tl:dr: http traffic works reliably and quick while https traffic is unreliable or extremely slow (2-5 minute load times). Details below.
Hey server fault, I have a good one for you. This is the beginning of week two at a new place that just expanded to included a 15th regional office the week before I hired in.
The new office is using a temporary cellular MPLS connection while we wait for the crews to get a hard line in. The new office is using the same hardware and firmware for mpls as the other 14 office, verified several times.
The web filtering and firewalling occurs in our DC which is not in this new office location. I want to call it a hub and spoke network, but since I have been hired-in during a "clean up" and documentation is sparse and I have never worked in a environment this complex before I can not be certain.
Users have a handful of https sites they need to use to do their work. These sites will not load regularly, if it all. If I had to put a number on it, they will load one out of 50 tries then fail to load the next page. A odd part of this is that the (browser) headers and URL will load almost every time, but nothing else will load past that.
Meanwhile http loads normal.
There is a server (DC, file server, DNS) in this office (like all the other branches) and it does have replication issues that could be related to this problem.
We have checked the following:
- Disabled AV/firewalls on hosts
- We can ping the websites in question all the time
- We have changed SSL/TLS settings in IE several times
- On the web filter, logs show all HTTPS sites are being allowed to this branch
- On the firewall, logs show all HTTPS traffic is being sent through/unscanned for this branch
- Our MPLS provider found a misconfig in the HQ MPLS router, "fixed" this but this did not provide any change
- pcap'd traffic from a test workstation; communication to these sites exists but the remote hosts send keep alives for 5 minutes before resetting the connection which is when we see a "page can not be displayed" error
I have been adjusting, tweaking, playing, reading logs, double/triple checking, calling ISP's and googling for 4 days now trying everything I can find and nothing has made a change (worse or better).
My last thought is it might be the slow cellular MPLS connection (1-3 Mbps; 12 users/12 VoIP phones/1 server) but I keep ruling that out because I feel it would present itself in HTTP traffic as well.