Lots of discarded IPv6 packets in Sophos XGS firewall log.

[Jaan]

Hi all,

 

Started to have this issue the last day in the office 30mins before i left for the weekend. Network became slow and things disconnecting.

 

Basically our network has been going very slow and i have lots of this in the firewall..... like non stop. Am i right to believe fe80: is internally originated?

 

We have had some 3rd party work on the site. any ideas?

 

We don't have any ipv6 scopes defined in dhcp on the XGS or have any ipv6 addresses on any of our interfaces.

 

What's the best cause of action here to find the issue?

 

I'm able to view my firewall via central just fine, and can see and access logs and settings.

 

VPN and RDP is a no go as i keep getting disconnected. It's like a ddos attack.

 

thoughts? can't wait for monday!

 

Edited November 2, 2024 by Jaan

[kevin_lane]

What was the thing you changed? Sounds like network loop, could be wrong though

[Steve21]

From the addresses that’s ipv6 multicast (the fb and 1:3 ones)

 

I know previously there have been some bugs with network cards that did that when it went to sleep but generally those were just driver updates to fix

 

In terms of fixes if you have no remote options going to be an issue; but generally if you can get in I’d just slowly start disabling downlinks on switches until it stops to isolate where it’s from (deffo downlinks not uplinks so you can remotely re enable it too)

 

Steve

[kevin_lane]

Check your servers and see if your tcp/ip v6 enabled on them

 

You could check your dns server and see it has registered itself, bit of a long shot but worth ruling it out at least you will see the host name

[Jaan]

Yeah we had a 3rd party wiring some CCTV.... recon it will be that.... yay

[PaddyNewman]

Yes, that sounds kinda loop-esque. If you have decent switching, it might be complaining about excessive broadcasts.

[Jaan]

Update: As suspected, the contractors that we're assigned the task of installing the optical cable, decided to patch it in before were removed that existing aggregated copper links. The new switches that went in at the same time, also didn't have rstp enabled.