We have an issue with an XG-125 running MR3. Every time it does an ATP or IPS update, it blocks all traffic for two minutes.
Any suggestions would be welcome, I have opened a tech support case (03253973) with 'High' priority five days ago but haven't had a single response yet.
Hi JasP,
After a talk with the support, I've found out anything that makes the IPS (Snort) service restarts will make your firewall drop packets.
Well, I've been facing a issue where creating a custom IPS signature, Snort would restart bringing a lot of packets down with it, after a while I've saw the same thing happens over IPS/ATP updates. This issue is a lot more noticeable on low-end CPUs since It takes a while to restart Snort.
In v17.5 It would primarily drop only the traffic that had IPS within a policy, now on v18 It's even worse because if your doing TLS Decryption half of the decrypted traffic gets dropped and you have to refresh the entire page over the browser.
The answer by them has - some traffic will get dropped while restarting Snort, so they will add this information at the Docs.
Thanks!
