topic Re: SMB random reboot, especially during IPS Update time in Firewall and Security Management

SMB random reboot, especially during IPS Update time

starmen2000 — Sat, 15 Jul 2023 08:20:52 GMT

Hi mates,

A customer has so many SMB 1500s in branch offices. And often the SMB gateways reboot randomly. Especially at night during IPS update time. Sometimes device does not come back, so no connectivity, in that case we have to reboot the device. Because of SMB device, we could not troubleshoot so much. As we generate Dr Spark report, it only shows the info at the time the report was executed. Any suggestion for further troubleshooting? or anyone expereinced this issue?

Thank you

Re: SMB random reboot, especially during IPS Update time

Chris_Atkinson — Sat, 15 Jul 2023 11:02:14 GMT

Have you tested R81.10.07 on any of the troublesome devices?

Re: SMB random reboot, especially during IPS Update time

starmen2000 — Sat, 15 Jul 2023 11:04:24 GMT

Not yet. All of them has R81.10.05 Version. Do you think, that Software upgrade might help?

Re: SMB random reboot, especially during IPS Update time

E_DDY — Fri, 09 Feb 2024 08:23:01 GMT

Hi Starman,

We faced the same issue with IPS Updates.
We solved this by changing the IPS Update Policy on the SMB Appliance to "Use IPS Management Updates".

Hope this helps

Re: SMB random reboot, especially during IPS Update time

K_R_V — Fri, 09 Feb 2024 09:29:20 GMT

The root cause may not be IPS update, but a restart of SFWD.

We have observed an issue with the SFWD process across all our 15XX firewalls. The process gradually consumes more memory until it reaches a specific threshold (sfwd_periodic_memory_rss), at which point SFWD is automatically restarted. It's worth noting that a restart of SFWD also triggers an IPS update.

According to Check Point R&D, it is considered normal for a process to not release memory and undergo several restarts throughout the day. This behavior leads to the consequential IPS updates.

In this scenario, it appears that SFWD is the primary concern, and the IPS update is merely a byproduct of the SFWD restarts.Do you also see SFWD often restarting ? ( cpwd_admin list to see the start time )

According to Check Point, R81.10.08 build 1711 is the stable version at this moment, so best to upgrade.