Case Study: Users Said "The Internet Is Slow" — The Firewall Was Innocent
  

rizzuan Lv2Posted 2026-Jul-28 12:42

Last edited by rizzuan 2026-Aug-04 16:08.

One morning, our helpdesk received multiple complaints:
"The Internet is very slow today."
As expected, the firewall became the first suspect.
However, instead of making immediate configuration changes, we decided to collect evidence first.

Initial Symptoms

  • Internet browsing was noticeably slower.

  • Large file downloads took much longer than usual.

  • Internal applications were working normally.

  • No firewall policy changes had been made recently.

  • Firewall CPU and memory utilization remained within normal levels.

At this point, nothing indicated that the firewall itself was overloaded.

Investigation Process
We followed a structured troubleshooting workflow:

Step 1 – Check Firewall Resource Usage
We reviewed:

  • CPU utilization

  • Memory utilization

  • Session count

  • Interface bandwidth

Everything looked healthy.

Step 2 – Review Traffic Logs
The firewall logs showed that traffic was being allowed correctly.
There were no unusual drops, security events, or policy mismatches.

Step 3 – Test Network Path
We performed:

  • Ping

  • Traceroute

  • Speed Test

  • ISP gateway latency check

This revealed intermittent latency spikes outside our internal network.

Step 4 – Verify ISP Performance
After comparing results from multiple locations, we found that latency increased significantly after traffic left our network.
The issue was eventually traced to an upstream ISP routing problem.

  Root Cause
The firewall was operating normally.
The actual issue was an external ISP routing problem that introduced high latency during peak hours.
Without collecting evidence first, we could have spent hours modifying firewall policies unnecessarily.

  Resolution

  • Reported the issue to the ISP with traceroute results.

  • Continued monitoring latency until routing was restored.

  • Confirmed normal browsing performance after the ISP resolved the issue.

No firewall configuration changes were required.

  Lessons Learned
One of the most valuable troubleshooting habits is to prove where the problem is before trying to fix it.
Just because users experience slow Internet access does not automatically mean the firewall is at fault.
Always verify:
✅ Firewall health
✅ Logs
✅ Routing
✅ ISP performance
✅ End-to-end latency
Evidence should always guide troubleshooting—not assumptions.

Discussion
Have you ever been in a situation where the firewall was blamed, but the real issue was somewhere else (DNS, ISP, routing, server, or even the client device)?
I'd love to hear your experience and what tools you used to identify the real root cause.

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

rizzuan Lv2Posted 2026-Jul-28 13:12
  
Hi, I'm having trouble posting my latest sharing. The content isn't fully displayed. This has happened before. How do I solve it? The latest topic that I wanna share is "Case Study: Users Said "The Internet Is Slow" - The Firewall Was Innocent"
Prosi Lv4Posted 2026-Jul-28 13:54
  
Hi,

The firewall is likely not the primary cause of congestion. It could be an upstream ISP issue that causes periodic packet loss and increased latency. If we start changing firewall policies, QoS, or security profiles without evidence, we could end up creating new problems while the real problem remains unsolved.
Newbie517762 Lv5Posted 2026-Jul-29 08:34
  
HiHi,

Thanks for sharing! Looking forward to hearing your progress update.
Newbie167857 Lv1Posted 2026-Aug-01 14:31
  
Thank you for sharing!
Newbie A4 Lv2Posted 2026-Aug-03 18:42
  
Thanks for sharing