Thread Info
  • State Not Answered
  • Replies 16 replies
  • Subscribers 0 subscribers
  • Views 4975 views
  • Users 0 members are here
Options
Suggested

"Default Drop" of HTTPS packets on internal connection

mhibler
Hi guys,

Here's another one from my workshop [;)]

I have an ASG v8 as a virtual appliance (192.168.98.254) on a ESXi host (192.168.98.1).

I can not connect to the ESXi host with VMware vSphere Client from another internal PC (192.168.98.11).

Here's a Packet Filter log:


2010:08:16-03:05:13 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="40" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK" 
2010:08:16-03:05:13 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="110" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK PSH" 
2010:08:16-03:05:16 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="110" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK PSH" 
2010:08:16-03:05:16 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="40" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK" 
2010:08:16-03:05:22 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="110" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK PSH" 
2010:08:16-03:05:22 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="40" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK" 
2010:08:16-03:05:34 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="110" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK PSH" 
2010:08:16-03:05:34 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="40" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK" 
2010:08:16-03:05:43 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="40" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK FIN" 
2010:08:16-03:05:46 vmaastaro ulogd[3728]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:e:7f:23:84:bb" dstmac="0:c:29:4a:f5:18" srcip="192.168.98.11" dstip="192.168.98.1" proto="6" length="110" tos="0x00" prec="0x00" ttl="128" srcport="3028" dstport="443" tcpflags="ACK PSH FIN" 
However, on a very rare occasion I do manage to connect just to be disconnected a couple of minutes later.

I have another ESXi host on the same network (192.168.98.2) which is working just fine...

What should I check?

Thanks in advance,

Miro
Parents
  • 0
    General philosophy for Astaro: an arriving packet is first considered by DNATs, then by Proxies, then by manual routes and, finally, by SNATs.

    I'm guessing that the vShpere Client is running on port-443 and that you have the HTTP/S Proxy in Transparent mode and are scanning SSL traffic.  If that's the case, then try putting the target server into the 'Transparent mode skiplist'.  If you're not in a transparent mode, then skipping the proxy for local IPs has to be done with wpad or a GPO.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    General philosophy for Astaro: an arriving packet is first considered by DNATs, then by Proxies, then by manual routes and, finally, by SNATs.

    I'm guessing that the vShpere Client is running on port-443 and that you have the HTTP/S Proxy in Transparent mode and are scanning SSL traffic.  If that's the case, then try putting the target server into the 'Transparent mode skiplist'.  If you're not in a transparent mode, then skipping the proxy for local IPs has to be done with wpad or a GPO.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson
    ...I'm guessing that the vShpere Client is running on port-443 and that you have the HTTP/S Proxy in Transparent mode and are scanning SSL traffic...


    Bob, this is Essential Firewall Edition - HTTP/S Proxy is disabled (as a matter of fact, it shows green light - greyed out, though - and I'm getting the 'Licensing Info - Web Security HTTP/S is disabled as you do not have a subscription or your subscription is expired!' message on top of the page)... [H]

    So, no fiddling there...

    Miro