We have an issue with an XG-125 running MR3. Every time it does an ATP or IPS update, it blocks all traffic for two minutes.
Any suggestions would be welcome, I have opened a tech support case (03253973) with 'High' priority five days ago but haven't had a single response yet.
After a talk with the support, I've found out anything that makes the IPS (Snort) service restarts will make your firewall drop packets.
Well, I've been facing a issue where creating a custom…
I've looked into this further but it doesn't seem to be limited to that one site. I checked our own site and that dropped all traffic for about 40s during an ATP update (I presume it was for a shorter period because it is an XG 230 and the update would have completed quicker).
Well, I've been facing a issue where creating a custom IPS signature, Snort would restart bringing a lot of packets down with it, after a while I've saw the same thing happens over IPS/ATP updates. This issue is a lot more noticeable on low-end CPUs since It takes a while to restart Snort.
In v17.5 It would primarily drop only the traffic that had IPS within a policy, now on v18 It's even worse because if your doing TLS Decryption half of the decrypted traffic gets dropped and you have to refresh the entire page over the browser.
The answer by them has - some traffic will get dropped while restarting Snort, so they will add this information at the Docs.
Thanks for the info Prism
So, in summary, the way they handle updates is crap and their solution to the problem is to document the fact it is crap!
If that is the behaviour then an obvious solution is to be able to specify a time period to check for IPS and ATP updates, then it can be scheduled out of hours. All you can do ATM is turn automatic updates on or off.
JasP said:If that is the behaviour then an obvious solution is to be able to specify a time period to check for IPS and ATP updates, then it can be scheduled out of hours.
Well, don't hold your breath.
People have been asking this since 2016, by the rate that things are moving we will see this really advanced feature by the year 2026.