TCP Retransmission / RST, ACK - Application Freezing

Hello Carlos,

Thank you for contacting the Sophos Community!

Could you please try changing the MTU size in the IPsec tunnel for these subnets or hosts. Modify as per your network, also you don't need to add the whole subnet but have only one host.

iptables -t mangle -I POSTROUTING -s 192.168.1.0/24 -d 10.10.0.0/22 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 900;
iptables -t mangle -I POSTROUTING -s 10.10.0.0/22 -d 192.168.1.0/24 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 900;

Are both sides of the IPsec XG?

Can you confirm if all the packets are leaving the interface ipsec0?

Are you running v18 or v17?

Regards,

Hi emmosophos,

I just applyed the iptables rules and disable bypass rules, and the problem happen.

Answering your question about if the traffic pass by ipsec interface, no the traffic pass by xfrm interface, because the Ipsec Tunnel is type Tunnel mode..

And other information, In these BO peers I have a transparent interface (layer 2) connected to HO, like a Point to Point  ... even using this interface I got the same problem.

Regards

Carlos

Hello Carlos,

Thank you.

Oh, I miss read the part about the bypass make it work, then the command wouldn't make too much of a difference.

Do you see something in the Live Log, that might give us a clue?

Regards,

Hello emmosophos

Yesterday, debbuging it with more details, I could see that when the application freeze, it is generated this event (captured by drppkt)

But I believe that is a result of " TCP Reset Connections"  previous sent. You can see in this log a *R* flag .

I re enable the by pass rule as workaround for it.

DO you have any other tip ?

Best regards

Carlos

Likely a Application issue. 

Those F/R Packets are dropped because they are duplicated. So the App or the client is closing the session. 

Hi LuCar Toni

I believe that no, because with bypass rules, DNAT or access originated from same LAN there are no problem.

Regards,

Carlos

Hello Carlos,

As Luca mentioned seems like it is the application/client closing the sessions. 

I guess your next step if you want would do a pcap on the XG and then examine on Wireshark the pcap should be with and without the bypass.

https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Regards,

Hello Carlos,

As Luca mentioned seems like it is the application/client closing the sessions. 

I guess your next step if you want would do a pcap on the XG and then examine on Wireshark the pcap should be with and without the bypass.

https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Regards,

Hi emmosophos,

But it does not make sense, because these events (close sessions) happen only when the traffic is filtred by Sophos.

As I told, this does not happen when I access it by DNAT, same LAN or using bypass rules.

But I will check pcap files generated by Sophos. 

I have other similar case that it was migrated from v17 to v18 presenting a similar problem.

Regards

Carlos

There is something, the Client or the Server does not like about this connection. There could be multiple reasons for this. MTU Size, fragmentation etc. 

If the packet is not the same, the application will close the connection. And you will see such errors in drop packet capture and logviewer (because the connection will be closed multiple times, thats sometimes normal, depending on the application). 

You say, the DNAT works fine. Is the DNAT from XG (WAN to Application) ? Therefore the XG is allowing this? So the App is likely having some issues with the VPN Connection.  

Hi LuCar Toni, thanks by reply.

I appreciate the considerations.
But only new information that make me believe that this problem is related to XG

1 - The DNAT it works as expected, yes the DNAT is done by XG (WAN to Application).

2 - The problem does not happen only with VPN, the problem happen with too with routing, in same device I have two network segments LAN (192.168.0.0/24) and other LAN Zone (192.168.2.0/24) each one connected in a physical port in XG device
The same problem happen when users from LAN network 192.168.2.0/24 try access application that is running on 192.168.0.0/24
I have tested replacing the XG device by Mikrotik (only to routing) and it works
In XG device when creating bypass rules from network 192.168.0.0/24 to 192.168.2.0/24 and vice-versa it works

3 - I have other similar scneario that was running V17 firmware and it was migrated to V18 and the similar behavior is happening.

Anyway I created I pcap file to investigate.

And I saw a lot of kind of this messages

Any other tip for this!?

Best regards

Carlos

Its a MTU Size issue. Try to smaller the MTU Size of your VPN Client to 1400 or something like that and retry this. 

Hello LuCar Toni,

Even with changes the problem persists.

The problem is was fixed as suggestion of

set ips ac_atp exception fwrules <number of the firewall rule>

I have tested the same configs with (SFOS 18.0.2 MR-2) and this problem does not happen. it seem anything with (SFOS 18.0.3 MR-3).

Regards,

Carlos