ProxySG & Advanced Secure Gateway

One Particular URL responding very slow when traffic going through proxy.

Client configured PAC file to reach proxy. When bypass proxy it's working well.

Website http://x.x.x.x:8080/UIUX93/ 

Ceckpoint timings:
      new-connection: start 1 elapsed 0 ms
      client-in: start 18 elapsed 69177 ms
      scan-request-completed: start 69195 elapsed 0 ms
      server-out: start 69199 elapsed 0 ms
      server-in: start 69279 elapsed 0 ms
      client-out: start 69280 elapsed 0 ms
      access-logging: start 69316 elapsed 0 ms
      stop-transaction: start 69316 elapsed 0 ms
      Total Policy evaluation time: 69177 ms
    url_categorization complete time: 69316
    ICAP Response Scan: start 69195 delay 0 finish 0
    server connection: start 69199
    server connection: connected 69200 first-byte 69279 last_byte 69316
    client connection: first-response-byte 69280 last-response-byte 69316
    
  Total time added: 69181 ms
  Total latency to first byte: 69183 ms
     Request latency: 69181 ms
    OCS connect time: 1 ms
    Response latency (first byte): 1 ms
     Response latency (last byte): 0 ms
stop transaction --------------------

tcp.stream eq 37

Attachment(s)

bluecoat_Jun_19_2019_11_14_05_UTC_ip_host_10.64.105.67_or...64   3.92 MB 1 version

Policy Trace Hralign Demo.txt   258 KB 1 version

Dear Lokesh,

Can you try this step and test:

1.)  Login to the Management Console (https://<ip.address.of.proxysg>:8082 )
2.)  Go to the Configuration tab > Policy > Visual Policy Manager > Launch
3.)  With the Visual Policy Manager window open, click on Configuration > Set Reverse DNS Lookup Restrictions...
4.)  In the DNS Lookup Restrictions, change the default of None to Listed host patterns.  Click on the Add button.
5.)  Enter in the host or subnet and click on the Add button.  When finished, click on the Close button.
6.)  Click on Install Policy.
7.)  Test

Hi Lokesh,

                Looks like 2 possible reasons to cause this. The websense REQMOD ICAP or RDNS lookup by proxy. Since the pcap is not having the filter to have these included, it is hard to confirm which one is causing this. Better to try both

1)    Bypass Websense REQMOD ICAP for the IP address 45.118.182.252
2)    Add the IP address "45.118.182.252" in RDNS lookup restrictions using VPM.
a.    Launch VPM
b.    VPM > Configuration > Set Reverse DNS lookup Restrictions
c.    On the Top box, if None is selected, set it to "Listed Subnets" and add the IP address into it.
d.    Install policy

Hi Aravind/Aboonaim,

Let me know it will affect other URL.

Dear Lokesh,

No, as we have applied only for particular IP.