IPS update pattern drop packets

Hello GuiSeb ,

Thank you for reaching out to the community, may we know the Pattern download/installation interval set ?
If it is by default set to "2 hours", change that to "Daily" as a best practice so that it does not hamper your production environment. 

Hi,

thanks the interval is set to "15 minutes".

But by security, i prefer keep it like this. 

I don't know why connections are dropped now after installing but before not.

In that scenario would require to investigate the logs that during the pattern update why we receive the drop packets ?

It's a very long log... we create a case. we're waiting the support

Can you share the service request number ?

07068588

Thank you for the service request, will help expedite the case !

Hi,

Upon update with the case, the case handler is requesting for a remote session. 

Hi, 

As per the update on the case, the case handler is seeking confirmation. 

"I hope this email finds you well. just a quick follow-up email to see if you have observed any packet drops during the update of IPS signature patterns after disabling the fast path?"

We create a case ! And we can't test with disabling the fast path.

Because when the fast path is disabled, we have garner process take 200 % of cpu usage, and all the dashboard is very slow.

Thanks

Hi GuiSeb,

Thank you for the information. I'll inform this information with the case handler about it.

Hi GuiSeb  Below is the summary of the case:

IPS restart/reload after IPS patterns update is the expected behavior and during this restart/reload few packet drops are observed for a while, Change on the OS side is planned in upcoming versions (no ETA) to prevent this behavior. The workaround would be to disable firewall acceleration if really needed to be applied.

Hi GuiSeb  Below is the summary of the case:

IPS restart/reload after IPS patterns update is the expected behavior and during this restart/reload few packet drops are observed for a while, Change on the OS side is planned in upcoming versions (no ETA) to prevent this behavior. The workaround would be to disable firewall acceleration if really needed to be applied.