Connections are dropped with "Could not associate packet to any connection." or "Invalid packet." several times a day for 1-3 minutes

Hi everybody,

Since EAP1 i got problems with normal connections (ips=off, no proxy, dpi=completly disabled) over the firewall.

Connections were dropped with "Could not associate packet to any connection." or "Invalid packet." in live log for http, https, ftp and maybe VPN connections (never tried any other protocol)

I can hit "reload" in browser but nothing happens.

After a minute up to 3 minutes it works again. There's nothing to find in any log but only the "Could not associate packet to any connection." message in fw-log.

Same thing happens a few times a day on different computers, but i don't know if all computers are affected at the same time, because the timeframe is to short to find out.

It's annoying. I wanna go back to 17.5.

Chris

(UTM and XG architect, but not happy with his XG115, even with EAP3)

0 LuCar Toni over 4 years ago

You got this issue also in V18 EAP3? Do you have the ATP enabled?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Sievers over 4 years ago in reply to LuCar Toni

Everything is off in rules for testing. Only Logging is enabled.

ATP is on, but no new entry in log for the last 2 weeks.

Testing now with a exception for my computer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni over 4 years ago in reply to Christian Sievers

Could you disable ATP completely and retest?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Sievers over 4 years ago in reply to Christian Sievers

Same problem with ATP Exception. Now turning ATP completly off.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Sievers over 4 years ago in reply to Christian Sievers

Same problem with ATP disabled.

85% Memory in use (XG115 with 4GB, 2x APX120)

Maybe the problem is in context with the new sdwan feature. (I have 2 wan connections.)

But there is a policy to use only the primary wan for this ip and use the second wan only as a backup.

I'm very unhappy with v18 so far....
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni over 4 years ago in reply to Christian Sievers

Do you have a drop packet capture of those blocks?

Do you use STAS or some sort of authentication?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Sievers over 4 years ago in reply to LuCar Toni

STAS was only used in a specific rule for another computer.

Now:

- disabled STAS (clearing configuration completly)

- stopping IPS

- stopping Hotspot

Nothing more left to disable. Next try is replacing the XG with a simple patchcable.

But: Memory use is down to 65%.

Testing again and try to catch some packets...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni over 4 years ago in reply to Christian Sievers

To be sure, we would need a drop packet capture of those "real" drops to find the Root cause of this issue.

A tcpdumo would be nice.

You "could" actually write a packetfilter.log like UTM at your own, if you want to.

Simply place following command in the background and watch your Disk Space.

drppkt > /tmp/drppkt.log &

Disable the command by killing it. https://linux.die.net/man/3/kill

killall drppkt

The & will place it in background.

Drppkt logs each packet in the log file. If your issue occurs, simply open this file with less and jump to the timeframe.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel