FW Gold reports alarm on AP and not on device

Follow

Geert De Roost

• December 16, 2020 23:58

HI,

 

I get Abnormal Upload alarms on the wrong device.

The pattern I'm seeing :

- The device that does the upload is no longer online at time of the alarm.

- FW Gold then reports the alarm on the wireless AP (which has the lowest wireless IP address in use).

 

Because I have reserved the DHCP IP addresses on most of my devices, above issue became quickly clear. The alarms have the same IP address and the alarms are in line with the usage of the device. (Email IMAP protocol which leads me to concluding that this is a bug.)

I did see the same issue with "Gaming Activity" on the wireless AP (which clearly is impossible).

 

Anything I should change/test?

0

• 

  Firewalla

  • December 17, 2020 03:39

  Does your AP have guest access? if it does, see if your devices are connecting to it.   

  And I am sure you checked that your AP is in AP mode, not router mode.   Some AP guest network will use the guest IP as the source. 

  0

  Comment actions Permalink
• 

  Geert De Roost

  • December 17, 2020 07:41

  Guest access is by default not enabled, I only activate it for a limited time when I really have guests that need it.

  The RT2600ac is in AP mode.

  0

  Comment actions Permalink
• 

  James Willhoite

  • December 17, 2020 14:26

  I have similar issue but it is because the device is in router mode.

  I have xFinity Home Security that the tech installed a Netgear router into my network. The only device that is on that Netgear network is the main security console. I had an abnormal upload from the Netgear router and not the console. It is because the Netgear router has a cable plugging it into the wan port of the of the Netgear router and not the lan. So Firewalla sees the router doing it, and not the console.

  0

  Comment actions Permalink
• 

  Firewalla

  • December 17, 2020 17:41

  @geert, have you ever connected the devices that generated alarm to that AP's guest mode?  I do remember, some devices (like iPhones) will optimize performance and pick the best wifi and automatically connect to them. 

  Here is more info on upload alarms and delays https://help.firewalla.com/hc/en-us/articles/360020926913-Abnormal-Upload-Alarms-Tutorial

  0

  Comment actions Permalink
• 

  Geert De Roost

  • December 17, 2020 17:58

  During the migration to firewalla as main router, I temporarily moved the SSID of the main wifi to the guest network, in order to create a new main network. So all devices may have been connected to the guest wifi in that sense.

  But at that time the guest network had a separate ip range and was still not routed via the firewalla.

  If I interpret above posts correctly, it indicates some kind of device caching that get mixed up? Would a reset of all stored data resolve the issue?

  0

  Comment actions Permalink
• 

  Firewalla

  • December 17, 2020 18:41

  Is it possible to have the devices that were on the guest to forget the guest SSID and see if you still see issues?  

   

  0

  Comment actions Permalink

Please sign in to leave a comment.