This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS blocks download of Java RE

Today we tried to download Java 6.0 Update 20 from here: http://javadl.sun.com/webapps/download/AutoDL?BundleId=39494

But it doesn't work since we deactived the IPS. The log shows only a warning:

2010:06:03-11:29:22 router snort[3553]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-CLIENT Portable Executable binary file transfer" group="320" srcip="92.122.188.113" dstip="192.168.3.72" proto="6" srcport="80" dstport="52890" sid="15306" class="Misc activity" priority="3" generator="1" msgid="0"

What's going on here? Any suggestions or does someone have the same problem?

This thread was automatically locked due to age.

0 cst over 13 years ago

Ok, the warning includes a "drop". But since today this hasn't happend before.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jack Daniel over 13 years ago in reply to cst

If you trust the source, you can disable rule 15306 under the advanced tab. It looks like that may be a new or updated rule.
Cancel
Vote Up 0 Vote Down

Cancel
0 rbasukala over 13 years ago

I have ASG 7.504 installed on server. We have 6Mbps bandwidth for my office and want to limit users to have 500 kbits/s as an guaranted bandwith and 2000kbits/s (2Mbps) as an upper limit bandwidth.

I added the QoS rule on firewall (position 1) but when I tried to download a huge file from my computer which lies on user network it almost consumes all available bandwidth which is greater than upper limit specified.

Download Equilizer and Upload Optimizer is enabled for the external interface.

I also tried different other options but it is still not working.

Can someone please help me to find out the problem?

Thanks a lot in advance !!

RB
Cancel
Vote Up 0 Vote Down

Cancel
0 Jack Daniel over 13 years ago in reply to rbasukala

RB, you will need to enable automatic QoS on the LAN interface as that is where the request originates.
Cancel
Vote Up 0 Vote Down

Cancel
0 rbasukala over 13 years ago in reply to Jack Daniel

Thanks Jack!

Where can I find that option? I mean enabling automatic Qos?

Thanks!
RB
Cancel
Vote Up 0 Vote Down

Cancel
0 rbasukala over 13 years ago in reply to rbasukala

ok, so may be I was not clear before, here is my QoS configuration in detail.

Under Status Tab:
- status of external interface is enabled
    + Limit uplink, selected
    + Download Equlizer, selected
    + Uplocad optimizer, selected

Traffic selector:
    - Internet  --> Any -->  UserNetwork

Bandwidth Pool:
    - Interface: External
        + Name: Ineternet2UserNetwork
        + Position: 1
        + Bandwidth(kbit/s): 500
        + specify upper bandwidth limit, SELECTED
             ++ Limit(kbit/s): 2000
         + Traffic selecter: Selected from above

I also looked at manual and looks like the configuration is okay.

Thanks!
RB
Cancel
Vote Up 0 Vote Down

Cancel
0 Pyro411_01 over 13 years ago in reply to Jack Daniel

If you trust the source, you can disable rule 15306 under the advanced tab. It looks like that may be a new or updated rule.

I have found yesterday that 15306 also blocks updates to Windows Security Essentials as well. Disabling the rule does get it working in case the rule is going to get reviewed/removed.
Cancel
Vote Up 0 Vote Down

Cancel
0 cst over 13 years ago

Does someone know if this is fixed, so I can remove the exception for Rule 15306 from the advanced options?
Cancel
Vote Up 0 Vote Down

Cancel
0 AMros over 13 years ago

Astaro Up2Date Announcements: IPS false-positive can block http download of windows executable
Cancel
Vote Up 0 Vote Down

Cancel