https uploads 5X slower thru one gateway than another

[Daniel_Kavan]

Hi Mates,

Developers are seeing 1.7 MB/s upload speeds with HTTPS thru one of my gateways with a 10 GB Firbre interface (1 40e driver), while seeing 9.5 MB/s HTTPS upload speeds thru another with a 1 GB interface tg3 driver.  I'm not seeing any rx/tx errors.   Using scp the speeds are similar, which indicates a issue with the application, but they are still blaming the firewall saying they are using the same code.   I'm not seeing any drops.  I'm not doing https inspection.   Let me double check categorization is the same on both.  Yes, it's a global setting categorize https and cached are both checked.   Any ideas are welcome.   This is all internal traffic going thru the internal interface and a VLAN interface.  Neither of these gateways are in a cluster, both are standalone.   I tried turning off fwaccel I tried a TE exception from IPS/AV/AB, no effect either.   I do have the URL filtering blade on the slower one and not the faster one.  

[Chris_Atkinson]

Are the gateways both the same version/JHF I assume they aren't showing other signs of performance issues / high load?

[Daniel_Kavan]

Hi Chris,

The load and memory (resources) all look good on both.   The slower one is on JHF65, whereas the faster has a slightly older JHF.  Same major version though.  I'm adding URL filtering on the faster one to see if that slows it down.   Assuming, URLF will slow it down, can you make an exception for URLF?   I assume you can in the access policy, but I haven't tried it before.

[emmap]

If it's a static IP destination you can 'except' it from URL filtering by adding a rule above all the URLF/APPC rules in the layer to that destination IP with standard logging configured.

[Daniel_Kavan]

So, once you add the URLF blade on your gw, you have to use the URLF category with the suitcase label in an access rule?   If you aren't using the category tag, then the blade isn't being used?    Do you block or allow on the URL filtering category?   I assume its a block?    I assumed URLF was used in the background for application control categories.

[emmap]

When the URLF blade is enabled on the gateway and inside the policy layer, it is invoked on any rule with URL categories or custom sites in it, or if the logging is set to Detailed logging. A rule that uses standard port based services with normal basic logging does not go through the URLF blade even when it is enabled on that policy layer.

[the_rock]

You can absolutely do that, yes.

Andy