some web page too slow when connected with proxy

[Chakuttha Riyaphan]

client use explicit and when play some https website  webpage loading  too slow to enter page it long time to loading page 

service https in proxy service config is bypass

when test with other https website (youtube facebook) it normal not slow.

 

thank you for your help.

[Migration User]

Hi Chakuttha,

 

           Can you share some of this slow website as accessed by customer? Also taking a pcap and policy trace would give us clue on where the slowness is getting added. Common area of slowness are RDNS lookup or Authentication.

[Chakuttha Riyaphan]

hi

this website >> https://app.otps.go.th

pcap and access log you can see from attach files.

thank you for your help.

Attachment(s)

primary informations source_moi.7z   3.54 MB 1 version

[Migration User]

Hi Chakuttha,

 

              The DNS query for app.otps.go.th is returning 2 IP addresses. "118.174.10.75" and "118.174.10.76". Out of this "118.174.10.75" is not responding to any request sent towards it. I have tried from my lab too and got no response from this IP. The other IP address "118.174.10.76" is working though. The issue is happening when proxy picks the IP address of "118.174.10.75" and tries to connect to that. I have filtered the communication from client, to IP address "118.174.10.75" and "118.174.10.76" in the attached packet capture.

 

We do have very limited control in such an issue. Updating the server team about the issue is the faster way to resolve. Another option is to try by creating a FWD host to the working IP address of "118.174.10.76" and then create a FWD Layer rule to forward this url requests to that IP address. Bit of an extra work but possible.

Attachment(s)

Exported.zip   502 KB 1 version

[Chakuttha Riyaphan]

Thank you very much. i will try to do that.
 

[Migration User]

Hi Chakuttha,

 

              If you are satisfied with the solution provided, please select accept solution as it will mark it as solved and will also help others to track solved questions easily :)
 

[Chakuttha Riyaphan]

how to config forwarding policy becase this website can enter by ip address

when i config forwarding rule cannot incert ip address  if i insert host name when connect that website

maybe dns resolved 118.174.10.75 it will be slowly loading

please recommend if you know how to do.

thank you for your help.

[Chakuttha Riyaphan]

sorry my word is wrong

this website cannot enter by ip address

[Migration User]

Hi Chakuttha,

 

               You need to have FWD configuration and FWD policy to make this work. You can find the config and policy below

 

FWD Config: Execute from SSh Console > config mode

 

forwarding ;mode
create host "App_Otps" 118.174.10.76 https=443 ssl-verify-server=no server
exit

 

Policy: Add the policy in your local policy file

 

define condition App_OTPS_Url
	server_url.scheme="https"	server_url.host.exact="app.otps.go.th"
end

<Forward>
	condition=App_OTPS_Url forward("App_Otps") forward.fail_open(yes)

 

Test with this and let us know

[Chakuttha Riyaphan]

ok thank you so much.

[Chakuttha Riyaphan]

i did same you told me before but that website still slowly

proxy it still go to that ip 118.174.10.75

you can see from attach files.

 

 

[Migration User]

Hi Chakuttha,

 

              Can you share a policy trace for this ?

[Chakuttha Riyaphan]

you can see attach file.

Attachment(s)

policy trace.txt   402 KB 1 version

[Migration User]

Hi Chakuttha,

 

           I didn't see any request in the trace attempting to got the site. This file seems to be a default trace. Can you disable the default trace and get a policy drivern trace while attempting this site?

[Chakuttha Riyaphan]

maybe is not working because forwarding to website

it not access by ip address

 

[Migration User]

Hi,

 

              that shouldn't be a problem. This is just a health check and it will be based on IP address. When proxy communicats to the server, it will be using proper domain based client hello. So nothing to worry there.
 

[Chakuttha Riyaphan]

ok iwill try to do again and when i access it still slowly.

but when i go to talk with customer.

my customer will tell why access through proxy it not slowly. not same when connect with proxy

do you have anything to explain it ? may be web browser have something to get website fast more than proxy.

 

[Migration User]

Hi Chakuttha,

 

               Whether you are trying via proxy or direct, the response from IP address is crucial. May when customer is testing, the requests are hitting the working IP address of 118.174.10.76. You can take a client pcap to confirm this. 

[Chakuttha Riyaphan]

ok thank you very much for your help.

after i go to test this issue on customer's network i will come to update to you again.

 

Best Regards,

Chakuttha R.

[Chakuttha Riyaphan]

Dear Aravind,

 

many thank you so much for your help

today i remote to config follow you told me before and when access website it not slowly.

just waiting my customer to verify this issues again.

 

Best Regards,

Chakuttha R.