This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS/SSL engine: performance degradation before stopping traffic

Sophos XG 125 rev2 MR1 Build 396.

After 1 day, Internet browsing slows down dramatically.

At the beginning of second day, stops to work. Lan doesn't have Internet. I need to reboot firewall to fix the issue.

Some samples of IPS LGG

09:15:04 :27910]:transmit_pkts_for_session:[S:623.53369] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:15:35 :27909]:transmit_pkts_for_session:[S:3229.2829] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:16:07 :27909]:transmit_pkts_for_session:[S:2888.27553] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:16:39 :27910]:transmit_pkts_for_session:[S:2784.11583] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:17:08 :27909]:transmit_pkts_for_session:[S:490.30654] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:17:40 :27910]:transmit_pkts_for_session:[S:2702.38267] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort
[Jun 13 09:18:11 :27909]:transmit_pkts_for_session:[S:620.53399] Max retransmit limit hit, pkt len 1286, dir 0, eof 0. Sending notification to Snort

1592243058.569570424 [19496/0x0] [nsg_nse_policy.c:1330:__nsg_error] xxx.xxx.xxx.xxx:62421 to xxx.xxx.xxx.xxx:443: Error from nse: NSE:Handshake [0xba00025a;code:90;sub:2]ed EC type
1592243058.622515552 [19495/0x0] [nsg_nse_policy.c:1330:__nsg_error] xxx.xxx.xxx.xxx:62422 to xxx.xxx.xxx.xxx:443: Error from nse: NSE:Handshake [0xba00025a;code:90;sub:2]ed EC type
1592243129.579430870 [19496/0x0] [nsg_nse_policy.c:1330:__nsg_error] xxx.xxx.xxx.xxx:62465 to xxx.xxx.xxx.xxx:443: Error from nse: NSE:Handshake [0xba00025a;code:90;sub:2]ed EC type

Thanks in advance.

Best regards

Walter



This thread was automatically locked due to age.
Parents Reply Children