slow internet speed through proxy ASG

[Sohail Rashid]

Hi,

we have ASG-S200-30, recently upgraded to firmware 6.7.4.13 to improve the internet speed.But it did not work. we are getting 10 MB/s download speed when I disable/bypass the proxy, but with proxy enabled we are getting max 2 MB/s. kindly need your valuable suggestions to improve the internet speed through proxy.

[Sakkarin Pichetskul]

Hi,

Do you enable or disable RFC-1323 on ASG?
the default TCP windows size is 262143?

BR
Sakkarin Pichetskul

[Sohail Rashid]

thanks @Sakkarin Pichetskul for the response. yes, ​RFC-1323 is enabled and the windows size is set to default value 262143

[Sakkarin Pichetskul]

Hi,

You test with no any shaping bandwidth or not?
the next hop of network such as firewall didn't limit bandwidth from ASG?

THX and BR
Sakkarin Pichetskul

[Sohail Rashid]

Hi @Sakkarin Pichetskul, we haven't set any bandwidth management. I check the download from the next hop (DMZ switch), which is directly connect with proxy appliance and the download sped is good (8-10 MB/s)​. so the issue is with proxyASG. we are getting only 400 kb/s now.

[Sakkarin Pichetskul]

Hi,

Can you shared your configuration expanded of your device ASG?
How you test bandwidth speed? Pls. shared your trace policy.
And Pls. PCAP at that time test bandwidth speed.

BR
Sakkarin Pichetskul

[Sohail Rashid]

Hi @Sakkarin Pichetskul,

I have attached the policy trace and pcap. I am try to download a file from google drive. with proxy enabled i am getting max 1 MB/s while without proxy the download speed is 10 MB/s.​

Attachment(s)

TSE_access.txt   905 KB 1 version

[Sakkarin Pichetskul]

Hi,

Can you test with no policy authentication? because I don't sure about I see your User is in group3 object and this group3 object was match policy quota volume.

Pls. test with clear any features apply to your connections, didn't decrypt SSL and didn't detect protocol.

For the TCP-IP windows size, maybe help that but pls. check on PCAP file for confirm.


BR
Sakkarin Pichetskul

[Sohail Rashid]

Hi @Sakkarin Pichetskul,

if it is possible for you to join a remote session, it would be great. let me know when you are available.

BR,

Sohail
​

[Sakkarin Pichetskul]

Hi,

I cannot join your remote session because about business term.
I can guide configuration to bypass any policy to your connections only.
pls. use step from this KB: https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=167192&_ga=2.56956394.1752386112.1583725758-1748859832.1583140179
and KB: https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=167379&_ga=2.56956394.1752386112.1583725758-1748859832.1583140179

BR
Sakkarin Pichetskul

------------------------------
System Engineer
nForce Secure Co.,Ltd. [Thailand]
------------------------------

[Sohail Rashid]

Hi @Sakkarin Pichetskul @MattJonson @Aboonaim Golandaz

As per support the issue is mostly related to tcp-ip windows size. they recommend to configured the windows size as compare to the windows size configured on internet firewall. can you let me know what is the window size you have configured on the appliance for the interface your are using​​​​

[MattJonson]

Hello,

What's the CPU/Memory usage?

The proxySG itself shouldn't reduce the throughput unless some massive policy is in-place and/or the CPU/Memory utilization is going through the roof.

As it's an ASG the issue could be in the Content Analysis section of the appliance. I suggest that you take a look at the scan times by going in to the proxySG GUI and checking statistics for ICAP. Thanks to Java Launcher i'll just write the path you'll have to click here:
In the ProxySG: Statistics -> Advanced -> Content Analysis Services -> Show content analysis service statistics

Ones you've got the statistics open, Check for Queued scanning objects. 

Have a great day!

Best regards,
Matt

[Sohail Rashid]

Hi Matt,

Thanks for the response. for troubleshooting purpose I did below config:
1. Disable content analysis
2. Bypassed all web auth layer policies and allow all --> all
 But still not difference in download speed.

Once I change the tcp-IP windows size from the default 256k to a higher value, the download speed increases too. so what windows size value should I put? is this the correct way? we have ASG-S200-30 and firmware v6.7.4.13

[Sakkarin Pichetskul]

Hi,

The correct way is enable the RFC-1323 for auto increase the window size scaling and set the default is 262143 (262143 is new default [old default is 65535])
If the File server that you were download wan't support the RFC-1323, it's has only way to increase the speed download with manual increase window size.

Thank you and BR
Sakkarin Pichetskul

------------------------------
System Engineer
nForce Secure Co.,Ltd. [Thailand]
------------------------------

[Rolando Casinillo]

HI! HOw to do it?

[Rolando Casinillo]

"Ones you've got the statistics open, Check for Queued scanning objects". After checking this, then....what???

[Sakkarin Pichetskul]

Hi,

"Ones you've got the statistics open, Check for Queued scanning objects". After checking this, then....what???
Answer: then if the ICAP queued was high volume, the internet speed slow was happened from the ICAP queued.
So, you should bypass scanning some domains or some true file types for decrease the volume of transaction for scan ICAP.

Thank you
Sakkarin Pichetskul

------------------------------
System Engineer
nForce Secure Co.,Ltd. [Thailand]
------------------------------

[Rolando Casinillo]

​

[Sulman Mushtaq Mushtaq Hussain]

Did you fix this issue?

------------------------------
Symantec Enthusiast
------------------------------

[Sohail Rashid]

Hi Rolando,

Have you configured ICAP best practices CPL? If not, configured the best ICAP practice CPL script as provided in below link.

https://techdocs.broadcom.com/content/dam/broadcom/techdocs/symantec-security-software/web-and-network-security/proxysg/common/SG_CA_ICAP_Best_Practice_CPL_v1.4_IS_Advanced.txt