Intermittent VPN Issues

Hi Alan Spark,

Thank you for reaching out to the Community! 

Could you please provide the model number and current firmware version of your firewall? 

Is firewall acceleration turned on? 

Please run the following command from the console and provide the output: 

• system firewall-acceleration show

Sophos XG Firewall: How to SSH to the firewall using PuTTY utility 

• Type 4 to access the Device console

Thanks,

Hi Harsh,

It is an XG 135 running SFOS 18.0.4 MR-4.

Here is the output from the command:

console> system firewall-acceleration show                                      
Firewall Acceleration is Enabled.

Regards,

Alan

Hi Alan Spark,

Thanks for the update! 

Would it be possible for you to turn off the firewall acceleration, monitor the issue, and provide an update? 

Run the following command to turn off the firewall acceleration:

• system firewall-acceleration disable

Thanks,

Hi Harsh,

I think I accidentally marked your answer as verified - I don't know how to undo it.

Before we make this change, can you please explain what the feature does and any impact of disabling it?

Thanks,

Alan

Hi Alan Spark.

I had kind of same problems on SG UTM while using VPN on UDP and DoS activated and solved by putting a exception for that port.

Perhaps this is a problem wirh your XG configuration as well.

Regards,

Thomas

Hi Alan Spark,

No problem, I've rejected the answer. :) 

The firewall acceleration uses the advanced data-path architecture allowing faster processing of data packets for known traffic.

Check out this thread: https://community.sophos.com/sophos-xg-firewall/f/discussions/123785/disabled-firewall-acceleration

You can turn on the firewall acceleration with the following command: 

• system firewall-acceleration enable

Thanks,

Hi Harsh,

I was notified that your answer had been verified. This was not me.

I have disabled firewall acceleration and we are monitoring it but I think it is too soon to mark this as verified. Even if it does "solve" the problem I would consider it a workaround as I don't think it should be necessary to disable the option.

We will continue to monitor over the coming days but in the meantime I have rejected your answer until we have more information at this end.

Regards,

Alan

Have you checked ThomW's answer? If your VPN Protocol is UDP it is very likely that IPS/DoS Protection is pointing to your problem. You should review the IPS logs.

Thanks. I don't think this is the problem as there was nothing in the IPS logs. It wasn't any particular port either, it seemed to be quite random.

So far with the firewall acceleration disabled we're not seeing the problem but as I said above, too early to draw conclusions.

Hi Alan Spark,

Are you still experiencing the same issue with firewall acceleration turned off? 

Thanks,