SEC 5.5 RMS Issues

Hello Cards11x,

AFAIK Sophos doesn't use the host's libraries but comes with its own set in order to avoid compatibility issues. So the OpenSSL version shouldn't matter.

server-vm3 seems to be unable to reach the parent's port 8192 - does telnet SECServer 8192 (or <SEC IP Address>) return an IOR? Looks like it doesn't.

server-vm1 seems receive an IOR (using the server's IP) but is (if I understand correctly) subsequently unable to connect to the host/port specified in the profile(s). For a server with a static IP the address is serverIP:8194 - this should work if serverIP:8192 works (unless 8194 is blocked on the way to the server). If this information doesn't help please show the IOR returned by the server.

Christian

Christian, 

Thank you for your quick response. We have fixed the issue with VM3. It turned out to be a simple access rule for the firewall that was not previously setup.

Now for server-vm1. This is still receiving the same error in the Router Logs. Here is what I know and have gathered attempting to troubleshoot this today.

Running RHEL 5

Running Sophos Ver 9

Successfully runs ./savupdate.sh and updates fine

This is using iptables but has rules in place to allow TCP/8192 & 8194

Successfully able to telnet the SEC IP via 8192 & 8194. 

Running a capture we see the client send out on 8192 to SEC. SEC then responds on 8194 but that is getting reset when it hits the client.

When restarting the sav-rms service and once verifying that it is running. I do not see any of the RMS ports listening when looking at netstat.

If you have any further possible troubleshooting solutions or ideas of a possible fix it is greatly appreciated.

Thanks!

Hello Cards11x,

I assume the No usable profile in IOR refers to the IOR received from the server. You get the IOR from the telnet <server> 8192 response and can parse it for example at parc.com. This will show host and port (note the port is the non-SSL port 8193) that should be contacted - could be that vm1 can't reach the server with this information, e.g. when the server returns a name that the client can't resolve.
If you're unsure please post the IOR here (be warned though that it will reveal the server's name and/or IP).

Christian

Hello Cards11x,

I assume the No usable profile in IOR refers to the IOR received from the server. You get the IOR from the telnet <server> 8192 response and can parse it for example at parc.com. This will show host and port (note the port is the non-SSL port 8193) that should be contacted - could be that vm1 can't reach the server with this information, e.g. when the server returns a name that the client can't resolve.
If you're unsure please post the IOR here (be warned though that it will reveal the server's name and/or IP).

Christian

Hi Christian,

I have placed the IOR into the link you provided and receive the following.

object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "serve.name.here.com", port 8193


Is this what I SHOULD be seeing when parsing the IOR?

Thanks!

Hello Cards11x,

thanks, looks correct. So the server has been configured to return a name, looks like vm1 can't resolve this name (or at least not correctly). Does (from vm1) telnet server.name.here.com 8194 connect or do you get a host no found or similar error?

Christian

Hi Christian,

I am able to successfully make a connection to our SEC over 8194. I receive no errors.

Thanks

Hello Cards11x,

indeed using the name - or did you enter the IP?
I'd suggest to make the Router log more verbose as mentioned here. Dunno what to expect in this situation but maybe there's a hint.

Christian

Christian,

I used both name and IP. Both had no issues telnetting to that port. At this point I'm going to be opening a support case with Sophos to help further investigate this issue. Thank you very much for your efforts. I'll be sure to post my findings here once this has been resolved.

Thanks!

Wanted to post a update although this thread if 5 months old. This issue was resolved by a OS upgrade.