Troubleshooting Slow Speed Tests with DPI-SSL on SonicWall NSA 4700

Experiencing drastically reduced speeds during speed tests when DPI-SSL is enabled on your SonicWall NSA 4700 firewall? You're not alone. Many users have reported similar issues, and this article will delve into the potential causes and solutions, drawing on real-world experiences and expert advice.

The Case: Speed Degradation with DPI-SSL

One user recently reported that their download speed plummeted from 999 Mbps to 80-90 Mbps when DPI-SSL (Deep Packet Inspection over SSL) was activated on their SonicWall NSA 4700 firewall. Disabling DPI-SSL restored the expected speed test results. This points to a potential bottleneck or performance issue introduced by the DPI-SSL inspection process.

Understanding DPI-SSL and its Impact on Performance

DPI-SSL is a crucial security feature that allows your SonicWall firewall to inspect encrypted traffic for threats. However, this inspection process can be resource-intensive and impact network performance. Several factors can contribute to this performance degradation:

• Hardware Limitations: The NSA 4700, while a capable firewall, has finite processing power. DPI-SSL requires significant CPU resources to decrypt, inspect, and re-encrypt traffic.
• Configuration Issues: Incorrectly configured DPI-SSL settings can exacerbate performance problems.
• Firmware Bugs: Software bugs in the firewall's firmware can introduce performance regressions with DPI-SSL.

Potential Solutions and Troubleshooting Steps

Based on community feedback and expert recommendations, here’s a systematic approach to troubleshooting slow speed tests with DPI-SSL enabled:

1. Check Gateway AV Settings:

   • Ensure that "TCP Stream" is disabled within the Gateway Anti-Virus settings. Several users have reported this setting dramatically reduces speed test performance when enabled.

2. Investigate Firmware Issues:

   • Downgrade Firmware: As one user discovered, downgrading to a specific firmware version (SonicOS 7.1.2-7019-R3835-HF50694) resolved their speed issues. This suggests a bug in later firmware versions might exist.
   • Hotfixes: Be aware of potential issues with specific updates. One user experienced stability issues related to URI lists and the necessity of a hotfix (R3835-50694) to address those problems.
   • Before downgrading take a backup of your current running firmware. You can also keep the backup on a USB drive.

3. Contact SonicWall Support:

   • Open a support ticket with SonicWall. Provide detailed information about your network setup, firmware version, and the performance issues you're experiencing. SonicWall support can analyze your configuration and identify potential bottlenecks.
   • If you're experiencing a DPI-SSL performance regression after a firmware upgrade (like version 7.1.2), explicitly mention this in your support ticket.

4. Monitor CPU Usage:

   • Check the firewall's CPU usage when running speed tests with DPI-SSL enabled. High CPU usage indicates that the firewall is struggling to keep up with the processing demands.

5. Examine DPI-SSL Exclusions:

   • Carefully configure DPI-SSL exclusions. Excluding trusted websites and applications from DPI-SSL inspection can reduce the processing load on the firewall without compromising security significantly. Make sure that you are excluding only the trusted domains and not any malicious website. Refer to SonicWall's documentation for guidance on creating effective DPI-SSL exclusion lists.

User Experiences and Lessons Learned

• Firmware Matters: The experiences shared highlight the importance of firmware stability. Upgrading to the latest version isn't always the best approach; sometimes, a specific older version offers better performance and stability. Be sure to read release notes and community discussions before upgrading.
• Hotfixes Can Introduce New Issues: Applying hotfixes can resolve specific problems but may also introduce new, unforeseen issues. Thorough testing is crucial after applying any firmware update or hotfix.
• Community Collaboration is Valuable: Sharing experiences and solutions within the SonicWall community can be invaluable in troubleshooting complex issues like DPI-SSL performance degradation

Conclusion

Troubleshooting speed test issues with DPI-SSL on SonicWall firewalls requires a methodical approach. By investigating firmware versions, gateway AV settings, CPU usage, DPI-SSL exclusions, and seeking assistance from SonicWall support, you can identify the root cause and restore optimal network performance without compromising security. Remember to always test configurations in a controlled environment before implementing them in a production network.