Barry,
It was logging UDP-4500 flood for the NAT-VPN, but this is not correct since our Cisco IPS was not seeing it.
Thanks for checking. No update from Sophos
just because cisco wasn't seeing it doesn't mean it wasn't there. I've seen sophos catch things cisco and others miss., I will say yes it could be a false positive..
The "UDP-4500 flood" was a valid NAT-IPsec request from a VPN peer.
So current state as follows:
1. Global IPS enabled, the rest are disabled: TCP/UDP/ICMP DoS and Anti-Portscan disabled, Pattern disabled.
2. Threat Detection enabled.
3. Antivirus and Anti-Spyware disabled.
4. Hot-Standby
5. Several Parent Proxies connected using IPSec VPN tunnels.
6. Several Web Filter Profiles pointing to unique Parent Proxy, and block personnal emails (Gmail, Hotmail, etc.)
7. Several interfaces (Vlans/Subnets) for wired clients.
8. CPU= 2%, Memory=10%
9. Users= 5 (designed for many-many users).
Performance:
download= normal at about 50-mbps
upload= half normal about 25-mbps
The "UDP-4500 flood" was a valid NAT-IPsec request from a VPN peer.
So current state as follows: 1. Global IPS enabled, the rest are disabled: TCP/UDP/ICMP DoS and Anti-Portscan disabled, Pattern disabled. 2. Threat Detection enabled. 3. Antivirus and Anti-Spyware disabled. 4. Hot-Standby 5. Several Parent Proxies connected using IPSec VPN tunnels. 6. Several Web Filter Profiles pointing to unique Parent Proxy, and block personnal emails (Gmail, Hotmail, etc.) 7. Several interfaces (Vlans/Subnets) for wired clients. 8. CPU= 2%, Memory=10% 9. Users= 5 (designed for many-many users).
Performance: download= normal at about 50-mbps upload= half normal about 25-mbps
thanks...
if ips is on but the patterns are all disabled turn off ips as it isn't able to check for anything. In order to get ips totally off turn of portscan detection as well as the ips. Also if you have any of the dos protections turn them off. Then turn off the web filtering and application control as well and retest. Answer the hardware esxi host question first please. What is the underlying hardware for the esxi host? cpu...ram...nic...etc...you ahve either a misconfiguration or a hardware problem of some kind.
William,
Yes you are right, practically my IPS is off (only using antivirus). No DoS protection.
As for hardware, he have abundant one: mega CPU, RAM, Disk. I can assure it is not HW.
We have Vyatta performing heavier function, and the CPU is in 2%. If Vyatta has SSO username logging, we would not go for UTM. Vyatta is very stable and cheaper.
William,
Yes you are right, practically my IPS is off (only using antivirus). No DoS protection.
As for hardware, he have abundant one: mega CPU, RAM, Disk. I can assure it is not HW.
We have Vyatta performing heavier function, and the CPU is in 2%. If Vyatta has SSO username logging, we would not go for UTM. Vyatta is very stable and cheaper.
Thanks,
Audie
If this is a paid license have you contacted support(your reseller or sophos directly depending on your support package?) ips has nothing to do with a/v. mega cpu doesn't tell me anything. what cpu..how much ram..and what nics. it could very well be a hardware problem. UTM can handle what you are doing..there is either a misconfiguration or a hardware issue. If you want to keep stonewalling that's fine. We are trying to help. If you truly have your mind made up that UTm won't work there's nothing we can do for you. This is an unpaid volunteer forum. I normally charge for doing this work however on this forum many of us who make our livelihoods doing this give this advice away.
Why don't you go back to 9.305. That is your fastest solution. It is very easy.
Break the HA. Leave one of the utm's or vm's running so it can continue to be used. Reinstall the other device to 9.305 and restore a backup. Shutdown other machine and bring 9.305 back up and than do same thing on other device and than add it back to cluster adn it should resync config. You should have minimal downtime this way.
Finally Sophos engineer called, and recommended the workaround:
1. Under IPS ==> Exception
a. Skip= "UDP Flood Protection"
b. Coming from the Sources: Add remote VPN Peers IP's.
The UDP DoS filter was seeing IPSec NAT UDP-4500 as flood.
Finally Sophos engineer called, and recommended the workaround:
1. Under IPS ==> Exception
a. Skip= "UDP Flood Protection"
b. Coming from the Sources: Add remote VPN Peers IP's.
The UDP DoS filter was seeing IPSec NAT UDP-4500 as flood.
