This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS update pattern drop packets

Hi,

we have a SFOS 19.5.3 MR-3-Build652 and since few weeks, when the ips update the patterns, the sophos firewall drops all the packets for 30s.

It will never do that before .

Is this a bug ?

Thanks

Regards,

This thread was automatically locked due to age.

Top Replies

Vivek Jagad over 1 year ago +1 suggested

Hello GuiSeb , Thank you for reaching out to the community, may we know the Pattern download/installation interval set ? If it is by default set to " 2 hours ", change that to " Daily " as a best practice…

0 Vivek Jagad over 1 year ago

Hello GuiSeb ,

Thank you for reaching out to the community, may we know the Pattern download/installation interval set ?
If it is by default set to "2 hours", change that to "Daily" as a best practice so that it does not hamper your production environment.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 GuiSeb over 1 year ago in reply to Vivek Jagad

Hi,

thanks the interval is set to "15 minutes".

But by security, i prefer keep it like this.

I don't know why connections are dropped now after installing but before not.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to GuiSeb

In that scenario would require to investigate the logs that during the pattern update why we receive the drop packets ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 GuiSeb over 1 year ago in reply to Vivek Jagad

It's a very long log... we create a case. we're waiting the support
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to GuiSeb

Can you share the service request number ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 GuiSeb over 1 year ago in reply to Vivek Jagad

07068588
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to GuiSeb

Thank you for the service request, will help expedite the case !

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 1 year ago

Hi,

what is your hardware? The reason I ask is because I have a XG115W which suffers the same issue when using the 15 minute update and the recommendation was reduce the updates to every 12 hours. I currently update every 4 hours which does not seem to affect the users that much.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan over 1 year ago in reply to Vivek Jagad

Hi,

Upon update with the case, the case handler is requesting for a remote session.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan 11 months ago in reply to GuiSeb

Hi,

As per the update on the case, the case handler is seeking confirmation.

"I hope this email finds you well. just a quick follow-up email to see if you have observed any packet drops during the update of IPS signature patterns after disabling the fast path?"

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel