Slow Google searches on 9.0

[Sec101]

Recently we changed to 9.0 code.   We are running decryption on our firewalls.   I've seen some very slow google searches recently, and a few errors when searching all while  using chrome.  Eventually the page will load the search if I wait long enough.   It's almost like chrome is failing the search at first, and then succeeding?   Wondering if this has something to do with http2 decryption?

[reaper]

See if you can set chrome in developer mode (or install a.http plugin) to track how many queries are being launched when running a.search. since google is all about tracking etc you're probably launching a handful of sessions that all need to be decrypted and some may wait for others to complete so google can optimize your 'ad' spread

You could try either blocking some ad categories or disabling decryption for them

[Sec101]

This is interesting.   is there a plugin you suggest that is best for this?

[reaper]

I used to use 'live http headers' bit that's been infested with malware some time ago

The built-in dev tool is pretty good though: hit shift+ctrl+J or option+command+J and then hit the "network" tab. Then see what happens if you do a Google search (mine currently shows 60 requests)

This will also help you visualize where the delay is (are all queries slow or are there 1/few that are slowing everything down)

[Sec101]

Just random ones, but it's the majority.   Seems you can replicate by closing the browser and relaunching it and googling something.  Even went as far as allowing web advertisements category for google-base, to see if that would help.   Same thing.   Edge surfs just fine, even on google.   Just chrome.   Anything to do with this?

https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption-err-http2-inadequate-transport-se... 

[Sec101]

it's interesting, as I see really long "Stalled" - some up to 50 -60 seconds.   All of these searches have the "h2" protocol involved.   If I strip alpn, all returns to normal and I can't replicate it.   All of the issues starts with a fresh window of chrome, and the first search you enter.   Below of an h2 transaction for a simple google search: