topic Re: Lost sessions with Wildfire active in General Topics

Lost sessions with Wildfire active

BigPalo — Tue, 18 May 2021 14:34:22 GMT

Hello everyone,

Currently, I have 2 FW model 5220 active/active version 9.0.12.

When I have Wildifire activated I have seen that I have session losses and incomplete sessions.

Can anyone help me? I have not seen any known BUGs

Regards.

Re: Lost sessions with Wildfire active

BPry — Tue, 18 May 2021 19:02:45 GMT

@BigPalo,

Can you expand on what you are actually seeing? When you're looking at these sessions do they have an associated wildfire subtype threat log associated with the traffic?

If WildFire is closing sessions, while it can be a false positive, it's generally an indication of an actual issue that should be investigated. If you go into the detailed session logs you'll see all the associated logs, otherwise you can search your Threat logs with (subtype eq wildfire-virus).

Re: Lost sessions with Wildfire active

BigPalo — Wed, 19 May 2021 06:25:50 GMT

But the traffic that is discarded in the sessions is also ICMP and trust zone traffic.

I have done a test inside the internal network and when I leave a time ping and activate Wildfire, I see the packets are lost and sessions end.

Re: Lost sessions with Wildfire active

BPry — Thu, 20 May 2021 13:21:07 GMT

@BigPalo,

You aren't seeing any other resource contention across this system when you activate Wildfire in your security profile are you? There's really not much additional overhead when assigning a wildfire profile and I've never seen it cause any packet loss or session issues by itself. There's also nothing that I'm seeing in 9.0.13 related to this type of issue.

I'd reach out to TAC and open a case on this if it's repeatable so that they can look at the system as a whole. I'm just guessing, but from my experience just enabling Wildfire wouldn't cause this sort of issue.