It would be great if we can have tests for two different protocols (like http and smb transfer) in two different scenarios. Otherwise, you don't have valid data for comparison. Of course, you'll need to use the same infrastructure for both tests. Again, low/high throughput scenarios could also mean using two different protocols, such as smb and ftp (please bear in mind that smb is known to have the worst performance). Always clarify which protocols are used (smb, http, ftp, etc.), location of the clients/servers, and Internet link speeds. The network path (between client and server) usually passes several devices and links, and the conditions are changing dynamically (CPU/link utilization, load, buffers, and so on).Īlways try to collect a minimum of two sets of data for "low throughput" and "high throughput" scenario, so you have a baseline that you can use to compare.
Globalprotect troubleshooting download#
With or without VPN client, you will have different download speeds measured if you try to download the same file multiple times. In other words, the throughput depends on several factors. Performance related issues are not easy to troubleshoot. General issues, limitations and recommendations The primary reason is that the throughput depends on several factors and each setup is different. It will be difficult to give numbers on the expected throughput difference between GlobalProtect client versus non-GlobalProtect client scenarios. TCP inside TCP encapsulation (no control over underlying TCP layer).Time needed for the operation depends on the current client/firewall load.Both the client and the firewall have to encrypt/decrypt and encapsulate/decapsulate traffic, which will introduce processing delays.It is expected for the throughput to be slower when the GlobalProtect client is being used as opposed to non-VPN or direct connection. GlobalProtect client-related issues (i.e., slow throughput when using GlobalProtect client) That is the main reason why we would recommend, if you're experiencing slow throughput (when using SSL), to migrate to IPsec whenever possible.īelow are a few ideas/suggestions/limitations regarding this topic. What that means is that the GlobalProtect (GP) client and/or firewall doesn't have control over the underlying TCP layer (error detection, flow control, congestion control), which is slowing down the throughput.
Globalprotect troubleshooting how to#
Here is some great information on how to troubleshoot performance related to GlobalProtect.įirst of all, please bear in mind that SSL VPN is not designed to be efficient (it is best effort and not designed for high throughput) mostly because it's TCP-based (TCP inside of TCP). Palo Alto Networks understands that with an increased remote workforce, there is the possibility of performance issues in your network with GlobalProtect.
0 kommentar(er)
