Web Filtering- Slow page loading.

Hi,

Could you please let know the firmware version used? And also the output of #diag debug rating

Best regards,

Jin

Did you check your DNS server config? (System / DNS)
Make sure you are using a server with low latency. Note also that DOH / DOT server may be slower. 

If this doesn't solve it, check the latency to webfiltering server (diag debug rating) Check more here:
Troubleshooting Tip: Unable to connect to FortiGuard servers

Hi Hakam,

Please refer below article as it seems much more similar to issue you have described:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Web-pages-not-loading-or-taking-too-long-to/ta-p/31395

Cheers,

Ankit

If you have found a solution, please like and accept it to make it easily accessible to others.

Kindly check when issue occur is there any spike in CPU or Memory usage? Also, what is the inspection you are using in web-filter and in firewall policy? Try to change it and check number of session utm is using. You can refer below document : https://docs.fortinet.com/index.php/document/fortigate/6.2.5/cookbook/963365/checking-the-number-of-sessions-that-utm-proxy-uses

Hi 

Please check with flow-based mode on the policy.

Regards,

I also currently have slow internet and timout issues on some 100F that are on 7.2.9 (but also occured with 7.2.8) in my case it worked normal after I disabled asic offloading on the internet policy.

Since this can only be a workaround I've opened a ticket with TAC on this.

aslo there where several bugs with NPU in 7.2.8 and earlier that were fixed in 7.2.9. Though my issue is obviously not.

unfortunately these options are not available on gui. You will have to add the column "ID" to the policy view  in gui to find the policy id and then set it on cli:

config firewall policy

 edit <id>

  set auto-asic-offload disable

end

Maybe you could also set np_acceleration to disable. But not sure if needed.

no did not yet get any reply from TAC. Just opened the ticket an hour ago :)

hm additionally I just noticed on two affected 100F that diag debug rating shows rtt > 50 (or even >100 on the 2nd server). In config system fortiguard these are already configured to use lowest latency location and protocol https with port 443.

But since annother 100F that still is on 7.0.15 and is not affected by this also has such rtts in diag debug rating. So I 'd say the rtt cannot be the reason.