Sophos XG210 High CPU / Amber Performance icon

[Olliedawg]

Afternoon all,

 

Experiencing some performance issues with our XG210. CPU usage sometimes bumps up to 100%, causes websites to load slowly for end users. Only thing I have changed recently is enabling HTTPS decryption for all student traffic, which includes Student PC's, Shared iPads, Student VLAN.. this was enabled for FastVue Reporting. Users authenticate through Sophos STAS. I don't really want to disable the decryption, as the keyword monitoring is invaluable to our Safeguarding lead.

 

In anyone's experience, is there anything I can tone down to lower this usage? (and yes i have tried switching it off and on again!)

 

 

[3s-gtech]

How big is your school?

 

HTPPS decryption can be intensive, and you may have simply given it one hell of a workload to suddenly do. These firewalls are for SMBs, and a school of 1000 users may be too much for this unit. I think.

[Olliedawg]

How big is your school?

 

HTPPS decryption can be intensive, and you may have simply given it one hell of a workload to suddenly do. These firewalls are for SMBs, and a school of 1000 users may be too much for this unit. I think.

 

Not massive. ~540 students, ~120 staff.

 

Decryption is not enabled for staff. (just double checking all the FW rules now..)

 

This is what it is reporting in Solaris mode ( Sophos Firewall: Check the CPU usage using top )

 

[Olliedawg]

Just checked, only two FW rules have HTTPS decryption applied, and they only apply to students.

 

I'll try disable the decryption & see what the usage is like this afternoon

 

*edit*

 

Disabled HTTPS decryption on both of the student policies about an hour ago now. CPU usage is now averaging around 25%. Seems like the FW can't keep up with the amount of decryption/scanning! This is a shame as we don't get the keyword reporting with this disabled.

Edited December 11, 2023 by Olliedawg

[Jaan]

we're running a xg 430 here (almost ready for retirement)

 

lows of 40% ish and highs of 80% ish with https decryption enabled highs of 60% ish with it off

 

1400 students 130 staff

35 fw rules

8 ssids

7 web filter rules

IPS enabled

Application control enabled

 

Https decryption is a cpu hog.

 

the XGS range are better at this.

 

hope that helps

[Olliedawg]

we're running a xg 430 here (almost ready for retirement)

 

lows of 40% ish and highs of 80% ish with https decryption enabled highs of 60% ish with it off

 

1400 students 130 staff

35 fw rules

8 ssids

7 web filter rules

IPS enabled

Application control enabled

 

Https decryption is a cpu hog.

 

the XGS range are better at this.

 

hope that helps

 

Thanks you. Yeh i've come to the conclusion that it just cant handle all the traffic, even for our small-ish school. Im sure our XG210 is in contact until early 2025

[Jaan]

have a look here: https://support.sophos.com/support/s/article/KB-000035279?language=en_US

[Olliedawg]

have a look here: https://support.sophos.com/support/s/article/KB-000035279?language=en_US

 

Seen that - EOL 31st March 2025. I'll get in touch with our service provider who provided us the firewall & see what our options are.