This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Slow Browsing

Hi

i am using UTM home edition with active directory
some of the sites are not loading https sites
no issues when web filter is off, loads fast.
current setup is transparent with browser authentication
what should i do to make the websites load faster, i have added the websites in exemption list but no difference.
IPS off, Antivirus off, antispam off

Hardware specs
4GB ram, i3 3.3Ghz 500GB hdd three realtek Interface
6Mbps wan link

This thread was automatically locked due to age.

Parents

0 TheDrew over 12 years ago
I'm thinking this is not an MTU issue. If it were, I'd expect browsing would be slow across the board. More likely the webproxy is causing the slowness.

Quick way to check for MTU issues is to issue the following command from the Astaro console/shell:

ping -s 1472 -c 4 -M do 8.8.8.8

That will force ping to send out pings that just fit inside the standard 1500MTU ethernet frame. If the MTU is good, you'd get the following:

test:/root # ping -s 1472 -c 4 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1472(1500) bytes of data.
72 bytes from 8.8.8.8: icmp_seq=1 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=2 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=3 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=4 ttl=49 (truncated)

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 23.300/24.211/24.966/0.594 ms

if the MTU is too high, something like the following will most likely show:

dclfw1:/root # ping -s 1473 -c 4 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1473(1501) bytes of data.
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)

--- 8.8.8.8 ping statistics ---
0 packets transmitted, 0 received, +4 errors

Note that I forced a packet size larger then a 1500MTU frame can hold so my ASG complained. You would expect this from your DSL modem if that were the constrained point.

---

no issues when web filter is off, loads fast.

I've noticed in all my installs (both appliances & soiftware) that enabling the transparent proxy noticeably slows down the apparent speed of a page loading, and in some instances would randomly cause failed page loads. Turning on the local content cache provided a measurable improvement, as did enabling the regular (non-transparent) proxy mode.

We first noticed this when we installed our first 120 w/ v8.0. With the filter off, web browsing was snappy, you couldn't tell we'd just changed the gateway device from a Cisco 1811 to an ASG120. Within 10min of turning on the transparent proxy, we had 50% of the office complain the internet was dog slow. Turn it off and everything went back to normal. Figured maybe it was just the hardware so I switched on the transparent proxy at home (same ISP, same service, better hardware, less users), wife started complaining the internet was slow. Turned it off, she was happy.

When the local cache easter egg first came out, tried it at home, made all the difference for my wife. Occasional hiccup but overall really good. I've also followed this through the v8 & v9 betas, as well as production release, and the same problem arises. Unless you are close to Astaro's cffs servers (under 80ms or so), the lag in the response is enough to cause the user's browsing experience to degrade badly.

For reference, this has been tested over several major software versions (v8.x & v9.x), and on the following hardware: an ASG120rev3, 1st & 2nd Gen Atoms, Core2Duo's, and even my Core i7 system, with similar effect. This is also tested on both a 6/6Mbps & 10/10Mbps Fiber, and on 3/1, 6/1 & 15/1Mbps DSL lines.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 TheDrew over 12 years ago
I'm thinking this is not an MTU issue. If it were, I'd expect browsing would be slow across the board. More likely the webproxy is causing the slowness.

Quick way to check for MTU issues is to issue the following command from the Astaro console/shell:

ping -s 1472 -c 4 -M do 8.8.8.8

That will force ping to send out pings that just fit inside the standard 1500MTU ethernet frame. If the MTU is good, you'd get the following:

test:/root # ping -s 1472 -c 4 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1472(1500) bytes of data.
72 bytes from 8.8.8.8: icmp_seq=1 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=2 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=3 ttl=49 (truncated)
72 bytes from 8.8.8.8: icmp_seq=4 ttl=49 (truncated)

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 23.300/24.211/24.966/0.594 ms

if the MTU is too high, something like the following will most likely show:

dclfw1:/root # ping -s 1473 -c 4 -M do 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1473(1501) bytes of data.
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)
From 207.194.97.57 icmp_seq=1 Frag needed and DF set (mtu = 1500)

--- 8.8.8.8 ping statistics ---
0 packets transmitted, 0 received, +4 errors

Note that I forced a packet size larger then a 1500MTU frame can hold so my ASG complained. You would expect this from your DSL modem if that were the constrained point.

---

no issues when web filter is off, loads fast.

I've noticed in all my installs (both appliances & soiftware) that enabling the transparent proxy noticeably slows down the apparent speed of a page loading, and in some instances would randomly cause failed page loads. Turning on the local content cache provided a measurable improvement, as did enabling the regular (non-transparent) proxy mode.

We first noticed this when we installed our first 120 w/ v8.0. With the filter off, web browsing was snappy, you couldn't tell we'd just changed the gateway device from a Cisco 1811 to an ASG120. Within 10min of turning on the transparent proxy, we had 50% of the office complain the internet was dog slow. Turn it off and everything went back to normal. Figured maybe it was just the hardware so I switched on the transparent proxy at home (same ISP, same service, better hardware, less users), wife started complaining the internet was slow. Turned it off, she was happy.

When the local cache easter egg first came out, tried it at home, made all the difference for my wife. Occasional hiccup but overall really good. I've also followed this through the v8 & v9 betas, as well as production release, and the same problem arises. Unless you are close to Astaro's cffs servers (under 80ms or so), the lag in the response is enough to cause the user's browsing experience to degrade badly.

For reference, this has been tested over several major software versions (v8.x & v9.x), and on the following hardware: an ASG120rev3, 1st & 2nd Gen Atoms, Core2Duo's, and even my Core i7 system, with similar effect. This is also tested on both a 6/6Mbps & 10/10Mbps Fiber, and on 3/1, 6/1 & 15/1Mbps DSL lines.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data