XG Firewall v18 MR-4: Feedback and experiences

Since we updated our XG 230 HA appliances to 18.0.4 (from 18.0.2 and 18.0.3) we see a lot RDP disconnects (after minutes or 30-60 seconds after connect) as soon as we connect to customer systems via IPSec VPNs. This annoying issue appeared with 18.0.3 already.

The RDP sessions from Win10/WIndows Server to Windows Servers (2008-2019) connect properly, but after seconds to minutes the sessions freeze and get disconnected after another 10-15 seconds. This issue can be reproduced easely and appear on all out internal Win10 clients which connect to customer systems using RDP over IPSec.

As soon as we downgrade our appliances to 18.0.2 the issues disappear instantely.

We opened and escalated a case (03469253) at Sophos, which should be escalated to 2nd level support soon.

Do you see the same issues on our 18.0.4 (18.0.3) installations, when using RDP over IPSec VPNs ?

Talked about this in this Thread: https://community.sophos.com/xg-firewall/f/discussions/109828/xg-firewall---windows-remote-desktop-freezing/395676#395676

It could be a DOS protection (UDP Flood) issue. Check your IPS, if there are UDP drops for RDP. 

Talked about this in this Thread: https://community.sophos.com/xg-firewall/f/discussions/109828/xg-firewall---windows-remote-desktop-freezing/395676#395676

It could be a DOS protection (UDP Flood) issue. Check your IPS, if there are UDP drops for RDP. 

Double checked again...there are no UDP drops listed:

I had this problem in several SFOS 17.5.x versions before. The only thing to stop this freezes was to create a firewall rule ontop which rejects rdp connections via udp 3389. It seems like xg drops these udp3389 packets randomly and then the connection timeouts...

I create an rule which blocks RDP (UDP, Port 3389) and I see the blocked UDP pakets in the firewall log. But still the RDP sessions freeze and disconnect in seconds or minutes. This issue can reproduced easely on our XG 230.

Is your rule droping or rejecting the udp packages? UDP on rdp service is used for "performance"... I rejected the packages, to notify the client about this permission error. So the client only uses tcp and not try using both. 

Would suggest to open a seperate thread to keep it more visible here, especially as you already noticed it with MR3. Suggest also to check if your IPSec VPN logs on client and XG for reconnects at about the time your RDP session starts hanging.
I remember an issue with the Connect Client reconnecting IPSec every ~15 minutes.

https://support.sophos.com/support/s/article/KB-000037055?language=en_US has an entry about

set vpn conn-remove-tunnel-up disable
When disabled, it will not flush the connections when IPSec tunnels come up