Hope you are doing fine.
The reason I asked to use a none-CDN site for the download speed test is due to the nature of the speed test websites, which connect to different servers, with sometimes different locations.
on the other hand, testing with host(s) with static IP address will gives us the ability to easier collect Packet Capture and trace the latency.
Regarding:
In this situation, if the proxy is explicitly configured, the user cannot bypass it, so what is the best practice? I am happy to hear and learn here.
I assume you are pointing to how we can have better download/upload performance. (Please correct me if Im wrong)
If so there are 2 options that I can think of:
[1] We need to review the WSA's mBUF cluster usage and if there is a good amount of free memory for the NIC buffer, we can change the: SENDSPACE, RECVSPACE, MBUF_CLUSTER_COUNT and/or SENDBUF_MAX , RECVBUF_MAX from CLI > networktuning command.
[2] Passthrough the traffic in the HTTPS Decryption, this will lead to least latency from the WSA side (no decryption and OfCourse no Scanning latency and so on) and if HTTP traffic we can set the Action in the Acceepolicy to Allow.
[3] Bypass the URLs from the source client (which really depends on the network design and security policies)
In general, WSA has no issue with the CDN hosted sites, we might have some difficulties in transparent deployment while the URL is in the ByPass Settings and the site is hosted on CDN (which can be addressed by TAPping the DNS traffic, WSA will learn the new IP address and will add them to its bypass table)
on the other hand, regarding the WSA's Performance monitoring, I would say it is always best to have the Accesslogs Performance parameter always configured:
we will have better visibility if any internal services in the WSA is introducing latency. (Like DNS, Auth, AMP, Scanners ... )
and regarding:
Is there any special consideration required to offload download traffic? (If we do that, the scanning of malware will be bypassed, right ?)
That is so true, there will be no scanning if we Passthrough or Allow the traffic
If HTTPS traffic gets Decrypt, then Access Policy will be apply, and in the AccessPolicy if the action is Monitor for the URL/WBRS, then next engines (AMP, Sopho, McAfee, WebRoot) will come in the game. this is the detailed steps (User guide: Figure 5: Applying Access Policy Action)
Please feel free to let me know if I had some misunderstanding about your message, or there are any questions or concerns.
Regards,
Amirhossein Mojarrad
+++++++++++++++++++++++++++++++++++++++++++++++++++
++++ If you find this answer helpful, please rate it as such ++++
+++++++++++++++++++++++++++++++++++++++++++++++++++
