Lost sessions with Wildfire active

[BigPalo]

Hello everyone,

Currently, I have 2 FW model 5220 active/active version 9.0.12.

When I have Wildifire activated I have seen that I have session losses and incomplete sessions.

Can anyone help me? I have not seen any known BUGs

Regards.

[BPry]

@BigPalo,

Can you expand on what you are actually seeing? When you're looking at these sessions do they have an associated wildfire subtype threat log associated with the traffic?

If WildFire is closing sessions, while it can be a false positive, it's generally an indication of an actual issue that should be investigated. If you go into the detailed session logs you'll see all the associated logs, otherwise you can search your Threat logs with (subtype eq wildfire-virus). 

[BigPalo]

But the traffic that is discarded in the sessions is also ICMP and trust zone traffic.

I have done a test inside the internal network and when I leave a time ping and activate Wildfire, I see the packets are lost and sessions end.

[BPry]

@BigPalo,

You aren't seeing any other resource contention across this system when you activate Wildfire in your security profile are you? There's really not much additional overhead when assigning a wildfire profile and I've never seen it cause any packet loss or session issues by itself. There's also nothing that I'm seeing in 9.0.13 related to this type of issue.

I'd reach out to TAC and open a case on this if it's repeatable so that they can look at the system as a whole. I'm just guessing, but from my experience just enabling Wildfire wouldn't cause this sort of issue.