This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Synology NAS loses connection after IPS is enabled in LAN to WAN Rule ?

Hi,

I'm struggling to understand an issue I'm facing. It seems like my NAS is losing few functionalities once I activate IPS (lantowan_general) in my LAN to WAN rule.

I see some IP being blocked, unable to perform cloud sync, etc.. but it's not clear why ?

In general, how can I find out why the IPS is blocking/preventing some traffic from happening ?

Thanks,
N

This thread was automatically locked due to age.

Top Replies

Nabil R1 over 4 years ago in reply to Nabil R1 +1

I'm starting to think the problem has nothing to do with Sophos but rather with my NAS itself.

I'll try to investigate something down this road first before bothering you any further.

I really appreciate the time you took in following my queries. I'll get back to you quickly
Jump to answer

Parents

0 Vivek Jagad over 4 years ago

Hello Nabil R1,

Thank you for reaching out to the community, you'll be able to see the traffic getting dropped under the log viewer > drop down menu > IPS.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Vivek Jagad

Thanks,

It's empty though.

If I remove the IPS, I get the connectivity back. So it is definitely due to that.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 4 years ago in reply to Nabil R1

The default tcp timeout is 10800. You can also check with the value of 86400 instead.
This is in the context when you start noticing the invalid events, after applying IPS. Check with the values provided and see if that helps with the situation.

To check whether the change has taken place, you may enter the following cmd:
show advanced-firewall

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Vivek Jagad

This has indeed solved the issue (86400). Could you explain to me what it means ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 4 years ago in reply to Nabil R1

If a user then sends a packet, it doesn't match any connection in the conntrack table. Sophos Firewall drops the packet and logs it as an invalid traffic event. With the value of 86400 it maintains the conntrack so it takes 24 hours before it completely expires connection.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Vivek Jagad

Actually, it wasn't enough, it seems to have lost connection again.

I don't understand as well : we have 3 hours timeout, we're moving to 6 hours or to 24 hours. Still seems plenty of time ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 4 years ago in reply to Nabil R1

Just for the testing purpose, what if you bypass the firewall rule under the IPS exception:
Please follow the steps mentioned in the KBA: https://support.sophos.com/support/s/article/KB-000038900?language=en_US

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Vivek Jagad

Same thing, it didn't seem to work.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 4 years ago in reply to Nabil R1

Can you share the results of show ips-settings.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Vivek Jagad

console> show ips-settings

-------------IPS Settings-------------

ac_atp_exception_fwrules 11

stream on

lowmem off

maxsesbytes 0

maxpkts 8

enable_appsignatures on

http_response_scan_limit 65535

search_method ac-bnfa

sip_preproc enabled

sip_ignore_call_channel enabled

inspect untrusted-content

-------------IPS Instances------------

IPS is running on all cores
Cancel
Vote Up 0 Vote Down

Cancel
0 Nabil R1 over 4 years ago in reply to Nabil R1

I'm actually lost. Now after deactivating IPS globally, I still don't have connection for some of my app on my NAS.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 4 years ago in reply to Nabil R1

Can you also increase the maxpkts with the help of the following command: set ips maxpkts 100
And then check the results again.
=============================
Monitor dropped packets using CLI : https://support.sophos.com/support/s/article/KB-000036858?language=en_US

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Vivek Jagad over 4 years ago in reply to Nabil R1

Can you also increase the maxpkts with the help of the following command: set ips maxpkts 100
And then check the results again.
=============================
Monitor dropped packets using CLI : https://support.sophos.com/support/s/article/KB-000036858?language=en_US

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data