Currently on 9.315-2 using software appliance. It's a Core2Quad 8400 with 8GB of RAM. Device is configured in bridge mode between main network switch and Cisco router.
So here is the weirdness. It would appear that IPS is causing some sort of bandwidth issue with Internet. Essentially, if upload bandwidth goes beyond a certain point, Internet connectivity grinds to nothing. I have a continuous ping going to 4.2.2.1 and running a speed test to speedof.me. When I do so, once the upload speed starts or before its finished, Internet connectivity goes down and the continuous ping starts giving me "request timed out". After a while, the pings come back but the speed test will either fail or give me a lowball measure.
Keep in mind that event browsing to a webpage, in which you have to upload your browsers request to the webpage in question, kills the Internet as well.
Now, with IPS disabled, everything works fine and the speed test runs successfully. The pings continue, though, while the test is running, the response time is higher, in the ~180ms range instead of the ~30 second range. I already disabled Web Protection in my testing to see if that was causing this and it only stopped once IPS is disabled.
The live log doesn't show anything. Mainly because I have a bypass for this website in the IPS (though, I assume, the bypass doesn't mean the traffic isn't still going through the IPS module, just that, it isn't looking at the traffic). Issue started after upgrade to 9.315-2.
Any ideas?
This thread was automatically locked due to age.
Guest User!
You are not Sophos Staff.
