After enabling Inline scanning on an ATP or SEDR Appliance, network connectivity becomes unstable.

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

When using an ATP or SEDR appliance in Scanner or All in One mode, you see network latency and packet loss shortly after enabling Inline Blocking or Inline Monitor mode.

Cause

If there is a difference in the auto-negotiation settings between the two network devices the appliance is connected to, the network bridge may try to transmit more data than the lesser speed link can handle, causing the network device to shut down the port or become overloaded.

Example showing a difference between eth2 and eth3 on the ATP/SEDR 8840 appliance:

eth3: igb: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
eth2: igb: eth2 NIC Link is Up 10 Mbps Full Duplex, Flow Control: RX

Resolution

The SEDR appliance requires that the NICs on the network devices connecting to LAN1/WAN1, and LAN2/WAN2 have identical auto-negotiation settings so the speed, duplex and flow control match. Failure to meet this requirement will result in network instability.

You can use the ethconfig command on the appliance command-line interface to adjust these settings as needed.

Usage:
ethconfig device [--speed|-s SPEED] [--autoneg|-a on|off] [---duplex|-d half|full]
device is the ethernet device. ex. eth0
SPEED is in Mb/s