I've got a ticket open for this, but have no idea how much effort is being put into it. Any extra help gratefully received or our office is going to be offline for most of the weekend.
Our XG135 suddenly stopped passing almost all traffic the other day - down from an peaks of around 100Mb/s during the day to a few 100kb. The session count went up by a factor of 4 at the same time, from 1.5-2k to 8k. Nothing inside the firewall could get out, or the other way around. The XG itself was still responsive, provided you went direct to the external address, no way to route through the VPN.
I connected the SophosSSL VPN (retired in the last 6 months, but not removed) and it connected fine, but again no traffic passing through.
Eventually, I found that stopping and restarting the IPS service brought it back to life.Since then, it's been doing the same every 3-4 hours. Overnight it will do the same for hours if left until the router or the IPS service is restarted. Yesterday I watched the session count climb very slowly over half an hour , then in the space of 3 minutes shot up to 9.5k and stayed there while the traffic dropped and all our internal services were cut off.
CPU (20-50%) and memory (60%) graphs all as flat as normal, though CPU does work harder when IPS is starting up
Over the weekend, there's not going to be anyone to do this - anyone who's experienced this, or can tell me how to restart the IPS service every 2-3 hours?
This thread was automatically locked due to age.
