Siebel - on PA2020 v.5.0.11 - slow

[DimitrisK]

Hello all,

we have recently Siebel 7.8 which is behind the PA2020.

The speed working on Siebel is so slow that in some requests freeze the clients.

I created a test client which bypasses the PA and siebel runs perfectly.

I created an application override with a custom application but the PA would not recognize the application and will not go through that rule.

The application override was created following this link How to Create an Application Override Policy

I used the inbuild app (siebel-crm) on the application override and rule. The traffic now passes through the rule but the speed is worse then dail-up connection.

Does not seem that it is overriding the app.

I increased the session timeout on the inbuild siebel-crm app and that stopped the clients from freezing and improved slightly the speed,

but still nowhere close to having the clients off PA. That is not an option.

Is there any other way to completely overide the app?

Thank you

[HULK]

Hello DimitrisK,

Would it be possible for you to share the custom app configuration and other details ( screen-shots). We need to see, why it is not going through the appropriate policy. Once the traffic will go through the override policy, then we would be able to compare the performance.

Thanks

[DimitrisK]

Thank you for your quick response, this issue is bugging me for the last week!

On the print screen the destination address on the application override policy is an IP same as on the security rule.

On the security rule the source addresses are 2 /24 networks 1 /23 network and 2 IPs.

I hope this helps.

[HULK · Accepted solution]

Hello DimitrisK,

Thanks for your reply. From the above mentioned application override policy, it, looks like you are using default application "Siebel-crm" on the policy. In order to apply an override policy, you need to create a custom application. You should not use the default Application  to override.

Please find below an example:

Step-1: Go to Object > Application > Add a new application i.e Siebel-custom

Step-2: Add the protocol/port number of that application.

Step-3:

Step-4: Add the custom application on the override policy ( not the default Siebel-crm).

Hope this helps.

Thanks

[DimitrisK]

Hulk thank you, that did the trick. seems to be working smothly and fast. apart from one function within Siebel.

Though I noticed that the service needs to be defined in the security rule also for the override to work.

One last question,  does the override of the custom-app created, completely ignors the timeouts and characteristics specified? or can thoughs be tweeted.

Thank you

[HULK]

Hello DimitrisK,

If you want, you can specify the timeout value for this specific application traffic, else it will take the global TCP (3600 Sec), UDP (30 Sec) timeout value.

Thanks

[DimitrisK]

thank you

[wvechamaneesri]

My customer face this issue too. However, they dont want to use app override as it bypass all content inspection. Do you know what is the root cause of slowness when enabling app-id on this application?

[cpainchaud]

bypassing content inspection on this one is not an issue if there is nothing to protect anyway for Siebel.

I advice you to open a TAC case with some packet captures.