This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is this normal for 300 users,

This is in a report for one day, I wonder is this amount normal or quiet a lot?
If total connections is above 1200 it's impossible to open webmail......
everyting else works ssl vpn,normail ipsec vpn, surfing.....
Very strange..... a reboot doesn't help. Changing mtu to 1400 everything works again????? And problem is gone again. The thing is i don't know how are what is causing the problem. Normal traffice for a week is about 80gb. Didn't have a lot of problems except strange problems and to go away also. The updates drive me crazy.

This thread was automatically locked due to age.

0 BarryG over 17 years ago

I think 1200 connections is over the limit on the free license.

Your users are probably running P2P apps.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 RFCat_vk_01 over 17 years ago in reply to BarryG

Hi,
what level of ASG licence are you running?

Ian M
Cancel
Vote Up 0 Vote Down

Cancel
0 ibeheer over 17 years ago in reply to RFCat_vk_01

It's not free @ all. Level is gold. max con: 512000
Is't for business no p2p no skype no drugs, no *** etc.
Using:

ipsec vpn
ssl vpn
http proxy
nat/dnat
webmail
smtp proxy
dns
active directory
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 17 years ago in reply to ibeheer

turn on the im and p2p blocking and see if that helps things. something is overloading he firewall and the common culprit is p2p and im transfers. Also what are your firewall's specs? you may not have enough hardware to handle things.
Cancel
Vote Up 0 Vote Down

Cancel
0 ibeheer over 17 years ago in reply to William Warren

standard everything is block. only skype can't block but needs alert?!?!?!?
hardware is hp ml350 with 4gb ram + raid 5 300GB (sas).
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 17 years ago in reply to ibeheer

What is the cpu spec? Also can you give a screenshot of the main system panel when it's acting up?

also log into the shell as loginuser and run top. hit the 1 key to show all the cpus and then take a screenshot of that as well.
Cancel
Vote Up 0 Vote Down

Cancel
0 ibeheer over 17 years ago in reply to William Warren

Thanks for your response william. A top takes longer.... ssh is not enabled.
Screenshot webinterface no problem. Is it much traffic are just normal?
Cancel
Vote Up 0 Vote Down

Cancel
0 gkemter over 17 years ago in reply to ibeheer

your paketfilter drops 103.358 Packets.
What is the reason for this high value ?

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Cancel
0 ibeheer over 17 years ago in reply to gkemter

2008:03:28-(none) ulogd[2880]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="2" initf="eth1" dstmac="" srcmac="" srcip="" dstip="" proto="17" length="78" tos="0x00" prec="0x00" ttl="64" srcport="137" dstport="137"
2008:03:28-13:10:12 (none) ulogd[2880]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="3" initf="eth1" dstmac="" srcmac="" srcip="172.16.0.40" dstip="" proto="17" length="229" tos="0x00" prec="0x00" ttl="128" srcport="138" dstport="138"

Idea is to drop most traffic so traffic for 137/138 is high so created a rule in top 2/3 to drop the traffic. Hoping the firewall will not process the traffic any further.
Cancel
Vote Up 0 Vote Down

Cancel
0 gkemter over 17 years ago in reply to ibeheer

137/138 comes from internal lan, but this dont need to go "outside".
Cancel
Vote Up 0 Vote Down

Cancel