ssouth Posted February 10, 2023 Posted February 10, 2023 Re: Smoothwall S9 Issue Hi all - we are having an issue with the Internet, which I can only put down to the smoothwall s9 box. Basically around 9-9.30am nearly every day, when a lot of devices are logging in (PC's, Laptops, Chromebooks) the Resource Usage on the smoothwall box goes up to around 8, which is quite high. We then start getting phone calls with people not being able to get on the internet or they get a Smoothwall Block Page message on websites we know aren't blocked - eg BBC. On the Block Page it shows the reason as "Server Socket Errored". This then coincides with alerts appearing on the smoothwall showing the "Gateway Down". It usually goes up and down 3 or 4 times in the space of 10 minutes. Around about 10am it usually starts to settle down. Only thing that has changed on the Smoothwall box is that we were upgraded to the Leeds 63 release. We are a large secondary. Our connection is full fibre 1gb. Our provider has reported no errors on the line, so I can only surmise the issue is with smoothwall. Has anyone experienced similar issues? Thanks in advance for any feedback.
ibpalle Posted February 13, 2023 Posted February 13, 2023 It's not something we get reports of generally. The connection check on the Smoothwall is a DNS lookup using Google DNS. If that fails, Smoothwall may think the connection is down but if it is the only external connection you have, the check failing should not have an effect. You can try disabling the connectivity check on Smoothwall in the external connection to see if that makes a difference. Are your internal DNS servers and/or BYOD/Wifi clients set to use Google for DNS? Also, if you run a ping to another external IP than Google DNS servers, during that time period, does that show connectivity issues? Finally, bandwidth. Check the realtime traffic graphs during the time to see if there's a bunch of downloading going on.
Rob_D Posted February 13, 2023 Posted February 13, 2023 We had something very similar with an S9 some years ago. The Smoothwall tech said it was to do with us having too many/too complex firewall rules.
Pjchadwick Posted March 13, 2023 Posted March 13, 2023 We have smoothwall S9. We are a large secondary school. I am experiencing the same issue. I currently have a smoothwall support ticket logged but currently do not have any answers. Did you get yours resolved - - - Updated - - - We have smoothwall S9. We are a large secondary school. I am experiencing the same issue. I currently have a smoothwall support ticket logged but currently do not have any answers. Did you get yours resolved
timbo343 Posted March 13, 2023 Posted March 13, 2023 @ssouth thinks his has been resolved. He asked me to double check my settings in this page 1
timbo343 Posted March 13, 2023 Posted March 13, 2023 How do you get to this page pleaseNetwork > Settings > Advanced
Pjchadwick Posted March 13, 2023 Posted March 13, 2023 Mine matched your settings apart from ICMP time stamps was checked to block and ignore
timbo343 Posted March 14, 2023 Posted March 14, 2023 Any reason the ARP filter setting is enabled?Nope, i've never changed these settings myself. Should it be set to Enabled?
ibpalle Posted March 14, 2023 Posted March 14, 2023 The ARP filter setting should only really be enabled in case you have multiple interfaces configured with IPs on the same subnet (Not multiple IPs on the same interface)
Pjchadwick Posted March 14, 2023 Posted March 14, 2023 (edited) Good Afternoon Thanks for the infomation. Still experincing issue with smoothwall. The school experiences internet issue for the first 30 mintues between 08:30- 09:00, We pages hanging and not loading. If you put the IP in exceptions (No Issue ). Edited March 14, 2023 by Pjchadwick
Joeloman Posted March 15, 2023 Posted March 15, 2023 (edited) I don't know how many students you have and whether they are also allowed to connect their own devices. But I personally would increase the ARP table size.. This is what it says in the manual"If the number of directly connected devices, or IP addresses, is more than the value shown for the ARP table size, from the list, select the maximum number of remembered hosts in the ARP table." We have faced this problem when the students had about 3 devices connected. The school computer, own iPad and a smart watch.. Then you mustn't forget all printers+AP points etc. which also have their own IP. Doesn't hurt to try increasing the ARP table size to 8192 or more Edited March 15, 2023 by Joeloman 1
Pjchadwick Posted March 15, 2023 Posted March 15, 2023 We have over 1500 students plus staff. Smootwall crashed again at 08:30-09:00. Smoothwall 3rd line is now looking at the ticket, but are still unsure what is causing issue. As a temp mesaure i unplugged smoothwall and all issues went away. Not sure where we go from here :S
ibpalle Posted March 15, 2023 Posted March 15, 2023 We have over 1500 students plus staff. Smootwall crashed again at 08:30-09:00. Smoothwall 3rd line is now looking at the ticket, but are still unsure what is causing issue. As a temp mesaure i unplugged smoothwall and all issues went away. Not sure where we go from here :S What are the subnet ranges of the networks the Smoothwall is directly connected to? What is the value of the ARP table size in Network - settings - advanced? What is the value of the SYN backlog queue size in Network - settings - advanced?
Pjchadwick Posted March 15, 2023 Posted March 15, 2023 Arp Table Size 16384 SYN Backlog 32768 Where do i find subnet ranges ? Thanks
ibpalle Posted March 15, 2023 Posted March 15, 2023 The subnets I need are the subnets of the IP addresses configured on the Smoothwall interfaces. What are you using for DNS on the Smoothwall? You can find DNS settings in networking - configuration - DNS.
Pjchadwick Posted March 15, 2023 Posted March 15, 2023 DNS 8.8.8.8 and Internal DNS server's x2 Our subnet 255.255.248.0
ibpalle Posted March 15, 2023 Posted March 15, 2023 DNS 8.8.8.8 and Internal DNS server's x2 Our subnet 255.255.248.0 Thank you - do you know what DNS servers your AD DNS are using as forwarders? Also, what DNS does your DHCP set for domain/BYOD users?
Joeloman Posted March 16, 2023 Posted March 16, 2023 (edited) I highly recommend using "System internal DNS server" in Smoothwall and letting everyone (clients and BYOD) query Smoothwall for DNS. Then your internal DNS will only respond to their domains. This is what it says in Smoothwall: "To achieve a faster service, set the resolver to System internal DNS server and configure forwarders and conditional forwarders below. Forwarders and conditional forwarders will only be used for local queries if the resolver is set to System internal DNS server." It is extremely helpful on slow systems! It may also be worth trying your ISP DNS as well as others e.g. 1.1.1.1 and see if they have better response times than Google 8.8.8.8 You test which is the fastest at slightly different times and redo the test a couple of times as the first test is often slower as he has to find the way to the DNS server. You will find the test function SYSTEM-Diagnostics-Functionality tests-Basic Connectivity Edited March 16, 2023 by Joeloman 1
ibpalle Posted March 16, 2023 Posted March 16, 2023 We have a KB with some useful DNS advice and explanation here: https://kb.smoothwall.com/hc/en-us/articles/360003640159
ssouth Posted March 17, 2023 Author Posted March 17, 2023 I thought our smoothwall woes were over - but this morning they've returned with a vengeance! Everthing was fine first thing, but during form time the Internet just came to a dead stop. I logged into the smoothwall (which took ages) and noticed the Resource Usage Load average had gone above 45! - a figure I've never seen before. A lot of the students were doing an online survey - or at least trying to, but nothing that should cause this level of performance. All very frustrating.
ibpalle Posted March 17, 2023 Posted March 17, 2023 That is obviously far too high. If the console can be accessed, and I'm sure support would have tried, the top command will give a good idea on what's causing the load. If I had to guess, excessive logging and/or block page generation. Network - settings - advanced. Any auditing policies enabled? Networking - firewall - firewall policies. Any logging enabled in policies? Reports » Settings » Datastore settings. What are the sizes of the logs shown as?
ssouth Posted March 17, 2023 Author Posted March 17, 2023 That is obviously far too high. If the console can be accessed, and I'm sure support would have tried, the top command will give a good idea on what's causing the load. If I had to guess, excessive logging and/or block page generation. Network - settings - advanced. Any auditing policies enabled? Networking - firewall - firewall policies. Any logging enabled in policies? Reports » Settings » Datastore settings. What are the sizes of the logs shown as? 1. No auditing policies enabled 2. No logging policies enabled that I know of 3. Log sizes Unused 414.49 51.45 Guardian 337.83 41.93 Reserved 40.94 5.08 Firewall 5.27 0.65 Traffic 3.89 0.48 Other 3.12 0.39 System 0.07 0.01
Pjchadwick Posted March 17, 2023 Posted March 17, 2023 Mine is still happening aswell! Did your box update to leeds-64 overnight aswell ?
ssouth Posted March 17, 2023 Author Posted March 17, 2023 Mine is still happening aswell! Did your box update to leeds-64 overnight aswell ? No - ours isn't set to automatically install new releases.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now