also for client to site or site to site VPN connections? What exactly means slow: did you measure website load times? What internet connection do you have for that firewall and is the firewall itself using the same connection or another dedicated one?

[BPry]

@upmpaloadmin,

All of the questions that @Remo is asking are important but tend to point towards one simple thing; there is a lot of different options on the firewall that can cause a PA-820 to be overtaxed and users to see increased load times. If you want to detail your configuration a bit more we can tell you if your experience is normal with the amount of features you have enabled and the traffic that we see on our own units, but even then we don't know what your traffic actually looks like.

I would really recommend that you reach out to TAC so they can look over all aspects of your configuration and see if you are actually hitting some sort of bug, or if you are simply over taxing the PA-820 due to the traffic patterns you are attempting to send through the box.