This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG 17.5 and Slow Downloads with Intrusion Prevention active

Björn Ebner over 6 years ago

I do have the impression, that Downloads a slower with Sophos XG 17.5 than with previous Versions.

When I do a speedtest (my WAN Speed is 100/40) I only get about 40/30.

I tried Speedtest on Speedtest.net from a Cabled PC.

When performing the Speedtest the CPU gets to about 90 - 100 % mostly used by IPS (Snort)

I think that this wasn't like this before Sophos XG 17.5 in previous Versions.

When I disable Intrusion Prevention I do get normal speeds.

Any idea?

Update:

I tested it also with a Sophos XG 115 on 200/100 WAN with IPS activated but there I couldn't see this issue.

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 6 years ago

Hi,

please post a screenshot of your IPS settings that are causing the issue. Is the failing version running on your own hardware?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Björn Ebner over 6 years ago in reply to rfcat_vk

yep, it's running on my own hardware from the beginning.

IPs Settings are default lan to wan IPS Settings
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Björn Ebner

Hi,

in the IPS tab please post a screenshot of the display in the first sub tab.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Björn Ebner over 6 years ago in reply to rfcat_vk

Sorry for the delay.

Here it is:
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Björn Ebner

Hi Bjoern,

I have some more things to look at.

I tried changing my ISP setting to the default LAN to WAN and the change made no different to my 100/40 download. I did create my own IPS policy by removing all the signatures for not needed systems eg line, mail server, windows servers etc.

What is the CPU on your XG?

Please review the Reports -> Network and threats tab to see if there are any specific IPS rules that are being triggered?

Other that I am running out of ideas and will need to have one of the more technical mods review your posts.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to rfcat_vk

With V17.5 we changed the IPS Pattern to Talos.

https://community.sophos.com/kb/en-us/133197

Can you check, whether they got installed or not?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 6 years ago in reply to rfcat_vk

With V17.5 we changed the IPS Pattern to Talos.

https://community.sophos.com/kb/en-us/133197

Can you check, whether they got installed or not?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data