Slow Google searches on 9.0

[Sec101]

Recently we changed to 9.0 code.   We are running decryption on our firewalls.   I've seen some very slow google searches recently, and a few errors when searching all while  using chrome.  Eventually the page will load the search if I wait long enough.   It's almost like chrome is failing the search at first, and then succeeding?   Wondering if this has something to do with http2 decryption?

[Sec101]

I wonder why it makes for such a slow search on http/2 connections?   It only appears to be on chrome too.   Other browsers work fine.

[tigeli]

@Sec101 at least I could reproduce the issue on Safari, Chrome and Firefox.

[Sec101]

you could reproduce on other browsers?   

[jmurphy]

While waiting on TAC to call me back, I found this forum and tried the "workaround"...worked for me!  So I guess now I can tell TAC what's actually wrong.

[Dpeters1]

No, I wasnt able to re-produce in other browsers, although I didn't really try very hard, 99% over browser use is chrome. I've ended up adding a few youtube URLs and some related google video URLs to our "strip ALPN" url category, youtube videos were being very slow to buffer.

all a bit ironic really, HTTP/2 is support to be faster than 1.1 🙂

PLEASE PLEASE PLEASE let us know the outcome of your TAC call, I anticipate that we'll see an updated HTTP2 decoder in a future content update. 

Speaking with some colleagues, they've seen the exact issue but with unrelated websites quite some time ago, and an updates HTTP2 decoder resolved the issue.

[Sec101]

@jmurphy

I'll be looking forward to hearing back on your TAC case too.

@Dpeters1 

update http2 decoder?  You mean on the firewall itself - or on the browser?

[Dpeters1]

@jmurphy on the firewall, the decoders for various protocols are updates as part of apps and threats updates, and as luck would have it... todays apps and threats has an updated http2 decoder... we had issues with this on different web sites back in 9.0 or 9.1 (feels like a million years ago now) and an updated decoder fixed the issues. that said we're on 10.0.2 now for our main site, and that hasn't been affected. still stumped as to how its not a consistent issue across locations and firewalls. 

[jmurphy]

So far nothing useful to report from the tac case.  After the content update 8356, it does seem to be working better though.

[Dpeters1]

Thanks for keeping us updated on your TAC case. I'd have raised one but frankly couldnt face it, already got a couple of super weird bug cases open that are taking forever to get to the bottom of! 🙂 

The content update didn't help for me unfortunately.