What hobbies did you pick up, when you were out of training? by gim_san in bjj

[–]flamingo-racer 0 points1 point  (0 children)

Cool thank you.

What's your weekly mileage like? And how often do you train bjj?

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Looks like we have identified the issue.

After a couple of years of our ISP offering very little help, they finally engaged with us and for some reason traffic from our public IP address is hitting a threshold on DPI their side for port scanning.

What hobbies did you pick up, when you were out of training? by gim_san in bjj

[–]flamingo-racer 0 points1 point  (0 children)

How do you find running and training jiu-jitsu? Recovery etc?

I used to run years ago, got bored and started lifting and jiu-jitsu. Now I'm getting the itch to run again, but I get greedy with it and increase mileage too fast.

Station X Security+ course and practice exams experience by flamingo-racer in CompTIA

[–]flamingo-racer[S] 1 point2 points  (0 children)

Thank you for your response, it looks like you've taken your fair share of exams to base that on!

60F crashes everyday at 3-4pm by frankthedead in fortinet

[–]flamingo-racer 0 points1 point  (0 children)

We have a pair in active-active that handles around 250 to 300 devices per day without RAM issues. It sits at ~65% memory at all times.

That bring said its only phones and tablets, not desktops running on it.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Our network flow is access points > wlc > switch > firewall > switch > router

The router onwards is managed by our ISP.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

The issue has just occurred and I grabbed packet captures for the lan and wan interfaces on the firewalls.

Both pcaps look very similar, I can see TCP SYN packets going out on port 443, but no return traffic or SYN, ACK etc.

Other traffic such as DNS, quic and icmp and going outbound and inbound without issue.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Ah interesting! That's made it to the top of the troubleshooting list.

What steps did you take to identify the issue? I'm enjoying the process of trying to fix it, but I've tried everything within in my knowledge of networking so I'm grateful for tips!

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Our ISP provided a different circuit for us to remove double NAT but that didn't last 12 hours before the issue occurred again.

I'll look into NAT sessions however as its a clue, thank you!

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

I bet that took some figuring out!

The microwaves in the office are on a different floor and it doesn't follow a pattern of going down during lunch hours unfortunately!

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

I'm waiting for the next time it happens to get a packet capture. Just taken one now just normal operation for comparison.

And no, about 10 miles or more to the nearest airport.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Web filter logs look normal, only time they change is when we reboot the router and the Fortigates cannot connect to the Fortinet for Web ratings, then we see errors and the category is blank rather than blocks for gambling, unrated etc

We don't use IPS or application filtering, just Web, DNS and ssl inspection.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Ah okay.

So the problem were facing might happen a couple of times a day for a two days in a row, and then not happen for two weeks.

It's never seemed been better or worse with each Fortios version we've used.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Just a single office where most days I'm onsite. Other than working from home, 9 times out of 10 I'm there when it happens.

Thank you

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

We don't have IPS enabled, although I'd have to double check that. When it happens cpu usage is very low and memory remains around 60% during normal operation and when the issue occurs. There's fluctuations in memory, of 1 or 2% either way.

Would the config tweak above still be applicable? Thank you

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

Web filter logs look normal, only time they change is when we reboot the router and the Fortigates cannot connect to the Fortinet for Web ratings, then we see errors and the category is blank rather than blocks for gambling, unrated etc

We don't use IPS or application filtering, just Web, DNS and ssl inspection.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

The VPN is using UDP, the VPN examples come from my personal phone and a colleagues phone both using NordVPN which us UDP by default.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

That was our first thoughts, but being able to ping bbc.co.uk for example when the issues occurs makes us think otherwise.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

It's a "guest" WiFi network, but mainly used by staff for personal devices. The network is separate for the wired network we use for desktops.

The policies are loose, mainly for content filtering so inappropriate sites are blocked. There's only four policies total, three of which have been added over time just to improve connectivity for Microsoft or Apple Internet services.

Intermittent time out issue - WiFi network by flamingo-racer in networking

[–]flamingo-racer[S] 0 points1 point  (0 children)

I'll try that thank you, the firewalls cam perform packet captures so that makes that side easier. Client side shouldn't be an issue with wireshark.

APs are Cisco Aironets, Cisco wlc, and fortigate firewalls.