topic Getting frequent disconnection on R80.20 in Firewall and Security Management

Getting frequent disconnection on R80.20

Blason_R — Tue, 12 May 2020 12:16:14 GMT

Hi,

I am on R80.20 with HFA 141 and mgmt on R80.30. Users are suddenly started experiencing disconnection is sessions. Mostly RDP or SAP connections are getting disconnected.

I immediately have stopped fwaccel due to which the frequency of session disconnection is very less now however in about 4-5 hours their session gets disconnected.

Any clue what to debug?

TIA

Blason R

Re: Getting frequent disconnection on R80.20

G_W_Albrecht — Tue, 12 May 2020 13:17:54 GMT

I would suggest to get help from TAC !

Re: Getting frequent disconnection on R80.20

Blason_R — Tue, 12 May 2020 13:41:58 GMT

Yes I have started with it.

Thanks

Re: Getting frequent disconnection on R80.20

Timothy_Hall — Tue, 12 May 2020 14:56:54 GMT

Any time certain connections seem to randomly die, enabling TCP state logging can be helpful to see why a connection died/ended:

sk101221: TCP state logging

You can enable it from the SmartConsole here:

SecureXL has slightly different timing rules for connections which may explain why the behavior changed when SecureXL was disabled.

Re: Getting frequent disconnection on R80.20

Kim_Moberg — Tue, 12 May 2020 15:07:04 GMT

I am not sure if this relates

I have seen IPS preventing some traffic over RDP for example from remote access to it-ressources at the office.

Could it be related to this frequent disconnection?

Re: Getting frequent disconnection on R80.20

Blason_R — Tue, 12 May 2020 15:43:19 GMT

Nah I feel this is related to multi-queue/corexl or may be secureXL. Anyways I am upgrading to R80.30 and latest HFA lets see if that disappears.

Re: Getting frequent disconnection on R80.20

Timothy_Hall — Tue, 12 May 2020 17:43:23 GMT

Maybe, but I'd verify first that the connection is not somehow getting killed by good ol' stateful inspection before trying to dive any deeper.

Re: Getting frequent disconnection on R80.20

Blason_R — Tue, 19 May 2020 03:23:39 GMT

Hi there,

I developed some progress and found that we created dyanmic_objects to fetch certain IP addresses from web server. This is happening if we enable those in rule base. And if we stop or delete those rule it does not happen.

I really don't see any logic behind this or would really appreciate if any few debug commands provided? or should I debug kernel or fwd daemon to pinpoint the issue?