This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ENTERPRISE CONSOLE - REMOTE CLIENT NOT CONNECTED

Good morning, our securty enterprise console from a couple of months is no longer able to communicate with customers' computers, even update managers have not been updated for months; client-side updates instead work correctly.
I tried with the following solutions:
- correct communication of  server-side ports and telnet tests from clients
- control of services started
- community.sophos.com/.../time-of-last-binary-update-is-a-long-time-ago
- https: //community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/96059/most-clients-shown-as-disconnected-in-sec-5-5-0

I have not solved
thank you

Emanuele

This thread was automatically locked due to age.

Parents

0 QC over 6 years ago

Hello Emanuele,

are you an MSP?

client side updates [...] work correctly
did you also check the Network Communication Report? You say that telnet yourSECserver 8192 works - you did get an IOR: in response= If so, you can parse it here (you have to remove the CRLFs so that the IOR: is a single line).

Christian
Cancel
Vote Up 0 Vote Down

Cancel

0 emanuele fumagalli over 6 years ago in reply to QC

Yes i am a partner.

Network report says it's everything ok,

telet result internal network:

_IIOP_ParseCDR:  byte order LittleEndian, repository id <IDL:SophosMessaging/MessageRouter:1.0>, 1 profile
_IIOP_ParseCDR:  profile 1 is 164 bytes, tag 0 (INTERNET), LittleEndian byte order
(iiop.c:parse_IIOP_Profile):  bo=LittleEndian, version=1.2, hostname=10.234.0.53, port=8193, object_key=<....NUP...!........RootPOA.RouterPersistent.........MessageRouter>
(iiop.c:parse_IIOP_Profile):  encoded object key is <%14%01%0F%00NUP%00%00%00%21%00%00%00%00%01%00%00%00RootPOA%00RouterPersistent%00%03%00%00%00%01%00%00%00MessageRouter>
(iiop.c:parse_IIOP_Profile):  non-native cinfo is <iiop_1_2_1_%2514%2501%250F%2500NUP%2500%2500%2500%2521%2500%2500%2500%2500%2501%2500%2500%2500RootPOA%2500RouterPersistent%2500%2503%2500%2500%2500%2501%2500%2500%2500MessageRouter@tcp_10.234.0.53_8193>
object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.53", port 8193

object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.53", port 8193




telnet from remote client:

_IIOP_ParseCDR:  byte order LittleEndian, repository id <IDL:SophosMessaging/MessageRouter:1.0>, 1 profile
_IIOP_ParseCDR:  profile 1 is 164 bytes, tag 0 (INTERNET), LittleEndian byte order
(iiop.c:parse_IIOP_Profile):  bo=LittleEndian, version=1.2, hostname=10.234.0.54, port=8193, object_key=<....NUP...!........RootPOA.RouterPersistent.........MessageRouter>
(iiop.c:parse_IIOP_Profile):  encoded object key is <%14%01%0F%00NUP%00%00%00%21%00%00%00%00%01%00%00%00RootPOA%00RouterPersistent%00%03%00%00%00%01%00%00%00MessageRouter>
(iiop.c:parse_IIOP_Profile):  non-native cinfo is <iiop_1_2_1_%2514%2501%250F%2500NUP%2500%2500%2500%2521%2500%2500%2500%2500%2501%2500%2500%2500RootPOA%2500RouterPersistent%2500%2503%2500%2500%2500%2501%2500%2500%2500MessageRouter@tcp_10.234.0.54_8193>
object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.54", port 8193

object key is <#14#01#0F#00NUP#00#00#00!#00#00#00#00#01#00#00#00RootPOA#00RouterPersistent#00#03#00#00#00#01#00#00#00MessageRouter>;
 no trustworthy most-specific-type info; unrecognized ORB type;
 reachable with IIOP 1.2 at host "10.234.0.54", port 8193

0 emanuele fumagalli over 6 years ago in reply to QC

Hello, if i telnet 8194 i receive no error, after some second the connection drops.

Same behavior from internal and external

Other test i can do?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

ran out of simple tests. As telnet can connect the Router should also be able to do so. I'd monitor (on the remote machine) the TCP activity on port 8194 with Wireshark.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 emanuele fumagalli over 6 years ago in reply to QC

i see only this error:

132 37.677772 192.x.x.x 10.x.x.x TCP 62 [TCP Retransmission] 61573 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1132 37.677772 192.x.x.x 10..x.x.x TCP 62 [TCP Retransmission] 61573 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

10.x.x.x is the internal ip of my message relay

so it's tcp / ip connection syn ack problem... but nothing is changed on my network or firewall
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

clearly no connection established. And if you telnet 10.x.x.x 8194, what does it show then?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 emanuele fumagalli over 6 years ago in reply to QC

no error but the command is empty, after some second the connection is dropped. but it's the same from a local machine
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

sorry, I menat what does Wireshark show for the telnet connection?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 emanuele fumagalli over 6 years ago in reply to QC

21 5.084280 192.x.x.x 10.x.x.x TCP 62 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1

96 19.082120 192.x.x.x 10.x.x.x TCP 66 [TCP Port numbers reused] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

106 22.083265 192.x.x.x 10.x.x.x TCP 66 [TCP Retransmission] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

129 28.081596 192.x.x.x 10.x.x.x TCP 62 [TCP Retransmission] 61604 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

also no connection established. Hm, telnet should return a Could not open ...: Connect failed. Wonder why you don't see it.
Anyway - the SYN is not acknowledged, no connection is established. Either the port is not open on 10.x.x.x - we can rule this out -, or the firewall on 10.x.x.x quietly drops the packet (e.g. because 192.x.x.x is not in the permitted IP range), or some device on the route drops the SYN. In theory some device could drop the SYNACK answer but this is very unlikely.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 emanuele fumagalli over 6 years ago in reply to QC

I will check all the rules on firewall but local computers are ok and the behaviour is the same... it's very strange.

Thanks

Emanuele
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

I don't think it's the local firewall - more likely the one on the relay or a firewall/ACLs between the subnets (assuming these servers and the relay are not on the same subnet).

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 6 years ago in reply to emanuele fumagalli

Hello Emanuele,

I don't think it's the local firewall - more likely the one on the relay or a firewall/ACLs between the subnets (assuming these servers and the relay are not on the same subnet).

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 emanuele fumagalli over 6 years ago in reply to QC

10.x.x.x is my local network behind a firewall, and i cannot see any computer on the local subnet of my customers, so i think there is some on my network blocking, otherwise it would be a problem just to a single customer
Cancel
Vote Up 0 Vote Down

Cancel