This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Frequent WAF crashes over the last four weeks

I'm running 9.413-4 on a pair of Active/Passive SG330s. from 4 to 10 times per day, WAF will stop working. I know when it happens because my external web site monitors light up my phone. The only fix seems to be rebooting the active UTM. After I do that, the websites come back up.

Users inside my network don't notice because the failover is smooth. However, until I get that UTM rebooted, our hosted websites are unavailable.

I cannot correlate this to any event of any kind. The WAF logs do not show anything remarkable. There are no core dumps from WAF.

I've already got an escalated case with premier support but I'm not feeling any closer to resolution.

I didn't see anything similar to this in the forum. I'm really at the end of my rope. The WAF is as likely to crash at 4AM as it is at 4PM.

Has anyone seen anything like this before? Does anyone have any recommendations for what I could search for?

This thread was automatically locked due to age.

Parents

0 BAlfson over 8 years ago

Joe, what do you mean "it stops working?" Does the WAF log show anything when this occurs or is occurring? What about Selfmonitoring, Configuration daemon, Fallback messages, Kernel messages and System messages?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 JoeStern over 8 years ago in reply to BAlfson

Hi Bob --

WAF stops passing traffic. The WAF log stops showing any traffic. Anyone trying to reach a website behind WAF gets a timeout until I reboot the UTM.

As for the other logs, I don't recognize anything out of the ordinary around the times that the WAF stopped working. The noise I see there all follows the reboot.

- J
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 8 years ago in reply to JoeStern

This is a known bug in 9.413. I do not know of it can be avoided by turning off https inspection, but it is worth trying.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 8 years ago in reply to JoeStern

And there's nothing in the Firewall log when WAF isn't passing traffic, Joe?

Doug, do you mean doing antivirus on HTTPS traffic in the Virtual Server's Firewall Profile?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 8 years ago in reply to BAlfson

Sophos announced the proxy crash dump problem for version 9.4113 in this forum for a week or so. I have seen other posts that seem to be on the same issue.

The good news is that the below link says that there is new release of 9.4113 which fixes the problem.

Those who have already updated to 9.4113 will need help from support to do the remediation.

The fix for 9.5 is in process but not yet available.

https://community.sophos.com/kb/en-us/126041

If this is not the problem and the solution, then I misread the original question.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 DouglasFoster over 8 years ago in reply to BAlfson

Sophos announced the proxy crash dump problem for version 9.4113 in this forum for a week or so. I have seen other posts that seem to be on the same issue.

The good news is that the below link says that there is new release of 9.4113 which fixes the problem.

Those who have already updated to 9.4113 will need help from support to do the remediation.

The fix for 9.5 is in process but not yet available.

https://community.sophos.com/kb/en-us/126041

If this is not the problem and the solution, then I misread the original question.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 DouglasFoster over 8 years ago in reply to DouglasFoster

Yes, I missed that this is the WAF, not the web proxy. I would open a case with support, as it may have a connection.
Cancel
Vote Up 0 Vote Down

Cancel
0 JoeStern over 8 years ago in reply to DouglasFoster

I've started hearing from escalated support, and that I am not alone with this problem. If I learn anything in the next few days, I will add that information to this thread.
Cancel
Vote Up 0 Vote Down

Cancel