I have a problem with my Sophos UTM that I haven't been able to figure out.
It is losing internet connectivity on a highly regular basis, sometimes for just 10 seconds, other times for up to 2 minutes.
I have tried the following:
- reset everything to default and start over fresh
- use a different ethernet port as my WAN port
- changed the WAN ethernet cable
None of the above fixed my problem.
My setup is this:
Internet -> cable modem (this device has the actual external IP address) -> Sophos UTM -> Netgear switch.
Between the cable modem and the UTM is a private network, there are no other devices connected directly to the cable modem. Of course, this private network is a different subnet than the private network on the LAN side of the UTM.
I found that I could keep pinging 8.8.8.8 from a wireless device (temporarily) connected to the cable modem's wifi when one the connectivity problems occurred, so the cable modem itself is not the problem. Without the UTM in the middle, connectivity remains stable.
Output of the version command:
Current software version...: 9.315002
Hardware type..............: 320C
Serial number..............: A1303A39******x
Installation image.........: 9.314-13.1
Installation type..........: ssi
Installed pattern version..: 86769
Downloaded pattern version.: 86769
Up2Dates applied...........: 1 (see below)
sys-9.314-9.315-13.2.1.tgz (Aug 7 03:00)
Up2Dates available.........: 0
Factory resets.............: 2
Timewarps detected.........: 1
It is an older Astaro Security Gateway 320, not one of the more handsome white Sophos appliances.
I'm using a home license and I deleted 1 line from the /etc/asg file to allow the installation of this license.
Other than that, I never changed anything from the command line.
Is there anyone who can help me figure this out and fix it?
Here are some entries from some logs that indicate there is no connectivity:
/var/log/mdw.log:
2015:08:28-12:33:05 myutm middleware[4160]: [WARN-032] Internet uplink is down
2015:08:28-12:33:30 myutm middleware[4160]: T modules::ipset:[:D]eleteUnused:320() => auto#=8/682 confd#=1/341
2015:08:28-12:33:30 myutm middleware[4160]: T main::top-level:264() => ending cycle 1480, caught 4 signals, 1 children still running
2015:08:28-12:33:30 myutm middleware[4160]: T main::top-level:213() => starting cycle 1481, caught 4 signals
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::Changed:194() => configversion=1446
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::Changed:204() => nodes=0 objects=4 triggers=0
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::load:347() => modules=16,53
2015:08:28-12:33:31 myutm middleware[4160]: T modules::up2date::load:108() => amazon_deployment_type=
2015:08:28-12:33:31 myutm middleware[4160]: [WARN-033] Internet uplink is up again
/var/log/confd.log:
2015:08:28-12:33:04 myutm confd[7023]: I main::top-level:677() => id="310a" severity="info" sys="System" sub="confd" name="object changed" class="interface" type="ethernet" ref="REF_IntEthExternaWan" objname="External (WAN)" user="system" srcip="127.0.0.1" sid="RKCXbaOgWLXttTikFuum" facility="system" client="service_monitor" pid="15213" attr_link="0" oldattr_link="1"
/var/log/mdw-debug.log
2015:08:28-12:33:05 myutm middleware[4160]: [WARN-032] Internet uplink is down
2015:08:28-12:33:05 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/lsmod
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => service_monitor.obj (interfaces.obj,uplink->condition.conf,uplink->
primary.conf)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(loadbalance)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => packetfilter.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_objects_using_object(REF_PacPac16553FromAny2)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_objects_using_object(REF_PacPac16553FromAny3)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_objects_using_object(REF_PacPac16553FromAny4)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_objects_using_object(REF_PacPacSshFromAnyTo)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => spoofing_protection.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => afc.adapter.obj (ipsec.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => qos.adapter.obj (qos.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => dhcp_client.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => dhcp_server.adapter.obj (dhcp_server.obj,interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => dhcp_relay.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => http.adapter.obj (http.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/lsmod
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => uplink.adapter.obj (uplink.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => icmp.adapter.obj (interfaces.obj,uplink->condition.conf,uplink->pri
mary.conf)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => icmp6.adapter.obj (dhcp_server.obj,interfaces.obj,uplink->condition
.conf,uplink->primary.conf)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => ipsec.adapter.obj (ipsec.obj,bridging.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/lsmod
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => nat.adapter.obj (masq->rules.conf)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => pptp.adapter.obj (pptp.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => pptpc.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => ipv6_six2four.adapter.obj (ipv6_six2four.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => up2date.adapter.obj (up2date.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => ips.adapter.obj (interfaces.obj,http.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(ips)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(WirelessSecurity)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(throttle_ips)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => dyndns.adapter.obj (dyndns.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => policyrouting.adapter.obj (policy_routes.obj,interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => dynamic_routing.adapter.obj (dynamic_routing.obj,interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => psd.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => generic_proxy.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(generic_proxy)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => geoip.adapter.obj (up2date.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => service_monitor.adapter.obj (uplink->condition.conf,uplink->primary
.conf)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => pppoe.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => xorp.adapter.obj (xorp.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => tproxy.adapter.obj (bridging.obj,http.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => bridge.adapter.obj (bridging.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => clientless_vpn.adapter.obj (ipsec.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D core::Config::load:355() => interfaces.adapter.obj (interfaces.obj)
2015:08:28-12:33:05 myutm middleware[4160]: D utils::Exec::SystemCall:99() => /usr/local/bin/ct -D -p udp --state NOT_SEEN_REPLY
2015:08:28-12:33:30 myutm middleware[4160]: D utils::Exec::ForkingSystem:173() => CHILD 1 FORK 15332 /usr/local/bin/ipt_clear_confirmed.sh
2015:08:28-12:33:30 myutm middleware[4160]: T modules::ipset:[:D]eleteUnused:320() => auto#=8/682 confd#=1/341
2015:08:28-12:33:30 myutm middleware[4160]: T main::top-level:264() => ending cycle 1480, caught 4 signals, 1 children still running
2015:08:28-12:33:30 myutm middleware[4160]: T main::top-level:213() => starting cycle 1481, caught 4 signals
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::Changed:194() => configversion=1446
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::Changed:204() => nodes=0 objects=4 triggers=0
2015:08:28-12:33:30 myutm middleware[4160]: T core::Config::load:347() => modules=16,53
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => bridging.obj (interfaces.obj)
2015:08:28-12:33:30 myutm middleware[4160]: D utils::Exec::System:121() => /usr/sbin/ebtables -t filter -L
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => interfaces.obj (uplink->condition.conf,interfaces->interfaces.conf,
uplink->primary.conf)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(multipath)
2015:08:28-12:33:30 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/ip link show dev eth0
2015:08:28-12:33:30 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/ip link show dev eth1
2015:08:28-12:33:30 myutm middleware[4160]: D utils::Exec::System:121() => /sbin/ip -o -f inet route show table 254 exact 0.0.0.0/0
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => networks.obj (network->dns_host->address.cobj,network->dns_host->re
solved.cobj)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => dynamic_routing.obj (interfaces.obj)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => routes.obj (interfaces.obj)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => policy_routes.obj (interfaces.obj)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(routes_policy)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::load:355() => dns.obj (interfaces.obj)
2015:08:28-12:33:30 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(dns_route)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => user_authentication.obj (remote_access->l2tp.conf)
2015:08:28-12:33:31 myutm middleware[4160]: Local authenticated user SophosUTMSupport is disabled
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(auth_backend)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(portal)
2015:08:28-12:33:31 myutm middleware[4160]: portal enabled, allow_any on
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(ssl_vpn)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(ipsec)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(http)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(smtp_all)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => ipsec.obj (remote_access->l2tp.conf,interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(roadwarrior_cisco)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => settings.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => ipv6_six2four.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => pptp.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => http.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(http_profile)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_static_data(ca,certdata.ph)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_license_info()
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => dhcp_server.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => up2date.obj (http.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(up2date-download)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => get_amazon_deployment_type()
2015:08:28-12:33:31 myutm middleware[4160]: T modules::up2date::load:108() => amazon_deployment_type=
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(up2date-pattern)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(clientless_vpn)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => qos.obj (qos->interfaces.conf,interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(throttle_net)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(throttle_uplink)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(throttle_vpn)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(throttle_av)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => executive_report.obj (remote_access->l2tp.conf,http.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::ConfdCall:532() => may(exec_report)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => dyndns.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => xorp.obj (interfaces.obj)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => mobile_control.obj (remote_access->l2tp.conf)
2015:08:28-12:33:31 myutm middleware[4160]: D core::Config::load:355() => uplink.obj (dns.obj,ipsec.obj,uplink->condition.conf,uplink->primar
y.conf)
2015:08:28-12:33:31 myutm middleware[4160]: [WARN-033] Internet uplink is up again
Need more information? I will be happy to provide!
Thanks for reading,
A long-time fan of the Astaro/Sophos home license program.
(a.k.a. Bob)
This thread was automatically locked due to age.
