Screen OS

last person joined: 8 months ago 

This is a legacy community with limited Juniper monitoring.

  • 1.  SSG 5 WIFI - Slow HTTP VIP Portforward from internet to local server.

    Posted 07-28-2009 11:11
      |   view attached

    Hello Everyone

     

    I just got a small Juniper SSG5 WIFI firewall from my employer to play with at home, and I've just finished installing it, and configuring it... But I've hit a wierd problem...

     

    I run my own linux server, which used to be my firewall also, and on the server I have apache running, serving multiple virtual hosts and domains.

     

    But now my "clients" are complaining about slow websites, when they browse to their websites, which is hosted on my linux box. But the wierd thing, is... Its only HTTP traffic that has slowed down significantly. Their websites now take between 5-20 seconds to load, where they before, took 1-5 seconds. But as soon as they or I browse to our webmail access, which runs on HTTPS, there is no speed problems anymore?!? (When i load the pages from the local lan, where the server is, the websites load immediadly) I've tried disabling all screen options on the untrust zone, where the domains are "hosted", but it doesn't change anything. I've also tried "set ff and debug flow basic" but nothing wierd there also, the sites do load, but after some time...

     

    I've added my firewall config as an attachment.

     

    And another thing, i can't figure out how to fix, is my FTP server... Ive forwarded port 20-21 to the server, and enabled ALG and choosen FTP as the appclication on the policy permitting the traffic, but the ftp connects stop when the dir listing is sent to the user, when the server switches to PASV mode... How can that be? I thought, that was what ALG should fix?

     

    Software Version 6.2.0r2.0, Type: Firewall+VPN

     

    I really hope someone can help me out 🙂 I'd really appreciate it.

     

    Kind regards

    Jacob


    #vip
    #SSG5
    #portforward
    #Slow
    #HTTP

    Attachment(s)

    txt
    fw-config.txt   9 KB 1 version


  • 2.  RE: SSG 5 WIFI - Slow HTTP VIP Portforward from internet to local server.
    Best Answer

    Posted 07-29-2009 09:43

    According to your configuration HTTP traffic should be handled by FTP ALG, "application FTP". Create one specific policy for HTTP and do not use application FTP on that policy.

     

    set policy id 10 from "Untrust" to "Trust"  "Any" "VIP(ethernet0/0)" "FTP" permit log
    set policy id 10 application "FTP"
    set policy id 10
    set service "FTP-CMD"
    set service "HTTP"
    set service "HTTPS"
    set service "OPENVPN-1194"
    set service "OPENVPN-1195"
    set service "POP3S"
    set service "SMTP"
    set service "SSH-6435"
    set log session-init
    exit