Troubleshooting Slow Speed Tests with DPI-SSL on SonicWall NSA 4700

Experiencing drastically reduced speeds during speed tests when DPI-SSL (Deep Packet Inspection over SSL) is enabled on your SonicWall NSA 4700? You're not alone. This article delves into the common causes and potential solutions to this frustrating issue, drawing from real-world experiences shared within the SonicWall community.

The Problem: DPI-SSL Impacting Speed Test Results

Users of the SonicWall NSA 4700, a popular mid-range firewall, have reported a significant performance drop during speed tests when DPI-SSL is active. Speeds that initially register near the expected bandwidth (e.g., 999 Mbps) quickly plummet to a fraction of that, sometimes as low as 80-90 Mbps. Disabling DPI-SSL often restores the performance as expected, confirming the feature as the culprit. Let's explore the potential reasons and troubleshooting paths.

Understanding DPI-SSL and its Performance Implications

DPI-SSL provides critical security by inspecting encrypted traffic for malicious content. It decrypts SSL/TLS traffic, analyzes it, and then re-encrypts it before sending it on its way. This process, while essential for security, introduces overhead that can impact network speeds. The extent of this impact will depend on several factors:

• Firewall Hardware: The processing power of the SonicWall NSA 4700 plays a crucial role. Older or under-spec'd hardware might struggle to handle the decryption/encryption workload, leading to bottlenecks.
• DPI-SSL Configuration: How DPI-SSL is configured significantly affects its performance impact. Certain settings, like those related to Gateway Anti-Virus and TCP stream inspection, can exacerbate the problem.
• Firmware Version: Bugs within the SonicWall firmware can lead to performance regressions. This means a specific version of the firmware may introduce performance issues that were not present in previous versions.

Common Causes and Solutions:

1. Gateway Anti-Virus with TCP Stream Enabled:

   • The Issue: Enabling "TCP Stream" within the Gateway Anti-Virus settings has been known to significantly degrade speed test performance.
   • The Solution: Disable "TCP Stream" within the Gateway Anti-Virus settings. Navigate to the appropriate section in your SonicWall management interface (usually under Security Services > Gateway AV) and uncheck the box.

2. Firmware Bugs and Incompatibilities:

   • The Issue: Reported issues within specific SonicOS versions, particularly around the 7.1.2 release, have caused DPI-SSL to function improperly, leading to diminished speeds.
   • The Solution: As seen in the user reports, rolling back to a previous, more stable firmware version can sometimes resolve the issue. In one documented case, downgrading to SonicOS 7.1.2-7019-R3835-HF50694 resolved the problem. Check the SonicWall Support Portal for the latest firmware and any associated release notes that might address performance issues. Consider applying hotfixes recommended by SonicWall support, but be aware of potential issues with these,

3. Overloaded Firewall:

   • The Issue: If the firewall is near its capacity in terms of concurrent connections or processing power, enabling DPI-SSL might push it over the edge, resulting in performance degradation.
   • The Solution: Monitor the firewall's CPU and memory usage. If resources are consistently high, consider upgrading to a more powerful firewall model. Review firewall rules for inefficiencies. Ensure unnecessary services are disabled.

4. DPI-SSL Exclusion Lists:

   • The Issue: DPI-SSL attempts to inspect all SSL/TLS traffic by default. This may include trusted and/or high volume traffic.
   • The Solution: Add known, trusted domains and IP addresses to the DPI-SSL exclusion list. This prevents the firewall from wasting resources inspecting traffic that is already considered safe SonicWall Documentation. This is especially helpful for streaming services or content delivery networks you trust

5. MTU Issues:

   • The Issue: Maximum Transmission Unit (MTU) size mismatches between the firewall and other network devices can cause fragmentation, leading to performance problems.
   • The Solution: Verify the MTU size configured on the SonicWall's WAN interface matches the MTU supported by your ISP. Experiment with slightly smaller MTU sizes to see if it improves performance.

Steps to Take When Troubleshooting:

• Isolate the Issue: Confirm that DPI-SSL is indeed the cause by disabling it and running speed tests. If speeds return to normal, you've pinpointed the problem.
• Check Firewall Resources: Utilize the SonicWall's monitoring tools to observe CPU, memory, and connection usage.
• Review DPI-SSL Settings: Examine the DPI-SSL configuration for any potentially problematic settings, such as Gateway AV with TCP Stream enabled.
• Consult SonicWall Support: Open a support ticket with SonicWall. Provide detailed information about your configuration, the firmware version, and the troubleshooting steps you've already taken. They may have specific recommendations or hotfixes available for your situation.

The Importance of Firmware

Firmware plays a critical role in the functionality and performance of your SonicWall firewall.

• Stay Updated: Always keep your SonicWall firmware up to date.
• Read Release Notes: Before upgrading, carefully review the release notes for any known issues or performance considerations.
• Consider Hotfixes: If you encounter a specific problem, SonicWall support may provide you with a hotfix. However, proceed cautiously as hotfixes are not always fully tested and could introduce new issues.

Real-World Examples from the SonicWall Community:

Several users have shared their experiences with DPI-SSL and performance issues on the SonicWall forums:

• One user reported that upgrading to version 7.1.2 caused DPI-SSL to break, eventually receiving a hotfix to resolve the issue.
• Another user experienced firewall failovers when adding URLs to a URI list after installing 7.1.2, highlighting the potential instability of certain firmware versions.

Conclusion:

Troubleshooting speed test issues with DPI-SSL enabled on a SonicWall NSA 4700 requires a systematic approach. By understanding the underlying mechanisms of DPI-SSL, identifying potential causes, and working with SonicWall support, you can often restore performance without sacrificing essential security. Remember the importance of firmware stability and the value of consulting the SonicWall community for shared experiences and solutions.