Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 21 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 54271 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IE Slow Behind Sophos

bsloan9858

Hi everyone,

I have had an issue with IE on all computers behind our Sophos UTM box for over 2 years now. We simply accepted the issue and moved on. The issue is, when browsing to a webpage, IE takes forever to load! This issue doesn't affect any other browser but our tools require Active X's to work so we are forced to use IE. I have tried:

Turning off IPS

Turning off Web Protection

Turning off Application Control

Creating QOS Rules

Resetting winsock on our PCs

And many more things!

 

I've looked at every log possible and I cant seem to figure it out. Sophos has alot of great features, alot of which we use but this issue is starting to get worse and is going to force us to go with another vendor. The workstations we use vary from Win7 to Win8. Sometimes they have the issue, sometimes they don't.

We currently run IPS, Web Protection, Application Control. 

IPS has never been messed with besides adding our networks

Web Protection has never been messed with. Runs in Transparent mode with no authentication and doesn't block on authentication fail

Application Control has been turned on and blocks windows updates (windows updates break our tools)

We also use the sophos AV included with the UTM. We keep the UTM up to date, 9.411-3 running right now. 

 

I'm begging for help! I cant seem to find the issue!

 

Thanks

Brandon



This thread was automatically locked due to age.
  • 0 in reply to bsloan9858

    Congratulations on your sleuthing.

    Host not found means that DNS is not resolving the way you want.   I suspect that it is querying your internal DNS servers and getting an internal address, but it is trying to use it as an external address.

    This link has Sophos recommendations for DNS configuration

    https://community.sophos.com/kb/en-us/120283

    The availability group adds some complexity, but the key issues are:

    On the Network Services... DNS... "Forwarders' tab, you want to use an external DNS server, such as google's DNS at 8.8.8.8

    On the Network Services... DNS... "Request Routing" tab, you want to configure an internal DNS server for each internal domain.

    Google says that they set up their DNS because they have almost everything about DNS cached, so their servers can reply faster than the DNS servers offered by your ISP.   This performance benefit is why the Sophos document recommends using them.

    Another option is Norton ConnectSafe DNS, which returns a dead-end DNS result if they have a DNS name on their blacklist.   More info at https://dns.norton.com/   For buisnesses, no-cost registration is required.

    If you have enabled DNSSEC validation (on the UTM DNS global tab), try turning it off.   If you have DNSSEC enabled but use a DNS server that does not implement it fully, you could get non-existent host errors as a result.   Active Directory DNS servers have very limited support for DNS SEC.

  • 0 in reply to DouglasFoster

    Hello,

     

    Thanks for the link tot he guide! I followed it to a T. I tested a few work stations and it appears the issue is gone but it's sporadic so it's possible that it's just not happening right now. I will let you all know what happens. We're a financial institution so I'd really like to be able to use IPS but the issues is was causing is far more concerning to users.

     

    Thanks

    Brandon

  • 0 in reply to bsloan9858

    Hi Brandon,

    nice to read that you found the issue. :)

    But I'm wondering why the other WebBrowsers had not the same problem, because the DNS querys are using the same way, independently which browser you are using. I guess that IE makes something different because of some kind of protection.

    I suggest that you check the IPS log to identify the reason for your issue, and try to solve it (e.g. disabling the DNS server pattern). Or create an exception for the AD DNS servers.

    Jas

  • 0 in reply to Jas Man

    Hello,

     

    I did turn off "Automatically Detect Settings" under connections and LAN settings in IE. Not sure if that changed anything or not. I know before it didn't seem to have any affect with the Waiting for Page issue. I did follow that guide for the best case DNS settings and I had my internal servers where I should've have forwarders and vice versa. 

     

    After all seemed well, I turned IPS back on and we haven't had any issues yet *knock on wood*. I think it was a combination of the DNS settings, Web Protection settings, and IE settings. I wish I could say what exactly it was but I changed so much that I really can't say. I do know the issue persisted eve when completely disabling IPS, WebProtection, Application Control, etc. 

     

    So currently, WebProtection is running in transparent mode (our tools run in IE with a few active X's and don't behave nicely when forcing IE to go thru a proxy and UTM in standard mode).

     

    Application Control is running, blocking all Windows Updates

     

    IPS is running with all defaults. 

     

    Our workstations use our internal DNS servers to resolve them our servers use the UTM for DNS forwarding. The UTM uses Google DNS.

     

    Our workstations all have Sophos Endpoint AV installed with web control active.

     

    UTM is updated to the latest available packages.

     

    I will be sure to update this thread if I come across a direct fix for my issue. Thanks everyone for you help!

     

    Brandon 

  • 0 in reply to DouglasFoster

    Douglas, the DNS Best Practice article in the KnowledgeBase was copied from DNS best practice almost two years ago.  As you'll see in the Change Log in my post, I've added six improvements since the copy was taken.  If they're not going to maintain their article, they should delete the content and have it link instead to the post I improve based on comments made here.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to bsloan9858

    As DouglasFoster and Jas Man have said, Brandon, the entire problem was probably DNS.  As I mentioned above, there were some updates in DNS best practice that might be worth examining - I didn't look.

    A look in the Web Filtering log would have told you if ports other than 80&443 were seen by the Proxy.  If so, then disabling 'Automatically Detect Settings' might have been important, too.  In fact, if the client sees that a proxy is active and sends to it, the UTM Web Filtering Profile handles the traffic as if it were in Standard mode.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hello everyone,

    This issue has returned but it is only happening at the site that utilizes a RED to full tunnel back to our UTM. Our main site that has our UTM isn't having any issues. Any ideas?

     

    RED Tunnel Compression is turned off.

  • 0 in reply to bsloan9858

    I forgot to mention, the issue goes away if a machine at the RED site disconnects from our network and connects to a mobile hot spot.

  • 0 in reply to bsloan9858

    Brian, do you mean the problem goes away for others at that site or that it goes away for the individual connected to a mobile hotspot?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to bsloan9858

    Issue is gone! I restarted the RED and the site's core switch. I started running wireshark connected to the hot spot then connected back to the site's network to test and it seems to be working okay now. I hope the issue is gone for good!

Unfiltered HTML