[7.386] IP licensing - possibly?

[:S]

I don't remember from 7.3 how often it checks, but I've noticed that on the beta, I have NO IP's listed on the licensing page, even though I know there's multiple connections...

Parents

0 BarryG over 16 years ago

IIRC, It's supposed to update every night, unless you have an unlimited license.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to BarryG

I've seen the same thing with the licensing daemon on production systems... so long as it doesn't stop things from working, it's no big deal... not sure why it doesn't work on some systems, though.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to Hubersan

Huberscan, that shouldn't happen... are the IPs from outside the network (internet-routable IPs)? If so, post a screenshot of the licensing tab showing those allocated IPs, maybe an Astaro tech will see those and ask to see your config, etc.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Hubersan over 16 years ago in reply to BrucekConvergent

Huberscan, that shouldn't happen... are the IPs from outside the network (internet-routable IPs)? If so, post a screenshot of the licensing tab showing those allocated IPs, maybe an Astaro tech will see those and ask to see your config, etc.

The IPs that are listed are ALL of the IPs that could possibly be behind the firewall, even the subnet and broadcast IPs - which shouldn't EVER appear (those IPs are .128 and .159, btw).

The packet filter log shows that someone scanned my network looking for MS SQL servers, which is normal, but it looks like the licensing daemon decided to take that as a 'I'm protecting that IP', which is different than the 7.3 functionality.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to Hubersan

Are you saying the 204.x.x.x IPs are behind the firewall? I don't know what to say about that, all the testing I've done is using IANA RFC private IP ranges behind the firewall... I suspect something is triggering because of the public IPs.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Hubersan over 16 years ago in reply to BrucekConvergent

Are you saying the 204.x.x.x IPs are behind the firewall? I don't know what to say about that, all the testing I've done is using IANA RFC private IP ranges behind the firewall... I suspect something is triggering because of the public IPs.

That's correct - old habits die hard. I personally HATE NATting if I don't have to. Those are publicly routable IPs that I've got. The part that I was curious about was that this hasn't been a problem in older versions, so I wasn't sure what changed in the beta (or maybe it's a configuration change).
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 16 years ago in reply to BrucekConvergent

Are you saying the 204.x.x.x IPs are behind the firewall? I don't know what to say about that, all the testing I've done is using IANA RFC private IP ranges behind the firewall... I suspect something is triggering because of the public IPs.

Bruce, we use public IPs (an entire Class C ) on version 6.3, and what Hubersan describes has never happened to us, although we DO get scanned all of the time.

I strongly suspect it's a bug in the 7.4 betas.

I'd be happy to do some more scans against my 6.3 if anyone wants.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to BarryG

Barry, on the inside of the 6.3 install too? YOu don't NAT or MASQ an internal IP range to the outside?

I admit, this could be a problem...

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 16 years ago in reply to BrucekConvergent

Although I'm being forced against my will to NAT our new install, our old network is not NAT'd at all... we're using the Class C that our ISP gave us, internally and externally (there's a transfer network on the outside, which routes everything else inside).

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 16 years ago in reply to BrucekConvergent

Even if you NAT, someone on INT could scan the DMZ subnet, and you'd have the same problem.

To anyone trying to test this: note that you won't see the extra IPs in the license count until the next day.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Scott_Klassen over 16 years ago in reply to BarryG

Congrats on the wizard promotion guys. So does this mean you can do a Harry Potter Expelliarmus now?

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to Scott_Klassen

I have to say that I've never even watched any of the Harry Potter movies.... Star Trek and Star Wars, well, that's a different matter.... [:)] Jedi would be a better title, ha ha ha!

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 16 years ago in reply to Scott_Klassen

I have to say that I've never even watched any of the Harry Potter movies.... Star Trek and Star Wars, well, that's a different matter.... [:)] Jedi would be a better title, ha ha ha!

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data