<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
<br>There is an issue with SonicWALL firewalls when using AF_Packet mode in Suricata running on a server. Seems to be an incompatibilitu because packets drop. Loss of IPSec connectivity, in particular phase1 handshake, is experienced. If Suricata is inline with Lan side then lan traffic appears to get dropped.<br><br>We had this issue 2 years ago and Sonicwall tech support made some obscure change in their firewall to fix it. We just dont remember what the fix was.<br><br>I dont know if there is anything in Suricata that I could do to fix this. I have turned off all nic offliading.<br><br>Thanks.<br><br>Leonard<br><blockquote style="padding-left: 5px; margin-left: 5px; border-left: #0000ff 2px solid; margin-right: 0px"><hr><b>From:</b> Eric Leblond [mailto:eric@regit.org]<br><b>To:</b> Leonard Jacobs [mailto:ljacobs@netsecuris.com], oisf-users@lists.openinfosecfoundation.org [mailto:oisf-users@lists.openinfosecfoundation.org]<br><b>Sent:</b> Fri, 13 Nov 2015 07:37:51 -0600<br><b>Subject:</b> Re: [Oisf-users] AF_Packet Mode vs. NFQUEUE Mode<br><br>Hello Leonard,<br>
<br>
On Fri, 2015-11-13 at 07:08 -0600, Leonard Jacobs wrote:<br>
> What happens if the interfaces are bridged when using AF_Packet mode?<br>
> Does that cause problems since this mode performs its own copy-mode<br>
> between interfaces?<br>
<br>
That would cause a duplication of packets:<br>
* Bridge forward packets from iface 1 to 2<br>
* Suricata see packets on iface 1 and copy packets on iface 2<br>
<br>
> In NFQUEUE IPS mode, are the interfaces supposed to be bridged? Will<br>
> IPTables not function properly without the interfaces being bridged?<br>
<br>
No bridge needed. Using it is even the buggiest setup that can be done<br>
(currently unexplained packets loss in that mode).<br>
<br>
BR,<br>
<br>
> Thanks.<br>
> <br>
> Leonard Jacobs<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/supp" target="_blank">http://suricata-ids.org/supp</a><br>
> ort/<br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u</a><br>
> sers<br>
> Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfeven" target="_blank">http://oisfeven</a><br>
> ts.net<br>
-- <br>
Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>><br>
Blog: <a href="https://home.regit.org/" target="_blank">https://home.regit.org/</a><br>
<br>
<br>
</blockquote><style>
</style>
</body></html>