[8.162][BUG][CLOSED] Network Security Firewall User Group Network

Hello,
i use a "User Group Network" object in the Network Securty Firewall alias Packet filter for Users with "Remote Access". After I'm connected with e.g. L2TP or SSL VPN it takes around five minutes until my packets from the vpn gets thru. In this time i can see them in the live log as Default DROP. In the context menu of the user group its says knowing IP addresses of users 1 IP v4 address. And than my packet filter rule 'goes on' an the packets are passed thru.

Regards,
Daniel

0 christianlouis over 14 years ago

Hi Daniel,

am I under the right impression that your problem is the five minute delay from successful login till the packets for that user are accepted? If yes, can you please post relevant log info from around that time?

What could be good to have is:

aua.log
the vpn technology specific log file
confd.log
packet filter log

Thanks
Christian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 daniel4 over 14 years ago in reply to christianlouis

Hi Christian,

the requested logs are attached.

Daniel

L2TP Logs.zip
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 14 years ago

Astaro Beta Report
--------------------------------
Version: 8.162
Type: BUG
State: CLOSED
Reporter: daniel4
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 kbr over 14 years ago

We also need the mdw.log from the same day, and the confd-debug.log.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 daniel4 over 14 years ago

Ok here are the two missed logs from the l2tp and some new from the ssl vpn.

ssl vpn login successful at 17:45. Then i constantly was pinging an IP address to get a precise packet filter log event when it goes thru. First ping goes thru a 17:50.38.

Hope it helps.

l2tp_logs_1.zip
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 14 years ago

Thanks for the logs, but i still miss the mdw.log... mdw-debug.log is nice too, but... [;)]

One additional question: did you shorten some of the files? the confd.log stops exactly at 23:38, so the log entries from the most interesting time period is missing.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 daniel4 over 14 years ago in reply to kbr
No the only cut I made was before the login. The log stops there.

Here the full logs from the asg.

I made a new connection and added the new logs. The Log stops again a short time after the login. Logs copied at 23:12, but conf.d stops at 23:05 the time where i logged in.

Next confd.log entry after 23:05:
2011:03:31-23:34:46 Ally confd[31970]: I sys::_close_session:6092() => id="3100" severity="info" sys="System" sub="confd" name="closing session" user="admin" srcip="192.168.0.130" sid="BmkNBQORNrTWLvkAQEHT" facility="webadmin" client="index.plx" call="logout"
confd_mdw-2011-03-29.log.zip
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel