This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG 330 Dropping Connection

Hi,

Last week we've been hit by BOTNET now we are rolling up some of the PC in our environment since it is windows 7.

Now we've notice that our Internet connection sometimes drop and also the ping to our branches which is connected via RED50 is also dropping.

Our CPU and Memory utilization is also high as indicated in the screenshot.

XG330

RED 50 - 20 Connections

Thanks,

Nidz

This thread was automatically locked due to age.

0 Alexander Brinck1 over 4 years ago

Dear Nidz,

could you please connect via SSH to the advanced shell and type the following command:

top

Please share a screenshot of the process list.

Kind regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Nidzpar Mohammad Sali1 over 4 years ago in reply to Alexander Brinck1

Hi Alexander,

Here's the screenshot of the top command.

Thanks,

Nidz
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Brinck1 over 4 years ago in reply to Nidzpar Mohammad Sali1

You can see that snort is running in the top processes, so there might be a misconfiguration of ips rules.

Are you using the LAN to WAN default IPS templates?
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Brinck1 over 4 years ago in reply to Nidzpar Mohammad Sali1

Which tunnel mode are the REDs running?

Are they running in standard/unified mode?

Please also share a screenshot of the firewall ruleset.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Nidzpar Mohammad Sali1

Hi Nidzpar Mohammad Sali1,

Could you please check the IPS logs from the log viewer and provide the screenshot?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Nidzpar Mohammad Sali1 over 4 years ago in reply to Alexander Brinck1

Hi Alexander,

Mostly i enable LAN2WAN IPS for traffic going to WAN.

Thanks,

Nidz
Cancel
Vote Up 0 Vote Down

Cancel
0 Nidzpar Mohammad Sali1 over 4 years ago in reply to Alexander Brinck1

Hi Alexander,

For the RED50 yes im using standard/unified for except 1 which is standard/split.

Thanks,

Nidz
Cancel
Vote Up 0 Vote Down

Cancel
0 Nidzpar Mohammad Sali1 over 4 years ago in reply to FormerMember

Hi H_Patel,

Mostly im seeing this.

Thanks,

Nidz
Cancel
Vote Up 0 Vote Down

Cancel