[7.450][DUPE][OPEN] Remote Desktop ssl tunnel

gnomme over 16 years ago

If IPS is enabled remote desktop connections trough SSL VPN do not work. If I stop the service and try again It works

Parents

0 BAlfson over 16 years ago

Gnomme, do you mean stop/start IPS while you have an SSL VPN session running, or that it only works when IPS is stopped?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 16 years ago in reply to BAlfson

Gnomme, do you mean stop/start IPS while you have an SSL VPN session running, or that it only works when IPS is stopped?

Cheers - Bob

yes! however some hours later when I make another vpn connection the same problem happens
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to gnomme

"Yes" ??? [;)]

Is it "A" or "B" ?

A. It works after you "stop/start IPS while you have an SSL VPN session running"

B. "it only works when IPS is stopped"

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 16 years ago in reply to BAlfson

sorry...stop/start
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dmzalarm over 16 years ago in reply to gnomme

hmm, I use TS over ssl vpn daily and I don't have this problem on my beta instances. Did you see anything in packet filter logs?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to dmzalarm

Check your IPS logs; chances are you are experiencing a IPS rule that's being falsely triggered; when you see the rule sid in the log, just add it to the disabled rule list in the advanced tab under Intrusion Protection configuration.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 16 years ago in reply to dmzalarm

Check your IPS logs; chances are you are experiencing a IPS rule that's being falsely triggered; when you see the rule sid in the log, just add it to the disabled rule list in the advanced tab under Intrusion Protection configuration.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 ee-tra over 16 years ago in reply to BrucekConvergent

@gnomme
Can you please specify which rules are causing the drops?
Just posting the SIDs would be great, thanks.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 16 years ago in reply to ee-tra

I thont know wich rule is...I used VPN a lot in my previous version of ASG with no problem. the configurations was imported from the older
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to gnomme

Gnomme, ee-tra wants you to look in your Intrusion Protection log to see what rules are listed when this traffic is blocked.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 16 years ago in reply to BAlfson

I believe the problem he has is with rule 2418. I was at a remote location on someone's PC when I tried to log in to my home network. The following error was generated.

/var/log/ips/2009/05/ips-2009-05-31.log.gz:2009:05:31-04:37:12 gatekeeper snort[31502]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MISC MS Terminal Server no encryption session initiation attempt" group="110" srcip="***.***.145.177" dstip="192.168.1.2" proto="6" srcport="1745" dstport="3389" sid="2418" class="Attempted Denial of Service" priority="2" generator="1" msgid="0"

I haven't had that alert pop since that day so I assume it had something to do with the client.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 nitehawk over 16 years ago in reply to ee-tra

@ee-tra, all: We've had an earlier report of something sounding very similar: https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/67561
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 16 years ago in reply to nitehawk

Yes, marked as dupe now.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 16 years ago in reply to ee-tra

Yes, marked as dupe now.

define DUPE please
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 16 years ago in reply to gnomme

DUPE...duplicate as in someone else has the same problem (not the definition of dupe which means something completely different).
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 16 years ago in reply to Billybob

Astaro Beta Report
--------------------------------
Version: 7.450
Type: DUPE
State: OPEN
Reporter: gnomme
Contributor: 
MantisID: 
--------------------------------