Several Services Cannot Connect after Upgrade beyond 9.404-5 (First Release)

Hi Kyle,

Always restore the backup from previous version after a successful firmware update.

What happens when you configure an exception for a single source IP address and bypass all the filters on it? Do you connect with the minecraft servers?

Thanks

Thanks for the advice sachingurung.  I have tried all these things, but still not working.  The behavior is more like it is allowed, but then packets are getting dropped or timing out.

Hi Kyle,

Do you seen anything in the Intrusion Prevention or Advanced Threat Protection logs?

Emile

Thanks for suggestions Emile.  Unfortunately, those do not indicate anything being blocked.  I did notice a lot of these logs in the kernel log:

kernel: [ 6070.061098] asix 2-1.1:1.0 eth1: asix_rx_fixup() Bad RX Length 1484

I looked at this post and it looks like there were bugs before, but were fixed maybe (?):

https://community.sophos.com/products/unified-threat-management/astaroorg/f/utm-9-1-public-beta/64852/9-060-question-usb-nic-test-system

It is really acting like there is a bug or something changed in the new versions that affect either my config or my hardware.

Also, noticed the MTU on my external interface is set to 576.  I do not recall what it was before, but seems strange to me.  Could that affect it?  I cannot change it currently as I am working, but may try later.

Hi Kyle,

Ahah, that is most likely to be the culprit! If the MTU is set too low it can sometimes break packet communications and lucky for you this is a known bug that there are workarounds for until it is properly resolved.

Take a look at this thread here to force your UTM to ignore your isps MTU allocation:

Just to test first see if you can set the MTU for the WAN interface from interfaces & routing > interfaces and if that successfully overrides then reboot. If it doesn't allow you to or doesn't persist after a reboot then try the resolution in the above thread :)

What's your isp by the way?

Looking forward to hearing if you can resolve it!

Emile

Thanks Emile!  I will try later when I have the chance and let you know what I find out.

Thanks Emile!  I will try later when I have the chance and let you know what I find out.

You pointed me the right direction Emile! Reading that thread, I found a link to another thread regarding 9-407-3:

https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/80641/sophos-utm-9-407-3-released

I followed these instructions from the thread link above to set the MTU to be adjustable:

cc 
RAW 
lock_override 
OBJS 
interface 
ethernet (or cable, or other type) 
REF_ (Tap TAB two times - then you can see the interface list. Mine is called "REF_IntCabExternaWan[WAN,interface,ethernet]"
(You will get a look like this:)

'additional_addresses' => [],
'bandwidth' => 0,
'comment' => 'Added by installation wizard',
'inbandwidth' => 100000000,
'itfhw' => 'REF_ItfEthEth1',
'link' => 1,
'mtu' => 576,
'mtu_auto_discovery' => 1,
'name' => 'WAN',
'outbandwidth' => 20000000,
'primary_address' => 'REF_ItfPri000024',
'proxyarp' => 0,
'proxyndp' => 0,
'status' => 1
}

Then write:

mtu_auto_discovery=0 
w  (write the changes) 

Now go into Webadmin and find the WAN link, change the MTU under Advanced to 1500 and voila! :-)

Hi Kyle,

That's great, glad to have helped!

Let's hope you don't get to the receipt roll of things I try to check as much as I can for my customers, ha ha!

Emile

I prefer to avoid doing things inside cc as you must be very, very careful.  using cc change_object at the command line feels safer to me.  I explain how to do this in my post on the thread Kyle referenced above.

Cheers - Bob

Thanks Bob, I will try that out the next time around.