Slow SCP file transfer via SAC

Products

• Symantec ZTNA

Issue/Introduction

Initial SAC setup with SSH application used for testing. 

Users are testing with SSH Gateway Application integrated within AWS.

Users can connect to remote SSH servers without issues, but experience slow speeds transferring files from their local machine to SSH hosts or vice versa using SCP. Cannot exceed 11MB/s despite having bandwidth of 300 Mbps.

Issue visible with multiple client hosts and back end SSH servers.

Environment

SAC connector running in Kubernetes.

SSH Gateway Application integrated within AWS.

Cause

Insufficient resources allocated to SAC connector host.

Resolution

Installed SAC connector on seperate Linux host, and assigned 8 vCPUs with 32GB RAM.

Additional Information

PCAPs taken during the file copy operation showed TCP throughput consistently at 11Mbps, without any drops. This indicated that the host or environment was somehow throttling the speeds.

Suspecting the connector, we spun up a new connector in parallel on a Linux host belonging to a different network, with the resources outlined above and tied the SSH application to this new connector. As soon as we did this, the speeds increased exponentially. It was decided to simply keep this new platform for testing, without tweaking the original one (which only had 2 vCPU and 8GB RAM assigned).

From a SAC perspective, we scale both vertically and horizontally within the Secure Access Cloud environment. It’s really important to ensure the resources consumed by Docker container are available in host machine, and adding resources when the connector is struggling can improve performance.