Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 14844 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IP Licensing problem (suddenly 245 IP's are used?!)

A.M. Heijboer

Dear Community,

Recently I installed Sophos UTM 9 (.407-3)

After a few days I had issues with the number of Active IP Addresses. It now says that there are 245 IP's in use (exceeds licence by 190).

This can't be, because I don't have more than 40 devices. Besides that, those devices have a ‘static’ IP, assigned from a Windows Server 2012 DHCP server.

If I take a look at the WebAdmin > Licensing > Active IP Addresses I see the most illogical IP's. The DHCP range on the Windows Server is .20 to .199, however, only 25 IP's are currently leased. The highest IP that is used is .83.

Now back at the WebAdmin again, I see the strangest addresses, for example .251. There is no way that I would use that IP address and it cannot be leased or something.

What I tried to do to solve the problem:

- First of all I did a Ping to a lot of the addresses. Results: the host cannot be found;

- I deleted the DHCP range on the Sophos UTM. Although it was disabled, I thought that it may interfere or something;

- Second I disconnected some devices, of which I suspected them of weird behaviour. Result: none.

Every time I cleared the licensed IP through the terminal with the CC command. But still after a day or so I recieved a mail that all addresses are used again.

I thought of looking in the logs, but I don’t know which logs too look at (anybody has a suggestion?).

I think it is either one of two problems; 1. There is a faulty device in my network, what I using a lot of different IP’s (that’s why I wanted to look in the logs, if it would be the same device you 'should be able to' recognise it by the MAC address) of 2. There’s something wrong with Sophos (a.k.a. it is placing almost the whole range of the 192.168.188.x network in de Licensed IP table).

And that Sophos is acting weird, I noticed that because of some other things. For example; although the IP limit was reached, I was able to go on the internet, with devices while their IP addresses where in the ‘outside scope’ box. in my believe; shouldn't they be blocked?

For now it seems like the IP licence isn’t doing anything. I was also able to connect through VPN and have internet access, while I used a ‘new’ IP with the VPN (SSL VPN Pool, a 10.x.x.x address).

Also, sometimes it seemed like it took really a lot of time to repopulate the tables in the WebAdmin > Licensing > Active IP Addresses. I tried to refresh it, but after half an hour of waiting and no change, I gave up (I connected to the internet on multiple devices by then, without any trouble, so they should be listed there).

To prove that I truly am a home user, I have attached a screenshot from the Web Protection Statistics, where you can see that there are only 21 unique users. (and for what I thought, there are only about 21 users at all, who access the internet. Anyways by far not 245).

I tried to be as clear as possible, but if you have any questions, I’be happy to answer.

Your help is greatly appreciated!

Kind regards,
Adriaan Heijboer


WebAdmin > Web Protection Statistics.PNG https://drive.google.com/open?id=0BwoVESK-l0ChTEY1VWl0UzAxZWM



This thread was automatically locked due to age.
Parents
  • 0

    Adriaan, I don't think you can any longer clear IPs from the license counter.  I think you just need to wait for seven days.  It's not uncommon for this to happen.  Someone scanned all of the IPs in your subnet.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob,

    Up until this point resetting the Licensed IP’s still works for me. This is the thread I used to do it: https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/33749/reset-licence-active-ip-s

    You said that it is not uncommon for this to happen, do you know if these are people with specific apps/programs that do this, or is this expected behaviour for some devices?

    And with IP scanning, isn’t a IP scan meant to just to ping all possible IP’s? Instead of using all IP’s once and while doing that also contacting the Default Gateway (Sophos) at least once, cause I think that this is happening here.

    Because, if I understand correctly, Sophos only counts a IP when the IP contact Sophos.

    And I would think that a normal IP scan would only ping the IP, and would not include a message to the Default Gateway, so in that case the IP’s wouldn’t show up in the license table.

    In any way, is it possible to find out who is doing this? It seems that the Licensing IP doesn't block new addresses as supposed, so it doesn't really matters for me right now, but still I would like to know. Cause -ofcourse- you would only want the IP’s that are actually on your network in the IP Licensing table.

    Thanks,

    Adriaan Heijboer

  • 0 in reply to A.M. Heijboer

    To reach an IP in the device's subnet, the NIC first broadcasts an ARP request asking "Who has IP ...?" - the UTM sees that IP and counts it.

    I'm glad to know that those commands still work - thanks, Adriaan!

    Interesting, my lab UTM should have a limit of 100 IPs, but it's not populating.  I only did the command line checks and never bothered to look on the 'Active IPs' section of 'Licensing' in WebAdmin.  I checked the one client with a non-Sophos appliance and found that they're having active_ips populated.  Since this is the only anomaly I've noticed, I think I'll not re-image from ISO until forced to do so. [;)]

    I think the only way to find out where that's coming from is to use tcpdump to capture ARP requests to a file and then check that file when you notice that a scan has been done.  If your subnet were 10.1.1.0/24, I would try something like the following:

     tcpdump -i eth0 arp |grep -oP 'who\-has 10\.1\.1\..*? tell.*'|sort -n|uniq -c >/home/arp-requests &

    That runs in the background, so do jobs -l to see the number of the process running tcpdump.  Assuming that it's 4430, you stop that by doing kill -9 4430 when you want to look at the result.  I would occasionally do this and restart the command if you're concerned about the size of your network.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob,

    Oh of course, how could I forget ARP….

    You’re welcome ;)

    Okay strange. And indeed, that’s too much work just for 1 small thing :)

    You’re command worked perfectly. I only had to make a small adjustment (different IP range). I’ve been testing this for like an hour and this command is very useful.


    I have a few questions regarding that tcpdump command; is it possible to show more information? For example Source MAC?

    And if I take a look at the log output below, what's up with the entry with ‘(Broadcast)’ in it; does it send an ARP-request to find his own MAC?

    6 who-has 192.168.188.20 (Broadcast) tell 192.168.188.20, length 46
    2 who-has 192.168.188.20 tell 192.168.188.1, length 28

    I also found two other weird lines;

    1 who-has 192.168.188.53 tell
    3 who-has 192.168.188.53 tell 0.0.0.0, length 46

    I guess an transmission error?

    I think I’m going to leave the command running and check it once in awhile. I assume that's okay for the job (or are there too many ARP-request > is the log becoming too big in such situation -If I leave it on for a few days-?).

    Thanks for your time!

    Kind regards

    Adriaan Heijboer

  • 0 in reply to BAlfson

    Hi Balfson,

    Shouldn't the Active IPs only be counted if they traverse down the default gateway path? At least that was my understanding.

    Reason for this is I have several customers with Hub & Spoke VPN networks and there's at least a 1000 IPs which are touched regularly by the central hub from the other spokes but the UTM is only counting the local IPs onsite when they go out to the internet and not when they go via the VPN tunnel.

    Just wanted to clarify?

    Emile

  • 0 in reply to A.M. Heijboer

    "what's up with the entry with ‘(Broadcast)’ in it; does it send an ARP-request to find his own MAC?" - that's a Gratuitous ARP request by the NIC confirming that no other device has its IP.  The "tell 0.0.0.0" line is an ARP Probe - again, nothing to worry about.

    If this is a home network, you probably can leave tcpdump running for a day or two with no problems.  I'm not sure whether tcpdump writes to a disk cache or keeps its undisplayed data in RAM.  If you notice it doing either, please comment.

    EDIT 2016-10-19: tcpdump write files in the /tmp directory.  You will want to keep an eye on that using df -h

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Emile Belcourt

    I think you're right, Emile.  IPs are counted only if their traffic arrives on a local interface that has no default gateway.  No public IPs are counted since their traffic arrives on an interface with a default gateway.  VPN traffic does not arrive on an interface at all.  RED traffic arrives on a reds# interface, so it is counted.  Unmasqed traffic from a subnet behind an internal router is counted.

    At least, that's how I understand it.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi BAlfson,

    I'll need to double check my facts, but I've set up firewall rules to block devices on the LAN accessing the WAN and their IPs were not counted in the Active IP log even though they arrived on the internal LAN interface, I could be wrong as it was a while ago since I last messed about with the IP licensing.

    That's why I believe it's only IPs that are traversing onto an interface that has a default gateway set on it are counted. It has been a long week already!

    Emile

  • 0 in reply to Emile Belcourt

    Hi Emile and Bob,

    I just couldn't find it just now, but I had read somewhere on a forum that every IP that contacted the UTM, is counted towards the license.

    I also found this blog, what would supposely confirm it http://www.greenvalleyconsulting.org/2015/05/18/sophos-utm-home-licensing-count/

    BAlfson said:

    "what's up with the entry with ‘(Broadcast)’ in it; does it send an ARP-request to find his own MAC?" - that's a Gratuitous ARP request by the NIC confirming that no other device has its IP.  The "tell 0.0.0.0" line is an ARP Probe - again, nothing to worry about.



    Okay, good.
    It is a home situation, so I think I will leave it on. (now I'm interested to see what happens...) Up until now I don’t see anything remarkable in Logging > Hardware (RAM or HDD usage).

    BAlfson said:

    VPN traffic does not arrive on an interface at all.  RED traffic arrives on a reds# interface, so it is counted.  Unmasqed traffic from a subnet behind an internal router is counted.


    This sounds logical to me.


    Thanks for your help.

    Kind regards,

    Adriaan Heijboer

Reply
  • 0 in reply to Emile Belcourt

    Hi Emile and Bob,

    I just couldn't find it just now, but I had read somewhere on a forum that every IP that contacted the UTM, is counted towards the license.

    I also found this blog, what would supposely confirm it http://www.greenvalleyconsulting.org/2015/05/18/sophos-utm-home-licensing-count/

    BAlfson said:

    "what's up with the entry with ‘(Broadcast)’ in it; does it send an ARP-request to find his own MAC?" - that's a Gratuitous ARP request by the NIC confirming that no other device has its IP.  The "tell 0.0.0.0" line is an ARP Probe - again, nothing to worry about.



    Okay, good.
    It is a home situation, so I think I will leave it on. (now I'm interested to see what happens...) Up until now I don’t see anything remarkable in Logging > Hardware (RAM or HDD usage).

    BAlfson said:

    VPN traffic does not arrive on an interface at all.  RED traffic arrives on a reds# interface, so it is counted.  Unmasqed traffic from a subnet behind an internal router is counted.


    This sounds logical to me.


    Thanks for your help.

    Kind regards,

    Adriaan Heijboer

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML