Threat Prevention Router reliability with TP in SRM 1.3.1

[JohnJohn]

My RT2600ac was too unreliable. If I tried to investigate then there was a reasonable chance it would reboot: it was claimed to be end-of-life eMMC. I can't remember the command line I used but it was reporting it had been heavily used.

I didn't have time to rebuild my network with some other vendor kit, so got a RT6600ax. Initially meshed to the MR2200ac, but I've just replaced that with a WRX560.

The RT6600ax still has the issue with ever increasing instances of Misc Attack signatures. Every so often I backup the TP configuration, uninstall TP deleting signatures/keeping log, reinstall TP, restore configuration.

Thanks for replying, I like the idea I can backup my RT2600 and then upload that to the 6600…at least in theory.

 

[wizard99]

Started getting E-Mail Alerts that my 2600 was shutting down after midnight typically... then a few minutes later another message that is successfully reconnected. This repeated itself each night and I sent a Ticket over to the Desk. It was suggested I Disable Threat prevention..... which I did.... that was yesterday and so far... no further messages... but its only been 8 hours. A quick search led me to fredbert's initial post here. I have two (2) 2200 in Ethernet Backhaul that for more than a year show via the logs arbitrarily turning on/off in short periods of time..... That was never resolved by the Desk... Though this is now an old post, the issue appears to be ongoing for many of us..... I've not yet reported my findings, but I have a feeling replacement gear will be suggested.... Arghhhhhh.... As a Synology NAS user prior, I moved to this gear as my previous Asus failed and three (3) different models of Asus had multiple issues and were quickly returned. Then it was on to TP Link... which was a big disappointment. And then there was Synology... which worked well until.......

 

[Jan Janowski]

I Have 2x 2600’s. 1.3.1-12. Both running TP. Not seeing that, but I’m not using Synology mesh, but homemade version, with an old Linksys being used as wired access point - in garage. (In use for more than 5 years).
Further, neighbor has a 2600, at 1.2.5.not last version, no mesh, and she is ok, too.
All 3 of 2600’s running TP on external USB enclosures with SSD’s for use with TP.
Have seen multiple posts on this sort of thing over the years, and every one seem to have a synology product as a mesh point. Support points at TP.
I’m Thinking based on my history, and my neighbors: It’s a Synology mesh issue, not TP….
PS to this. All 3 of TP, my 2 plus Neighbor, are running the non-default: TEST ALL, Don’t Drop, Any Packets in TP. This should tax the systems more than usual, but we don’t see anything unusual!
My 2x TP also using over 100 custom TP rules, as well. Gotta be mesh!
$.02

 

[wizard99]

Thanks Jan.... I'm still early into this rabbit hole so we'll see what the Desk wants in further testing and Logs.... I thought I had an advantage initially that both my 2200's were hardwired backhaul.... But no... I'll give it another48 hours before reporting back to them to see if it Cycles again.....

 

[Jan Janowski]

I’m no genius but I can report what seems to work and what doesn’t…. Given that I have it long enough to realize it

Many Years ago - I used, and killed, a couple SD Cards with TP. TP needs a robust storage medium, especially with lots of custom rules. It’s been solid since moving to SSD in external USBV3 Enclosure. $.02

 

[wizard99]

Ditto!........ Trying to find stuff these days that reliably works initially and in the long term is always a challenge..... a daily one....

 

[Jan Janowski]

One last thing… during all my tests and before and then after firmware upgrades, after TP loads... I will occasionally monitor router CPU & Ram useage, via DS ROUTER APP on phone.
run it, and test to monitor useage and wait 15 seconds for it to settle down. Gives an idea what router reserves are left!
I see CPU Vary from 40% to 65%, and Ram to 50-55%… here.

It will see CPU go higher during TP Daily updates loading. I run TP & SA Only, no other packages. Ram stays relatively the same.

Never heard what other folks see on this

 

[wizard99]

I now recall that I initially had difficulties in finding a USB Flash Drive that was acceptable to store the Virus Definitions on.... it was very picky and required numerous back + forth with Synology and Kingston (helpful application staff) before finding the Kingston Data Traveler DTKN 128GB compatible.... I seem to recall TP was hanging up or not loading new files ...... I don't use SA... just had TP running until now... Be interesting to see if Disabling TP corrects the issues.... and what SYN suggests...

​