RDP freezes for 5-10 seconds

Hello VTH ,

Thank you for reaching out to the community, currently the XGS 2300 is active on which firmware ?
As in Version 19.5 GA Build 197, the following issue were fixed:

By default IPsec acceleration is disabled on all appliances except XGS. 

XG135w_XN03_SFOS 19.0.0 GA-Build317#

console> system ipsec-acceleration show
IPsec acceleration isn't available on XG Series hardware, virtual, software, and cloud devices.

console> system ipsec-acceleration enable
IPsec acceleration isn't available on XG Series hardware, virtual, software, and cloud devices.

Additionally you may refer - Sophos Firewall: MSS Clamping and IPsec Acceleration & Sophos Firewall: Connection fails for remote access IPsec clients when IPsec acceleration is turned on

So we are using:

Sophos Firmware Version: SFOS 19.5.3 MR-3-Build652                              
Model: XGS2300                                                                  
Hostname: Firewall1                                                          
HA node name: Firewall1                                                      
Current status: Primary (Active) from 10:34:09 PM, Dec 20, 2023                 
                                                                          
console> system ipsec-acceleration show                                         
IPsec acceleration status: turned on   

The links you posted are mentioning tcp but all remote desktop traffic is udp

Ok, I've tested some more and can exclude ipsec problems.

We have a Cloud Server that is accessible without ipsec tunnel and I established a remote desktop session and just fooled around a bit and everytime the connection lags I see the sophos firewall reporting incoming udp packets from src port 3389 getting blocked.

Can you check this KB article and see if it helps ?

support.sophos.com/.../KB-000041197

Hi, whats the downside of this command?

Firewall shows that  vpn conn-remove-tunnel-up enabled at the moment.

It is disabled per Default on all newer installations and even V20.0 will disable this command. So likely you can safely disable it. 

done. I will keep you updated if it changed anything.

Problem is solved with a strange outcome.

The Hyper V Host had a BIOS Problem which effected the CPU frequency so it would not boost correctly. The CPU was able to hit 2,6Ghz but was mostly stuck at 1,2GHz which caused the VM to drop packets and lag out. So it was a VM problem which caused a firewall problem because packets were sent late etc.

Thanks for your support.

yes we had also the RDP freeze on the ssl vpn. We could clearly observe the source port 3389 drop after the freeze. This at each IPsec vpn  terminated status. The command "set vpn conn-remove-tunnel-up disable"  disable the activ udp session flush.