I recently started a new job and have been thrown right into the fire. Users are complaining about very slow connections from globalprotect. They get speed tests between 3mbps - 20mbps. Internet speed from ISP is 500Mbps. When I attempt from a speed test site, I get a little over 100Mbps off the network but around 20Mbps when I'm on GlobalProtect. This is not split tunnel. Globalprotect connections are IPSec VPN
I don't want to jump to conclusions but I believe the issue is inadequate hardware. Firewall is a PA-3050. When I check the specs, I see max IPsec throughput is 500Mbps. There are over 100 users connecting to globalprotect during peak times. Assuming my understanding is correct, those 100 users are going to be sharing the 500 Mbps throughput? Plus the profiles attached to the security policy rules (av, threat, url, decryption) add some overhead, I'm not entirely sure how much that would impact though. The firewall also has some site-to-site VPNs too. Would Globalprotect share the 500Mbps throughput with those Site-to-Site VPNs too, or is that 500Mbps per tunnel interface?
I've also heard similar complaints from other Palo customers who blame the issue on globalprotect, but I'm not sure if there is truth to that, so I don't want to assume
Any advice would be helpful
When trying to troubleshoot slowness, a lot of things can affect the speed.
Max Throughput .. not sure if "per tunnel" or total for machine.. hard to say.
The Policies can affect things, but also the versions can have a huge effect on everything.
What versions are we dealing with here? PAN-OS and GP version?
Also, just incase anyone needs it, this is a great document to help troubleshoot GlobalProtect..
For the guys that have replied, I'm curious what kind of performance you see on your GlobalProtect sessions? I think it might be helpful to set a baseline when talking about GlobalProtect performance. I've read tons of these posts on the forums, but rarely see anyone discuss what we should expect.
In my testing I can never average more than 50-70 mbps GlobalProtect SSL VPN connection (dedicated 3020 firewall with just me, dedicated 1 Gbps internet link on both sides for just me, 30ms latency, no inspection or app-id, no QoS, iperf3). I can open a second SSL VPN connection from a different computer and simultaneously get another 50-70 mbps without impacting the first session. I don't see a significant CPU load on the firewall at either point. I can do testing outside GlobalProtect (static NAT) and pretty consistently get 940 mbps. My assumption is that this is some internal tuning limitations that we can't see.
On my production system, I will have stretches where I can get 50-70 mbps, but this will frequently drop down to the 2-10 mbps range (for minutes at a time). Like the OP, the overall bandwidth usage doesn't explain all of the issues). Certainly, I can see slowness when there are peaks in bandwidth usage, but I also see slowness that doesn't correspond to any bandwidth usage. My assumption is that it is due to firewall load (although the firewall doesn't show 100% CPU, I assume the GP process is somehow throttled and that the performance slowness is due to other stream processing inspections and app-id that is happening).
I can run a simultaneous test (iperf3) where I test using a static NAT (non-GP) at 200 mbps, along side 2 GP connections. The static NAT connection will remain consistent, while the two GP connections will suffer performance hits around the same time.
I should note that I've read the usual comments about SSL VPN and performance (due to a TCP session encapsulated in another TCP session). I can see this demonstrated when I do testing at my DR site and I run into (what I assume) are throttling issues when the interior and exterior TCP sessions have conflicting sliding windows. For example, the session will be cooking along at 70mbps for 30 seconds, then drop to zero and then ramp back up to 70 mbps. I'm planning to do some testing on my test site with GlobalProtect in IPSEC mode to see if this goes away or if my overall bandwidth is improved.
Anyway here are some things I've noticed (recognizing this is the blind leading the blind), in case any of it give you some things to check on your system:
If anyone has any better information, especially about the internal workings or scheduling of GP traffic inside the firewall, I'd love to hear it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!