Slow connection to use.fontawesome.com

[lubomir_cerny]

Hi folks,

I observe very slow response from MWG setting https connections to use.fontawesome.com. I guess the point is with long SSL ciphers variants to choose from.

Can you propose tested Server cipher list for MWG SSL Scaner ?

[mkutrieba]

Hello,

this is hard to say without seeing debug data etc.

In general, we do not "recommend" to use any specific ciphers in SSL settings anymore. MWG does no longer have Ciphers configured (cipher list is just empty) since many versions which means, that the ciphers provided by browser will be taken.

Of course, customer can configure a cipher list as required/wished depending on the environment.

If you think, that slowness is caused by cipher list, then you could run a test with duplicate/test setting which does have same ciphers configured where you assign only your client IP for testing purpose. Then reproduce the slowness issue, after that remove all ciphers, test again and check if issue is resolved or not.

In general, slowness could occur on many ends (client/server connection, DNS, Authentication,..). So maybe a Service Request with debug data (Feedback file, tcpdump, connection trace and rule trace) is needed to check this from all perspectives.

Let us know if you have further questions.

[lubomir_cerny]

Hi Marcel.

Thank you for comment. Nice to know that empty cipher suite list will use method proposed by client browser. It is new for me. Our current setting was defined by security and was preserved during several upgrades.

Nevertheless empty ciphers list did not solved slowness to this specific site. I will try to debug this deeper and give feedback.

Have a nice day.

[mkutrieba]

no problem. I attach a screenshot showing a SSL setting from fresh installed 8.2.X version.

Here you can see that Server Cipher list is empty and only alternative server cipher list is filled.

If you want, you can also import "HTTPS Scanning" rule set from library but take care when doing so. It will indicate that some settings are existing where you get the option to use the existing ones or create duplicate of them with new naming.
Not that you mix up anything or overwrite productive settings. You can also use a test installation to perform the tests, adjust the policy and if all is verified you can take a backup of test machine and restore policy in productive system afterwards. In this case, always take a backup of productive system! 😊

Let us know if you have further questions.

[lubomir_cerny]

Debuging browser session via Fiddler, I have found, that slow response is result of HTTP 502 - The proxy could not connect to the destination in time. I have to forward this issue to security to check other sources.
Thank you for your help.

[mkutrieba · Accepted solution]

Okay, this most likely means, that either DNS host was not resolvable or more common, that external connection was timing out, then MWG closes connection and indicates a block page with 502 error to client to tell that it could not connect to destination in time.

More details here in best practices article:
https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-HTTP-502-s/ta-p/554073