Users reporting slow performance accessing Windows server with ZTNA RDP application

Products

• Symantec ZTNA

Issue/Introduction

Global enterprise with ZTNA applications globally.

ZTNA admin enabled a new RDP application for users in France, where the Windows servers users were accessing was also in France.

After deploying application, users complained that the RDP performance was slow - launching applications on the server, or switching applications post connection is slower than normal.

RDP application showing warning about latency and high round trip time as shown below.

 

Environment

ZTNA.

RDP Application.

Remote connectors.

Cause

RDP Application tied to a ZTNA site in another region (US and not EU).

Resolution

When creating ZTNA applications (RDP in this case), make sure it is tied to a ZTNA 'site' that is nearest to the back end application server.

In the above case, the newly created RDP Application was tied to a ZTNA site that was in the US region, and not the EMEA region. This resulted in the user request hitting the ZTNA pod controller in Europe, get routed to a ZTNA connector in the US where the RDP session would be sent to the Windows server in France!

By re-creating the RDP application and tying it to a Site linked to the Europe region (europe-west1), all the traffic remained in Europe and the round trip dropped exponentially.

Additional Information

When looking at ZTNA activity logs (see below), the connector IP address is always logged - which can be used to confirm which connector the user/entity is accessing when RDPing to the application server.

This log entry also shows the time to first bytes, which can be an indication of slow latency. Running a tcpdump from the connector to the Application server is also an option to get more detailed latency informortion.