Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 27 subscribers
  • Views 1894 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Internet connection dropping

Ben Reeve

Hi all,

We're having an issue with seemingly random users losing their internet connection for a couple of minutes throughout the day since replacing our Juniper SSG5 with a Sophos XG 135. I'll try to post what I think are the salient points but please let me know if there's other info that would be helpful to see Slight smile

  • We're running software version SFOS 18.0.1 MR-1-Build396
  • It doesn't affect the whole company at the same time
  • It doesn't affect all of our users
  • This happened before and after we started using the Sophos web filtering service
  • The hardware graphs don't seem to show anything like the CPU or RAM etc getting maxed out
  • Our VOIP phones continue to work, they're connected to a different NIC on the firewall from our LAN traffic but use the same fibre connection
  • I haven't really been able to find a pattern of what the users are doing to cause this
  • A continuous ping to a website persists through the loss of internet connection but a ping to a different website fails (this works once the connection is back up again)
  • It feels like any new connections are being dropped for the duration of the 2 or 3 minutes
  • Internal traffic continues to work absolutely fine

While I know I haven't gone into lots of detail I won't add more at this stage in case there's a known fix and I've just muddied the waters.

Thank you in advance for any help and advice of how to resolve this.

All the best,

Ben.



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to the Community! 

    Did you configure STAS? If yes, what is the configured value for identity probe time-out? 

    Did you configure web proxy or DPI? 

    Thanks,

  • 0 in reply to FormerMember

    Hiya,

    Yep we have STAS configured though I can't see any metion of an Identity probe time out, could it be called something else?

    Many thanks,

    Ben.

  • FormerMember
    0 FormerMember in reply to Ben Reeve

    Hi ,

    You could find it at Authentication > STAS on your XG firewall. 

    When the user reports this issue, did you see any dropped packets on the firewall form that users workstation? 

    Thanks,

  • 0 in reply to FormerMember

    Ah I see it now. So it's set to 120 seconds, Restrict client traffic during identity probe is set to yes and Enable user inactivity is set to off. I haven't noticed any dropped packets, however I will look for that the next time it happens. Also we see quite a lot of the following in the firewall logs but I don't know if it's related at all -

    2020-09-23 16:08:00
    Invalid Traffic
    Denied
    N/A
    0
    192.168.20.1
    40.77.18.167
    63140
    443
    TCP
    0
    01001
    Open PCAP
    Could not associate packet to any connection

Reply
  • 0 in reply to FormerMember

    Ah I see it now. So it's set to 120 seconds, Restrict client traffic during identity probe is set to yes and Enable user inactivity is set to off. I haven't noticed any dropped packets, however I will look for that the next time it happens. Also we see quite a lot of the following in the firewall logs but I don't know if it's related at all -

    2020-09-23 16:08:00
    Invalid Traffic
    Denied
    N/A
    0
    192.168.20.1
    40.77.18.167
    63140
    443
    TCP
    0
    01001
    Open PCAP
    Could not associate packet to any connection

Children
No Data