web browsing slowness

[PaloAltorrr]

Hello,

Is there a Palo Alto expert who can help explain an issue we are facing? At times, we experience internet slowness on our firewalls (not always on the same unit). When this happens, we check resources, CPU, and interfaces, and everything appears normal. However, once we reboot the firewall, performance immediately returns to normal.

[kiwi]

Hi @PaloAltorrr ,

It's hard to say with the current information.

How did you check resources exactly ?

This sounds like a classic symptom of a resource exhaustion issue that is not reflected in the standard CPU or memory metrics.

Your observation that a reboot fixes the problem is the most significant clue, as a reboot clears out temporary memory, buffers, and stale sessions that can cause performance degradation over time.

While your initial checks show normal CPU and interface stats, the problem is likely occurring in a more granular area of the firewall's resources, such as the packet buffer or session table.  I'd start with this:

• Check Packet Buffer and Descriptors: From the CLI, run the command 'show running resource-monitor' and check the percentages for packet buffer and packet descriptor usage. Values approaching 100% indicate a resource issue.

• Monitor New Connections: Run the command show session info to check the new connection establish rate. A sudden spike here can indicate a problem.

• Check Ingress Backlogs: The command 'show running resource-monitor ingress-backlogs' can identify specific sessions that are consuming an excessive amount of packet buffer, which points to the source of the issue.

Tip to check traffic latency: Traffic Latency - Packet Descriptors (on-chip)

I would also recommend generating a TSF and submit it to TAC for review. Make sure to add a timeframe specifying the timeframe when you encounter the issue.

Kind regards,

-Kim.

[PaloAltorrr]

Hi,

Thank you for your time and for the clear explanation.
I did check the Packet Buffer and Descriptors when the issue happened, and they were both low and within normal range, so I didn’t review the Ingress Backlogs.

Do you think it’s still worth checking the Ingress Backlogs even if the Descriptors were normal?
And if those values also turn out to be normal, do you have any other ideas that might help clarify cause?