Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 13 replies
  • Subscribers 30 subscribers
  • Views 3811 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG Slow Upload Speeds with IPS Enabled. Download Speeds are ok.

CMC

System

Sophos home license on an XG 125. Running latest firmware. 

Issue

This is kind of interesting. I recently upgraded to gigabit internet. When the LAN to WAN firewall rule is enabled with nothing other than logging, my downloads are around 925Mbps+- and my Uploads are around 900Mbps+-. Solid results. Run in Safe Mode just to ensure local software isn't causing any problems. 

If I enable IPS however, the upload speed drops to about 155Mbps on the dot each time. Hold on though, there's more to this.

In an attempt to try and track down what signature was causing the slow down, I created a new "LAN to WAN" rule set. Except I left it empty, no signature in place at all. The same issue still persists. How can that be?

To Recap Settings:

  • IPS Policy with no signatures enabled/active
  • No custom IPS signatures
  • DoS & Spoof Protection disabled
  • IPS enabled on Lan to Wan firewall rule 
  • Download = Normal 
  • Upload = Significantly reduced

The reduced upload speed is curiously consistent (150Mbps). It's almost as if IPS is triggering a QOS Rule. I mean I doubt it, but that's what it seems like. 

Thoughts on this issue?



This thread was automatically locked due to age.
  • 0 in reply to LuCar Toni

    Woah, that made quite the difference. The upload speeds have gone from 150Mbps average (250 at it's highest scan) to about 550-600Mbps average. And that's with the default LAN to WAN rule which has hundreds of signatures not applicable to my network. 

    If you don't mind, a few questions: 

    1. What method was in use before and what, if any downsides should be noted with this new method. 

    2. Why do the amount of signatures not seem to affect the upload / CPU performance? Running both the default LAN to WAN and my custom LAN to WAN with no signatures results in the same upload speeds and CPU usage. 

  • 0 in reply to CMC

    If you start Snort (IPS) it will generally speaking forward the traffic to the engine, which will decrease the performance, even without pattern enabled. More pattern will further decrease the performance.

    Appliances and Azure etc. have hyperscan per default. Software installations have ac as default. 

  • 0 in reply to LuCar Toni

    Thanks, I really appreciate you taking the time to help.