Troubleshoot slow performance between an Edge SWG (ProxySG) and firewall
Article ID: 169275
Updated On:
Products
Issue/Introduction
Proxies and firewalls need to be configured to work together. Connections from the Edge SWG can be reset or dropped silently resulting in slowness.
Environment
Edge SWG (ProxysG) in a DMZ or a firewall is configured for Internet access.
Cause
Connection reuse being denied on the firewall or packets are being silently dropped on the firewall.
Resolution
The resolution depends on what is seen in the packet captures and the firewall logs.
For out of state packets being reported on the firewall, and unanswered SYN packets in the packet capture or multiple retransmissions from the Edge SWG but unacknowledged, see Firewall is reporting a lot of out of state packets.
To stop the firewall from dropping connections silently, modify pertimeout value for the persistent connection. For details, see Upstream Firewall dropping connections from the ProxySG.
In some cases, disabling persistence is the only workaround, depending on the environment and security posture. You can disable persistent connections globally or for specific sites or URLs. For details, see How do I disable HTTP persistence on the ProxySG?
Lowering connection persistence or disabling persistence can lead to TCP port exhaustion. Expand the TCP source port range and disable port randomization.
For details, refer What TCP source ports are used by the ProxySG and how do I manage them?
Feedback
