This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bad IPS pattern

Hi,
it looks like last week Sophos released a bad IPS pattern which cause traffic to be dropped causing bad connections (slow downloads, lost connections, ecc).

Anybody have info about this issues ?
Support has confirmed the problem without details....

Thanks

This thread was automatically locked due to age.

0 Jimstigator over 10 years ago

Yep - tons of us with the issue. I am not sure where the resolution is at now. I added an exception in IPS for all traffic going to my webserver to help performance. I also noticed that a few days prior to the IPS issue, another release might have tightened down the web application firewall protection settings. Out of nowhere, a bunch of functionality on my site stopped working until I backed off on protection.

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41822

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41835

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41820

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 nf over 10 years ago in reply to Jimstigator

I had to shut down our IPS. It was causing serious performance issues through the SSL VPN.
Cancel
Vote Up 0 Vote Down

Cancel
0 Pikkio over 10 years ago

Sophos told me that they are testing a patch which should be released tomorrow...
let's hope for the best........
Cancel
Vote Up 0 Vote Down

Cancel
0 nf over 10 years ago in reply to Pikkio

we can hope.
how does everyone test? do you keep it all set for manual? then what, just apply and see what happens? how do you revert back?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 10 years ago in reply to nf

I had put in IPS exceptions for traffic going to my webservers that fixed the problems... but now even that has failed as of 2pm today.  The issue started back up.  I have since turned off IPS and its all back to normal.

Issues are easy to recreate for me.  Hit "submit ticket" on my site, freeze.  Turn off IPS, hit "submit ticket" - straight through to next screen.

As of this afternoon, users couldn't even save files over the network to the share drives.  I had to turn off IPS on both ends to get that working.

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 10 years ago

Making the same post in two threads - but its relevant in both.

NAFU - You can't really test these updates. They are released silently with a check like every 15 minutes. These updates are similar to how an antivirus scanner gets its virus definitions and need to run almost real time to keep up with constant threats.

For better or worse, you kind of have to trust Sophos that they are testing these releases. In a year of ownership, this is the first silent update I have received that has caused trouble like this.

-Jim
Cancel
Vote Up 0 Vote Down

Cancel