Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BrunoCiongoli
Participant

Slow HTTPS sites download

Hello dears

I have a problem downloading some https sites

What happens is that first the site appears blocked as shown in the following image, but after a few seconds it loads without problems

 

We have a Cluster HA running R81

 

I would be very grateful for help in finding the reason.

 

Thank you in advance

0 Kudos
7 Replies
Chris_Atkinson
Employee
Employee

Please provide the following:

- JHF Take?

- HTTPS inspection enabled? Y/N

- If yes how is the HTTPS inspection rule base configured?

- Trusted CAs updated?

- Is fail-close used?

- Is hold mode used?

 

 

BrunoCiongoli
Participant

Hi Chris, thanks for your response

-R81 take 44

-Yes

-Image

-No

-Yes

0 Kudos
Chris_Atkinson
Employee
Employee

Unfortunately your attachments aren't working...

Note the latest GA JHF take includes the following fixes amongst others.

PRJ-31694,
PMTR-73790
IPS Improved the handling of decoded HTTP/S traffic.
PRJ-29476,
PMTR-72234
SSL Inspection In some scenarios, a memory leak may occur when creating ECDHE keys.
PRJ-30460,
PRHF-19516
SSL Inspection In rare scenarios, HTTPS connections may hang indefinitely during the TLS handshake, causing timeout.
PRJ-30701,
PMTR-72756
SSL Inspection,
VPN
A memory leak in HTTPS Inspection and HTTPS portals may occur when using ECDHE ciphers.

 

An upcoming JHF Take will also include:

PRJ-30819,
PRHF-19417
SecureXL In a rare scenario, after an upgrade, HTTPS traffic may be dropped.

 

You could try upgrading to the latest GA JHF or contact TAC to diagnose further.

BrunoCiongoli
Participant

Hi Chris, I will try with the latest GA JHF, and check the behavior

 

Thank you

0 Kudos
the_rock
Champion
Champion

The first thing that came to my mind when I read your post was https inspection. Can you disable it and test to see if same issue happens?

Andy

0 Kudos
BrunoCiongoli
Participant

Hi Andy, thanks for your response

It is not possible because it is a critical service

0 Kudos
the_rock
Champion
Champion

Not even in a short maintenance window? That would take literally 10 mins tops.

0 Kudos