XG135(s) locked up using IPSEC tunnel

Question

HI All, 
 I have had 3 lock ups over the last 4 days from two different XG135's all connected via IPSEC. And the only way to resolve is to reboot the device. 
 The reason I mention IPSEC tunnels is that the only thing causing any load was over IPSEC. We are currently in lockdown and no one is onsite to generate any additional traffic. 
 the two XG135's have 5 IPSEC tunnels configured in a mesh configuration with each other and the other remote devices are 2x XG125's, 1x fortigate and 1x Untangled Firewall. 
 Its all been running fine since we implemented 6 months ago until the last few days and I suspected that it maybe a hardware issue until the second XG135 did the same thing. 
 I cant see anything in the logs. And it only seems to happen when I pumping traffic down the IPSEC tunnel. 
 Any troubleshooting hints here? Would love to get this sorted. 
 Andy

emmosophos · Answer

Hello Andy, 
 Thank you for contacting the Sophos Community. 
 If you haven't open a case with support I would recommend you to open one and share the Case ID with me. 
 Please confirm what Firmware version are you running 18.5 18.0 17.5? 
 You would need to check the following logs: 
 csc.log, applog.log, syslog.log, msync.log, and networkd.log and see if there&rsquo;s any recent core-dump under /var/cores 
 Check the Memory and CPU graph details under, you'd be looking for a gap in the graph. 
 Diagnostics >> System Graphs (Change the Live Graph to a time range that matches the last time the issue happened) 
 If this is a recurrent issue you would need also Console output (might be hard for you to get since you mentioned there is nobody in the office) 
 Note: Be sure that the computer in question does not go into Standby or Hibernate while logging. 
 Using PuTTY, go to 'Session' - 'Logging.' Here, select "All session output', and set the file name to a folder and name for later retrieval. Configure the Serial connection to use the proper COM port on your PC and a Speed of 38400. Start the session, and log in to ensure it is all proper. Once logged in, you can leave it there or log out and leave the session at the password prompt. Either way, leave the session active and allow it to capture the output from the next reboot. Once that reboot occurs, you can end the Serial connection and provide the logs to support further investigation. 
 Things you can try to mitigate this: 
 Check if Firewall acceleration is enabled, if it is disable 
 console> system firewall-acceleration show 
 To disable run: 
 console> system firewall-acceleration disable 
 Try the following command as well 
 console> set advanced-firewall tcp-selective-acknowledgement off 
 And if you are not using RED devices, but the RED service is running try to disable it from 
 System Services >> RED 
 Regards,

XG135(s) locked up using IPSEC tunnel

Top Replies