the equipment it is since December 2010. We have only "Network Security" license so we can't use the web application protection. So far we makes many changes and tests with IPS local nets and the "flood protection". The ASG works only in the 30% of the IPS and firewall throuput limits. I will try to uncheck the some IPS "attack patterns".
the equipment it is since December 2010. We have only "Network Security" license so we can't use the web application protection. So far we makes many changes and tests with IPS local nets and the "flood protection". The ASG works only in the 30% of the IPS and firewall throuput limits. I will try to uncheck the some IPS "attack patterns".
the equipment it is since December 2010. We have only "Network Security" license so we can't use the web application protection. So far we makes many changes and tests with IPS local nets and the "flood protection". The ASG works only in the 30% of the IPS and firewall throuput limits.
I will try to uncheck the some IPS "attack patterns".
Hello I.Schiniadis
If the ASG does IPS and Firewalling only on the 425, I probably have three further tweaks to try
1. Use QoS Autoshaper / Download Equalizer Feature (supported feature)
==> Activate QoS on the WAN Interface and the internal Interface where the Webserver resides
==> Check, that - especially on the WAN side - correct values for uplink and downstream are entered e.g. 50 down / 10 up or whatever you have
==> Check on both QoS Interfaces the Limit Uplink and the Download Equalizer checkbox
2. TCP Window Scaling active on ASG ? (supported feature)
As the appliance is from 2010, it's very likely, that it was set up with V7, and got upgraded over the time. As V7 had TCP Window Scaling disabled per default (started with V8), it's possible, that it's still disabled. Try once with TCP Window Scaling set to active.
3. More IPS instances (unsupported by Sophos...and only worth a try, if it' a >= 4 GB Memory equipped ASG425 Revision)
Per default your Appliance should activate a number of "CPU cores -1" snort_inline instances. You may higher the amount of them, which also may help make system more reactive. But be aware, that each IPS instance may add a few 100MByte up to ~1GB memory usage per instance. Keep Memory and Swap usage in close view ! If you actually have 3 instances, try slowly to higher the instances from 4 up to max. 8 instances (with a Quadcore CPU) - but keep the load and memory usage in view using top on the console. I guess for 50 MBit 4 Instances should be way enough...
with following command you can change the number of ips instances as root on the console, and remind, that a change may interrupt you network traffic for 1...few minutes in worst case until all instances got (re)started.
cc set ips num_instances y
where y i the number of snort instances. To reset to default behaviour set num_instances to 0
PS: Tweak #3 is activated at own risk, as it's a unsupported setting via console!
PSPS: Attention with the "flood protection", as it may lead quick to unnecessary packet drops and retransmits, which puts additional unnecessary load on the ASG and webserver.
