Troubleshooting WSS Agent performance issues

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Goal of the following document is to provide a list of steps to execute and information to send into support when troubleshooting performance issues with WSS Agents.

Performance issues tend to be generic and not specific to one site - if it is specific to one site, it is more than likely to be related to OCS communications and gathering a HAR file and PCAP at the same time will help determine root cause.

Performance issues are most frequently network related between the host and Cloud SWG, and may occasionally need ISP involvement.

 

Environment

WSS Agent.

Cause

Network connectivity/performance.

Resolution

Initial troubleshooting steps: The following actions are simply used to home in on root cause, and will provide Broadcom support with some useful feedback. Please follow each step and provide feedback on each item.

• • Basic tests to validate if network specific:
    • Is your performance issue with all Websites, or just a single Web server? It may be an issue with the OCS rather than the Cloud SWG service.
    • What are your download speeds, and line speed? Note that with download speeds are greater than 20mbps, it's unlikely any user will report slowness browsing web sites.

• • Does another network path into Cloud SWG change the performance? 
    • With Agents : Tether WSS Agent host to phone and verify whether same performance is visible. This approach often highlights issues with network connectivity on local networks.
      

Gathering performance data: Identifies the information required by the Broadcom support team for any performance related issues. The info to send in depends on the access methods:

• Making sure that your agent is as close to the network egress point, start Symdiag and RECONNECT the tunnel to log all initialisation information.
• Capture a traceroute (tracert in Windows) to the data center VIP IP you are connecting to (available from the Portal UI ‘Support’ or agent diagnostic file.
• Select a file to download from download.gradle.org - a selection of files from 40MB to 150MB are available to download, but select a file greater than 100MB. The Cloud Proxy round trip time into Gradle is extremely low, and we can focus all our attention on the downstream communication to the client from the Cloud Proxy.
• Stop Symdiag and upload the Symdiag output file to the support ticket, network layout containing as well all devices in path from host to Cloud SWG as well as traceroute output.
• Confirm that tethering the agent host to a mobile phone addresses the performance issues.

Data to send Broadcom support: To do an initial analysis of performance into Cloud SWG, please make sure you send the following information into Broadcom support:

• Responses to ‘Basic tests to validate if network specific’ questions above
• Traceroute into Cloud SWG data center VIP
• Symdiag (WSS or SEP Agent) or host PCAPs when downloading files from gradle.org.
• Network layout identifying all devices setting between the host being tested and Cloud SWG.