1

I have two networks communicating with each other through a transparent firewall. My problem is that the software using these networks is reporting that it's losing packages. The number of lost packages varies, but it may be around 0.1%. This applies even with "any/any" rules in both directions on the firewall. I have done some capturing with Wireshark on one side of the firewall, and I see that there are some ICMP packets generated when the firewall is connected. If I replace the firewall with a patch cable, the number of ICMP packets significantly decreases.

In captures of 1.5M packets, both with and without the firewall:

  • With the firewall: About 100 ICMP packets saying Time-to-live exceeded (Fragment reassembly time exceeded), and 40 to 50 Destination unreachable (Port unreachable) packets.

  • Without the firewall: About 40 Time-to-live exceeded (Fragment reassembly time exceeded) packets, and none of the Destination unreachable packets.

To me, it seems like some packets are delayed/damaged by the firewall, hence the ICMP messages, but I can't really imagine how that could be. Any ideas on why this is happening, or how to best continue troubleshooting? I'm thankful for any input!

The firewall is a Phoenix Contact mGuard GT/GT, and the all switches are Cisco 3650.

EDIT: Regarding network throughput, the mirrored interface on the switch I'm capturing traffic from shows only about 0.25% utilization, ie 2.5 Mbit. That should be well within the limitations on the firewall.

EDIT2: I have done some bandwidth testing through the firewall, and the results are quite bad. I'm using iperf3 on two machines connected to the switches on both sides of the firewall, and when forcing UDP traffic (the majority of the regular traffic is UDP) between them I can just send about 30Mbit/sec of data before it starts to lose packets. At 50Mbit/sec about 16% of the packets are lost and at 200Mbit/s there is a gigantic packet loss of over 80%.

The firewall can't be that bad, or am I missing something?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 4:33

1 Answer 1

Reset to default
1

Your ICMP Time-to-live exceeded (Fragment reassembly time exceeded) messages are generated by the endpoints, not the firewall. The problem is likely that the firewall can't handle the data rate at which you are sending. If you have gigabit connections, you are losing a lot of traffic, and that causes TCP segments to be resent, many of which may be dropped again, and the TCP reassembly is timing out.

Router - FL MGUARD GT/GT - 2700197 (emphasis is mine):

Routers with intelligent firewall, up to 200 Mbps of data throughput, Gigabit connectivity, SFP Slots Stateful Inspection Firewall for maximum security and very simple configuration, interchangeable configuration memory

In other words, your firewall doesn't have the throughput to handle the speed at which you are trying to transfer data.

Improve this answer
2
  • There is no mechanism to retransmit a fragment, so the lose of a fragment will cause the entire packet to be resent, which will spew forth more fragments that could be lost. *FRAGMENTS BAD*(tm) No modern network stack will send fragments.
    – Ricky
    May 27, 2016 at 2:06
  • They could be generated by the firewall if it's doing virtual reassembly. But that would be unlikely in transparent mode.
    – Ricky
    May 27, 2016 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.