Deep Security Agent query status response very slow

I maintain a lot Rocky 8 Server, antivirus use Deep Security, firewall use firewalld but rule use direct.xml and block in & out, allow specific IP and ports in or out. all server has two rule, allow A IP and 4118 in, allow out to A IP and 4120 4122. some Server to query antivirus status like pattern is very quicky, but some Server is very slow, if stop firewalld service, then the response is fast.
compare those direct.xml, all same.
where can check the system setting, or how to trace this problem?