Slow Performanced Based on Order of ACL Rules

[SDorsey]

We have several PAN 3020s at a client site with similar issues but for this, I’ll focus on a specific case. One pair in Active\Passive HA has 124 rules. We started noticing really slow RDP connect performance. (it would take 45 seconds to establish an RDP session to a target where the traffic was passed through the firewall). Out of the 124 rules, the rule which this RDP traffic matched on was around rule 100. If we moved that rule up earlier in the ACL to say, rule 5, the RDP session would only take 10 seconds or less to establish.

So initially, it is looking like the further down the ACL the rule is, the longer it takes the PAN to process that traffic. However, seeing that the 3020 supports up to 2500 policies and we only have 124, I wanted to check with you as it doesn’t seem right.

We are not doing any PBF here. Or App-ID override. Jumbo frames are enabled.

[hshah]

Click on User Advanced Editor, it will give options to add files.

[SDorsey]

Note that even on rule 5, establishing the RDP session takes 18 seconds (while going through PAN) which still seems like a long time compared to other environments.

[cpainchaud]

There is no reason to see such a delay. You should check that no rule is denying connections from client to server and server to anywhere else (a bit like SSH when DNS is filtered on server side).

If you still experience that problem, you should open a TAC case.