XG550 and firware 16.1 strange issues

Matteo,

are you using Sophos Heartbeat? Did you enable it on Firewall Rules? If you try to ping www.google.com or an external address (by IP), does it work?

How are the CPU and RAM utilization? How many users are behind the XG?

Did you clean the ARP table once you swapped from Fortinet to XG (because virtual mac address changed from the previous Fortigate Cluster). This is a problem that can occur if you retain the same IP address and you do not clear or check switches mac-address table.

Let us know.

Thanks

Hi, thank you for your answer. No i'm not using Heratbeat and in this moment i have no rul with IPS  ora HTTP/FTP scan because i had to many problems ad packets dropped.

But with IPS disabled i still see packets dropped for:

fw_rule_id=0 policytype=0 live_userid=0 userid=0 user_gp=0
 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0
 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 scanflags=0 gateway_offset=0
 max_session_bytes=0 drop_fix=0 ctflags=0 connid=0 masterid=0 status=0 state=0 sent_pkts=N/A recv_pkts=N/A sent_bytes=N/A recv_bytes=N/A

All rule are "=0"

CPU=2% Memory=12% so very low.

I have done the change from fortigate to sophos during the night between Monday and Tuesday, i don't have reset arp table on the switches but i have read that the arp table will be dropped avery 4 hours normally, so today is Friday... (but i will do the reset during lounch time)

I will update the Firewalls from Firmware 16.01.1 to 16.01.2 and hope that this will solve some problems but actually is really difficult to work.

We have 400 clients connected internally on different interfaces of the firewall and 350 clients connected from the internet using Citrix Netscaler.

It happens very oft that the firewall exclude from the net a client totally, so you can only ping the interface of the firewall froma that client and other clients on the same network or sometimes this client can ping other networks but not do dns requests.

Thank for your help,

Matteo

How are your clients accessing the XG? are you using the clientless setup, if so do you have enough activated addresses?

Scanning doesn't seem to affect performance from my limited experience, the IPS plays havoc with throughput. You can't fine tune the IPS by turning off false positives which can also cause problems.

In IPS you need to go to DOS attacks and disable all.

What firewall rules do you have in place?

Matteo,

your XG550 have enough HW resources to mange your environment. If you have access to switches, check the arp table or reboot the Switches. As rfcat_vk suggested, check the dos protection from command line system dos (it should be the command I am out of the office).

Thanks

Matteo,

your XG550 have enough HW resources to mange your environment. If you have access to switches, check the arp table or reboot the Switches. As rfcat_vk suggested, check the dos protection from command line system dos (it should be the command I am out of the office).

Thanks