R82 | Large File Downloads Fail with HTTPS Inspection

[B_P]

When downloading large files (~4.5GB), they fail after a few GB or so. This only happens on clients whose traffic is HTTP inspected. Not sure if sk150933 is applicable as fw ctl commands don't show indicators. Why would HTTPS inspection cause the download to fail midway through?

[the_rock]

How is blade settings configured? Fail open or close? Also, is it set to background or hold?

Andy

[PhoneBoy]

HTTPS Inspection alone shouldn't cause this.
Threat Prevention may, though large files should be bypassed for emulation.
What blades are enabled here and is there any relevant logs?

[B_P]

Mmmm yes, possibly (and likely) Threat Prevention. Seems like every once in a while I'll see a detect on the domain but nothing on why. It oddly just says "whatever.domain.com Detected".

[Wolfgang]

We had similar experience with R82, but not sure that HTTPS inspection is the problematic feature. The download stops after some time and after a long time 30-50s the download continues . The same behaviour is seen with streaming, after some minutes watching a stream it stops and continues after some seconds.

[the_rock]

Thats interesting...I may upgrade my cluster to R82 in the lab to test this theory, since I had never seen that problem in R81.20

Andy

[ccsjnw]

I have the same issue. Large files (Proliant Support Pack) downloaded directly from HPE. When HTTPs is enabled, after 4.5 GB has been downloaded a network error is reported in the browser (Microsoft Edge) and the download stops and it won't recover.

I tried a number of different large ISO files from HPE, and they all failed after exactly 4,350,966K had been successfully downloaded.

I have two internal subnets. One has HTTPS inspection enabled and the other does not. All other settings are identical. 
The large downloads work from the subnet that does not have HTTPS inspection enabled.

I have downloaded large ISO files from Microsoft, and these have worked OK. So it appears it's only certain sites that have the problem, but so far, I've not been able to find a pattern.

There's nothing in the Firewall logs that indicates any problems, nothing is blocked or dropped.
I have extended logging enabled for all web traffic.

I don't think this is new to R82. Pretty sure it occurred in earlier releases too.
I'm running R82 with the latest recommenced Jumbo Hotfix Accumulator.

[the_rock]

How are fail and categorization modes configured under blades setting in manage&settings in smart console? I always find its best to have it to block and background, respectively.

[Timothy_Hall]

Any PBR configured?  sk183194: Slow web browsing to the Internet and download of files is stuck

Using Firefox with DNS over HTTPS enabled? sk183628: HTTPS Inspection is slow when using the Firefox web browser with DoH enabled

Lightspeed card involved? sk184291: LightSpeed Acceleration Card may fail to accelerate large data TCP connections at the hard...

This is kind of old and probably fixed, but might be worth checking: sk150933: High Latency or Download of large files from http or https is slow or get stuck

Quantum Force Appliance (3900/9XXX/19XXX/29XXX)?  Might be a UPPAK thing but unlikely.

[the_rock]

This is what I was referring to.

[ccsjnw]

I'll investigate when I get time, and report back my results. Thanks for the tips.

[the_rock]

Sounds good.

[Chris_Atkinson]

To clarify do you see any of the symptoms described by sk183681: Security Gateway blocks the download of files larger than 4 GB with the log "Application C...  ?

[the_rock]

Great point Chris, that certainly could be related.

[Chris_Atkinson]

@B_P  Have you investigated sk183681 and did it solve your issue?