AIProtection Brings Down WAN?

[SHibbard]

Have been having frequent WAN disconnects on my Asus wireless-router-based network, happening every 15-60 minutes lasting for a second to almost a minute. Nothing shows up in Syslog that I can see relates. ISP is Comcast, using BYOD Arris SVG2482AC modem. Started with an RT-AC3100 (first with Asus 3.0.0.4.385.20631, then 9.0.0.4.386.41994 Beta, then Merlin 386.1_2, then down to Asus 3.0.0.4.385.20631 – factory resets after each change), 3 AImesh nodes, and a few switches. Got dependable service ONLY when using Arris as Wi-Fi Router, every switch & device connected but AIMesh nodes, just the main (Asus) router bypassed – so points to router. Replaced main router with an RT-AX88U (flashed with Merlin 386.1_2). However, as soon as router was back in got disconnects, with or w/o mesh nodes. Have narrowed it down to apparently occurring only when AIProtection Infected Device Prevention and Blocking and/or Malicious Sites Blocking are enabled. Neither of them show any threat activities however. Kind of worried leaving them shutoff in case there IS a threat. Anyone have ideas?

 

[eibgrad]

What's the lease period on your WAN?

nvram get wan0_lease

 

[SHibbard]

What's the lease period on your WAN?

nvram get wan0_lease

7200

 

[eibgrad]

7200 (secs) means every two hours it expires. And the DHCP client of the router will normally attempt a renewal halfway through that period (every hour in this case). It does this to avoid interruptions. Because if the DHCP lease is allowed to expire, then it's possible you'll get assigned a new public IP, and that will force the WAN to be refreshed. And that could take a few seconds, and invalidate current connections.

It's highly speculative at this point, but it *may* be that AiProtection is somehow preventing the DHCP renewal from being completed, leading to the DHCP lease expiring, and hence the brief interruption. But exactly why I don't know.

 

[SHibbard]

Thanks. Been pulling my hair out for a couple of weeks on this one. Two things: 1) I have never noticed the WAN IP change, and 2) the interrupts happen much more often than 1x/hour. Can I override the lease period, or will Comcast just overwrite that?

 

[eibgrad]

You have no control over the DHCP lease period. The ISP always determines it.

I could be mistaken here about DHCP being the problem. I'm just speculating.

 

[SHibbard]

Thanks. I see the frequent DCHPREQUEST calls. AiProtection is not completely off, as Two-Way IPS is on - and I'm not getting any dropouts. However, I hear you ... hard to say if something connected with the 2 AiProtection features currently turned off is stepping on something else at this point. I have not done a good job in monitoring Trend Micro signature updates, so I also do not know if the update in there now (2.222) is the only one where these problems occurred, or if they occurred with earlier signature versions as well.