We are experiencing significant latency with a critical SaaS application used by our finance team. The vendor's status page is green, and our ISP has confirmed our internet circuit is operating within spec. The issue manifests as slow page loads and timeouts during file uploads within the app.
Our edge firewall is a WatchGuard Firebox M570 running WatchGuard OS 12. Our current working hypothesis is that the firewall's Deep Packet Inspection (likely the HTTP proxy) or application control features may be introducing the latency. We have already verified that the SaaS app's IP ranges are correctly allowed through the policy.
Before engaging the SaaS vendor more deeply, I want to systematically rule out the firewall as the root cause. My planned steps are:
* Create a temporary policy bypassing all UTM features (AV, IPS, spam blocking, etc.) for traffic to the specific application's FQDNs and IP ranges, then measure performance.
* Compare latency and packet loss using `tcping` and `traceroute` both with and without the UTM policy engaged.
* Review the Firebox System Log and Traffic Monitor logs for any blocks, drops, or alerts related to the application's traffic during the slowdowns.
My specific questions for the community are:
1. Are there any known performance interactions between WatchGuard's HTTP proxy and specific SaaS platforms (e.g., Oracle NetSuite, Workday) that we should check?
2. Beyond the basic UTM bypass, what other firewall configuration nuances (e.g., ALG settings, session timeouts) could affect SaaS application performance that we should examine?
3. What specific log entries in WatchGuard System Log are most indicative of a performance bottleneck versus a straightforward block?
I will be conducting tests over the next 24 hours and can share comparative latency data if it would be helpful for others.
— Jessica
Trust but verify. Then renegotiate.