Akamai caches hammering Sophos XG firewalls

Mon Feb 5 18:59:36 UTC 2018

* jeremyparr at gmail.com (Jeremy Parr) [Mon 05 Feb 2018, 18:28 CET]:
>Somewhat OT, but before I was a jack of all trades enterprise 
>sysadmin, I was a jack of all trades ISP sysadmin.
>
>I'm seeing an issue at a few sites where I have Sophos XG firewalls 
>deployed where the XG gets hammered on it's WAN interface by Akamai 
>hosts with TCP re-transmissions. Anyone at Akamai who may have some 
>background on this issue please reach out to me. The hosts currently 
>in question are 24.244.145.137 and 24.244.145.139, but I suspect 
>that is only due to these being closest to me, colocated at my ISP 
>AS15146.

Chances are your firewall cannot keep enough state in memory and 
starts complaining about packets because it's missing sessions.

	-- Niels.