Thread Info
  • Locked Locked
  • Replies 66 replies
  • Subscribers 26 subscribers
  • Views 223664 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Disable bad bugfix in 9.405-5 "Fix [NUTM-2840]: [AWS] UTM ignores MTU sent by DHCP server"

Vegard77Norway

Do not do this if you don't feel comfortable messing up your UTM. 

I'm pretty shure this voids the warranty.  But my UTM is pretty useless using a MTU of 576 from my ISP.

The 9.405-5 upgrade introduces a mandatory, non disable, usage of the MTU provided with DHCP, if one is provided.

A lot of us have ISP's that provide bad MTU values. Like my own ISP giving a MTU of 576 (Confirmed with wireshark).

This is what you need to do to disable the usage of MTU from DHCP. Beware, you will be touching the system, and also.. it will not update MTU based on any DHCP.

(I'm not telling you how to get into the UTM, if you don't know... you have no business being there... better wait for the fix.)

In the 

/var/chroot-dhcpc/etc

There is a file named: default.conf

cat default.conf

interface "[<INTERFACE>]" {
timeout 20;
retry 60;
script "/usr/sbin/dhcp_updown.plx";
request subnet-mask, broadcast-address, time-offset,
routers, domain-name, domain-name-servers, host-name,
domain-search, nis-domain, nis-servers,
ntp-servers, interface-mtu;
[<HOSTNAME>]
}

"interface-mtu" : If you remove that (not the following ;!!!), and take your interface down/up, your MTU is possible to edit by hand again in the GUI.

AND ... it will use the number you give it, not the dumb MTU value one of your ISP's let be in their equipment because they did not bother to change it.

Finally I have a UTM back up and working, and I can get back to business.



This thread was automatically locked due to age.
  • in reply to Martin Murray

    That's certainly unfortunate. I was lucky in that the MTU setting caught my eye pretty quick so I was able to mitigate the downtime. I also only have a handful of clients that aren't on dedicated fibre connections so I'm obviously not in harm's way like you seem to be. I can honestly say I've never had to factory reset a UTM (other than wiping settings) so for me it's been a one time set it and forget it thing. I do agree this should be patched permanently. Don't know why they haven't been forthcoming in doing that. Perhaps this discussion can help.

  • in reply to plecavalier

    Yes, it's strange that they can't seem to fix this.

     

    Or at least make sure everyone in Sophos Support knows about it.

     

    And put a note in the GUI that the MTU setting can only be changed in CLI.

     

    But fixing it would be best :)

  • in reply to Martin Murray

    In V9.509, you can set the MTU on every interface type.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • in reply to BAlfson

    Hi Bob,

     

    You could change the Internet MTU in the GUI to whatever you wanted but it wouldn't stick unless the changed the settings in the CLI.

    If you didn't change the CLI, then leaving the MTU page then returning, the MTU would change back to its original setting.

    You have to change this:

    to

     

    Unless Sophos have changed these settings in CLI?

  • in reply to Martin Murray

    You're right, Martin, that it's not something you can do in WebAdmin.  I saw the recommendation to use cc in an interactive mode.  Instead, I would do the following:

    Find the REF_ of the Interface object named, for example, External (change ethernet to pppoe, pppoa or other if the following returns no result):

    cc get_object_by_name interface ethernet External |grep \'ref\'

    Say that returned REF_IntEthExternal:

    cc change_object REF_IntEthExternal mtu_auto_discovery 0

    If that returns REF_IntEthExternal, the change was successful.  Then change the MTU to 1500 in WebAdmin.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • in reply to BAlfson

    This just came back for me. I can only assume it comes from 702 but have no proof at the moment.

Unfiltered HTML