XG reboot and change in HA Status

Question

Dear Comminity, 
 
 I've a customer with an HA pair of XG135 with SFOS 18.0.5 MR-5-Build586. They are facing random reboot of the appliance that force a change HA status. 
 During this reboot they 5/10 minutes of disconnectoin. 
 I've open a sophos case 04435878 in order to investigate and support replay that this problem is caused by the automatic pattern updates feature and it's a known behavior and the only mitigation solutions are stop automatically update or schedule it every 24 hours. 
 Also they say that the last SFOS 18.5.1 MR1-Build326 don't solve this problem. 
 
 Is everyone facing the same problem? 
 There are any action or bug open by sophos in order to solve this? 
 Is there any KB that describe this known behavior? 
 
 Thank you

LuCar Toni · Answer

Just to recap this: It is known, the IPS/ATP installation can cause a dropping of the connections on smaller appliances for a short time period. Most likely this drop is not noticed, as TCP stack will simply retransmitted. 
 It should not cause any harm to the HA nor to the status of the HA. This is not known nor reported, as far as i know.

emmosophos · Answer

Hello Ste, 
 Thank you for contacting the Sophos Community. 
 I have escalated this case internally to the Manager of the engineer, to have this investigated accordingly, let me know if you don't hear from support in the next 24 hours. 
 The issue with the IPS/ATP updated is caused by the restart of the IPS process, which will drop internet momentarily while this happens. 
 This specific behavior of not having to restart the IPS module is targeted to be fixed on version 19. (NC-71039) 
 This issue is noticeable in the lower-end devices, but this shouldn't cause a reboot of the HA, if it&rsquo;s then it needs to be investigated but I don't think this is your case. 
 Regards,