This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[9.200] Web filtering causing slow internet browsing?

I upgraded to 9.200 a few weeks ago and noted no decrease in internet browsing speed.  The unit is a 320 with max 100 users behind it.  Most features turned on, including IPS and now ATP.

As of the past few days, browsing is... SLOWWWW.  All of a sudden, sites with lots of images, say, a shopping website, are extremely slow to load.  I went in, turned Web Filtering off, and boom, right back to instant load.  Anyone else experiencing this?

As far as the web filtering config, pretty much default.  Transparent mode, single scan, only block p0rn, all other traffic allowed.

I rebooted the UTM which didn't help.
Thoughts?

-Jim

This thread was automatically locked due to age.

0 Jimstigator over 11 years ago in reply to scorpionking

IPV6 is disabled.

Agreed, the pings to those Sophos sites are NUTS.  What could cause this?  DNS speeds are fine from what I can gather.  Further, I don't think its DNS as sites resolve instantly when the filter is off.

For comparison,  I just pinged the same sites from a physically seperate network, utilizing a different brand firewall, and different ISP, and the pings are still really high.  Is this a Sophos issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to Jimstigator

Again, this hasn't always been an issue. Last few weeks, everything has performed great.

What do the rest of you see when you turn on the service and the UTM pings the numerous Sophos sites?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Jim, from your log file, it doesn't look like IPv6 is disabled. Is your issue related to Slow DNS queries with parallel requests and ipv6?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to BAlfson

Hey Bob,

Is there any place it can be turned on outside of Interface->ipv6? Screenshot below of the configuration.

Thanks!
Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 pedja over 11 years ago

I have this issue on UTM 9.2 as well, sometimes it takes way too long to load images, not the HTML and flash data come ASAP but images get delayed or not displayed.

Also I have experienced drop of performance for my Office 365 applications (Sharepoint in this case). I will wait for few more patches to come out on 9.2 before upgrading to get the new features.

I had 9.1 also deployed as a virtual machine and had none of these issues. The VMs were located on ESXi 5.5.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to pedja

Predrag, perfect screenshot. That is exactly what mine is doing! Still not sure what it is....
Cancel
Vote Up 0 Vote Down

Cancel
0 pedja over 11 years ago

Well I wanted to submit a ticket to Sophos few days ago but since it is trial version on the 9.2 I think I cannot submit it. I am going to wait few patches on 9.2 before I upgrade my 525s.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to pedja

Well I wanted to submit a ticket to Sophos few days ago but since it is trial version on the 9.2 I think I cannot submit it. I am going to wait few patches on 9.2 before I upgrade my 525s.

Yeah, I only have one unit on 9.200 but the users are hating it. I've since turned off web filtering at that site, and left the other UTMs on 9.107 until the actual release of 9.2.

Sorry you have the problem, but its good to know its not just me.

If you come across the solution, or speak with Sophos, please let me know!

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 pedja over 11 years ago

Hi,

I've managed to replicate the issue, these web sites are being protected by cloudflare and it results in such action. I will submit the ticket request now.
Cancel
Vote Up 0 Vote Down

Cancel
0 mmshanif over 11 years ago

please check the web  filtering live logs

even i have the same issue
"SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="GET" srcip="192.168.50.66" dstip="" user="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="3235" request="0xe15e8000" url="static.klix.ba/.../tx_140313040.jpg" exceptions="" error="" authtime="0" dnstime="0" cattime="205901" avscantime="0" fullreqtime="206075" device="0" auth="0" reason="category" category="137" reputation="neutral" categoryname=  "Provocative Attire"

please change the AV  to avira
Cancel
Vote Up 0 Vote Down

Cancel