SSL Inspection Very slow internet traffic

chandan
chandan Posts: 72  Ally Member
First Comment Friend Collector Second Anniversary
in Security
Hello zyxel team,

After enabling SSL inspection in the zyxel firewall, We are experiencing very slow throughput although we have high bandwidth available. The website load speed is drastically drowned after enabling the SSL inspection.

WO SSL inspection, it works very fine.
The loading speed varies from page to page.

Firewall: USG110
Firmware Version: 4.62
No. Of users with allowed internet:16 - 20
No of concurrent sessions: 1000

We have also checked by enabling only SSL inspection and disabling other UTM profiles. But, the result is still the same.



Hence, we have to disable this feature as of now...
Zyxel team, please look into this matter.

All Replies

  • chandan
    chandan Posts: 72  Ally Member
    First Comment Friend Collector Second Anniversary
    @zyxel_Team,

    You might have missed this thread. 
    Please look into this...


    Regards
  • CHS
    CHS Posts: 181  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    SSL inspection will cost a lot CPU resource for HTTPS encryption & decryption.
    How many SSL inspection session is working on your device?  (Check Monitor > SSL Inspection > Concurrent sessions)


    How about your speedtest result before/after active SSL inspection function on your device?
  • chandan
    chandan Posts: 72  Ally Member
    First Comment Friend Collector Second Anniversary
    Hello @CHS,

    The maximum concurrent session I found in the firewall statistics is 560 with only 2 PC. The rest PC in the network is not activated with SSL inspection service.
    The speedtest result gave around 92Mbps without SSL inspection and 81Mbps with SSL inspection.

    But the page loading speed is very poor indeed.
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,379  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary

    Can you take a screenshot of your SSL Inspection profile setting?
    If you change your setting like it, does speed is getting higher?

    You can also take a video how slow throughput during access to WebSite.
  • Julien_ALM
    Julien_ALM Posts: 10
    First Comment Friend Collector First Anniversary
    HI,
    Same problem with ATP700.

     - Without inspection ssl but with all other security services enabled, web pages load less than one  second.
    - With inspection SSL enable and all other services enabled, web pages load on average 10 seconds
    - With inspection SSL enable but all other services disabled, web pages load on average 10 seconds too

    - the First load is more longer
    - I Have installed latest firmware version (5.02(ABTJ.0)),  it's the same.
    - I Have tested with only one WAN interface and disabled wan load balancing and it's the same.
    - The weird thing is that even unsecured (http) sites are slow to display if SSL inspection is enabled. On the other hand if I deactivate it, it is instantaneous.

    Best Regards,
  • Julien_ALM
    Julien_ALM Posts: 10
    First Comment Friend Collector First Anniversary
    HI,
    Same problem with ATP700.

     - Without inspection ssl but with all other security services enabled, web pages load less than one  second.
    - With inspection SSL enable and all other services enabled, web pages load on average 10 seconds
    - With inspection SSL enable but all other services disabled, web pages load on average 10 seconds too

    - the First load is more longer
    - I Have installed latest firmware version (5.02(ABTJ.0)),  it's the same.
    - I Have tested with only one WAN interface and disabled wan load balancing and it's the same.
    - The weird thing is that even unsecured (http) sites are slow to display if SSL inspection is enabled. On the other hand if I deactivate it, it is instantaneous.

    (Sorry For My English  :) )
    Best Regards,
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,379  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary
    Hi @Julien_ALM

    When accessing websites, it may including many frames in the web page. (per frame may include one or more URLs). SSL inspection will exchange all of certificates between these clients and those URL web server during website loading the content to you....more URLs then more busy.

    If you like, you can share you tested sebsite and your SSL certificate to me by private message. Then we may have a further check. :)
  • chandan
    chandan Posts: 72  Ally Member
    First Comment Friend Collector Second Anniversary
    Zyxel_Stanley said:

    Can you take a screenshot of your SSL Inspection profile setting?
    If you change your setting like it, does speed is getting higher?

    You can also take a video how slow throughput during access to WebSite.


    Hello,
    As per your advise please see the below attached videos of computer browser with and without SSL inspection. Actually I have this settings activated in the firewall. There is no website loading performance improvement by this...


    SSL Settings





    Without SSL Inspection
    https://drive.google.com/file/d/10EJhTwbXn3EohWnDqI0cRzu_xLCakqVR/view?usp=sharing




    With SSL Inspection
    https://drive.google.com/file/d/11B4cvyvF0dci_6M2X7fmAInpUKBVpdy4/view?usp=sharing



    Note the throughput is also reduced by 5 - 10 Mbps depending on various sites.
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,379  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary
    Hi @chandan

    Thanks for share video of your test result.
    In this video, when SSL inspection is turned on, the almost frames and images are loaded within around 5 seconds. 
    Users may feel few latency comparing to the cases without using SSL inspection.  This is because when SSL inspection function is turned on, it will bring some overhead to the system due to certificate exchange handling. This is more likely some kind of  tradeoff between performance and security.
  • chandan
    chandan Posts: 72  Ally Member
    First Comment Friend Collector Second Anniversary
    But, this is annoying indeed. As an end user I or nobody will like slow loading webpages. However, the webpages loading varies from sites to sites.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）