Internal NIC being reported as down periodically

Do you have NIC ports bridged but not both connected?  That may cause this error.

You might have a problem with that NIC port itself, you might want to try another port if you have it.

Double check your MTU as well.

oops, it's not the internet connected NIC that's a problem. it's (primarily) one of the 3 bridged ports for LAN use - 'eth1'. (I have 4 ports total.) I searched back through a week of kernel logs for "NIC Link is Down" and twice out of at least 2 dozen entries, it was 'eth0', another of the bridged ports for LAN use. 

Two of the 3 bridged ports are connected to windows 10 PC's (not sure which two and unit is at remote site), and the other has a Ubiquity Unifi AP connected to it. I know one of the PC's is shutdown periodically - would that cause NIC to go down? But then wouldn't it just stay down if it's related to that PC's status? Is NIC kernel message related to status of what's connected to it, or is it about internal connection to hardware?

I also see from searching for "NIC Link is Up" that the eth1 comes up at different speeds, 10,100,1000. In contrast to that, eth0 came back up at 100M both times it went down. (Is there a way to get more info from sophos as to what's connected to a port? not finding it but am new to sophos.)

To try another port I'd have to go to the site (with a switch in hand as 3 LAN ports are needed.) Is there anything more I can do remotely first?

MTU is 1500.

Jean, have you tried using tcpdump on eth1 to see what device is talking there?

Cheers - Bob

not familiar with tcpdump. googled it and it seems I would have to install it on the machine connected to eth1 (which I can only guess at this point as this is a remote site, and it might be an AP that would not be able to run it). Unless this tool available to run from sophos appliance? 

tcpdump is available in every UTM.  You can SSH into the UTM and do:

tcpdump -i eth1

That should give you the IP of the device active there.

Cheers - Bob

tcpdump is available in every UTM.  You can SSH into the UTM and do:

tcpdump -i eth1

That should give you the IP of the device active there.

Cheers - Bob

nice, now I just have to figure out why I can't ssh. I followed various instructions including https://support.sophos.com/support/s/article/KB-000038680?language=en_US and others and set the allowed networks to internal and the vpnnetwork I use. From the vpn LAN connection is refused and from a PC on the remote LAN (i.e. on internal network) no matter how many times I put the right password in, I get permission denied (password). I did set up shell to use password authentication and I did use loginuser instead of my webadmin userid (though I tried webadmin one for giggles too). I also changed the password to something easier in case I was just such a klutz with the first one. 

As this is going in a different direction, unless there's a quick sophos ssh newbie thing that you can point to, I'll look into starting a separate thread as it is something Id like to set up and be able to use.

I always use the RSA key approach explained at the bottom of that KB article, Jean, and login directly as root.

Cheers - Bob

got someone at other end to switch eth1 and eth0 network cable then started seeing eth0 kernel messages so looking like an issue with NIC on one of the machines.

Now, though I'm having lots of other problems. can't load webadmin, either through VPN (which was working but stopped working) or through UTM Manager, which says device is offline. had someone power cycle unit, VPN came back up temporarily but no access to webadmin via either channels. hadn't set up ssh yet so can't poke around that way.

more to come

By default, eth1 and eth0 are your internal and external ports.  So, when you switch them, nothing has changed as far as configurations.

SSH not working either with password or RSA. Instead of the expected first time alert with putty

I get 

I have the following allowed networks, which should cover it.

Did you get the 'Network error' after touching the [Yes] button, Jean?

Cheers - Bob

no. got it just trying to "Open" the putty session

I got a bit lazy here. Sorry about that. I just opened up a separate thread on trying to get SSH working...

https://community.sophos.com/utm-firewall/f/general-discussion/126584/can-t-get-ssh-access-working---utm-9

so this issue appears to be related to what ended up being memory problems. I had a number of weird, intermittent issues on top of this one so I decided to memtest things and several errors were reported. I've replace the RAM; memtested it - all good); and problem is not occurring anymore. Now there remains possibility it's an issue with one of the PCs at remote site plugged into one of the ports I bridged together (I had to pull unit out to do more testing) but either way I don't see it as a sophos UTM issue.

Thanks fir the replies