This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS 3100 becoming unresponsive and requiring hard restart

We have an XGS 3100 which approx. every 1-2 weeks becomes unresponsive and requires a hard restart as it completely stops functioning. We have a smart plug connected now, which automatically powers it off and on again if the network goes down to mitigate the issue.

How can I find the cause of the issue? We've had a replacement device from Sophos but with the same config the issue persists.

Our network is on 255.255.254.0

We have configured IPSEC and SSL VPNs

We use a Horizon VOIP system which required us to increase the UDP NAT timeout to 600s, and disable SIP.ALG

We have a web/ftp server in the DMZ

All I can think to do is to reconfigure it myself from scratch on a weekend, as I don't know what other admins may have previously done with it. But I'd really prefer not to.

This thread was automatically locked due to age.

Top Replies

MichaelBolton 6 months ago in reply to Vivek Jagad +1

Vivek Jagad I am also interested in the details of NC-132941. It is not listed in the known issues list. Can you please provide more details?

Parents

0 Vivek Jagad 6 months ago

Hello Admin O'Mara ,

Thank you for reaching out to the community, suspecting a known issue - NC-132941, to get this validated please log a service request, so that we can expedite the process of resolution.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 6 months ago in reply to Vivek Jagad

Thank you, I've logged a service request. Where can I see the details of NC-132941?
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 6 months ago in reply to Admin O'Mara

Hi Admin O'Mara could you please provide us the support case id ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 6 months ago in reply to Vivek Jagad

I've set up support access. Is it safe to post the ID here? I tried to PM you but it wouldn't allow me!
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 6 months ago in reply to Admin O'Mara

Not here, please private message me Admin O'Mara

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan 6 months ago in reply to Admin O'Mara
Hi Admin O'Mara,

Upon checking case 07315511, the case handler is seeking assistance from your side with the following queries.

Could you keep one appliance/ laptop in the firewall's serial console so we can get the logs in detail when an issue occurs again?

As per the logs, we also found the issue in March during the below time stamp. Could you confirm if you received an alert during this time as well?
Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 6 months ago in reply to Erick Jan

Hi Erick,

Unfortunately I'm only in the office on Tuesdays, but I can set up a serial connection on Tuesday. Once it's connected, what should I do to get the logs on the connected computer?

I don't see a timestamp in your post, but looking at previous email alerts it occurred on the 15th March at 16:24, the 20th March at 13:20, the 25th March at 13:41 and the 27th March at 10:49
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Admin O'Mara 6 months ago in reply to Erick Jan

Hi Erick,

Unfortunately I'm only in the office on Tuesdays, but I can set up a serial connection on Tuesday. Once it's connected, what should I do to get the logs on the connected computer?

I don't see a timestamp in your post, but looking at previous email alerts it occurred on the 15th March at 16:24, the 20th March at 13:20, the 25th March at 13:41 and the 27th March at 10:49
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Erick Jan 6 months ago in reply to Admin O'Mara

Hi Admin O'Mara,

Upon update of the case, this has been escalated to our L2 Engineer, who will contact you for further guidance and troubleshooting.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 6 months ago in reply to Erick Jan

Thanks Erick
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan 6 months ago in reply to Erick Jan

Hi,

Upon checking the case, our GES has activated the script and informed you to let us know directly in case of another failure.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 5 months ago in reply to Erick Jan

Hi Erick,

We haven't had the issue re-occur since logging it, it's may or may not still be an issue. It has been over 3 weeks between occurrences in the past. I have disabled L2TP VPN and added a matching NAT rule for a firewall rule that didn't previously have one, so it's possible the issue was related to one of those things if it doesn't come back.

Kind regards,

John
Cancel
Vote Up 0 Vote Down

Cancel
0 Admin O'Mara 5 months ago in reply to Admin O'Mara

The issue has just re-occurred, so that didn't fix it.
Cancel
Vote Up 0 Vote Down

Cancel