This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Latest KB's] Sophos UTM: MTU error on HA interface

Hey Community,

In some scenarios, HA is configured between two locations. The most reported problems are link problems because the Master node cannot find the Standby node. An issue can also occur wherein the HA link is flooded by a large amount of traffic. This is a typical case scenario where the PMTU is overlooked by the UTM due to jumbo frames.

Example logs:

16:05:04.036177 00:1a:8c:65:52:4e > 01:00:5e:00:00:32, ethertype IPv4 (0x0800), length 2010: 198.19.250.1.36339 > 225.0.0.50.3780: UDP, length 1968 16:05:04.036186 00:1a:8c:65:52:4e > 01:00:5e:00:00:32, ethertype IPv4 (0x0800), length 2006: 198.19.250.1.36339 > 225.0.0.50.3780: UDP, length 1964 16:05:04.036194 00:1a:8c:65:52:4e > 01:00:5e:00:00:32, ethertype IPv4 (0x0800), length 2002: 198.19.250.1.36339 > 225.0.0.50.3780: UDP, length 1960

This can occur due to the following:

All large multicast packets (> 1500 bytes) from the Master node which are somehow not received by the Standby node will result in re-transmission. These large packets are control messages, i.e. they are not connection tracking or connection expectation.
Since the Standby node does not receive these large packets, it cannot respond to the Master node. Hence, this results in the Master's re-transmission of these large packets.

This article provides information regarding the interface settings for the UTM HA cluster and how to resolve the MTU error for the HA interfaces.

Regards,

This thread was automatically locked due to age.