blocked traffic ?

Umpf · #1 (**permalink**) 04-20-2009, 07:14 PM

Hello,

we're using an older appliance from pyramid (intel serverboard, 2x xeon ht cpu (ht disabled!), raid, 4GB) with v7.401, fresh install.

there are 6 dual-wan cards (intel GBit), 4 in use (8 subnets).

the fw runs for a few days now, today the traffic locks up, only the webadmin-access is possible.

i've created an any/any rule, but nothing happens so i restarted the device an anything works fine again.

anyone with similar effects?

The environment is an powerplant, so it have to work without this issues!

BAlfson · #2 (**permalink**) 04-20-2009, 07:38 PM

We need more information, but this feels like a hardware issue. Can you show us what you see in the packet filter log when it locks up? When you say the traffic locks up, is the CPU at 100%? Is it only traffic going in/out, or also internal traffic between subnets routed through the Astaro?

I assume that you have consulted the HCL and that you have confirmed that your hardware is approved, especially your Ethernet ports.

I would start by replacing all of the Ethernet cables between the Astaro and the switches/routers it's connected to. If that doesn't resolve the issue, try experimenting with the MTU and/or the duplex setting of the External interface.

Here's a great article that one of the Admins pointed at last year. I found it very helpful, and wish I'd read it back when I first started to post here.

Cheers - Bob

eganders · #3 (**permalink**) 04-20-2009, 08:06 PM

I'm with Bob:

Did this start as a consequence of the upgrade to v.7.401?

Just how old is this box? Have any of the drivers, BIOS, etc. been updated? I know you're in a power plant, but have you blown it out lately, reseated cards, RAM, cables, etc.?

Do you get power surges in a power plant?

How about removing the unused NIC's and swapping the remaining ones around. You mentioned HT is off - turned off in the BIOS presumably?

Check your graphs to see if you're experiencing CPU spikes. Some have after upgrading to v.7.401.

Do the graphs show the box gradually ramping towards high CPU usage?

Umpf · #4 (**permalink**) 04-20-2009, 08:07 PM

Quote:

Originally Posted by BAlfson

We need more information, but this feels like a hardware issue. Can you show us what you see in the packet filter log when it locks up? When you say the traffic locks up, is the CPU at 100%? Is it only traffic going in/out, or also internal traffic between subnets routed through the Astaro?

I assume that you have consulted the HCL and that you have confirmed that your hardware is approved, especially your Ethernet ports.

I would start by replacing all of the Ethernet cables between the Astaro and the switches/routers it's connected to. If that doesn't resolve the issue, try experimenting with the MTU and/or the duplex setting of the External interface.

Here's a great article that one of the Admins pointed at last year. I found it very helpful, and wish I'd read it back when I first started to post here.

Cheers - Bob

Hello,

in packetfilter log is nothing to see, just default drops as always seen.
No cpu-issues (around 5% usage).
all internal networks are routed (and managed with packetrules ) thru the astaro.
the thing is, that after a restart anything works fine, without trouble.

in v6.314 we've noticed an absolutely stressless operation of the same machine... so i wonder, what this could be.

i'll have a look into the article, thx.

Umpf · #5 (**permalink**) 04-20-2009, 08:38 PM

Quote:

Originally Posted by eganders

I'm with Bob:

Did this start as a consequence of the upgrade to v.7.401?

Just how old is this box? Have any of the drivers, BIOS, etc. been updated? I know you're in a power plant, but have you blown it out lately, reseated cards, RAM, cables, etc.?

Do you get power surges in a power plant?

How about removing the unused NIC's and swapping the remaining ones around. You mentioned HT is off - turned off in the BIOS presumably?

Check your graphs to see if you're experiencing CPU spikes. Some have after upgrading to v.7.401.

Do the graphs show the box gradually ramping towards high CPU usage?

Hi Eganders,

the box is around 4 yrs old. no bios-updates, no reseats of ram/nics etc.
no power surges, the lines were measured from time to time by electricians/staff.

ht disabled in bios because i read about some strange behaviours/issues with paketfilters (hanging up).

In my graphs i can't see some cpu bursts/spikes. it looks like a normal line (with some not so serious highs and lows).

BAlfson · #6 (**permalink**) 04-20-2009, 08:44 PM

It is still not clear to me what is locked up. Is the only problem the connection to the outside world, or is traffic between subnets also blocked?

Cheers - Bob

Umpf · #7 (**permalink**) 04-20-2009, 08:58 PM

Quote:

Originally Posted by BAlfson

It is still not clear to me what is locked up. Is the only problem the connection to the outside world, or is traffic between subnets also blocked?

Cheers - Bob

pardon. it seems, that some subnets are blocked, some works.
so i can reach the outside world (wan) from the "B" subnet (servers) via ping (resolved) and browser (e.g. heise.de). from the "A" subnet nothing works, i cant reach servers in "B"-Net, which is necessary to resolve dns-names (domaincontrollers) or authenticate the users (shares).

BAlfson · #8 (**permalink**) 04-20-2009, 09:42 PM

These aren't problems that anyone else has reported this year. I still say it's a hardware issue, and I would start with the cable to the "B" subnet. When did you do the upgrade from 6.3 to 7? Was it done via Up2Dates or with a full install from ISO? Which ISO?

Cheers - Bob

Umpf · #9 (**permalink**) 04-21-2009, 08:33 AM

Quote:

Originally Posted by BAlfson

These aren't problems that anyone else has reported this year. I still say it's a hardware issue, and I would start with the cable to the "B" subnet. When did you do the upgrade from 6.3 to 7? Was it done via Up2Dates or with a full install from ISO? Which ISO?

Cheers - Bob

Last wednesday at 10h we've switched. from this time it runs flawlessly. From monday at around 12h nothings works, today, a few minutes ago i've to restart the 2nd time this week.

No Update, fresh install from an v7.401 iso.

BAlfson · #10 (**permalink**) 04-21-2009, 11:39 PM

Have you updated BIOS, etc. per

Quote:

Originally Posted by eganders

Just how old is this box? Have any of the drivers, BIOS, etc. been updated? I know you're in a power plant, but have you blown it out lately, reseated cards, RAM, cables, etc

After that, I think you should submit a support ticket to Astaro. It's still not clear to me what you are experiencing, what specific traffic is blocked, etc., so please be a little clearer on that with them.

Cheers - Bob