Sophos Red SD-60 Poor lan speeds one way

Hi Philipp, i've changed both the RED to 1280 and the workstation testing MTU to 1280, no change, also tried lower but still no change, Sophos was on the line today with still no fix, they were concerned regarding the "TCP segment of a reassembled PDU" message from with Wireshark.

Hi Kent,

it is not that easy, but I try: in principle every component along the route can cause your bottleneck with an MTU size being too small.

You could start with the tunnel definition for the RED. But you should then reduce the MTU of the clients behind that tunnel as well.

We had a customer with Telekom DSL and RED, some homeoffices ran without any problems, other sites had to be reduced to 1280 bytes at the RED tunnel definition. It depends from site to site for him.

For Windows-Clients, we have a script to set the MTU, that I could send you.

You could start with 1280 and then try to get to higher numbers.

Hi Emmanuel, we have already run this command with no change

Hello Kent,

Thank you for the Case ID.

Can you run this command from the console of your Sophos Firewall and  try again the to replicate the issue:

console> set ips ac_atp exception fwrules 2

Substitute the 2 for the Firewall rule you are using to pass traffic from the RED to the LAN.

This command disables any additional check that the Sophos Firewall does for IPS; this would help rule out the issue with the Firewall side.

Regards

Hi Philipp, just on the red side? - any recommendation on what to lower it to?

Kent.

Maybe it's fragmentation happening here. Try to lower MTU size on the links.

This would explain to me that the packets coming out of order.

Response from Sophos - I have reviewed the logs and the only thing suspicious is the TCP Out Of Order captured on Wireshark. I have checked Wireshark Q&A, and that error probably indicates there are multiple paths between source and destination - and one travels a through a longer path. It means TCP has slightly more work to reassemble segments in the correct order. I have checked raw tcpdump and not seeing any other path the traffic is traversing.

Not sure where to go from here. will wait for an update, ETA is march 2nd.

Could be an MTU size problem with one of the used uplinks.

CaseID: 06220394

Should have some update by EOB today.

Hello Kent,

Thank you for contacting the Sophos Community.

May we know the Case ID you have with Support so we can check what has been done?

Regards,