FW Log "Could not assocate packet to any connection" when IPS enabled

If possible then please share ips log screenshot.

I suspect this has something to do with conntrack entries because I have the same problem after running the initial configuration wizard and I am not using IPS at all.

Here is my default rule with only web filtering enabled that is why there are only ssl erro entries in my firewall rules.

Hi Apurv,  IPS log is completely empty

same problem, lots of dropped traffic and ips log is empty.

I had the same issue, saw tons of the invalid data, web was extremely slow and some pages kept timing out. Browsing web through work VPN was not an issue but all house sites didn't work. So I had to revert back to 16 for now. 

I have the same problem when trying to watch Netflix. It worked for about an hour when watching a film and now these errors occur immediately even 12 hours later.

def seems like the IPS module needs looking at, ive not seen any log entires at all.

JK

I put my IPS in lowmem mode and it helped.  but i doubt it will work for people using high spec HW.

Hi folks,

it appears to be mail and web proxy errors as far as I can see on my XG.

Ian

As I mentioned earlier, these are conntrack entries that are expiring. Has nothing to do with IPS module otherwise the logs would be in IPS and not Firewall. The default timeout for conntrack is set to 3 hours(10800 seconds) in this beta... I haven't used XG in a few MR releases so don't have any way of looking at older default values to compare with. Also don't know if conntrack invalid packets were actually logged in the GUI before and that is why we never saw them before.

You can change the value to something higher on the console by using 

set advanced-firewall tcp-est-idle-timeout 21600 (for 6 hours)

For reference on current UTM9.5, the value is

ip_conntrack_tcp_timeout_established' => 86400

If anything, they need to tune the logging so that the same entries are only repeated once every x amount of seconds in firewall logs.