Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 7148 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC missing computer details and unable to apply policies

CFB

We recently had a hard drive failure on our Windows 2003 Sophos Enterprise Console 4.5 server and discovered that our backup was corrupt.  The server has been rebuilt (same host/doman and IP address) and I've installed SEC 4.7.

Existing client computers are unable to pickup definition updates.  I can see them SEC, but am not able to not collect computer details or send them policies (greyed out).

On one client computer I uninstalled the Antivirus, Updater and Management components, restarted, then reinstalled using a command line to the Sophos server share.  It is able to pickup updates, but no computer details are showing and I am unable to send it policies.

Windows Group Policy is opening the three standard Sophos ports (UDP & TCP) on the client computers.

:15357


This thread was automatically locked due to age.
Parents
  • 0

    HI,

    Well the problem is definitely :

    "E Failed to get parent router IOR "

    The client router is unable to connect to port 8192 on the server to read the IOR string to tell it where to connect back to.  I assume you've edited the client log to anonymize the address the client is using to connect as:

    • ServerIP
    • SERVERHOST.IPDOMAIN
    • SERVERHOSTNAME

    don't look quite right.  Typically if the server has a static IP address the client will attempt to connect using a parentaddress string of:

    <IPAddress>, <FQDN>, <NETBIOS> 

    and it will try them in order if it is unable to resolve each in turn.  If the server is DHCP, the IP value would not exist.

    The router log on the server shows that it is sending messages to EM, which leads me to believe the server router is working and I would expect that it is hosting an IOR on port 8192 for the client to read.

    I would think if on the server you ran:

    telnet  SERVERHOST.IPDOMAIN 8192

    that must return the IOR string?

    For some reason though, the client is unable to connect to port 8192 of the server using SERVERHOST.IPDOMAIN .  If you've tried IP, it can't just be a resolution problem.  The only thing I can suggest is to confirm you can connect to port 8192 locally on the server (just to prove that it is there and ready) and after that, the firewall on the server does seem the most likely culprit.

    Can you check the logs or turn it off temporarily until you are able to telnet port 8192 from the client successfully.  I'm sure once you are communication will spring to life.

    Regards,

    Jak

    Note: you will also need the client to be able to connect to 8194 of the server, telnetting to port 8194 should also connect but it will not display anything.  This is also a valid test but the router connects to port 8194 once it has read the IOR from 8192 as it's failing to do that I would start with 8192.

    :15669
Reply
  • 0

    HI,

    Well the problem is definitely :

    "E Failed to get parent router IOR "

    The client router is unable to connect to port 8192 on the server to read the IOR string to tell it where to connect back to.  I assume you've edited the client log to anonymize the address the client is using to connect as:

    • ServerIP
    • SERVERHOST.IPDOMAIN
    • SERVERHOSTNAME

    don't look quite right.  Typically if the server has a static IP address the client will attempt to connect using a parentaddress string of:

    <IPAddress>, <FQDN>, <NETBIOS> 

    and it will try them in order if it is unable to resolve each in turn.  If the server is DHCP, the IP value would not exist.

    The router log on the server shows that it is sending messages to EM, which leads me to believe the server router is working and I would expect that it is hosting an IOR on port 8192 for the client to read.

    I would think if on the server you ran:

    telnet  SERVERHOST.IPDOMAIN 8192

    that must return the IOR string?

    For some reason though, the client is unable to connect to port 8192 of the server using SERVERHOST.IPDOMAIN .  If you've tried IP, it can't just be a resolution problem.  The only thing I can suggest is to confirm you can connect to port 8192 locally on the server (just to prove that it is there and ready) and after that, the firewall on the server does seem the most likely culprit.

    Can you check the logs or turn it off temporarily until you are able to telnet port 8192 from the client successfully.  I'm sure once you are communication will spring to life.

    Regards,

    Jak

    Note: you will also need the client to be able to connect to 8194 of the server, telnetting to port 8194 should also connect but it will not display anything.  This is also a valid test but the router connects to port 8194 once it has read the IOR from 8192 as it's failing to do that I would start with 8192.

    :15669
Children
No Data
Unfiltered HTML