Unreached OCSP - causes serious lag

TimV

Hi,

Setup

Current setup is a Maestro R81 Take12. (already the case on Take10)

MHO140 /9300&9400's.

These is a serious delay in browsing websites thru the SG's.

Nearly all Security features are on - Sandblast suite.

Symthom

When browsing to a domain, the initial delay is 12-15sec, before it starts loading.

Seen these kinds of messages before in R81.20, but to compare :

R81.20 - 25msg in 1,5h, 500+ endpoints active 24/7
R82 - 25msg in 1,5min 5active users.

So far

TAC is already involved, but wondering if somebody else is experiencing this issue?
Currently no big clue where the issue may reside.

The OCSP error very present, and near the timeline of the actions taken.
Certificate used in HTTPS Inspect is exactly the same as the existing setup.

It's, apart of a RemoteAccess configuration move, the last hurdle I need to fix before being able to go live.

Kind regards

Tim

PhoneBoy

OSCP is occurring because we are validating the certificate for the remote site is valid as part of SNI verification we do.
This occurs on anything where SNI is processed (App Control, URL Filtering, and HTTPS Inspection among others).
If the OSCP connection is failing somehow (you didn't include the message, but I assume that's what they are), that would account for the slowness of establishing the initial connection.

the_rock

OSCP would definitely have to do with certificate. Where is the error? Does it happen on client side or somewhere else?

Andy

AaronCP

Hi @TimV,

Is there a way you can switch to CRL for certificate validation and see if it improves your situation?

We had a scenario some time ago with validating VPN authentication certificates. From memory, there was a change in behaviour that defaulted to using OCSP, but when we switched back to CRL validation, it resolved our issue.

Thanks,

Aaron.

TimV

Hello,
How you would you do this?

AaronCP

To resolve our issue, we used Scenario 2 in SK179434.

the_rock

Never seen that sk before, GREAT reference @AaronCP

TimV

Hello

Sorry about the missing information.

There are 2 types -
One related to HTTPS Inspect, other one related to URLF.

Anyone a good guide on how to create a HTTPS inspect certificate with CRL and/or OCSP? ADCS based pref.

Kind Regards

Tim

PhoneBoy

Both issues have the same root cause, as explained earlier.
The Certificate used for HTTPS Inspection must be a Certificate Authority (i.e. can't be a wildcard cert).
The CRL/OSCP server used by the CA needs to be reachable by the gateway (also client in case of Remote Access).
Beyond that, no specific guidance.