Slow Traffic

[simsim]

Hi,
PA in vwire mode , zone client and zone servers

In zone servers there is a print server(windows) and the zone client users pc .

Users are trying heavy duty printing (50-100) pages .

User complaining about slow operations

How can I verify pa is bottleneck or making some issues

data plane is seems to be ok

Thanks

[Mick_Ball]

can i just ask...

where exactly is the printer ?

[simsim]

Hi,

Printer and users are in the clietn zone 

[Mick_Ball]

firstly... have you checked the status of the print job on the print server.

it may give some indication..

i would imagine you are looking for some diagnostics on the PA. I would run wireshark on the print server or the printer port to see what the traffic is doing.

you could use the monitor/packet capture on the firewall and filter printer traffic.

somebody else may post with some clever CLI commands..

[simsim]

Hi,

here is the summary of total connections  per day   from the printer to server  

bytes 15.91 G

sessions 29.39 k

Is it quite large in your experience ?

Thanks

[simsim]

Hi,

Is it possible , Pa just monitor and do not take any action against the session .

Thanks

[Mick_Ball]

Sorry @simsim. I cant advise here because all of our clients, printers and servers are on the same Pan interface.

[simsim]

Hi,

What does it mean by same interface ? .Same zone 

Thanks 

[Mick_Ball]

Yes @simsim, the same zone. 

[simsim]

Hi,

The question is out of context , how these servers are protected ?

Thanks

[Mick_Ball]

Protected from what?.

users?

User devices are all domain members and very restricted.... no command prompt, only allowed programmes ( word, excel, ppoint etc,,,). All tied down by group policy.

the internet?

no acces to these servers from rhe internet, unless via reverse proxy, vdi gateways or global protect for domain membership.

[Brandon_Wertz]

I may be totally off base here, but perhaps in this instance the PA is being used to segment printing?

It's been widely publicized that you can use printers to get root access to windows machines using non-privileged accounts.  So users would be in one zone and printers in another potentially?

[Mick_Ball]

@Brandon_Wertz, Hi.

I may be totally off base here, but perhaps in this instance the PA is being used to segment printing?

yes fully understood and totally agree.

@simsim is using Vwire for that very purpose,

I was only saying that I cannot assist @simsim any further as we do not use Vwire.

it is not a requirement for us,

sorry for any confusion or mislead...

Mick.

[OtakarKlier]

Hello,

I would try a p[rint job from within the same zone and see if the speed changes, e.g. faster or the same. This would be an indication of potential slow downs caused by the firewall. I also have a similar setup but the print servers are remote and honestly we havent had nay complaints. Perhaps the users are just used to the slower printing?

Regards,