This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[9.200] Web filtering causing slow internet browsing?

I upgraded to 9.200 a few weeks ago and noted no decrease in internet browsing speed.  The unit is a 320 with max 100 users behind it.  Most features turned on, including IPS and now ATP.

As of the past few days, browsing is... SLOWWWW.  All of a sudden, sites with lots of images, say, a shopping website, are extremely slow to load.  I went in, turned Web Filtering off, and boom, right back to instant load.  Anyone else experiencing this?

As far as the web filtering config, pretty much default.  Transparent mode, single scan, only block p0rn, all other traffic allowed.

I rebooted the UTM which didn't help.
Thoughts?

-Jim

This thread was automatically locked due to age.

Parents

0 JavierCasares over 11 years ago

Two support technicians passed and the issue is still present. They say that nothing on the Web Filter can be the cause of this and that they made every adjustment possible but I still see randomly sites that take almost a minute to load, when they should load in a couple of seconds. If we disable Web Filter this doesn't happen.

It's the only bad thing about the SOPHOS UTM so far. A shame because it's a nice product but this is disheartening.

An example (the request was made 11:03:59 and it fully loaded at 11:04:54

2014:08:01-11:03:59 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="7329" request="0xe1366cc0" url="www.timeanddate.com/.../montevideo" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="176851" cattime="0" avscantime="0" fullreqtime="675298" device="0" auth="0"

2014:08:01-11:04:00 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="190.210.62.18" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="2273" request="0xa388000" url="a.tadst.com/.../citypages_6.css" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="509888" cattime="0" avscantime="0" fullreqtime="529151" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="190.210.62.17" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="999" request="0xe088aee0" url="a.tadst.com/.../togglefullscreen_1.js" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="202822" cattime="0" avscantime="0" fullreqtime="225027" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="2500" request="0xe1366cc0" url="www.timeanddate.com/.../dstclockimage_city.php

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="1019" request="0xe13c7ba0" url="www.timeanddate.com/.../moon.php

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="987" request="0xe0834220" url="c.tadst.com/.../wc-tmz.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="170281" cattime="0" avscantime="0" fullreqtime="504169" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="374" request="0xa3db760" url="c.tadst.com/.../wt-20.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="170217" cattime="0" avscantime="0" fullreqtime="512880" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="441" request="0xe13c6000" url="c.tadst.com/.../icon-map-pin.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="170486" cattime="0" avscantime="0" fullreqtime="524368" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="509" request="0xe0834ee0" url="c.tadst.com/.../wt-7.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="170430" cattime="0" avscantime="0" fullreqtime="540792" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="3883" request="0xee52880" url="c.tadst.com/.../uy-10.png

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="743" request="0xe0aaf540" url="c.tadst.com/.../uy.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="170420" cattime="0" avscantime="0" fullreqtime="552307" device="0" auth="0"

2014:08:01-11:04:53 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="2503" request="0xe1366cc0" url="www.timeanddate.com/.../dstclockimage_city.php

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="716" request="0xee52880" url="c.tadst.com/.../wc-dff.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="193023" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="469" request="0xe0834220" url="c.tadst.com/.../wc-snr.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="366160" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="466" request="0xa3db760" url="c.tadst.com/.../wc-sns.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="369001" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="607" request="0xe13c6000" url="c.tadst.com/.../wc-dln.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="385546" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="17" request="0x9da6880" url="www.timeanddate.com/.../ts.php

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="457" request="0xe0834ee0" url="c.tadst.com/.../wc-clc.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="400371" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="298" request="0xee52880" url="c.tadst.com/.../wc-cal.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="373562" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="426" request="0xe0834220" url="c.tadst.com/.../wc-nrb.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="370541" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="1375" request="0xa3db760" url="c.tadst.com/.../tg-city.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="370229" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="1239" request="0xe13c6000" url="c.tadst.com/.../logo-toolbar.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="374343" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="3760" request="0xe0834ee0" url="c.tadst.com/.../uy.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="392071" device="0" auth="0"

2014:08:01-11:04:54 firewall httpproxy[18856]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.79.11" dstip="69.164.11.64" user="" statuscode="200" cached="0" profile="REF_HttProMaiten (Maiten)" filteraction="REF_HttCffMaitePolic (Maiten Policy)" size="9539" request="0xa3db760" url="c.tadst.com/.../citybg-map.png" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size" error="" authtime="0" dnstime="0" cattime="0" avscantime="0" fullreqtime="168986" device="0" auth="0"

And some sites, because of this get like the screenshot attached.

0 Billybob over 11 years ago in reply to JavierCasares
So only when I use my Kabel Modem as forwarder I get the (wrong?) answer.
Why would you use a $50 consumer cable modem dns in front of a full service firewall. Those things are not reliable at all and randomly stop answering as you have already noticed. Use google forwarders or even your ISP forwarders which are better than your cable modem. I would say use opendns but I believe google has the fastest dns when outside the US unless you use one of your local ISP dns servers.

Two support technicians passed and the issue is still present. They say that nothing on the Web Filter can be the cause of this and that they made every adjustment possible but I still see randomly sites that take almost a minute to load, when they should load in a couple of seconds. If we disable Web Filter this doesn't happen.

Looking at your logs, since you are bypassing all scans, your times are zero but the load time is still high. This points to some kind of connectivity issue. I would change the mtu to 1400 or less and see if it helps. If it does, slowly move it up till you start seeing problems.

Also, at my home UTM, I always bypass av scanning for all the image files so there are av exceptions in http proxy for
.bmp
.gif
.jpg
.jpeg
.png
I have av running on my computers and chances of getting a virus attached to an image are fairly low anyways. This makes the images load almost immediately since av is what slows down loading of images on web pages.
Cancel
Vote Up 0 Vote Down

Cancel
0 JavierCasares over 11 years ago in reply to Billybob
Looking at your logs, since you are bypassing all scans, your times are zero but the load time is still high. This points to some kind of connectivity issue. I would change the mtu to 1400 or less and see if it helps. If it does, slowly move it up till you start seeing problems.

Didn't change anything and I doubt it's network related as it would have to be the same with the Web Filter on or off.

Also, at my home UTM, I always bypass av scanning for all the image files so there are av exceptions in http proxy for
.bmp
.gif
.jpg
.jpeg
.png

I already tried disabling the AV but there was no sensible change with the issue. I really don't understand where you can put those image exclusions.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JavierCasares over 11 years ago in reply to Billybob
Looking at your logs, since you are bypassing all scans, your times are zero but the load time is still high. This points to some kind of connectivity issue. I would change the mtu to 1400 or less and see if it helps. If it does, slowly move it up till you start seeing problems.

Didn't change anything and I doubt it's network related as it would have to be the same with the Web Filter on or off.

Also, at my home UTM, I always bypass av scanning for all the image files so there are av exceptions in http proxy for
.bmp
.gif
.jpg
.jpeg
.png

I already tried disabling the AV but there was no sensible change with the issue. I really don't understand where you can put those image exclusions.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data