This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

weird behavior that I expect not a VPN problem but need to ask

First I don't believe this is a VPN problem but making sure I cover all bases.

Recently our VPN users have start to see a problem when VPN in to our network. They are accessing files on a Linux server via a editor on their laptop that is VPN in. Some use notepad++ and other use notetab light to access the files. When they make either changes and save the file, the file on the Linux server either gets blanked out or corrupt that you can't open it any more.

So for testing I first tried modifying a test file on my desktop on the inside network (no VPN). Works like it should saving does not corrupt file and everything is good. I then VPN in from outside on a laptop using the same editor and file and the file gets corrupted. I tried MS notepad, notepad++ and notetab light - all cause the file on the Linux side to go bad.

My guess is the windows and or Linux side is causing the problem. Has anyone else seen something like this? I don't see how the VPN would be causing it but I'm no expert.

I can't pin point time frame but looks like this started to be a problem with in last two months.

John

This thread was automatically locked due to age.

Parents

0 Keyur over 4 years ago

Hi JohnAdamski

Thank you for providing in-depth details of the issue.

Are you facing this issue with all the VPN users?

Which VPN are you using to connect and edit the file on the Linux server?

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to Keyur

Most of the users that VPN do not need to edit files on the Linux server (our ERP). But a few of the ones that do have contacted me on this. So a small portion of all VPN users are affected, but it does seem all of the ones that edit files are having this problem.

We are using the Sophos VPN from the Sophos firewall. I'm not the main firewall admin, but am the main admin for the ERP and all Linux servers. that's why I got this question to resolve. :-)

I've taken a laptop and connected to inside with a local copy of editor and tried modifying file, works. Then connect laptop via VPN and bad things happen to file.

Again I don't think is VPN but from surface that is the only difference.

john
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to JohnAdamski

Late Friday the Network Admin turned off IPS and I tested. I was able to modify the file and save it without corrupting the file. he turned IPS back on and said he would work with me later to figure out what is causing the problem when IPS is on.

will be a week or so as he on vacation now.

john
Cancel
Vote Up 0 Vote Down

Cancel
0 KingChris over 4 years ago in reply to JohnAdamski

Hi JohnAdamski

Glad you were able to narrow it down.

You may have to create a custom IPS policy using signatures that are pertinent to your environment. So if you are not running any linux servers, do not choose linux IPS patterns to use.

Please do keep us updated.

Thanks.

KingChris
Community Support | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to KingChris

The network Admin has a few minutes to do some more testing this morning and he things the text editors are trying to do something over port 445 when saving the file. He ran out of time and did not get further. Said that port 445 sounds like it should be blocked.

So that's the latest.

john
Cancel
Vote Up 0 Vote Down

Cancel
0 KingChris over 4 years ago in reply to JohnAdamski

Hi JohnAdamski

Port 445 is the CIFS port, aka SMB/file sharing.

It is possible that IPS is blocking it due to running of older SMB version on your network. If you remove all IPS policies that state "SMB", then it should work.

Thanks!

KingChris
Community Support | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to KingChris

Yes our ERP server still needs smb1, we been waiting for the provider to figure out how to run on suse 15. they missed two proposed release dates for the update.

I will pass this on to my network guy.

john
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to JohnAdamski

Network admin made ips rules for VPN to allow smb1, we tested again and still failing.

probably time to open trouble ticket with Sophos.

john
Cancel
Vote Up 0 Vote Down

Cancel
0 KingChris over 4 years ago in reply to JohnAdamski

Hi JohnAdamski

Thanks for the response. Then it must be something else inside the IPS rules you have.

Please DM your case number you get so that we can track it.

Thanks!

KingChris
Community Support | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to KingChris

got this from Sophos. Your case number is [#9685143] .

john
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to KingChris

Sophos support email say Your case number is [#9685143] .

john
Cancel
Vote Up 0 Vote Down

Cancel
0 JohnAdamski over 4 years ago in reply to JohnAdamski

Sophos support found the problem. needed to allow packets for "SERVER-SAMBA Samba write andx command memory leak attempt" .

something to do with samba 1 the tech things and the Linux server currently doesn't support smb2 or above. Waiting on ERP to release version of ERP that can run on newer OS (with smb2).

so working now and once we can upgrade Linux OS can remove.

john
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JohnAdamski over 4 years ago in reply to JohnAdamski

Sophos support found the problem. needed to allow packets for "SERVER-SAMBA Samba write andx command memory leak attempt" .

something to do with samba 1 the tech things and the Linux server currently doesn't support smb2 or above. Waiting on ERP to release version of ERP that can run on newer OS (with smb2).

so working now and once we can upgrade Linux OS can remove.

john
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data