Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 20 replies
  • Subscribers 2 subscribers
  • Views 21671 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ENTERPRISE CONSOLE - REMOTE CLIENT NOT CONNECTED

emanuele fumagalli 
Good morning, our securty enterprise console from a couple of months is no longer able to communicate with customers' computers, even update managers have not been updated for months; client-side updates instead work correctly.
I tried with the following solutions:
- correct communication of  server-side ports and telnet tests from clients
- control of services started
- community.sophos.com/.../time-of-last-binary-update-is-a-long-time-ago
- https: //community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/96059/most-clients-shown-as-disconnected-in-sec-5-5-0

I have not solved
thank you

Emanuele


This thread was automatically locked due to age.
Parents
  • 0

    Hello Emanuele,

    are you an MSP?

    client side updates [...] work correctly
    did you also check the Network Communication Report? You say that telnet yourSECserver 8192 works - you did get an IOR: in response= If so, you can parse it here (you have to remove the CRLFs so that the IOR: is a single line).

    Christian

  • 0 in reply to QC

    Yes i am a partner.

     

    Network report says it's everything ok, 

     

    telet result internal network:

     

    _IIOP_ParseCDR:  byte order LittleEndian, repository id <IDL:SophosMessaging/MessageRouter:1.0>, 1 profile
_IIOP_ParseCDR:  profile 1 is 164 bytes, tag 0 (INTERNET), LittleEndian byte order
(iiop.c:parse_IIOP_Profile):  bo=LittleEndian, version=1.2, hostname=10.234.0.53, port=8193, object_key=<....NUP...!........RootPOA.RouterPersistent.........MessageRouter>
(iiop.c:parse_IIOP_Profile):  encoded object key is <%14%01%0F%00NUP%00%00%00%21%00%00%00%00%01%00%00%00RootPOA%00RouterPersistent%00%03%00%00%00%01%00%00%00MessageRouter>
(iiop.c:parse_IIOP_Profile):  non-native cinfo is <iiop_1_2_1_%2514%2501%250F%2500NUP%2500%2500%2500%2521%2500%2500%2500%2500%2501%2500%2500%2500RootPOA%2500RouterPersistent%2500%2503%2500%2500%2500%2501%2500%2500%2500MessageRouter@tcp_10.234.0.53_8193>
object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.53", port 8193

    object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.53", port 8193



    telnet from remote client:

    _IIOP_ParseCDR:  byte order LittleEndian, repository id <IDL:SophosMessaging/MessageRouter:1.0>, 1 profile
_IIOP_ParseCDR:  profile 1 is 164 bytes, tag 0 (INTERNET), LittleEndian byte order
(iiop.c:parse_IIOP_Profile):  bo=LittleEndian, version=1.2, hostname=10.234.0.54, port=8193, object_key=<....NUP...!........RootPOA.RouterPersistent.........MessageRouter>
(iiop.c:parse_IIOP_Profile):  encoded object key is <%14%01%0F%00NUP%00%00%00%21%00%00%00%00%01%00%00%00RootPOA%00RouterPersistent%00%03%00%00%00%01%00%00%00MessageRouter>
(iiop.c:parse_IIOP_Profile):  non-native cinfo is <iiop_1_2_1_%2514%2501%250F%2500NUP%2500%2500%2500%2521%2500%2500%2500%2500%2501%2500%2500%2500RootPOA%2500RouterPersistent%2500%2503%2500%2500%2500%2501%2500%2500%2500MessageRouter@tcp_10.234.0.54_8193>
object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.54", port 8193

    object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.54", port 8193


     

  • 0 in reply to emanuele fumagalli

    Hello Emanuele,

    as far as I can see this SUM/relay is communicating with its clients, it can also connect to the management server but when it tries to actually send a message it encounters a timeout. What's missing are the lines after Accessing parent:
    Accessing parent
    SSL handshake done, local IP address = xxx.xxx.xxx.xxx
    Parent is Router$UpstreamServer

    It looks like establishing the connection to port 8194 fails with a timeout.

    Christian

  • 0 in reply to QC

    Hello, if i telnet 8194 i receive no error, after some second the connection drops.

    Same behavior from internal and external

     

    Other test i can do?

  • 0 in reply to emanuele fumagalli

    Hello Emanuele,

    ran out of simple tests. As telnet can connect the Router should also be able to do so. I'd monitor (on the remote machine) the TCP activity on port 8194 with Wireshark.

    Christian

  • 0 in reply to QC

    i see only this error:

     

    132 37.677772 192.x.x.x 10.x.x.x TCP 62 [TCP Retransmission] 61573 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1132 37.677772 192.x.x.x 10..x.x.x TCP 62 [TCP Retransmission] 61573 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

     

    10.x.x.x is the internal ip of my message relay

     

     so it's  tcp / ip connection syn ack problem... but nothing is changed on my network or firewall

     

  • 0 in reply to emanuele fumagalli

    Hello Emanuele,

    clearly no connection established. And if you telnet 10.x.x.x 8194, what does it show then?

    Christian

  • 0 in reply to QC

    no error but the command is empty, after some second the connection is dropped. but it's the same from a local machine

  • 0 in reply to emanuele fumagalli

    Hello Emanuele,

    sorry, I menat what does Wireshark show for the telnet connection?

    Christian

  • 0 in reply to QC

    21 5.084280 192.x.x.x 10.x.x.x TCP 62 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

    96 19.082120 192.x.x.x  10.x.x.x  TCP 66 [TCP Port numbers reused] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

    106 22.083265 192.x.x.x  10.x.x.x  TCP 66 [TCP Retransmission] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

    129 28.081596 192.x.x.x  10.x.x.x  TCP 62 [TCP Retransmission] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

  • 0 in reply to emanuele fumagalli

    Hello Emanuele,

    also no connection established. Hm, telnet should return a Could not open ...: Connect failed. Wonder why you don't see it.
    Anyway - the SYN is not acknowledged, no connection is established. Either the port is not open on 10.x.x.x - we can rule this out -, or the firewall on 10.x.x.x quietly drops the packet (e.g. because 192.x.x.x is not in the permitted IP range), or some device on the route drops the SYN. In theory some device could drop the SYNACK answer but this is very unlikely.

    Christian 

  • 0 in reply to QC

    I will check all the rules on firewall but local computers are ok and the behaviour is the same... it's very strange.

     

    Thanks


    Emanuele

Reply Children
Unfiltered HTML