Scheduled Nightly Network Checks on Static IPs Causing Disconnects?
We have a T30 box and I recently upgraded to the latest OS version on the 21st June which has been our only recent network change. Since the 8th July we've been experiencing a strange issue where PCs reconnect and disconnect rapidly simultaneously during the night at seemingly coordinated times (though not the same every night). It tends to happen once a night sometime between 23:30 and 05:30. Whats stranger, is that it appears to only happen to PCs that have a certain NIC model (intel 82567LM-3). This NIC is no longer supported but we've had them for a long time and not had issues before. We have other NICs on the network, some that are older, which don't experience this issue.
We have 1 network subnet that our T30 manages which is DHCP and 1 network subnet that is static. The issue only seems to happen on the static subnet. The specific process in the windows event logs is related to 'e1kexpress'. Also, none of the PCs have had any Windows updates and are currently running Windows 7 (though I'm looking to update this to 10!).
My question is therefore: is there anything (a default process maybe) that the T30 runs daily when it maybe spots a time of low traffic (e.g. during the night) where it does some kind of maintenance or check on static IPs, that this particular NIC maybe just happens to not like?
Comments
The scheduled scans that come to mind are:
. for wireless firewalls - Rogue Access Point Detection scans
. Network Discovery Scan
. for cloud managed APs, WIPS security scanning
Thanks Bruce. It's a physical box and all managed locally so I guess it's just the network discovery scan that might be relevant.
A couple of follow up questions:
Would this normally happen at the same time everyday or is the time a bit dynamic?
Is this on by default normally?
Is it critical that this runs? I guess without it we just can't add anything new (which we are unlikely to at the moment), so I wanted to turn it off temporarily to see if it is that which is upsetting the NICs in question.
Roughly where can I find it in the Web UI?
Web UI -> Subscription Services -> Network Discovery - the Enabled box needs to be selected for these to be done.
It should not be on by default.
If scheduled, I would expect that the scan would happen at pretty much the same time on each day of the schedule.
No problem, thanks for the pointers! I think its probably not that then as the issue occurs at varying times.
Perhaps a packet capture on a PC which is on the static network and which does not have this NIC will show the cause.
Many use Wireshark for packet captures.
Thanks Bruce, yeah I have been monitoring packets on the PCs but the disconnects begin without any apparent warning, as in theres no specific packet type that arrives right before the disconnect. This suggests it's something outside of them cutting their connection which brought my investigation to the Watchguard.
Is rolling back to a previous OS version on the T30 straightforward? I don't really want to do this but I feel I need to test it to at least rule it out as that was updated in the last month (though several weeks before the issues started). I did take a backup image before the update so I guess restoring that is the most sensible approach.