This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

TCP Disconnect with IPS-Pattern updates ??

We have some customers who use quite sensitive software.
We have had repeated session drops with one customer (always at noon on Tuesdays -GMT-)
The IPS patterns are said to have been updated at this time today.
IPS is only active for some external connections. Not for the "sensitive" internal ones.
They are running version 20.0.1 MR1
Could there be a connection?

Thanks Dirk

This thread was automatically locked due to age.

Top Replies

LHerzog 3 months ago in reply to LuCar Toni +2 suggested

isn't it so that the traffic "always" flows through IPS/DPI? You could exclude the firewall rule only for the sensitive traffic from inspection. Maybe that's a workaround? set ips ac_atr exception fwrules…

Parents

0 Mayur Makvana 3 months ago

Hello,

Thank you contacting the Sophos Community!

As per the description, I believe it may not be the IPS which could be causing an issue. As if the IPS would be dropping the traffic in that case it will continue to drop if any matching signature triggered.

We suggest collecting below logs from the advance shell and saving them on putty.

1. tcpdump -nei any host destIP

2. Conntrack -E

3. Packet capture using KBA: https://support.sophos.com/support/s/article/KB-000037007?language=en_US

4. Collect the drop packet using KBA: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/index.html#drop-packet-capture

With this information, I would suggest raising the support case to take it further.

Mayur Makvana
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 Mayur Makvana 3 months ago

Hello,

Thank you contacting the Sophos Community!

As per the description, I believe it may not be the IPS which could be causing an issue. As if the IPS would be dropping the traffic in that case it will continue to drop if any matching signature triggered.

We suggest collecting below logs from the advance shell and saving them on putty.

1. tcpdump -nei any host destIP

2. Conntrack -E

3. Packet capture using KBA: https://support.sophos.com/support/s/article/KB-000037007?language=en_US

4. Collect the drop packet using KBA: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/index.html#drop-packet-capture

With this information, I would suggest raising the support case to take it further.

Mayur Makvana
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 dirkkotte 3 months ago in reply to Mayur Makvana

Since this happens once a week (so far), it is not easy to capture the correct traffic.
The only thing we see... the moment of disconnection (multiple devices losing connection to servers and devices at the same time) matches the time of an IPS pattern update (Timestamp of Last successful update of IPS and Application signatures)

From SG we know the "Restart policy - Bypass IPS scan".
Maybe there is something similar at XGS?
But I have a lot of customers using this software and IPS for external connections and never I saw such problems before 20.0.MR1

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mayur Makvana 3 months ago in reply to dirkkotte

Hello,

It is advisable to raise the support ticket and share it with us to priotarize. We shall help you with the commands which you may run to collect the logs.

Mayur Makvana
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte 3 months ago in reply to Mayur Makvana

Unfortunately, we have confirmation.
With the IPS pattern update yesterday, the connections were disconnected again.

Because support handling is not simple ... (isolated "critical infrastructure")
What could the support engineer do?
The relation to the IPS is clear. What else could be in a log file?

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel