This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.504] No connections anywhere

I've just recently recovered a clients ASG from not allowing connections going in any direction.

This had me stumped for a while until a fellow ASG-er called and also had the same problem with one of his clients that run ASG.

After disabling the IPS it allowed connection to run correctly. This error effectively killed all internet, email, VPN connections and only allowed Webadmin access. No modifications had been made to the ASG for about 4 days so I have to point the finger at Astaro on this one!

Both our clients had just received the 12404 pattern. I'm assuming that this may also have something to do with the forum being down as they almost occurred at the same time.

This thread was automatically locked due to age.

0 ohamel over 15 years ago

Seems like a rule update is the problem..

[...]
2010:05:07-06:26:50 mail snort[32582]: FATAL ERROR: Warning: /etc/snort/rules/astaro.rules(1132) => Unknown keyword ' detection_filt
er' in rule!
[...]

Today:
mail:/var/log # grep -c "FATAL ERROR" /var/log/ips.log
128

Yesterday:
mail:/var/log # zgrep -c "FATAL ERROR" /var/log/ips/2010/05/ips-2010-05-06.log.gz
0
Cancel
Vote Up 0 Vote Down

Cancel
0 thefuzz4 over 15 years ago

Yes there is a problem with the latest update that we all grabbed tonight.
Cancel
Vote Up 0 Vote Down

Cancel
0 buddy007 over 15 years ago

Check this thread:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39670
Cancel
Vote Up 0 Vote Down

Cancel
0 Lemo over 15 years ago

Tonight! It's the middle of the work day in Australia.....I had some very pissed off clients!
Cancel
Vote Up 0 Vote Down

Cancel
0 madifor over 15 years ago in reply to Lemo

Unfortunally, they had the same issue on their BETA (ASG8) version 7.904.On the BETA version it have been fixed, hopefully, it will be fixed soon on the released version(s).Due to this IPS issue i was also not ABLE to authenticate with my normal AD Account(s) which was really frustrating for the user(s)
Cancel
Vote Up 0 Vote Down

Cancel
0 ohamel over 15 years ago

So i just installed 12405 pattern. Now, 3 mins later there arrived 12406 update.

Anyone enabled IPS after 12405 pattern install? Is IPS working again?
Does 12406 fix anything or is it just a regular update?
Cancel
Vote Up 0 Vote Down

Cancel
0 R1Bandit over 15 years ago in reply to ohamel

Yep it seems to have worked for quite afew by the look of it. Myself included.

...but....

what does this mean been in the IPS log for 1 day +

2010:05:07-18:48:02 lns-fw1 snort[8442]: Encoded Rule Plugin SID: 11016504, GID: 3 not registered properly. Disabling this rule.
2010:05:07-18:48:02 lns-fw1 snort[8442]: Encoded Rule Plugin SID: 52016534, GID: 3 not registered properly. Disabling this rule.
2010:05:07-18:48:02 lns-fw1 snort[8442]: Encoded Rule Plugin SID: 41016533, GID: 3 not registered properly. Disabling this rule.

Plus another 2 dozen rules.
Cancel
Vote Up 0 Vote Down

Cancel