Terrible perfomance with Web filtering

[KingBarries]

Hi - I would like to get some input from the community... We are using fortigate 60C firewall with AD integration. We activated the UTM Web filter for a certain group. However the performance is terrible. Sites time out and sometimes cant even be reached. CPU usage at 20% and Memory at 55% about when tested. It seems like timeouts - although I cannot establish what causes this. The profiles that are not web filtered or do not use UTM runs 100%. Any advice?

[ede_pfau]

When checked, a few bytes from the already scanned content will be passed to the client to avoid a timeout.

[RetchedOne]

I' ve been trying to get a good solid FSSO integrated URL filtering for months... it works, then it breaks... works, then it goes SLOW... then denies sites. The issues seem to stem from multiple monitored DC' s and remote sites (across IPSec tunnels). Same complaints as above. One thing that I DID see an improvement, in 5.0, is the DNS option. It queries Forti DNS servers and they are told what the rating is... Didn' t help me with user authentication, but it did speed up url rating.

[Rick_H]

We have intermittent problems with FSSO-integrated UTM profiles as well. The problem I' ve found is the Agent " forgetting" users for one reason or another. If the user generates a logon event from his machine then this usually makes the Agent remember him for a little while. Where I' ve seen the problem most often is with IT staff or highly mobile users that log onto and off of many workstations/servers during the course of a day. One way I' ve combated this is to exclude my server ranges from FSSO-integrated UTM scanning (they are still filtered, but use a different, non-FSSO policy). For what it' s worth, the 95% of my users who operate from only one machine rarely see a problem.

[rwpatterson]

We created a generic IT login for IT people when they visit remote work stations. This login is exempted from FSAE/FSSO browsing more or less, so your issue is bypassed to an extent.

[Aigarz]

What I’m seeing on mid-range boxes, as soon as you are doing web filtering, enabling „webcache” is absolute MUST! If it isn’t set – no matter how fast your DNS responds. It seems to me that it checks each and every link within code page is loading and with complex pages – they just times out or loads extremely slow. Webcache checkbox policy on GUI is available only if “set gui-wanopt-cache enable” is set from CLI. or from the GUI Dashboard Otherways you have to set cache manually from CLI under your corresponding firewall policy.

[lelsbecker]

Is your internet caching set up? I had horrible performance and disabled caching, much much better now.