Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 62 replies
  • Answers 2 answers
  • Subscribers 50 subscribers
  • Views 192551 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SFOS 16.01.0 known IPS issue - Work arounds?

Darrian Churchill

Hey all,

Anyone have any other work around for the known IPS issue (NC-8238   [IPS] IPS Service drops legitimate traffic in very high load average conditions)? The IPS service seems to constantly fail to start and causes this issue from what I can see (CPU usage and memory usage spike all over the place). As my work around, I set the IPS service to Stop, performance and traffic return to normal. Obviously this isn't a great solution... Anyone have anything better? 

I'd like to know when this will be resolved too, seems to me to be a rather big problem. I may actually just roll back to 15 if this is going to be a thing for a while.

Thanks !!



This thread was automatically locked due to age.
Parents
  • +1

    HI All

    I may have a Work aournd  by changing the IPS settings , As this is a Workaround

    Default IPS settings

    stream on
    lowmem off
    maxsesbytes 0
    maxpkts 100
    enable_appsignatures on
    http_response_scan_limit 65535

    Run Commands on Console 

    set ips maxsesbytes-settings update 8192
    set ips maxpkts 8

    IPS settings after changes 

    -------------IPS Settings-------------
    stream on
    lowmem off
    maxsesbytes 8192
    maxpkts 8
    enable_appsignatures on
    http_response_scan_limit 65535

     This should help..

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Aditya Patel

    I've just installed SFOS 16.05.1 MR-1 and the issue seems to be fixed. I will monitor for a couple days and reply again, but it does look like its a lot better already - the service stays running now instead of flapping up and down. 

    Will be sure to reply again with feedback in a couple days.

  • 0 in reply to Darrian Churchill

    Thanks for letting us know Darrian - is this a BETA release? My appliances say 'no updates available' for 16.01.2

  • +1 in reply to DaveHamer

    Dave,

    first download and apply the 16.05 gpg package and then move to MR1. You can download the gpg from community or from your Sophos Account.

  • 0 in reply to lferrara

    I admit, I couldn't find the 16.05 download, but I was able to install 16.05.01 MR1 straight from my previous 16.01.2 installation. I'm not saying that will work all around, but did for me. 

    I note - while the IPS service was more stable earlier, it seems to have reverted to its flapping unable to keep running behavior. I'm going to fiddle with the IPS config, and will report back. 

Reply
  • 0 in reply to lferrara

    I admit, I couldn't find the 16.05 download, but I was able to install 16.05.01 MR1 straight from my previous 16.01.2 installation. I'm not saying that will work all around, but did for me. 

    I note - while the IPS service was more stable earlier, it seems to have reverted to its flapping unable to keep running behavior. I'm going to fiddle with the IPS config, and will report back. 

Children
No Data
Unfiltered HTML