Massive "invalid traffic/invalid tcp state" with 19.5 and HA

Hi Christian,

Thank you for reaching out to Sophos Community.

For reference with regard to  Invalid Traffic, kindly see Recommended Read below. 

soph.so/SophosFirewall_InvalidTraffic

I know this document. But it does not explain that the issue disappears when one node is shut down.

The first system with the issue was seperating several LAN-Segments and after update to 19.5 the clients lost the connection to several servers. Only after disabling stateful inspection on the cli for the internal LANs the problem diappeared. Thats cause the sophos support always pointing to asymmetric routing, which was not the cause for the problem. The routing is simple and tcpdump shows only the 2 IPs and MACs when a client communicate to his server.

Now i got another ha-system (still non-productiv) with this issue and have the opportunity to do some testing with.

I see 20-40 invalid tcp state per second on a system without any traffic for routing, only normal system traffic from the firewall itself.

Something must be wrong with conntrack after going to ha mode.

Hi Christian,

Would it be possible to share the case #

06001957 / XGS 4300 High rate of "invalid traffic" since update to 19.5

06146033 / Strange Routing and invalid traffic on XGS4300

and now:

06201660 / Massive "invalid traffic/invalid tcp state" with 19.5 and HA

Hi Christian,

Thank you for sharing this, will further check and update you.

Hello Christian,

Would it be possible to share appliance access id over PM with me for both the HA setups?

Is 2nd HA pair still facing "invalid traffic" issue?

Hi Sanket,

Upon checking case 06201660

I'll DM you the case ID.

Hi Christian,

Would it be possible it inquire the following

1.Are there any traffic being hampered?
2.Can you share the Access ID also for the other setup that was fixed by disabling HA( you can DM it to Sanket or me)

"Now i tried dissolve HA and reimage the auxillary with 19.0MR1, update to 19.5GA and reestablish HA. This seems to help."

This will help us to see any differences that can be found between working and non-working scenario.

Hi Christian,

Would it be possible it inquire the following

1.Are there any traffic being hampered?
2.Can you share the Access ID also for the other setup that was fixed by disabling HA( you can DM it to Sanket or me)

"Now i tried dissolve HA and reimage the auxillary with 19.0MR1, update to 19.5GA and reestablish HA. This seems to help."

This will help us to see any differences that can be found between working and non-working scenario.