Every day at around 3 PM, Microsoft 365 services become extremely slow or fail to load on our corporate LAN. The web versions of SharePoint, Forms, Copilot, the Admin Center, and similar services are affected, and loading Outlook attachments in the modern desktop client is also very slow. Other websites and network services continue working normally, and the same Microsoft 365 apps perform fine from other networks. Firewall traffic does not show an obvious bandwidth problem. We have tested different VLANs and rebooted the firewall, but the issue still occurs. Our firewall is a SonicWall NSA 2700. What should we investigate?
4 Answers
On the SonicWall, check CPU, memory, connection/session counts, and especially DPI-SSL usage during the incident. Microsoft 365 can behave badly when deep packet inspection is applied incorrectly or when the appliance is running out of inspection capacity. Temporarily excluding a test group of Microsoft 365 endpoints from DPI-SSL could quickly confirm whether inspection is the cause.
Try isolating the network path before 3 PM. For example, bring up a site-to-site VPN or temporarily test the affected users through a simpler firewall path. If the slowdown disappears, the firewall or its inspection policies are likely involved. If it remains, look for a scheduled backup, synchronization job, automation, or ISP-side problem that starts at that time.
Scheduled maintenance, backups, or cloud synchronization are still worth ruling out, even if other websites appear normal. Capture traffic and firewall health data before, during, and after the event, and compare DNS, TLS handshakes, Microsoft 365 endpoint latency, packet loss, and session behavior. Also check whether the ISP is changing routes or imposing a policy at that time.
Do not focus only on bandwidth. A network can show moderate throughput while running into a connection or session-table limit. Check the firewall's concurrent session count, new connections per second, NAT resources, and any upstream modem or ISP limits. A scheduled task or a burst of users reconnecting after lunch could create enough sessions to affect Microsoft 365 without noticeably consuming the link.
That is where I am leaning. I have already tested separate VLANs and rebooted the firewall, but neither changed the behavior. I will compare CPU, DPI-SSL, and session statistics specifically around 3 PM.