topic Re: Slow HTTPS sites download in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143758#M25219 <P>Not even in a short maintenance window? That would take literally 10 mins tops.</P> Tue, 15 Mar 2022 13:57:50 GMT the_rock 2022-03-15T13:57:50Z Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143512#M25212 <P><SPAN>Hello dears</SPAN></P><P><SPAN>I have a problem downloading some https sites</SPAN></P><P><SPAN>What happens is that first the site appears blocked as shown in the following image, but after a few seconds it loads without problems</SPAN></P><P>&nbsp;</P><P>We have a Cluster HA running R81</P><P>&nbsp;</P><P><SPAN>I would be very grateful for help in finding the reason.</SPAN></P><P>&nbsp;</P><P><SPAN>Thank you in advance</SPAN></P><P> </P> Fri, 11 Mar 2022 14:32:23 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143512#M25212 BrunoCiongoli 2022-03-11T14:32:23Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143517#M25213 <P>Please provide the following:</P> <P>- JHF Take?</P> <P>- HTTPS inspection enabled? Y/N</P> <P>- If yes how is the HTTPS inspection rule base configured?</P> <P>- Trusted CAs updated?</P> <P>- Is fail-close used?</P> <P>- Is hold mode used?</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 11 Mar 2022 14:57:17 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143517#M25213 Chris_Atkinson 2022-03-11T14:57:17Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143525#M25214 <P>Hi Chris, thanks for your response</P><P>-R81 take 44</P><P>-Yes</P><P>-Image</P><P>-No</P><P>-Yes</P> Fri, 11 Mar 2022 15:36:11 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143525#M25214 BrunoCiongoli 2022-03-11T15:36:11Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143545#M25215 <P>The first thing that came to my mind when I read your post was https inspection. Can you disable it and test to see if same issue happens?</P> <P>Andy</P> Fri, 11 Mar 2022 19:37:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143545#M25215 the_rock 2022-03-11T19:37:56Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143560#M25216 <P>Unfortunately your attachments aren't working...</P> <P>Note the latest GA JHF take includes the following fixes amongst others.</P> <TABLE id="limitationTable" class="footnote" border="1" width="100%" cellspacing="2" cellpadding="4"> <TBODY> <TR> <TD height="69px">PRJ-31694,<BR />PMTR-73790</TD> <TD height="69px">IPS</TD> <TD height="69px">Improved the handling of decoded HTTP/S traffic.</TD> </TR> <TR> <TD height="69px">PRJ-29476,<BR />PMTR-72234</TD> <TD height="69px">SSL Inspection</TD> <TD height="69px">In some scenarios, a memory leak may occur when creating ECDHE keys.</TD> </TR> <TR> <TD height="69px">PRJ-30460,<BR />PRHF-19516</TD> <TD height="69px">SSL Inspection</TD> <TD height="69px">In rare scenarios, HTTPS connections may hang indefinitely during the TLS handshake, causing timeout.</TD> </TR> <TR> <TD height="69px">PRJ-30701,<BR />PMTR-72756</TD> <TD height="69px">SSL Inspection,<BR />VPN</TD> <TD height="69px">A memory leak in HTTPS Inspection and HTTPS portals may occur when using ECDHE ciphers.</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>An upcoming JHF Take will also include:</P> <TABLE class="footnote" border="1" width="100%" cellspacing="2" cellpadding="4"> <TBODY> <TR> <TD width="15.088105726872246%">PRJ-30819,<BR />PRHF-19417</TD> <TD width="11.784140969162996%">SecureXL</TD> <TD width="73.01762114537445%">In a rare scenario, after an upgrade, HTTPS traffic may be dropped.</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>You could try upgrading to the latest GA JHF or contact TAC to diagnose further.</P> Sat, 12 Mar 2022 01:12:35 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143560#M25216 Chris_Atkinson 2022-03-12T01:12:35Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143743#M25217 <P>Hi Chris, I will try with the latest GA JHF,&nbsp;and check the behavior</P><P>&nbsp;</P><P>Thank you</P> Tue, 15 Mar 2022 12:32:57 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143743#M25217 BrunoCiongoli 2022-03-15T12:32:57Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143744#M25218 <P>Hi Andy, thanks for your response</P><P>It is not possible because&nbsp;it is a critical service</P> Tue, 15 Mar 2022 12:34:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143744#M25218 BrunoCiongoli 2022-03-15T12:34:24Z Re: Slow HTTPS sites download https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143758#M25219 <P>Not even in a short maintenance window? That would take literally 10 mins tops.</P> Tue, 15 Mar 2022 13:57:50 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Slow-HTTPS-sites-download/m-p/143758#M25219 the_rock 2022-03-15T13:57:50Z