Large amounts of HP-RGS traffic over VPN (Global Protect)

[J0eShmow]

Hello Everyone!

We are noticing a large amount of HP-RGS tagged traffic on our Palo Alto FW/VPN.

The usage is typically a spike, and very sporadic / happens throughout the day.

The workload for our end users doesnt typically require streaming video, and its mostly productivity.

For example, for about 20-30 remote RGS users, we generated 2.3 TB of traffic for yesterday alone.

This morning we noticed an 85 GB spike HP-RGS usage report on the PA, and we confirmed that the user of that system did in fact have an RGS connection, but he was sleeping, and did nothing with that system during that 10 minutes of the large usage.

Other systems will exhibit similar behavior but not as large, ~ 20-40 GB (usually as spikes)

We suspected something like a screen saver was to blame, but i tested have a screen saver running for 2 hours, and it didnt generate any sizable usage.

Ive seen RGS traffic in the past elsewhere, but this seems highly excessive.

Has anyone seen this type of behavior before?

[KellyRGS]

Hello,

I see the version of Remote Boost you are mentioning is 20.2.  Are you able to test with 20.3.0 to see if this issue is resolved? I would like to gather some log files, so will reach out in a PM.  May need to get that enabled for you before I can do that.

Kelly

[KellyRGS]

I did a little checking on your issue.  Not sure if you are using AVC or not, but this is what could be going on.

If connecting with AVC, the bandwidth can be high even when the desktop is not changing. HP3 connections

will send very little data when the desktop is idle. For AVC, minimizing the receiver window pauses the updates.

Let me know if this helps or not.

Kelly