Hello,
I'm experiencing sudden break ups witht he connection with my XG135w.
The configuration is as follows: ISP model with optical connection - unmanaged switch (with nothing else connected except ISP modem and XG) - XG - couple of switches with PoE and two Ubiquiti AP.
It all started on friday last week when I wanted to configure my two Ubiquiti APs with additional Guest WiFi network (with our existing one). After that the Ubiquiti APs started breaking up, so I deleted the newly created Guest WiFi, but after this I realised that our XG is always breaking up the connection to the internet. COuple of times it was WAN interface down, then it was okay but the connection was just broken for couple of seconds (without messaging that the WAN is down), then it went up for another couple of minutes, than breaks and so on (often with the message DNS_PROBE_FINISHED_NXDOMAIN after trying to refresh a site or to open a new one).
We have a ESXi on the network that has a AD virtual machine. The XG has a static DNS IP address set.
I'm not sure where to look at. It was all running smoothly before this Ubiquiti thing. Tried one more time to play with MTU (it was 1500) or to add a second rule to the WAN link manager for going down, but without help.
Any suggestions?
Thank you!
Hey Shteki,Thank you for the update, use global DNS 8.8.8.8 in DNS 1 preference following with the mentioned one. Under the WAN Link manager under the failover gateways > edit the failover rules and with…
here are the pictures of the setting:
And the screenshot of the CLI (I've run the command "cat dgd.log |grep dead")
Hey Shteki,Thank you for the update, use global DNS 8.8.8.8 in DNS 1 preference following with the mentioned one. Under the WAN Link manager under the failover gateways > edit the failover rules and with the "AND" condition also add your interface gateway too.Observe this and see if that has improved the situation.
Thanks & Regards,
Vivek Jagad | Technical Account Manager 3 | Cyber Security Evolved
Sophos Community | Product Documentation | Sophos Techvids | SMSIf a post solves your question please use the 'Verify Answer' button.
You faced the issue in last two hours or before that ? Shteki
We had the issues also i n the last couple of hours
Couple or exactly 2 hours, cause the reports is show for last 2 hours, I would suggest generate it for last 24 hours !!
Hello Vivek,
here is for the last 48 hours:
Memory/CPU looks fine, but the WAN data transfer seems to be on a peak when the issue occurs !! What type of authentication is being used for the users to access internet ?Under the FW rule , do you use web/app/IPS or scanning ?
There is no real authentification, as son as you connect to any of the outlets in the office or via WiFi, you have the ability to access internet.
Regarding FW rule, I need to check this one and give an edit.
Please check and perform a packet capture from the diagnostics to see if it is not causing any violation !!
Just checked the web/app/IPS, everything okay, like it was before when it worked (for two years), no changes.
I've started packet capture, going to check, when the first break apperas, what is says.
Could it be with dynamic DNS? We had some problems with it a while ago (two months), it would break the connections, but that it worked for some time.
May be may be not, let's perform a packet capture during the break from the diagnostics.From the CLI, check for the drop-packet-capture: https://support.sophos.com/support/s/article/KB-000036858?language=en_USAnd also conntrack: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/117389/sophos-xg-cli-troubleshooting-tools
Since it's complicated to that exactly the moment when the drop happends (today it lasts for only 3-4 seconds according to my colleagues), I took some that I think were part of the drop.
Here are some of CLI outputs for your suggested commands.
Conntrack:
proto=tcp proto-no=6 timeout=10799 state=ESTABLISHED orig-src=10.27.27.106 orig-dst=20.82.247.128 orig-sport=63599 orig-dport=443 packets=2464 bytes=174110 reply-src=20.82.247.128 reply-dst=192.168.1.2 reply-sport=443 reply-dport=63599 packets=11353 bytes=16037318 [ASSURED] mark=0x8001 use=1 id=1481722368 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=100 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659340513 microflowid[0]=503 microflowrev[0]=11 microflowid[1]=1587 microflowrev[1]=5 hostrev[0]=31 hostrev[1]=31 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=3 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=29 sessionidrev=28236 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=56 state=LAST_ACK orig-src=192.168.1.2 orig-dst=195.29.179.143 orig-sport=47698 orig-dport=80 packets=11 bytes=1456 reply-src=195.29.179.143 reply-dst=192.168.1.2 reply-sport=80 reply-dport=47698 packets=10 bytes=7716 [ASSURED] mark=0x8001 use=1 id=1454865920 masterid=560186624 devin= devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=0 bwid=0 appid=2174 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=0 devinindex=0 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x80020000280809 flags1=0x10002800000 flagvalues=0,3,11,19,21,41,55,87,89,104 catid=29 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:56:bc:ea:84 startstamp=1659341371 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=1 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=0 sessionid=3075 sessionidrev=55011 session_update_rev=5 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=9 state=TIME_WAIT orig-src=10.27.27.106 orig-dst=10.27.27.2 orig-sport=50569 orig-dport=4444 packets=6 bytes=776 reply-src=10.27.27.2 reply-dst=10.27.27.106 reply-sport=65003 reply-dport=50569 packets=4 bytes=309 [ASSURED] mark=0x0 use=1 id=2548414080 masterid=0 devin=Port1 devout= nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=1 outzone=4 devinindex=5 devoutindex=0 hb_src=0 hb_dst=0 flags0=0x800208000 flags1=0x40400000000 flagvalues=15,21,35,98,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659341444 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=25 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=0 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=92 sessionidrev=51664 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10797 state=ESTABLISHED orig-src=10.27.27.127 orig-dst=8.8.8.8 orig-sport=58680 orig-dport=853 packets=11 bytes=1201 reply-src=8.8.8.8 reply-dst=192.168.1.2 reply-sport=853 reply-dport=58680 packets=11 bytes=6388 [ASSURED] mark=0x8001 use=1 id=3640590336 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=2974 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3b sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52000a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=98:0d:51:68:f3:71 startstamp=1659341427 microflowid[0]=129 microflowrev[0]=6 microflowid[1]=1733 microflowrev[1]=42 hostrev[0]=2 hostrev[1]=2 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=2 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3981 sessionidrev=10590 session_update_rev=5 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=1 state=TIME_WAIT orig-src=10.27.27.106 orig-dst=10.27.27.2 orig-sport=50501 orig-dport=4444 packets=8 bytes=1923 reply-src=10.27.27.2 reply-dst=10.27.27.106 reply-sport=65003 reply-dport=50501 packets=7 bytes=789 [ASSURED] mark=0x0 use=1 id=1409504256 masterid=0 devin=Port1 devout= nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=1 outzone=4 devinindex=5 devoutindex=0 hb_src=0 hb_dst=0 flags0=0x800208000 flags1=0x40400000000 flagvalues=15,21,35,98,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659341436 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=25 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=0 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3554 sessionidrev=53462 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=udp proto-no=17 timeout=23 orig-src=192.168.1.2 orig-dst=8.8.8.8 orig-sport=24654 orig-dport=53 packets=1 bytes=110 reply-src=8.8.8.8 reply-dst=192.168.1.2 reply-sport=53 reply-dport=24654 packets=1 bytes=192 mark=0x8001 helper=dns use=1 id=1454652928 masterid=0 devin= devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=0 outzone=0 devinindex=0 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x200000 flags1=0x0 flagvalues=21 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ae src_mac=44:22:7c:ab:c6:38 startstamp=1659341438 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=0 sessionid=1604 sessionidrev=53323 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10756 state=ESTABLISHED orig-src=10.27.27.122 orig-dst=8.8.4.4 orig-sport=51198 orig-dport=443 packets=26 bytes=2708 reply-src=8.8.4.4 reply-dst=192.168.1.2 reply-sport=443 reply-dport=51198 packets=34 bytes=4680 [ASSURED] mark=0x8001 use=1 id=567736896 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=100 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=e8:6a:64:f5:cb:78 startstamp=1659341090 microflowid[0]=568 microflowrev[0]=51 microflowid[1]=1473 microflowrev[1]=17 hostrev[0]=8 hostrev[1]=8 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=3 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=4099 sessionidrev=28422 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10783 state=ESTABLISHED orig-src=192.168.1.2 orig-dst=34.104.35.123 orig-sport=56678 orig-dport=80 packets=4 bytes=542 reply-src=34.104.35.123 reply-dst=192.168.1.2 reply-sport=80 reply-dport=56678 packets=3 bytes=683 [ASSURED] mark=0x8001 use=1 id=3640597056 masterid=1060553984 devin= devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=0 bwid=0 appid=2174 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0xd sigoffload=0 inzone=1 outzone=0 devinindex=0 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x80020000280809 flags1=0x10000800000 flagvalues=0,3,11,19,21,41,55,87,104 catid=29 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=18:1d:ea:fe:1f:aa startstamp=1659341428 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=1 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=0 sessionid=3984 sessionidrev=10602 session_update_rev=3 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10698 state=ESTABLISHED orig-src=10.27.27.101 orig-dst=34.149.211.227 orig-sport=59257 orig-dport=443 packets=41 bytes=17821 reply-src=34.149.211.227 reply-dst=192.168.1.2 reply-sport=443 reply-dport=59257 packets=37 bytes=9463 [ASSURED] mark=0x8001 use=1 id=1454858880 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=2731 appcatid=13 hbappid=0 hbappcatid=0 dpioffload=0xf sigoffload=0x5 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=3c:a9:f4:86:41:c0 startstamp=1659340561 microflowid[0]=1456 microflowrev[0]=9 microflowid[1]=1574 microflowrev[1]=52 hostrev[0]=8 hostrev[1]=8 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3722 sessionidrev=58039 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10789 state=ESTABLISHED orig-src=10.27.27.107 orig-dst=31.13.84.8 orig-sport=58215 orig-dport=443 packets=133 bytes=11754 reply-src=31.13.84.8 reply-dst=192.168.1.2 reply-sport=443 reply-dport=58215 packets=165 bytes=105123 [ASSURED] mark=0x8001 use=2 id=1060559424 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=220 appcatid=19 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=18:1d:ea:fe:1f:aa startstamp=1659341163 microflowid[0]=1260 microflowrev[0]=13 microflowid[1]=1722 microflowrev[1]=15 hostrev[0]=8 hostrev[1]=9 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3727 sessionidrev=58011 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=7555 state=ESTABLISHED orig-src=10.27.27.144 orig-dst=20.199.120.151 orig-sport=49676 orig-dport=443 packets=12 bytes=2756 reply-src=20.199.120.151 reply-dst=192.168.1.2 reply-sport=443 reply-dport=49676 packets=14 bytes=5609 [ASSURED] mark=0x8001 use=1 id=1454542592 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=2730 appcatid=3 hbappid=0 hbappcatid=0 dpioffload=0xf sigoffload=0x5 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:56:bc:ea:84 startstamp=1659338199 microflowid[0]=1689 microflowrev[0]=8 microflowid[1]=1590 microflowrev[1]=16 hostrev[0]=1 hostrev[1]=1 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=1 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=14 current_state[1]=14 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3266 sessionidrev=16157 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=udp proto-no=17 timeout=12 orig-src=192.168.1.2 orig-dst=8.8.8.8 orig-sport=30238 orig-dport=53 packets=1 bytes=84 reply-src=8.8.8.8 reply-dst=192.168.1.2 reply-sport=53 reply-dport=30238 packets=1 bytes=148 mark=0x8001 helper=dns use=1 id=1454650688 masterid=0 devin= devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=0 outzone=0 devinindex=0 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x200000 flags1=0x0 flagvalues=21 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ae src_mac=44:22:7c:ab:c6:38 startstamp=1659341427 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=0 sessionid=571 sessionidrev=58232 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=3 state=CLOSE orig-src=10.27.27.2 orig-dst=10.27.27.6 orig-sport=37912 orig-dport=389 packets=8 bytes=457 reply-src=10.27.27.6 reply-dst=10.27.27.2 reply-sport=389 reply-dport=37912 packets=6 bytes=452 [ASSURED] mark=0x0 use=1 id=2548408320 masterid=0 devin= devout=br0 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=0 outzone=0 devinindex=0 devoutindex=25 hb_src=0 hb_dst=0 flags0=0x200000 flags1=0x0 flagvalues=21 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:0c:29:a3:96:91 startstamp=1659341438 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=0 sessionid=3126 sessionidrev=13526 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=3 state=TIME_WAIT orig-src=10.27.27.106 orig-dst=10.27.27.2 orig-sport=50510 orig-dport=4444 packets=8 bytes=1923 reply-src=10.27.27.2 reply-dst=10.27.27.106 reply-sport=65003 reply-dport=50510 packets=7 bytes=789 [ASSURED] mark=0x0 use=1 id=1060555264 masterid=0 devin=Port1 devout= nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0 sigoffload=0 inzone=1 outzone=4 devinindex=5 devoutindex=0 hb_src=0 hb_dst=0 flags0=0x800208000 flags1=0x40400000000 flagvalues=15,21,35,98,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659341438 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0 loindex=25 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=0 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3132 sessionidrev=13996 session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10789 state=ESTABLISHED orig-src=10.27.27.106 orig-dst=142.250.180.194 orig-sport=50321 orig-dport=443 packets=6 bytes=922 reply-src=142.250.180.194 reply-dst=192.168.1.2 reply-sport=443 reply-dport=50321 packets=5 bytes=1050 [ASSURED] mark=0x8001 use=1 id=4026984640 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=100 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0xd sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52000a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659341389 microflowid[0]=458 microflowrev[0]=39 microflowid[1]=1377 microflowrev[1]=13 hostrev[0]=2 hostrev[1]=2 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=878 sessionidrev=33899 session_update_rev=3 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10797 state=ESTABLISHED orig-src=10.27.27.107 orig-dst=31.13.84.23 orig-sport=58214 orig-dport=443 packets=1455 bytes=309765 reply-src=31.13.84.23 reply-dst=192.168.1.2 reply-sport=443 reply-dport=58214 packets=1668 bytes=115248 [ASSURED] mark=0x8001 use=1 id=1412506240 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=220 appcatid=19 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=18:1d:ea:fe:1f:aa startstamp=1659341163 microflowid[0]=1515 microflowrev[0]=21 microflowid[1]=1615 microflowrev[1]=33 hostrev[0]=7 hostrev[1]=7 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=3 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=3530 sessionidrev=31817 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10288 state=ESTABLISHED orig-src=10.27.27.107 orig-dst=20.199.120.182 orig-sport=56209 orig-dport=443 packets=18 bytes=3516 reply-src=20.199.120.182 reply-dst=192.168.1.2 reply-sport=443 reply-dport=56209 packets=15 bytes=5750 [ASSURED] mark=0x8001 use=1 id=1987231232 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=2730 appcatid=3 hbappid=0 hbappcatid=0 dpioffload=0xf sigoffload=0x5 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=18:1d:ea:fe:1f:aa startstamp=1659338040 microflowid[0]=1391 microflowrev[0]=50 microflowid[1]=698 microflowrev[1]=45 hostrev[0]=3 hostrev[1]=3 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=2 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=2605 sessionidrev=28195 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10765 state=ESTABLISHED orig-src=10.27.27.101 orig-dst=8.8.8.8 orig-sport=59319 orig-dport=443 packets=14 bytes=1621 reply-src=8.8.8.8 reply-dst=192.168.1.2 reply-sport=443 reply-dport=59319 packets=16 bytes=2507 [ASSURED] mark=0x8001 use=1 id=975251968 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=100 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=3c:a9:f4:86:41:c0 startstamp=1659341230 microflowid[0]=416 microflowrev[0]=23 microflowid[1]=1779 microflowrev[1]=46 hostrev[0]=5 hostrev[1]=5 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=2 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=856 sessionidrev=24285 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED proto=tcp proto-no=6 timeout=10766 state=ESTABLISHED orig-src=10.27.27.106 orig-dst=91.211.75.130 orig-sport=61975 orig-dport=443 packets=434 bytes=27947 reply-src=91.211.75.130 reply-dst=192.168.1.2 reply-sport=443 reply-dport=61975 packets=2277 bytes=2771138 [ASSURED] mark=0x8001 use=1 id=1971575360 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0 policytype=1 fwid=5 natid=1 fw_action=1 bwid=0 appid=100 appcatid=5 hbappid=0 hbappcatid=0 dpioffload=0x3f sigoffload=0 inzone=1 outzone=2 devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a080020000a flags1=0x52002a00018 flagvalues=1,3,21,35,41,43,55,67,68,85,87,89,101,104,106 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:7d:5f:ad src_mac=00:50:b6:9b:55:c7 startstamp=1659339755 microflowid[0]=656 microflowrev[0]=46 microflowid[1]=837 microflowrev[1]=25 hostrev[0]=42 hostrev[1]=41 ipspid=0 diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=2 gwoff=0 cluster_node=0 current_state[0]=18 current_state[1]=18 vlan_id=0 inmark=0x0 brinindex=25 sessionid=1543 sessionidrev=55086 session_update_rev=6 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=39 nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADE
Drop-packet-capture interface Port2 (this is WAN)
2022-08-01 10:29:25 0103021 IP 192.168.1.112.40968 > 255.255.255.255.10001 : proto UDP: packet len: 188 checksum : 36450 0x0000: 4500 00d0 8e62 4000 4011 e9a2 c0a8 0170 E....b@.@......p 0x0010: ffff ffff a008 2711 00bc 8e62 0206 00b0 ......'....b.... 0x0020: 0200 0ad0 21f9 b1e5 1cc0 a801 7001 0006 ....!.......p... 0x0030: d021 f9b1 e51c 0a00 0400 0d0b 370b 0007 .!..........7... 0x0040: 5536 2d4c 6974 650c 0004 5541 4c36 0300 U6-Lite...UAL6.. 0x0050: 2242 5a2e 6d74 3736 3231 5f36 2e30 2e32 "BZ.mt7621_6.0.2 0x0060: 312b 3133 3637 332e 3232 3036 3037 2e32 1+13673.220607.2 0x0070: 3030 3416 000c 362e 302e 3231 2e31 3336 004...6.0.21.136 0x0080: 3733 1500 0455 414c 3617 0001 0018 0001 73...UAL6....... 0x0090: 0019 0001 011a 0001 0113 0006 d021 f9b1 .............!.. 0x00a0: e51c 1200 0400 029a b51b 0006 352e 3239 ............5.29 0x00b0: 2e30 2700 08e4 b012 b246 5b07 e92a 0010 .0'......F[..*.. 0x00c0: 467d a608 13f2 452e 84b0 12b2 465b 07e9 F}....E.....F[.. Date=2022-08-01 Time=10:29:25 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=d0:21:f9:b1:e5:1c dest_mac=ff:ff:ff:ff:ff:ff bridge_name= l3_protocol=IPv4 source_ip=192.168.1.112 dest_ip=255.255.255.255 l4_protocol=UDP source_port=40968 dest_port=10001 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1058902400 masterid=0 status=256 state=0, flag0=549757911040 flags1=0 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:26 0103021 IP 184.105.247.199.43981 > 192.168.1.2.5001 : proto TCP: S 2972623788:2972623788(0) win 65535 checksum : 10709 0x0000: 4500 0028 d431 0000 f306 81c2 b869 f7c7 E..(.1.......i.. 0x0010: c0a8 0102 abcd 1389 b12e a3ac 0000 0000 ................ 0x0020: 5002 ffff 29d5 0000 P...)... Date=2022-08-01 Time=10:29:26 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=44:22:7c:ab:c6:38 dest_mac=7c:5a:1c:7d:5f:ae bridge_name= l3_protocol=IPv4 source_ip=184.105.247.199 dest_ip=192.168.1.2 l4_protocol=TCP source_port=43981 dest_port=5001 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1454647168 masterid=0 status=256 state=1, flag0=549757911040 flags1=17179869184 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:28 0103021 IP 192.168.1.108.55769 > 255.255.255.255.10001 : proto UDP: packet len: 193 checksum : 45973 0x0000: 4500 00d5 2bc4 4000 4011 4c40 c0a8 016c E...+.@.@.L@...l 0x0010: ffff ffff d9d9 2711 00c1 b395 0206 00b5 ......'......... 0x0020: 0200 0ad0 21f9 5cfe 67c0 a801 6c01 0006 ....!.\.g...l... 0x0030: d021 f95c fe67 0a00 0400 0d0a 270b 0005 .!.\.g......'... 0x0040: 5536 2d4c 520c 0007 5541 4c52 3676 3203 U6-LR...UALR6v2. 0x0050: 0022 425a 2e4d 5437 3632 325f 362e 302e ."BZ.MT7622_6.0. 0x0060: 3231 2b31 3336 3733 2e32 3230 3630 372e 21+13673.220607. 0x0070: 3230 3034 1600 0c36 2e30 2e32 312e 3133 2004...6.0.21.13 0x0080: 3637 3315 0007 5541 4c52 3676 3217 0001 673...UALR6v2... 0x0090: 0018 0001 0019 0001 011a 0001 0113 0006 ................ 0x00a0: d021 f95c fe67 1200 0400 029b 4f1b 0007 .!.\.g......O... 0x00b0: 352e 3433 2e33 3727 0008 1e4d e602 d8c7 5.43.37'...M.... 0x00c0: e465 2a00 1065 1358 cd13 2849 318e 4de6 .e*..e.X..(I1.M. 0x00d0: 02d8 c7e4 65 ....e Date=2022-08-01 Time=10:29:28 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=d0:21:f9:5c:fe:67 dest_mac=ff:ff:ff:ff:ff:ff bridge_name= l3_protocol=IPv4 source_ip=192.168.1.108 dest_ip=255.255.255.255 l4_protocol=UDP source_port=55769 dest_port=10001 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1454648128 masterid=0 status=256 state=0, flag0=549757911040 flags1=0 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:28 0103021 IP 162.142.125.248.8861 > 192.168.1.2.42306 : proto TCP: S 2431145224:2431145224(0) win 1024 checksum : 1109 0x0000: 4500 002c c409 0000 2806 ec91 a28e 7df8 E..,....(.....}. 0x0010: c0a8 0102 229d a542 90e8 5508 0000 0000 ...."..B..U..... 0x0020: 6002 0400 0455 0000 0204 0584 `....U...... Date=2022-08-01 Time=10:29:28 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=44:22:7c:ab:c6:38 dest_mac=7c:5a:1c:7d:5f:ae bridge_name= l3_protocol=IPv4 source_ip=162.142.125.248 dest_ip=192.168.1.2 l4_protocol=TCP source_port=8861 dest_port=42306 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1616816640 masterid=0 status=256 state=1, flag0=549757911040 flags1=17179869184 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:29 0103021 IP 89.248.165.204.55880 > 192.168.1.2.10436 : proto TCP: S 3720676461:3720676461(0) win 1024 checksum : 1332 0x0000: 4500 0028 9f97 0000 f606 63c9 59f8 a5cc E..(......c.Y... 0x0010: c0a8 0102 da48 28c4 ddc5 046d 0000 0000 .....H(....m.... 0x0020: 5002 0400 0534 0000 P....4.. Date=2022-08-01 Time=10:29:29 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=44:22:7c:ab:c6:38 dest_mac=7c:5a:1c:7d:5f:ae bridge_name= l3_protocol=IPv4 source_ip=89.248.165.204 dest_ip=192.168.1.2 l4_protocol=TCP source_port=55880 dest_port=10436 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1454861120 masterid=0 status=256 state=1, flag0=549757911040 flags1=17179869184 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:33 0103021 IP 194.26.29.86.56063 > 192.168.1.2.31101 : proto TCP: S 4053988008:4053988008(0) win 1024 checksum : 53758 0x0000: 4500 0028 38eb 0000 ef06 f1c9 c21a 1d56 E..(8..........V 0x0010: c0a8 0102 daff 797d f1a2 f2a8 0000 0000 ......y}........ 0x0020: 5002 0400 d1fe 0000 P....... Date=2022-08-01 Time=10:29:33 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=44:22:7c:ab:c6:38 dest_mac=7c:5a:1c:7d:5f:ae bridge_name= l3_protocol=IPv4 source_ip=194.26.29.86 dest_ip=192.168.1.2 l4_protocol=TCP source_port=56063 dest_port=31101 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1616817280 masterid=0 status=256 state=1, flag0=549757911040 flags1=17179869184 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:35 0103021 IP 192.168.1.112.43286 > 255.255.255.255.10001 : proto UDP: packet len: 188 checksum : 31060 0x0000: 4500 00d0 8f5e 4000 4011 e8a6 c0a8 0170 E....^@.@......p 0x0010: ffff ffff a916 2711 00bc 7954 0206 00b0 ......'...yT.... 0x0020: 0200 0ad0 21f9 b1e5 1cc0 a801 7001 0006 ....!.......p... 0x0030: d021 f9b1 e51c 0a00 0400 0d0b 410b 0007 .!..........A... 0x0040: 5536 2d4c 6974 650c 0004 5541 4c36 0300 U6-Lite...UAL6.. 0x0050: 2242 5a2e 6d74 3736 3231 5f36 2e30 2e32 "BZ.mt7621_6.0.2 0x0060: 312b 3133 3637 332e 3232 3036 3037 2e32 1+13673.220607.2 0x0070: 3030 3416 000c 362e 302e 3231 2e31 3336 004...6.0.21.136 0x0080: 3733 1500 0455 414c 3617 0001 0018 0001 73...UAL6....... 0x0090: 0019 0001 011a 0001 0113 0006 d021 f9b1 .............!.. 0x00a0: e51c 1200 0400 029a b71b 0006 352e 3239 ............5.29 0x00b0: 2e30 2700 08e4 b012 b246 5b07 e92a 0010 .0'......F[..*.. 0x00c0: 467d a608 13f2 452e 84b0 12b2 465b 07e9 F}....E.....F[.. Date=2022-08-01 Time=10:29:35 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=d0:21:f9:b1:e5:1c dest_mac=ff:ff:ff:ff:ff:ff bridge_name= l3_protocol=IPv4 source_ip=192.168.1.112 dest_ip=255.255.255.255 l4_protocol=UDP source_port=43286 dest_port=10001 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1058903680 masterid=0 status=256 state=0, flag0=549757911040 flags1=0 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:36 0103021 IP 89.248.165.169.53508 > 192.168.1.2.3661 : proto TCP: S 2444277217:2444277217(0) win 1024 checksum : 50098 0x0000: 4500 0028 0892 0000 f606 faf1 59f8 a5a9 E..(........Y... 0x0010: c0a8 0102 d104 0e4d 91b0 b5e1 0000 0000 .......M........ 0x0020: 5002 0400 c3b2 0000 P....... Date=2022-08-01 Time=10:29:36 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=44:22:7c:ab:c6:38 dest_mac=7c:5a:1c:7d:5f:ae bridge_name= l3_protocol=IPv4 source_ip=89.248.165.169 dest_ip=192.168.1.2 l4_protocol=TCP source_port=53508 dest_port=3661 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1454646208 masterid=0 status=256 state=1, flag0=549757911040 flags1=17179869184 pbdid_dir0=0 pbrid_dir1=0 2022-08-01 10:29:38 0103021 IP 192.168.1.108.57997 > 255.255.255.255.10001 : proto UDP: packet len: 193 checksum : 40673 0x0000: 4500 00d5 341e 4000 4011 43e6 c0a8 016c E...4.@.@.C....l 0x0010: ffff ffff e28d 2711 00c1 9ee1 0206 00b5 ......'......... 0x0020: 0200 0ad0 21f9 5cfe 67c0 a801 6c01 0006 ....!.\.g...l... 0x0030: d021 f95c fe67 0a00 0400 0d0a 310b 0005 .!.\.g......1... 0x0040: 5536 2d4c 520c 0007 5541 4c52 3676 3203 U6-LR...UALR6v2. 0x0050: 0022 425a 2e4d 5437 3632 325f 362e 302e ."BZ.MT7622_6.0. 0x0060: 3231 2b31 3336 3733 2e32 3230 3630 372e 21+13673.220607. 0x0070: 3230 3034 1600 0c36 2e30 2e32 312e 3133 2004...6.0.21.13 0x0080: 3637 3315 0007 5541 4c52 3676 3217 0001 673...UALR6v2... 0x0090: 0018 0001 0019 0001 011a 0001 0113 0006 ................ 0x00a0: d021 f95c fe67 1200 0400 029b 511b 0007 .!.\.g......Q... 0x00b0: 352e 3433 2e33 3727 0008 1e4d e602 d8c7 5.43.37'...M.... 0x00c0: e465 2a00 1065 1358 cd13 2849 318e 4de6 .e*..e.X..(I1.M. 0x00d0: 02d8 c7e4 65 ....e Date=2022-08-01 Time=10:29:38 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=d0:21:f9:5c:fe:67 dest_mac=ff:ff:ff:ff:ff:ff bridge_name= l3_protocol=IPv4 source_ip=192.168.1.108 dest_ip=255.255.255.255 l4_protocol=UDP source_port=57997 dest_port=10001 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=1454646528 masterid=0 status=256 state=0, flag0=549757911040 flags1=0 pbdid_dir0=0 pbrid_dir1=0
Conntrack established is fine, and we can see the FW rule id is 5 from where the traffic passes and the natid is 1, can you confirm whether it is correct a correct rule or not ?drop traffic is mainly cause of the ACL component and the destination port differs from the conntrack captured so seems not relevant !!
The FW rule is okay, nothing uncommong here.
Any other suggestions, as in maybe to start disconnecting someting just to rule it out?
Try creating a plain FW rule on the top with no restrictions in scanning, web, app, IPS just a plain FW rule for a single machine and keep it under observation for 24-48 hours !!
Tried it for a while, plain FW rule like you suggested, source LAN, destionation WAN, with a asociated NAT rule (source and destination any, SNAT is MASQ) and it still loses the conenction for couple of seconds. Awkardly, it doesn't report a WAN gateway failover immediately. It happens once or twice per day that it sends us emails with the Gateway Down/Up reported from yesterday or couple of days ago..
Hey Shteki, Is there any specific time or there is daily pattern or after certain interval of time users face internet disconnection ?Can you please share the following logs during the time of disconnection:#tail -f /log/nSXLd.log #tail -f /log/dgd.log#ls -larth /var/cores# df -kh
Hi Vivek,
here are the log reports:
This one was taken imediately:
XG135w_XN03_SFOS 18.5.3 MR-3-Build408# tail -f /log/nSXLd.log
[2022-07-29 07:52:32Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 07:54:36Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 08:58:50Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 09:29:02Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 09:45:11Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 09:46:39Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-07-29 10:04:58Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-08-02 12:30:41Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-08-02 12:30:42Z] <139652316337344> [error] nSXLd: DNS lookup timed out [2022-08-02 12:31:01Z] <139652316337344> [error] nSXLd: DNS lookup timed out
This one was left over the night and here are the status reports of the "dead" links, normaly it was "live":
DEBUG Aug 03 01:40:34Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 01:40:34Z [17495]: Ping : S DEBUG Aug 03 01:40:34Z [17495]: Current Status [GW(XXXXXXXX,Port2)] : Live DEBUG Aug 03 01:40:34Z [17495]: Sleep for 300 Seconds DEBUG Aug 03 01:45:34Z [17495]: Initiating Ping : 8.8.8.8 DEBUG Aug 03 01:45:34Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:45:34Z [17495]: Success, Retrying(1) Ping : 8.8.8.8 DEBUG Aug 03 01:45:34Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply
DEBUG Aug 03 01:45:34Z [17495]: Current Status : Live DEBUG Aug 03 01:45:34Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 01:45:34Z [17495]: Ping : S DEBUG Aug 03 01:45:34Z [17495]: Current Status [GW(XXXXXXX,Port2)] : Live DEBUG Aug 03 01:45:34Z [17495]: Sleep for 300 Seconds DEBUG Aug 03 01:50:34Z [17495]: Initiating Ping : 8.8.8.8 DEBUG Aug 03 01:50:34Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:36Z [17495]: Failed, Retrying(1) Ping : 8.8.8.8 DEBUG Aug 03 01:50:36Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:36Z [17495]: Current Status : Live DEBUG Aug 03 01:50:38Z [17495]: Failed, Retrying(2) Ping : 8.8.8.8 DEBUG Aug 03 01:50:38Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:38Z [17495]: Current Status : Live DEBUG Aug 03 01:50:40Z [17495]: Failed, Retrying(3) Ping : 8.8.8.8 DEBUG Aug 03 01:50:40Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:40Z [17495]: Current Status : Live DEBUG Aug 03 01:50:42Z [17495]: Failed, Retrying(4) Ping : 8.8.8.8 DEBUG Aug 03 01:50:42Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:42Z [17495]: Current Status : Live DEBUG Aug 03 01:50:44Z [17495]: Failed, Retrying(5) Ping : 8.8.8.8 DEBUG Aug 03 01:50:44Z [17495]: GW (XXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:44Z [17495]: Current Status : Live DEBUG Aug 03 01:50:46Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 01:50:46Z [17495]: Ping : F DEBUG Aug 03 01:50:46Z [17495]: Current Status [GW(XXXXXXXX,Port2)] : Dead DEBUG Aug 03 01:50:46Z [17495]: Sleep for 300 Seconds DEBUG Aug 03 01:50:46Z [17495]: Initiating Ping : 10.27.27.6 DEBUG Aug 03 01:50:46Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:48Z [17495]: Failed, Retrying(1) Ping : 10.27.27.6 DEBUG Aug 03 01:50:48Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:48Z [17495]: Current Status : Live DEBUG Aug 03 01:50:50Z [17495]: Failed, Retrying(2) Ping : 10.27.27.6 DEBUG Aug 03 01:50:50Z [17495]: GW (XXXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:50Z [17495]: Current Status : Live DEBUG Aug 03 01:50:52Z [17495]: Failed, Retrying(3) Ping : 10.27.27.6 DEBUG Aug 03 01:50:52Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:52Z [17495]: Current Status : Live DEBUG Aug 03 01:50:54Z [17495]: Failed, Retrying(4) Ping : 10.27.27.6 DEBUG Aug 03 01:50:54Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:54Z [17495]: Current Status : Live DEBUG Aug 03 01:50:56Z [17495]: Failed, Retrying(5) Ping : 10.27.27.6 DEBUG Aug 03 01:50:56Z [17495]: GW (XXXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:50:56Z [17495]: Current Status : Live DEBUG Aug 03 01:50:58Z [17495]: Ping Result for : 10.27.27.6 DEBUG Aug 03 01:50:58Z [17495]: Ping : F DEBUG Aug 03 01:50:58Z [17495]: Current Status [GW(XXXXXXXX,Port2)] : Dead DEBUG Aug 03 01:50:58Z [17495]: Sleep for 300 Seconds NOTICE Aug 03 01:50:58Z [17495]: Actiontree, Live to Dead NOTICE Aug 03 01:50:58Z [17495]: Actiontree, executing: Live_To_Dead @XXXXXXXX DEBUG Aug 03 01:50:58Z [32352]: Executing Service : <gateway:gw_live_to_dead> args : <{"param":"@XXXXXXXX"}> DEBUG Aug 03 01:55:58Z [17495]: Initiating Ping : 8.8.8.8 DEBUG Aug 03 01:55:58Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:55:58Z [17495]: Success, Retrying(1) Ping : 8.8.8.8 DEBUG Aug 03 01:55:58Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 01:55:58Z [17495]: Current Status : Dead DEBUG Aug 03 01:55:58Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 01:55:58Z [17495]: Ping : S DEBUG Aug 03 01:55:58Z [17495]: Current Status [GW(XXXXXXXX,Port2)] : Live DEBUG Aug 03 01:55:58Z [17495]: Sleep for 300 Seconds NOTICE Aug 03 01:55:58Z [17495]: Actiontree, Dead to Live NOTICE Aug 03 01:55:58Z [17495]: Actiontree, executing: Dead_To_Live @AXXXXXXXX DEBUG Aug 03 01:55:58Z [1843]: Executing Service : <gateway:gw_dead_to_live> args : <{"param":"@XXXXXXXX"}> DEBUG Aug 03 02:00:58Z [17495]: Initiating Ping : 8.8.8.8 DEBUG Aug 03 02:00:58Z [17495]: GW (XXXXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 02:00:58Z [17495]: Success, Retrying(1) Ping : 8.8.8.8 DEBUG Aug 03 02:00:58Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 02:00:58Z [17495]: Current Status : Live DEBUG Aug 03 02:00:58Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 02:00:58Z [17495]: Ping : S DEBUG Aug 03 02:00:58Z [17495]: Current Status [GW(XXXXXXXXX,Port2)] : Live DEBUG Aug 03 02:00:58Z [17495]: Sleep for 300 Seconds DEBUG Aug 03 02:05:58Z [17495]: Initiating Ping : 8.8.8.8 DEBUG Aug 03 02:05:58Z [17495]: GW (XXXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 02:05:58Z [17495]: Success, Retrying(1) Ping : 8.8.8.8 DEBUG Aug 03 02:05:58Z [17495]: GW (XXXXXXXX,Port2) : Waiting for reply DEBUG Aug 03 02:05:58Z [17495]: Current Status : Live DEBUG Aug 03 02:05:58Z [17495]: Ping Result for : 8.8.8.8 DEBUG Aug 03 02:05:58Z [17495]: Ping : S DEBUG Aug 03 02:05:58Z [17495]: Current Status [GW(XXXXXXXX,Port2)] : Live DEBUG Aug 03 02:05:58Z [17495]: Sleep for 300 Seconds
XG135w_XN03_SFOS 18.5.3 MR-3-Build408# ls -larth /var/cores -rw------- 1 nobody nobody 239.6M Aug 19 2020 core.httpd -rw------- 1 nobody nobody 132.7M Aug 31 2021 core.vncfreerdp drwxrwxrwt 2 root 0 4.0K Aug 31 2021 . drwxr-xr-x 39 root 0 4.0K Aug 3 06:41 ..
XG135w_XN03_SFOS 18.5.3 MR-3-Build408# df -kh Filesystem Size Used Available Use% Mounted on none 234.1M 8.9M 208.9M 4% / none 2.9G 24.0K 2.9G 0% /dev none 2.9G 48.2M 2.8G 2% /tmp none 2.9G 14.6M 2.8G 0% /dev/shm /dev/boot 127.7M 38.7M 86.3M 31% /boot /dev/mapper/mountconf 385.4M 75.2M 306.1M 20% /conf /dev/content 5.4G 585.6M 4.8G 11% /content /dev/var 46.5G 11.7G 34.8G 25% /var
Hi Shteki,Thank you for the update, it looks like the SXL server's responsible categorization is getting a timeout, I am suspecting NC-100418,But can you perform a quick advance shell lookup as per the KBA: https://support.sophos.com/support/s/article/KB-000037012?language=en_USAnd if it really fails then add a DNS host entry for URL is 4.sophosxl.net : https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/DNS/NetworkDNSHostEntryAdd/index.html
SXL
4.sophosxl.net
the lookup brought okay results - for example:
XG135w_XN03_SFOS 18.5.3 MR-3-Build408# nsxld -l bbc.com Raw Data: 0:1:30:NEWS 0:2:27:MEDIA_NEWS 0:3:2:LOW 0:5:41:PROD_NEWS Identified Categories: Web Category: News I've addeed the new DNS host entry for the sophos URL, we'll see what happens.
Sure, keep it under observation as of now. If the issue persist then have a service request raised with the Sophos support for further diagnosis !!