WRVS4400N - IPS Causing Lockup(s)

Unanswered Question
Aug 24th, 2010

Firmware Release        v2.0.0.8

IPS Signatures            1.42

ProtectLink                 Not Activated

Log Level Enabled to    0,1,2

Outgoing Log               Disabled

Incoming Log               Disabled

Loccal Log                  Disabled

E-Mail Alerts               Enabled

DoS thresholds           20

Log Queue Lentgh       100

Log Time Threshold     1440

Syslog Server              Disabled

Output Blocking Event Log     Disabled

If more information is needed I can always upload my backup configuration.

I was doing alot of reading on the forums and came across some articles about how having IPS turned on will degrade the network performance, so I wanted to test this on my network, I've found that if I keep IPS on, everything seems to work just fine.

However if I disable IPS within 2-3 days the router will stop functioning.

My internet connection becomes sporadic at first then stops functioning completely a couple hours after the initial outage.

When this occurs I can't even reach the administrative webpage on the device, I have to power cycle it to restore connectivity, if I leave IPS off, repeat scenario, after 2-3 days it'll lock up again.

If I turn the IPS back on, everything functions fine for days... weeks... months...

Is anyone else seeing this?

other than the obvious leave IPS on, any thoughts?

I'm pretty sure there is a problem here, I just dont know if i'm the only one experiencing this, or if this is a known bug of some kind.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
sfluker4511 Wed, 09/08/2010 - 11:12

No responses to this? am i in the right forum to be asking this type of question?

David Carr Thu, 09/09/2010 - 06:26

With the wrvs4400n, there is not a known issue with the device and ips locking up.  I have a couple questions for you to help understand the situation. 

1: Did you upgrade the firmware to the latest?

  • If so, did you backup your configuration/ do a factory reset/ reload your configuration after the firmware?  If not, lets try that.  Backup your configuration, Reflash the Firmware, Factory reset the device, and reload the configuration.   Once you do this test it for a couple of days with the IPS turned off and see if your seeing the same issues.
sfluker4511 Thu, 09/09/2010 - 06:44

I just performed a Flash update as I've done in the past, I want to say I've only been bringing the device back from the dead with a power cycle

I'll backup the configuration, and perform a hard reset on the device, then reapply the config again, and see how it responds.

michael.wegemer Thu, 10/14/2010 - 11:13

I am very interested in the results of this. I recently purchased the WRVS4400N router which came with version (the most current version) of the firmware already installed. I am experiencing hard lock ups as described above on an almost daily basis. A power cycle reset is the only way to get the device back up. When I disabled IPS it locked up in a couple of hours. That may be coincidence but I quickly re-enabled IPS and it has been up for just over 24 hours now. The device has been on an APC UPS since I purchased it so I don't believe that power fluctuations could be an issue. Any advice or help would be greatly appreciated as my users (wife and a friend accessing my FTP server) are very upset with the reliability. I purchased this rather expensive (for me) device in the hopes that it would last longer than Belkin, Linksys, and Netgear but those routers stayed up well where this one is not doing so.

michael.wegemer Fri, 10/15/2010 - 04:52

My router locked up last night but I have much more information from the logs that the router Emailed to me. I cannot seem to past into this text box so I created a text attachment. It looks like there is a memory leak and the router is shutting itself down. The messages arrived in several different Emails and were cut and pasted into a single document. The blank line indicates where I reset the router.

I hope this information can help someone get to the bottom of this.

sfluker4511 Fri, 10/15/2010 - 06:59

I haven't had the time to play with this since the recommendation of backing up the config and recycling the device completely, however you bring up a point that I didn't think of, I just cranked up all my logging and disabled IPS, i'm sure my network will die in about 2 days or less... it's just frustrating when it does because the router isn't in the most convenient of spots

michael.wegemer Fri, 10/15/2010 - 11:02

I have just received more log messages:

ip_conntrack: table full, dropping packet.  (seven times)

smtp.3web.com: unknown host

That is a valid host. It is my ISP's smtp server.

sfluker4511 Sun, 10/17/2010 - 08:27

As noticed with past experiences, with IPS disabled, the router has started acting up, it appears as though the WAN link is sporadically shutting down, and the DHCP server has died entirely.

sfluker4511 Sun, 10/17/2010 - 08:49

I've just managed to get around to doing more tests on this, I just reloaded the latest firmware, performed a hard reset on the device, and reloaded my config file.

I'll update this thread again in a couple of days when i suspect the router will stop functioning again.

sfluker4511 Mon, 10/18/2010 - 06:46

WiFi is acting up again, appears the DHCP server may be offline again, I am unable to access the device through the administration portal as well.

I have the logging cranked to max, and I'm not receiving any alerts on anything which seems odd to me.

WAN & LAN connectivity appears to be okay, so far, but as seen in past experiences this will start becoming and intermittent connection.

Does anyone know if there are any SSH ports open that I can connect to the device directly and see what's going on here?

sfluker4511 Mon, 10/18/2010 - 08:53

Appears as though the device has once again failed entirely, started with WiFi dumping, and now the local WAN / LAN connections are failing.

I'm not able to access the device via the admin portal, and no logs appear to have been sent out indicating any problems with the device.

michael.wegemer Tue, 10/19/2010 - 05:39

I have opened a case with Cisco support. The case number is 615758881. I cannot find out how to update this case with any new information. I am finding their site very difficult to navigate. I must say that I am somewhat dismayed at Cisco's lack of concern for problems with their products and/or firmware. I purchased a Cisco product because of their reputation for good reliable products. I was tired of replacing other routers every one or two years because they stopped working. At this point I have to say that their reputation is NOT deserved.

The support rep suggested changing some settings and seeing how things go. I should know if it is helping by tomorrow morning. One of the things I was asked to turn off is logging. The rep seemed to feel that this may be chewing up the memory. I am using nagios to keep an eye on the router and it will Email me when it fails. Because I am running Linux, I have a mail server on my local machine and can get the Email when the router is down.

sfluker4511 Tue, 10/19/2010 - 06:51

Before I started these tests the device was up for 16 days straight, and would have been longer but my power went out and the UPS it was attached to drained as well.

after doing these tests throughout the weekend, I power cycled the device yesterday when it failed, and re-enabled the IPS on the device.

I currently still have my Log Level set to ALL, previously I was only logging 0,1,2

should the device start having problems again, I can probably attribute it to the LogLevel, otherwise this doesn't seem like a reasonable response, if the Logging is causing the device to stop responding then there is probably a problem with the firmware and/or Log Rolling that still needs to be corrected.

sfluker4511 Wed, 10/20/2010 - 06:48

I'm not sure if I should be upset or disappointed in the lack of interest of this issue with CISCO's Q/A or  Engineering department.

michael.wegemer Wed, 10/20/2010 - 08:07

I assure you that I am upset. Why should we be paying a premium price for products tht just plain don't work as advertised. At least IBM has the decency to change the documentation when they can't make a product perform to specifications.

Of more interest is that my router has now been up for more than 48 hours without a reboot. This is the first time that has happened since I purchased it. I would like to update Cisco on this but I can't find out how to update my open case.

Thanks for being here Sam. It is somewhat comforting to know that I am not alone in this matter.

Eric Moyers Wed, 10/20/2010 - 08:26

The only way that I am aware of is to contact the agent that was handling your case. I looked your case up in our system and will contact her for you with the update. The only other way is to make sure that when you talk with your agent to get an email if one is not provided. 

Eric Moyers
Cisco SBSC Network Engineer

davbarre Wed, 10/20/2010 - 14:26

Hi Michael,

I am going to speak to the engineer who has this case assigned to them.  I would like to gather the logs and a config file.

From there I would like to get your case escalated to our Engineering team.

My sincerest apologies this has gone on this long.



michael.wegemer Mon, 11/01/2010 - 10:44

On Thursday, second level support sent me some firmware to try. This seems to have resolved my issue. I have no more information on this firmware than it bears the release number My guess is that it is not production ready at this point but that is ONLY a guess. My router has not had to be power cycled since I installed the new firmware.

sfluker4511 Mon, 11/01/2010 - 10:57


Thanks for the update

Are you able to post the firmware they provided you? I would like to try it and see if it resolves my problems as well

Not that I'm one to argue, but what is CISCO doing... what happened to firmware versions





For that matter where is v2.0.1.3 posted, maybe it is a beta release, I wouldn't know as it appears CISCO doesn't post firmware updates, but if what you say is true it appears to be more stable than their current production standards

I wonder what the response would be if asked about an IPS Update...

michael.wegemer Mon, 11/01/2010 - 11:24

I am very hesitant to post something that Cisco has not authorized when I know so little about it. I tried to find your Email address on the weekend to see if you would be interested in trying the firmware but I only found out where you live and work. If we can find a way to exchange Email addresses in a less public forumn I would be willing to send it to you privately with ABSOLUTELY NO GUARENTEES WHATSOEVER and a USE AT YOUR OWN RISK disclaimer.

davbarre Mon, 11/01/2010 - 14:26

Hi Samuel,

What I would suggest you do is call into the Small Business support center at 1-866-606-1866 and open a case. Please refer to this thread.

A case can then be created and escalated to gather that firmware for you.



kevin.brocard Sun, 11/07/2010 - 10:59

Hi all,

I'm experiencing exactly the same issue on my two WRVS4400N routers. I've tried firmware upgrade to and problem's still there.

Since I am a french customer, who can I contact to obtain and try firmware ?

Best regards,


sfluker4511 Mon, 11/08/2010 - 06:52

The Firmware is still in a 'beta' release.

when you call in, insure that you have your product Serial Number.

michael.wegemer Mon, 11/08/2010 - 07:27

It may be beta firmware but my router has not had any issues since I

installed it. I was told that it had not finished regression testing.

For me, at least, it is a great improvement over version


J. R. Michael Wegemer

Mississauga, ON, Canada

On Mon, 2010-11-08 at 07:53 -0700, sfluker4511 wrote:

Michael Wegemer,

A new message was posted in the Discussion thread "WRVS4400N - IPS Causing Lockup(s)":


Author : Samuel Fluker

Profile : https://supportforums.cisco.com/people/sfluker4511


kevin.brocard Mon, 11/08/2010 - 10:53

Thank you for your advice ... I'll call the french support tomorrow with my 2 serial numbers.

I'll keep you informed of the potential end of the issue if I'm able to obtain the new fimware.

davbarre Mon, 11/08/2010 - 13:37

Hi Kevin,

You can also contact 1-866-606-1866 and we have 2 French speaking techs here, and we can also contact an interpreter service as well.



DominikAu Thu, 11/11/2010 - 01:10

is there already a estimated date for a public release of this firmware? (since i wont open a call to get it in advance and see the public release just a few days later)

will it include updated IPS signatures?

and finally: is there a chance that the 5ghz wlan band (which is supported by the hardware) will be supported by the firmware?

that would be great, since most consumers had more or less problems with that device and most dont even know that this would be possible, so cisco could surprise some of us



sfluker4511 Fri, 01/07/2011 - 07:40

Finally a new Firmware is released!!  January 5th 2011  v

I'll be testing this shortly

sfluker4511 Sat, 01/08/2011 - 08:58

This new Firmware doesn't appear to be the answer, I was up and running for just over 80 days on with IPS turned on. I upgraded to the yesterday around 4:00PM and today I am not able to access the routers web interface, nor is the DHCP server responding to requests.

The internet connection appears to be active still, but if history prevails, that will start being an intermittent connection problem until it just stops working completely.

I am able to ping the router internally, unfortunately cisco has SSH turned off so I can't even begin to try to diagnose the problem with this device.

cyber-wolf Sun, 01/09/2011 - 12:30

According to the release notes you are correct.

You will no longer be able to access the web GUI interface via the default

You can however access it via EXAMPLE:

However, that's assuming the starting IP address range given to computers on your LAN via DHCP server is .100


cyber-wolf Sun, 01/09/2011 - 12:35

Looks like you were having better luck with the BETA firmware?

I wonder why they failed to incorporate the changes in the BETA firmware into the latest firmware release.

sfluker4511 Wed, 06/29/2011 - 12:27

Odd, thought I posted this already but on 06/17/2011 i updated the firmware on WRVS4400Nv2 to version

Rebooted the router

Disabled IPS

The following morning my internet connection was randomly dying, followed by the network going unresponsive approx 20 - 21 hours after the upgrade and disabling IPS.

Since then, I have to reboot the router to get connectivity back to the network & console of the device, I re-enabled IPS and balance was restored as I have not lost network connectivity, nor have I lost console access to the router since.

However, I did have to reboot the router 3 days ago as for some reason port forwarding seemed to stop working, needless to say this will be something I'll be watching much closer.