Sophos UTM 9.705-3 Intrusion Prevention

Hello,

I appear to be having some trouble with the Intrusion Prevention on my UTM. When I have Intrusion Prevention enabled, my network speeds are reduced dramatically. For example, my WAN connection; with and without Intrusion Prevention enabled:

Enabled - Download: 98Mbps
Disabled - Download: 206Mbps

I have tried changing various settings within Intrusion Prevention (whilst still having it enabled), but this made no improvement in the network speed. I had a look in the live-log whilst trying a speedtest and I had a large amount of this entry:

S5: Session exceeded configured max bytes to queue 1048576 using 1053000 bytes (client queue).

I tried doing some searches online for this but I can't seem to find anything other than it's nothing to worry about... but I'm pretty sure this is telling me what the problem is? Is it possible to increase the max bytes to queue? I'm currently using only 35% of 8GB RAM on this box.

Cheers,
Richard

  • Hello Richard,

    Thank you for contacting the Sophos Community!

    Please check out this KB and this KB on IPS tunning and some settings you can modify.

    Regards,


     
    Emmanuel (EmmoSophos)
    Community Support Engineer | Sophos Technical Support
    Sophos Support VideosProduct Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • Hi Richard,

    What tool are you using to measure speeds?

    What results do you get when you can try the following at the command line of the UTM?  Copy and paste as one block:

    cd /home
    wget raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py --no-check-certificate
    cc set ips status 0
    sleep 15s
    python speedtest.py
    cc set ips status 1
    sleep 30s
    python speedtest.py

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    I was using speedtest.net from a web browser for both tests, with and without Intrusion Prevention enabled.

    I've just ran that test there with Intrusion Prevention enabled:

    Retrieving speedtest.net server list...
    Selecting best server based on ping...
    Hosted by UltraNetworks (Aberdeen) [201.67 km]: 38.947 ms
    Testing download speed................................................................................
    Download: 64.44 Mbit/s
    Testing upload speed................................................................................................
    Upload: 19.92 Mbit/s

    Without Intrusion Prevention enabled:

    Retrieving speedtest.net server list...
    Selecting best server based on ping...
    Hosted by Sure Telecom (Douglas) [195.42 km]: 34.97 ms
    Testing download speed................................................................................
    Download: 98.78 Mbit/s
    Testing upload speed................................................................................................
    Upload: 20.19 Mbit/s


    The server seems to change when switching Intrusion Prevention on/off. If I try doing speedtest.net from a web browser and select a server nearer to me, I get 212Mbps download (with Intrusion Prevention disabled). With it enabled... I got 99Mbps.

    Cheers,
    Richard

  • Hi Emmanuel,

    I have looked at both KB articles, but unfortunately the problem is still occuring. The odd thing is that if I enable Intrusion Prevention but disable everything within... the problem still occurs?

    Regards,
    Richard

  • Download: 98.78 Mbit/s

    That makes me wonder if there isn't another issue causing your speed measurements to vary  What if you start the following at 6PM to test once every hour for 12 hours?

    for i in {1..11}; do python speedtest.py|grep Mbit; sleep 1h; done; python speedtest.py|grep Mbit

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    Just set this up now so I'll let you know the results. I'm not sure exactly what is wrong here as it only happens when I enable Intrusion Prevention. Even if I disable every setting within Intrusion Prevention, but still have Intrusion Prevention enabled... I still get the limited Download speeds.

    Cheers,
    Richard

  • Download: 106.59 Mbit/s
    Upload: 17.73 Mbit/s
    Download: 94.82 Mbit/s
    Upload: 20.20 Mbit/s
    Download: 90.58 Mbit/s
    Upload: 19.71 Mbit/s
    Download: 67.39 Mbit/s
    Upload: 19.85 Mbit/s
    Download: 84.04 Mbit/s
    Upload: 19.80 Mbit/s
    Download: 104.32 Mbit/s
    Upload: 14.04 Mbit/s
    Download: 90.97 Mbit/s
    Upload: 20.42 Mbit/s
    Download: 115.38 Mbit/s
    Upload: 20.07 Mbit/s
    Download: 103.59 Mbit/s
    Upload: 20.30 Mbit/s
    Download: 97.71 Mbit/s
    Upload: 20.69 Mbit/s
    Download: 106.73 Mbit/s
    Upload: 20.36 Mbit/s
    Download: 103.26 Mbit/s
    Upload: 20.28 Mbit/s

  • I've always assumed that the snort single instance was the crux of the speed test always capping at <=100Mbps problem.

    I upgraded to 9.705-3 this morning and decided to search to see if I could find problems anyone else was reporting so I could be aware in case I experienced similar issues, and saw this thread.

    In the past I've found some things Bob has mentioned about settings that helped tune IPS but I never got over 100Mb (like 105 would be the highest burst I would see)

    Today I decided to spend some time playing with settings and I found an odd anomaly.
    ****disclaimer I'm not an expert at Sophos UTM, I've been using since Astaro 'in 2007ish I think', but follow the recommendations of support, and then defer to Bob, be ready to assume your own risks****

    Prior to 9.705-3, I had already set my num_instances to 7 for my 8 cpu VM: (default = 0 which is supposed to be n-1)

    cc set ips num_instances 7

    Prior to 9.705-3, I had already adjusted my queue_length:

    cc set ips queue_length 16384

    Today I decided to play with max_queued_bytes and immediately saw the speed increase:

    cc set ips snortsettings max_queued_bytes 2097152

    The anomaly was when I changed my max_queued_bytes back to 0 I'm still getting 220+Mbps. I've rebooted the UTM to be sure it wasn't a fluke, and I'm seeing similar S5 logs for max bytes:

    2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Session exceeded configured max bytes to queue 1048576 using 1050867 bytes (client queue). 192.168.0.10 54928 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0x4e007
    2020:10:03-07:14:21 vue-utm9fw snort[5551]: S5: Pruned session from cache that was using 1060929 bytes (stale/timeout). 192.168.0.10 54446 --> 172.102.72.17 8080 (0) : LWstate 0x9 LWFlags 0xe007
    So I can't explain why now after being back to max_queued_bytes 0 I'm not seeing the same results as before, I'm not seeing any abnormal spikes in memory or cpu on my vsphere realtime charts.
    ****I am not advocating you do this****
    ****change settings at own risk****
    ****this reply is only to share my experience****
  • EDIT: 2020-10-06 Instead of using the link I provide here, use the one below found by Amodin and davery23.

    Excellent find, Dave!  I think the best thread here for such optimizations is Sascha Paris' old ASG Tweaking thread.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Bob, I wen to that ASG tweak link and page isn't found.  ;)  

    I'd like to start tweaking mine, as my UTM seems to be having the same thing on this release, and I've SSH'd into my UTM maybe twice ever.

    I found this one, but wasn't sure if that was the same one you were trying to link.

    UTM - 9.705 | Intel i3-4150 4th Gen Processor
    16GB Memory | 500GB SATA HDD | GB Ethernet x5



    link
    [edited by: Amodin at 2:14 PM (GMT -7) on 6 Oct 2020]