Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 4168 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

InactiveRpcError when using Sophos FW

Imesh Liyanage

A few users in our network use Python & Java scripts to connect to some services on AWS. The scripts work fine when bypassing the Sophos FW or using mobile hotspots. But when using Sophos the users see errors like this in their terminals:

Exception has occurred: _InactiveRpcError
<_InactiveRpcError of RPC that terminated with:
	status = StatusCode.UNAVAILABLE
	details = "failed to connect to all addresses; last error: UNAVAILABLE: ipv4:x.x.x.x:80: Connection timed out"
	debug_error_string = "UNKNOWN:failed to connect to all addresses; last error: UNAVAILABLE: ipv4:x.x.x.x:80: Connection timed out {grpc_status:14, created_time:"2023-08-29T11:22:07.56380364+00:00"}"
>
  File "C:\Users\imesh\Desktop\fw_test.py", line 27, in <module>
    qid = cursor.execute('select * from date_dim limit 3')
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
	status = StatusCode.UNAVAILABLE
	details = "failed to connect to all addresses; last error: UNAVAILABLE: ipv4:x.x.x.x:80: Connection timed out"
	debug_error_string = "UNKNOWN:failed to connect to all addresses; last error: UNAVAILABLE: ipv4:x.x.x.x:80: Connection timed out {grpc_status:14, created_time:"2023-08-29T11:22:07.56380364+00:00"}"
>

In the firewall logs, I see a few denied packets with this error: Could not associate packet to any connection.

Any idea what could be causing this?



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Imesh Liyanage

    Hi  Perfect! Regarding the traffic via the original rule for which connection is getting RESET may have different possible reasons, like Firewall DPI/Proxy coming into the picture and inserting Firewall cert, which is not accepted by the remote server, or many more..! If you want more investigation on same - why it works with plain rule and why with the original rule you are getting RESET error then you may log a support case for same, so support team may review the logs for the required services along with tcpdump and PCAP files for those IPs.

    Regards,

    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'Verify Answer' link.

Children
Unfiltered HTML