Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 4 subscribers
  • Views 5278 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SG210 stops passing https traffic

csf45

We have an SG210 currently running fw version 9.605-1 but the problem has been happening for more than a year so I don't really think the fw version is important. What happens is at random times web traffic just completely stops and sites time out. We are not using decrypt and scan for https traffic. I've tried disabling web filtering completely, as well as IPS, virus scanning, and ATP one at time and all at once but it still drops out. The problem seems to very random it can happen 2 or three times a day or once every two three weeks. To get it back up I can either reboot the utm, disable the WAN interface /or pull the WAN cable for about 20 - 30 seconds and everything goes back to normal. The live logs don't really show much when it's happening other that a bunch of sites timing out. The problem only pops up during working hours and I can't get much troubleshooting in with the phone ringing off the hook and people coming to my office to tell me its down again. Has anyone else had this problem or have any suggestions on what to look at?



This thread was automatically locked due to age.
  • 0 in reply to csf45

    Not getting anywhere on my own, opened a support ticket this morning, I'm sure they'll get it sorted out.

  • 0 in reply to csf45

    In case anyone was curious how this turned out, I have been working with SOPHOS support since the last time I posted. We didn't come up with anything that helped so they overnighted me another unit last week to rule out a hardware issue, but we are still experiencing the same problem. So I decided to try running Wireshark on the WAN side of the SG to see if I could figure anything out when the issue was actually happening. Had to purchase a small managed switch out of mine pocket to do it since we didn't have any extra that were gigabit. So Monday we had the issue 3 times and I got captures of all of them. What I found was when we are having the issue of not being able to load any https sites we are sending out tons of TCP Retransmission packets from our IP destined to tcp port 443. When we aren't having the problem you only seen them sporadically but when it's happening its big blocks of consecutive lines. I'm thinking this means our requests aren't getting to their destination (dropped/ lost) or the acks are getting dropped/lost outside our network. Contacted our ISP and gave them the pcap but not getting anywhere with them.

Unfiltered HTML