Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 7 subscribers
  • Views 4813 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sporadic poor surfing performance

neo243

Hi Guys,

 

since we use Sophos (5 years 2 UTM Generations) we have sporadic poor Browsing Performance.

 

- Suddenly Websites take up to 30 seconds to be shown.

- it also not appears on all devices at once

- it can happen that a device is hit and others are not for the whole day

- it occurs on wifi and cable

- dns and ping works without any problem

- We tried disabling Web Proxy but without success

 

I hope you guys have some ideas to solve this.

We also have ips enable maybe this can cause this behavior?

 

Greetings Neo



This thread was automatically locked due to age.
Parents
  • 0

    Things for you to investigate:

    IPS blocks will cause browser timeouts.l (up to 2 minutes) for the affected session.  Check for embedded links that are blocked, not just main pages.  Details on IPS logs.

    High CPU may hinder traffic.   Too many IPS rules can contribute to this problem.  This would be 8n the hardware performance graphs.

    Http proxy may be crashing.     I think others have said that this problem reappeared with one if the newer releases (after 9-506).   This event also should be in the logs.

    What have you checked?

Reply
  • 0

    Things for you to investigate:

    IPS blocks will cause browser timeouts.l (up to 2 minutes) for the affected session.  Check for embedded links that are blocked, not just main pages.  Details on IPS logs.

    High CPU may hinder traffic.   Too many IPS rules can contribute to this problem.  This would be 8n the hardware performance graphs.

    Http proxy may be crashing.     I think others have said that this problem reappeared with one if the newer releases (after 9-506).   This event also should be in the logs.

    What have you checked?

Children
  • 0 in reply to DouglasFoster

    Hi Guys,

    We have a sg230 with approx 60 Users Local and 20 abroad over 3 Reds and a 100 Mbit/s up and down fibre connection.

     

    Ok i will check when the problem appears again: Like i said it's very sporadic but for affcted users proper surfing is not possible. 

    Atm IPS Settings for us are Rule: Drop hidden and Restart-Rule: Drop all packets. Can i change these to improve the user experience?

    CPU wise the SG is at 5-10% max. Ram, HDD usage, logs etc. are unremarkable.

     

     

    thanks for your Time

  • 0 in reply to neo243

    It's the number of rules that are checked that takes time, the "action" selected takes no time.

    I don't see any way to solve this problem unless you can check logs for the exact time someone is having a problem.  Check Intrusion Prevention as well as Web Filtering.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML