slow HTTP from LAN behind firewalls

[pawelz]

Hi!

I have got problem with performance for http requests from users in LAN to internet (about 500 users in LAN). All
traffic pass through two firewalls (Nokia IP530, IP710 all IPSO4.1 Checkpoint R62NGX) and two diffrent proxy servers,
one ISA2000 or IPlanet 3.8. ISA is located behind 2 FW in LAN, IPlanet beetwen two FWs. Hardware for ISA is very good,
4 CPUs 4 GB RAM, IPlanet works on Solaris. NAT for proxy servers is performed by external FW. Type of NAT (by
Checkpoint) Hide behind two diffrent public IPs. When users surfs web sites through ISA or IPlanet, surf speed is slow
and pages loads very slow. I have got also a box for testing in Internet to which I can connect through ssh from LAN.
I can also tunnel http traffic from my computer located in LAN to that box in Internet through ssh. Surf speed in that
situation is OK, pages load fast and surf speed is almost similar to speed of my internet connection to provider.
I dont have any QoS on these FWs, all traffic is EF. Maximum number of concurrent connections on both FWs in
SmartDashboard is 25000. Average on these 2 FWs in SmartMonitor I can see that there is about 2500 Active Connections,
Average CPU util 10-30%.

If you know how I can find how many connections for http is placed logged on FW, or how I can tune surf speed from LAN
users to internet, I'll be very gratefull:)
Thanks for any answers!

[Bob_Zimmerman]

Try turning off content inspection. That tends to improve performance rather dramatically.

Also, all traffic passes through two firewalls and two proxies? Isn't that a little excessive? Try testing further upstream such that you're only dealing with the outermost device. See how fast that is. Then test one layer in. Keep going until you figure out where the biggest slowdown is, then look at that device.

[Coronabeer]

I had to deal with this for 3 months. Finally I disabled most of the smartdefense features and web intell.

That did it.

try it..

Take screenshots of what is checked , then disable all and test.


Dont forget to back up the DB as well.