Users connected behind EX access switches may report slow internet access. In some cases, web pages load very slowly or do not load at all. Speed test sites may also fail to load or may fail during the download test.
Basic connectivity may still work. For example, users may be able to ping the default gateway and public IP addresses, but web browsing remains slow.
This can make the issue look like a switching problem, but further isolation may show that the EX switch is forwarding traffic correctly and the problem is related to congestion or an upstream firewall path.
The following symptoms may be seen:
Use switch-side checks to confirm whether the EX switch is causing the issue or only forwarding traffic toward a bad upstream path.
show dot1x interface <user-port> detail
show ethernet-switching table | match <client-mac>
show interfaces <user-port> extensive
show interfaces queue <user-port>
Confirm that the client is authenticated, assigned to the expected VLAN, and that the port does not show errors, drops, or flaps.
show chassis alarms
show system alarms
show chassis routing-engine
show system core-dumps
show log messages | last 100
Confirm that CPU and memory are stable and that no core dumps or major switch errors are present.
show interfaces <uplink-port> extensive
show interfaces queue <uplink-port>
show ethernet-switching table interface <uplink-port>
show spanning-tree interface <uplink-port> detail
Look for errors, output drops, queue drops, MAC moves, STP changes, or link flaps.
Also check for high-bandwidth devices. A single endpoint, such as a backup server, camera recording server, update server, or unknown client, can consume a large amount of bandwidth and affect other users sharing the same path.
Additionally:
> If two firewall-facing links are used, test each path one at a time during a maintenance window:
> Disable one firewall-facing path and test internet access.
> Re-enable it, disable the other path, and test again.
> Compare speed test results and browsing behavior.