Hello, we switched from a Zyxel Firewall to a XGS126 . Sinced we switched we have the problem, that gpudate takes a lot of time SSL UDP: 6-10 minutes SSL TCP: >30 minutes IPSec: 6-10 minutes In firewallrules we opened from VPN to LAN all Ports for AD: Link - Ports for AD With our old Zyxel VPN100 with SSL we took < 2Minutes for an update. Is this normal or any ideas what we can try to accelerate this process?

Hello Community, To update this thread, the case is now closed. As per the ticket the resolution was the following: "gpUpdate was slow because queries on AD were failing, the customer disabled the NetBios on AD after that speed was better." Regards,

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS126 gpupdate took a very long time via VPN

Steve Reschke 9 months ago

Hello,

we switched from a Zyxel Firewall to a XGS126 . Sinced we switched we have the problem, that gpudate takes a lot of time

SSL UDP: 6-10 minutes
SSL TCP: >30 minutes
IPSec: 6-10 minutes

In firewallrules we opened from VPN to LAN all Ports for AD: Link - Ports for AD

With our old Zyxel VPN100 with SSL we took < 2Minutes for an update.

Is this normal or any ideas what we can try to accelerate this process?

This thread was automatically locked due to age.

Top Replies

emmosophos 7 months ago in reply to emmosophos +1 suggested

Hello Community, To update this thread, the case is now closed. As per the ticket the resolution was the following: "gpUpdate was slow because queries on AD were failing, the customer disabled the…

Parents

0 Erick Jan 9 months ago

Hi Steve,

Thank you for reaching out to Sophos Community.

Kindly check the following KB which might assist you regarding the slow speed.

Sophos Firewall: Troubleshoot VPN speed

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Steve Reschke 9 months ago in reply to Erick Jan

Hello Erik, thank you for the answer. Yes we tried all points from your link.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos 9 months ago in reply to Steve Reschke

Hello there,

Can you enter the following commands directly from the Advanced Shell (5>3)of the Sophos Firewall

iptables -t mangle -I POSTROUTING -s 172.20.10.0/24 -d 10.10.0.0/16 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1300;

iptables -t mangle -I POSTROUTING -s 10.10.0.0/16 -d 172.20.10.0/24 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1300;

Just substitute the networks according to your subnets, if the issue persists after this, please open a case reference this Thread and let us know the Case ID.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Steve Reschke 9 months ago in reply to emmosophos

I tried for IPSec. Not very sucessfull but faster (value above for IPSec is wrong. It tooks about 30 minutes.

1st try: 5 minutes
2nd try: 12 minuten
3rd try: 16 minutes (with abort of computerpolicies)

I opened a case (07224519)
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan 9 months ago in reply to Steve Reschke

Hi Steve,

Thank you for sharing the case ID.Will put a note on your case ID.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Erick Jan 9 months ago in reply to Steve Reschke

Hi Steve,

Thank you for sharing the case ID.Will put a note on your case ID.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data