topic Re: HTTP traffic slowness when accessing web internal in Firewall and Security Management

HTTP traffic slowness when accessing web internal

Adity12 — Thu, 07 Apr 2022 10:52:00 GMT

Hi All,

On my customer site,

There is problem when accessing web internal, the traffic is slow and even the page not displayed.

i have already check on logs there is no drop, only accept and ping to web server latency is good.

when i search for the issue, i noticed there is on log suspicious when traffic is slowness.

Here i attach that log, maybe anyone have dealt with this issue?

Thanks Regards

Dio Aditya Pradana

Re: HTTP traffic slowness when accessing web internal

Ruan_Kotze — Thu, 07 Apr 2022 11:46:12 GMT

Hi Dio,

Verify that your Website categorization mode is not set to hold. If it is, change to background and see if things work better. The setting lives in Manage & Settings > Blades > Application and URL Filtering > Advanced Settings

Re: HTTP traffic slowness when accessing web internal

the_rock — Thu, 07 Apr 2022 12:30:36 GMT

I agree with @Ruan_Kotze . Please check that setting and correct it if needed.

Andy

Re: HTTP traffic slowness when accessing web internal

Adity12 — Thu, 07 Apr 2022 13:12:05 GMT

i see on threat prevention engine settings, there is same options like this.

is that same options?

note : name blade show in log is Anti-Bot, sorry i think this options is only one for threat prevention.

Thanks Regards

Dio Aditya Pradana

Re: HTTP traffic slowness when accessing web internal

the_rock — Thu, 07 Apr 2022 13:21:14 GMT

You almost got it : - ). Here is what we are referring to brother. I attached 3 screenshots for you.

Andy

Re: HTTP traffic slowness when accessing web internal

Adity12 — Thu, 07 Apr 2022 13:31:28 GMT

Hi @the_rock thanks for your explanation, i will checks first on that configuration.

This default right? i mean this options, even in my lab this options already same like your advice.

Thanks Regards

Dio Aditya Pradana

Re: HTTP traffic slowness when accessing web internal

the_rock — Thu, 07 Apr 2022 13:46:08 GMT

You are right, it is default, but as a test, I would change fail mode to allow, push policy and test.

Andy

Re: HTTP traffic slowness when accessing web internal

Adity12 — Mon, 11 Apr 2022 10:26:32 GMT

Hi @the_rock

i have question about checkpoint online web service, do you know any SK related to this service?

And i just want to make this clear, i think when traffic going through security gateway, this service will hold this traffic for categorization? i think checkpoint online web service, work like this, CMIIW

If the categorization failed the traffic will not able going to destination right? and the result on user, web server doesn't appear.

Thank regards

Dio Aditya Pradana

Re: HTTP traffic slowness when accessing web internal

Chris_Atkinson — Mon, 11 Apr 2022 13:03:18 GMT

I think we're skipping over some fundamentals.

Before changing these settings can you please describe how your access & threat prevention policies are defined?

* Are URLF & AppC rules referencing a destination of internet (not any)?

* Are the web servers on the internal LAN or in the DMZ?

* What Threat Prevention exceptions do you have configured?

Re: HTTP traffic slowness when accessing web internal

the_rock — Mon, 11 Apr 2022 11:44:37 GMT

Correct, thats default setting. What is your other question?

Re: HTTP traffic slowness when accessing web internal

the_rock — Mon, 11 Apr 2022 12:27:47 GMT

I totally agree @Chris_Atkinson . @Adity12 , if you could give us more details about what Chris mentioned, it would help.

Andy

Re: HTTP traffic slowness when accessing web internal

Adity12 — Mon, 11 Apr 2022 19:18:13 GMT

@Chris_Atkinson as far i know URLF & AppC rule is used on gateway cluster internet, and for web server is internal, am not sure about this, i will double check again.

Note: actually this case already resolved, but end user still want know the root cause this issue, so i think maybe you already see this issue before, for resolve this issue they just delete default routing from isp 2. ( they have 2 isp )

I hope thats makes sense.

Thanks Regards

Dio Aditya Pradana

Re: HTTP traffic slowness when accessing web internal

Adity12 — Thu, 21 Apr 2022 03:58:04 GMT

Hi @Chris_Atkinson,

Sorry for late response,

I will answer your question one by one:

1. Are URLF & AppC rules referencing a destination of internet (not any)? yes, AppC & URLF referencing a destination to internet.

2. Are the web servers on the internal LAN or in the DMZ? Internal LAN

3. What Threat Prevention exceptions do you have configured? for now only exception for IPS, to allow some traffic from Internet Banking

I hope thats make sense, if not let me know.

Thanks Regards

Dio Aditya Pradana