Firewall is stopped every short period of time

[it-phatt]

Version

2.4.2

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

120

Storage for /

260

Storage for /nsm

529

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

2023/12/19 16:17:10 [error] 28#28: *78 connect() failed (113: Host is unreachable) while connecting to upstream, client: 172.17.1.1, server: 10.1.3.191, request: "GET / HTTP/2.0", subrequest: "/sessions/whoami", upstream: "http://10.1.3.191:4433/sessions/whoami", host: "10.1.3.191"
2023/12/19 16:17:10 [error] 28#28: *78 auth request unexpected status: 502 while sending to client, client: 172.17.1.1, server: 10.1.3.191, request: "GET / HTTP/2.0", host: "10.1.3.191"
2023/12/19 16:17:10 [error] 28#28: *78 connect() failed (113: Host is unreachable) while connecting to upstream, client: 172.17.1.1, server: 10.1.3.191, request: "GET /favicon.ico HTTP/2.0", subrequest: "/sessions/whoami", upstream: "http://10.1.3.191:4433/sessions/whoami", host: "10.1.3.191", referrer: "https://10.1.3.191/"
2023/12/19 16:17:10 [error] 28#28: *78 auth request unexpected status: 502 while sending to client, client: 172.17.1.1, server: 10.1.3.191, request: "GET /favicon.ico HTTP/2.0", host: "10.1.3.191", referrer: "https://10.1.3.191/"
2023/12/19 16:17:10 [error] 28#28: *78 connect() failed (113: Host is unreachable) while connecting to upstream, client: 172.17.1.1, server: 10.1.3.191, request: "GET /favicon.ico HTTP/2.0", subrequest: "/sessions/whoami", upstream: "http://10.1.3.191:4433/sessions/whoami", host: "10.1.3.191", referrer: "https://10.1.3.191/"
2023/12/19 16:17:10 [error] 28#28: *78 auth request unexpected status: 502 while sending to client, client: 172.17.1.1, server: 10.1.3.191, request: "GET /favicon.ico HTTP/2.0", host: "10.1.3.191", referrer: "https://10.1.3.191/"

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

I'm not sure I understand what you're reporting. Please provide more information about the question you're asking or the problem you're experiencing.

Also, you specify that you are running version 2.4.2. Is that correct? If so, that is an old BETA version and you should upgrade to the latest version:
https://docs.securityonion.net/en/2.4/release-notes.html