Intermittent Internet Access

[Christopher_To]

Hi,

I am experiencing random internet connectivity issues.  Throughout the day access out to the internet will go down.  Some blips will only be a few seconds and other times they will be longer.  Some days would be worse than others, and these blips would occur more frequently throughout the day. 

A Health Check was run on both the active and standby members, and on the active member a warning was reported for "cluster under load".  

Is there a way to determine for certain that this is a system usage issue?  Memory issue?

The environment is a cluster of two standalone 4600 appliances.

Below are some screenshots of gateway configuration and command output of the active cluster member.

Thanks,

Chris

[Kaspars_Zibarts]

I would say 4600 would be underpowered to run gateway and management on the same box efficiently. Did you check CPU load when it happens?

Separate your management if you can.

[Maarten_Sjouw]

Check during the day wit cpview how the load is on the different processors and network.

The pages to check are:

Overview ==> to get a general idea of the state of the box

network - top connections ==> to get an idea if there are specific connections bringing down the box

advanced - network ==> to see the load dispersion between slow / medium / fast path, how well is SecureXL doing it's job?

You can also get the history from cpview with -t and then walk through the database.

[PhoneBoy]

You should use cpview -t to see the statistics of what was going on during the time you were experiencing the issue as a starting point.

[Eric_Appelboom]

Check ted.elg log. May be related to Threat Emulation uploads if enabled. 

[Christopher_To]

After reviewing the statistics from cpview we noticed that the CPU usage would spike during the time of outages, and the rx dropped packet amount would also jump on one of the interface.

We first enabled drop optimization and installed Jumbo take 343 on both gateways, but the issue still continued.  Next we raised the rx ringsize for the interface that was experiencing drops.  We also enabled NAT templates.  There are no longer any dropped packets and the internet has been stable.  

Will keep everyone updated if there are any changes.

Thanks!