This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

V6.300 Update ISP blocks everything

Hi all,
I just update to V6.300 and i can't connect to the internet anymore. When I disable IPS I can enter the internet. What's causing this problem with IPS. It should be faster but it blocks ALL traffic [:(] V6.203 worked just fine.... Can someone help me please?

This thread was automatically locked due to age.

Parents

0 Frank_H over 18 years ago

Same here!!
https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/25673

When you look at the logs nothing seams to be wrong. But hell nothings working so someting is wrong! [;)]
I got my system back on the net after disabling the IDS/IPS just like you.

An statement from the folks @ Astaro would be nice =)
Or at least a way to reverse the new snort to the old again.
Cancel
Vote Up 0 Vote Down

Cancel
0 ECKEROTH over 18 years ago in reply to Frank_H

Had to downgrade to 6.203 before things worked normaly again [:O]
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 18 years ago in reply to masliah

Running now v6.300 but when I try to download something the fw-fetcher of Astaro doesn't work..... Also how can I test the AV engine for SMTP???
Cancel
Vote Up 0 Vote Down

Cancel
0 Frank_H over 18 years ago in reply to PabloDiablo

Hi

It works for me. Do you get any errors?

Try to download the eicar file from www.eicar.com
Then send it out to for instance your yahoo mail. Dont forget to enable scanning for outgoing emails.

An other alternative i think checks this also is nessus, A free service scan from the outside can be found at https://www.testadatorn.se/
Just enter your email address and push the button.

If my memorys not wrong this will test to send an virus file to you.
Cancel
Vote Up 0 Vote Down

Cancel
0 squeeze over 18 years ago in reply to Frank_H

hi,

I have no trouble with IPS so far, but I only have 'HTTP' listed as HTTP service.. did you have a service range (e.g. 80:8080) before and is that the reason why it did not work?

cheers..
Cancel
Vote Up 0 Vote Down

Cancel
0 Frank_H over 18 years ago in reply to squeeze

Hi!

Well dont know for the others but I had 80:8080
Du you only have 80?
Cancel
Vote Up 0 Vote Down

Cancel
0 squeeze over 18 years ago in reply to Frank_H

hi,

yes, I only have (the predefined) HTTP TCP/80 .. and that works for me..

cheers..
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 18 years ago in reply to squeeze

Strange, normally I had a lot of updates for the AV engine but now there is only 1 update downloaded. Have someone the same issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 Frank_H over 18 years ago in reply to PabloDiablo

Hi!

Okey Squeeze thanks for the info will try that [:)]

Fobe, Yepp me to. However under weekends its normaly less activity. We should wait until monday. If its the same sometings not right.
Cancel
Vote Up 0 Vote Down

Cancel
0 Timo Steinbach over 18 years ago in reply to Frank_H

Conclusion - IPS problem:

Webadmin >> Intrusion Protection >> Advanced >> HTTP Service. If a portRANGE is configured the problem will occure. Problem is: IPS takes a high amount of CPU for 1-3 Minutes. Also it uses a lot of memory. Then it returns to normal operation. Anyway high memory usage will stay.

Workaround: Do not use a port range. Use single ports.
Cancel
Vote Up 0 Vote Down

Cancel
0 Frank_H over 18 years ago in reply to Timo Steinbach

Hi Timo Steinbach,

Well the workaround is correct.
However your assessment on the time is wrong. It does not lower CPU after 1-3 min, Applied my 6.300 when i went from work the other day and when I arrived at my house 10-15min later the load was around 3-4 and no surfing was possible. On a P4 1.7Ghz with 768MB ram i dont se that it would take that long unless it's a endless loop or bug.

The memory im not to conserned about but when it uses all CPU and freezes everything i tend to care more. [;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 AaronGenter over 18 years ago in reply to masliah

After loading 6.3, if anyone from the WAN tries to go to a server on the LAN on http it passes through fine, but if you try to go to the same servers using https, it sends you to the firewall's webadmin page. NAT is set to pass all ports through to the internal IPs, and it has been working until the update.

I am having the same problem. None of the addresses I have setup in NAT to point to an HTTPS service are getting through, all addresses end up at Astaro Webmin page but http passes just fine. Any Suggestions?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AaronGenter over 18 years ago in reply to masliah

After loading 6.3, if anyone from the WAN tries to go to a server on the LAN on http it passes through fine, but if you try to go to the same servers using https, it sends you to the firewall's webadmin page. NAT is set to pass all ports through to the internal IPs, and it has been working until the update.

I am having the same problem. None of the addresses I have setup in NAT to point to an HTTPS service are getting through, all addresses end up at Astaro Webmin page but http passes just fine. Any Suggestions?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BrucekConvergent over 18 years ago in reply to AaronGenter

Per ACE training, change the webadmin port to something else... should work fine after that. It seems some folks were "lucky" in that the NAT rules they had set up for port 443 were taking effect before the WebAdmin port binding.. well, Astaro recommends changing the Webadmin port in these scenarios, and apparently the new update breaks that "lucky streak."

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 AaronGenter over 18 years ago in reply to BrucekConvergent

Thank you very much, that did the trick.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 18 years ago in reply to AaronGenter

Had the same issues here after applying 6.300. Nothing worked and cpu usage was maxed. Did a reboot. After 10 long minutes, things settled down on the Astaro and function returned to normal.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 Frank_H over 18 years ago in reply to Scott_Klassen

Hi Scott,

What is your hardware on the firewall? And did you have a port span on the HTTP Service?
Cancel
Vote Up 0 Vote Down

Cancel
0 caponord over 18 years ago in reply to Frank_H

Did anyone with this problem had the following symptoms ?

- Problems connecting via VPN PPTP
- Slowing down connection and web admin
- Slowing refresh pages in web admin when chenging config
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 18 years ago in reply to caponord

For those experiencing the port range issue with their IPS, install the latest Up2Date.. I haven't loaded 6.301 myself on a machine with a port range, but this issue is listed in the bug fix list.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 caponord over 18 years ago in reply to BrucekConvergent

Should the problem occur even if the "http Service" is not set and all servers are left blank ?

Is possible that such a situation can cause the same problem ? Should be better if i define a single port also in this case ?
Cancel
Vote Up 0 Vote Down

Cancel