Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 27 subscribers
  • Views 5568 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Large number of interface overruns causing VOIP issues

Sammore

Hello there, I've recently been experiencing an issue where calls on our VOIP system seem to "pause" for a few seconds(you cannot hear or speak to the other person on the phone). This is not a port/firewall issue I believe, nothing is being blocked and I see no errors or dropped traffic in the logs. Our outgoing rule and incoming ports have AV scanning disabled, IPS/Web Filter/Application control/TSP disabled.

 

Our setup/configuration worked without issue for the better part of a year on XG v15 and XG v16 beta + v16.01.0 this issue started sometime(weeks) after I upgraded to 16.01.1 and has persisted through 16.01.02 and still now in 16.05.0

I've disabled anything and everything I thought could be the issue but unfortunately it still persists. I've disabled ATP/IPS/DOS Attacks/Web filtering/there is no active VPN connections/no application filtering/no scheduled reporting etc.

I have confirmed the issue is the sophos, I've replaced the sophos with a configured sonicwall and fortinet device I have no VOIP issues, our ISPs have been out and shot our fiber to verify there was nothing wrong, they've also replaced our fiber modem. I've reloaded our XG125 and reconfigured it, I have also replaced it with another unit to no avail. I have multiple clients that are having a similar issue, they all have a sophos firewall (105 or 125) and all are using 3cx for their VOIP server.

The only thing I've found is that all of the affected firewalls have a large number of interface Overruns, I've played with MTU(increasing and decreasing) but it hasn't helped.

eth7 Zonetype:LAN MAC Address:removed MTU:1500
IPv4 Addr(s): removed/24 Bcast:removed
IPv6 Addr(s): removed/64 (link-local)
Speed:1000Mb/s Full Duplex Auto Negotiation:yes
UP BROADCAST RUNNING MULTICAST
RX State: packets:955493470 bytes:1192777331525 (1.0 TiB)
errors:0 dropped:101233 overruns:14220905429 frame:0
TX State: packets:364545112 bytes:224629569022 (209.2 GiB)
errors:0 dropped:0 overruns:0 carrier:0

Mine in house seems to have these overruns on the internal LAN, I've already replaced the cabling and the switch. Some of my affected clients have these overruns on one of their WAN interfaces.

Thanks for the help, I wanted to take a shot and see if there is anything that anyone can think of for a solution before I log a ticket with support, I haven't had much time recently to devote to this. I plan on submitting a case next week.

 

Regards,

 

EDIT: In case someone finds this thread by searching, there was an IPS bug that was fixed in 16.05.3 which resolved my issues.



This thread was automatically locked due to age.
Parents
  • 0

    You definitely have done a lot of troubleshooting on this issue. The overruns are definitely disconcerting.  Only two things I can think of to suggest to you, though given your thoroughness, you have likely already addressed these issues:

    1)  Try stopping IPS completely in Services

    2)  Make sure to turn off the SIP helper:

    to check:

    console> system system_modules show

    to disable:

    console> system system_modules sip unload

  • 0 in reply to Greg CT

    Thanks for the reply, I did try manually disabling the IPS services when I first started troubleshooting, I just checked though and it is currently running on our in-office XG125. Likely happened one of the times we rebooted or reloaded the appliance. SIP helper is disabled during our initial setup when we have VOIP phones. I have recently(last week) verified that the SIP helper was still disabled. I had the idea that maybe it got re-enabled somehow during an upgrade, but I found that this was not the case.

     

    I'll go ahead and try disabling the IPS service again through out the rest of my testing. Thanks again for the reply, I welcome any ideas and/or things to try.

     

    Regards,

  • 0 in reply to Sammore

    Hi,

    Check #4.3 in my guide here. Any help?

    Thanks

Reply Children