This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9.705-3 Intrusion Prevention

Hello,

I appear to be having some trouble with the Intrusion Prevention on my UTM. When I have Intrusion Prevention enabled, my network speeds are reduced dramatically. For example, my WAN connection; with and without Intrusion Prevention enabled:

Enabled - Download: 98Mbps
Disabled - Download: 206Mbps

I have tried changing various settings within Intrusion Prevention (whilst still having it enabled), but this made no improvement in the network speed. I had a look in the live-log whilst trying a speedtest and I had a large amount of this entry:

S5: Session exceeded configured max bytes to queue 1048576 using 1053000 bytes (client queue).

I tried doing some searches online for this but I can't seem to find anything other than it's nothing to worry about... but I'm pretty sure this is telling me what the problem is? Is it possible to increase the max bytes to queue? I'm currently using only 35% of 8GB RAM on this box.

Cheers,
Richard

This thread was automatically locked due to age.

Top Replies

davery23 over 4 years ago +1

I've always assumed that the snort single instance was the crux of the speed test always capping at <=100Mbps problem. I upgraded to 9.705-3 this morning and decided to search to see if I could find…

Parents

0 davery23 over 4 years ago

I've always assumed that the snort single instance was the crux of the speed test always capping at <=100Mbps problem.

I upgraded to 9.705-3 this morning and decided to search to see if I could find problems anyone else was reporting so I could be aware in case I experienced similar issues, and saw this thread.

In the past I've found some things Bob has mentioned about settings that helped tune IPS but I never got over 100Mb (like 105 would be the highest burst I would see)

Today I decided to spend some time playing with settings and I found an odd anomaly.
****disclaimer I'm not an expert at Sophos UTM, I've been using since Astaro 'in 2007ish I think', but follow the recommendations of support, and then defer to Bob, be ready to assume your own risks****

Prior to 9.705-3, I had already set my num_instances to 7 for my 8 cpu VM: (default = 0 which is supposed to be n-1)

cc set ips num_instances 7

Prior to 9.705-3, I had already adjusted my queue_length:

cc set ips queue_length 16384

Today I decided to play with max_queued_bytes and immediately saw the speed increase:

cc set ips snortsettings max_queued_bytes 2097152

The anomaly was when I changed my max_queued_bytes back to 0 I'm still getting 220+Mbps. I've rebooted the UTM to be sure it wasn't a fluke, and I'm seeing similar S5 logs for max bytes:

2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Session exceeded configured max bytes to queue 1048576 using 1050867 bytes (client queue). 192.168.0.10 54928 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0x4e007

2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Pruned session from cache that was using 1060929 bytes (stale/timeout). 192.168.0.10 54446 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0xe007

So I can't explain why now after being back to max_queued_bytes 0 I'm not seeing the same results as before, I'm not seeing any abnormal spikes in memory or cpu on my vsphere realtime charts.

****I am not advocating you do this****

****change settings at own risk****

****this reply is only to share my experience****
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 davery23 over 4 years ago

I've always assumed that the snort single instance was the crux of the speed test always capping at <=100Mbps problem.

I upgraded to 9.705-3 this morning and decided to search to see if I could find problems anyone else was reporting so I could be aware in case I experienced similar issues, and saw this thread.

In the past I've found some things Bob has mentioned about settings that helped tune IPS but I never got over 100Mb (like 105 would be the highest burst I would see)

Today I decided to spend some time playing with settings and I found an odd anomaly.
****disclaimer I'm not an expert at Sophos UTM, I've been using since Astaro 'in 2007ish I think', but follow the recommendations of support, and then defer to Bob, be ready to assume your own risks****

Prior to 9.705-3, I had already set my num_instances to 7 for my 8 cpu VM: (default = 0 which is supposed to be n-1)

cc set ips num_instances 7

Prior to 9.705-3, I had already adjusted my queue_length:

cc set ips queue_length 16384

Today I decided to play with max_queued_bytes and immediately saw the speed increase:

cc set ips snortsettings max_queued_bytes 2097152

The anomaly was when I changed my max_queued_bytes back to 0 I'm still getting 220+Mbps. I've rebooted the UTM to be sure it wasn't a fluke, and I'm seeing similar S5 logs for max bytes:

2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Session exceeded configured max bytes to queue 1048576 using 1050867 bytes (client queue). 192.168.0.10 54928 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0x4e007

2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Pruned session from cache that was using 1060929 bytes (stale/timeout). 192.168.0.10 54446 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0xe007

So I can't explain why now after being back to max_queued_bytes 0 I'm not seeing the same results as before, I'm not seeing any abnormal spikes in memory or cpu on my vsphere realtime charts.

****I am not advocating you do this****

****change settings at own risk****

****this reply is only to share my experience****
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 BAlfson over 4 years ago in reply to davery23

EDIT: 2020-10-06 Instead of using the link I provide here, use the one below found by Amodin and davery23.

Excellent find, Dave! I think the best thread here for such optimizations is Sascha Paris' old ASG Tweaking thread.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Amodin over 4 years ago in reply to BAlfson

Bob, I wen to that ASG tweak link and page isn't found. ;)

I'd like to start tweaking mine, as my UTM seems to be having the same thing on this release, and I've SSH'd into my UTM maybe twice ever.

I found this one, but wasn't sure if that was the same one you were trying to link.

link
[edited by: Amodin at 2:14 PM (GMT -7) on 6 Oct 2020]
Cancel
Vote Up +1 Vote Down

Cancel
0 davery23 over 4 years ago in reply to Amodin

found this one:

community.sophos.com/.../utm-tweaking-guide-2-0
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 4 years ago in reply to Amodin

Thanks, old friend, I fixed the broken link in my post above. I think the one you and Dave found is the newer version, so I'll edit the old one for Sascha and point users to the newer version.

Cheers - Bob
Cancel
Vote Up +1 Vote Down

Cancel
0 Amodin over 4 years ago in reply to BAlfson

Thanks, the 2.0 guide does need some tweaking of its own - I was just reading the TCP scaling, and where it points to adjust it is even out of date, lol. Some of it could also be a bit more specific.
Cancel
Vote Up 0 Vote Down

Cancel
0 RichardHughes1 over 4 years ago in reply to Amodin

Still having great trouble with IPS. Simply having it enabled with everything within disabled, is still crippling the connection to the Internet. I did a speedtest on two different machines, each connected to different VLAN's. Only one of those VLAN's was included in the IPS config. Here are the results:

Machine on VLAN which is included in IPS:

Download: 120Mbps
Upload: 21Mbps

Machine on VLAN which is not included in IPS:

Download: 185Mbps
Upload: 20Mbps

Both machines were tested twice and one after the other. Both tests used the same Speedtest.net server.

Cheers,
Richard
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 4 years ago in reply to RichardHughes1

I just scanned this thread, Richard, and didn't see where you mentioned what CPU you have.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 RichardHughes1 over 4 years ago in reply to BAlfson

Hi Bob,

The CPU in this box is a Intel® Core i5-2467M. The box has 8GB of RAM also.

Cheers,
Richard
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 4 years ago in reply to RichardHughes1

We should have asked you that awhile ago, Richard. That's a 1.6 GHz dual-core introduced in 2011. You're getting the maximum throughput that one would expect with that CPU - about the same as with the lowest-end Sophos SG appliance. Depending on the number of people in your home, a newer dual- or quad-core processor with 3+ GHz is what's appropriate for your needs. 8GB sounds good.

Cheers - Bob
Cancel
Vote Up +1 Vote Down

Cancel