Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

 
 
LinkBack Thread Tools Display Modes
Senior Member
Join Date: Sep 2010
Posts: 131
#11 (permalink)  
Old 09-29-2011, 07:12 AM
Default

have you also ensured what I asked you first:

Quote:
Originally Posted by Hakan Yueksel View Post
did you put your ASGs networks to the allowed networks under
Management -> Gateway Manager -> Device Security in the webadmin
of your ACC?
Member
Join Date: Sep 2010
Posts: 48
#12 (permalink)  
Old 09-29-2011, 07:13 AM
Default

Yes, we have "Any" networks in device security for now.
Senior Member
Join Date: Sep 2010
Posts: 131
#13 (permalink)  
Old 09-29-2011, 11:03 AM
Default

Could you please run tcpdump also on your remote ASG.

If you have an ASG in front of your ACC, please check on that machine
whether your remote ASGs are in principle able to come through. I.e.
appropriate rules, e.g. dnat rules are set, etc.

Please also check on each of the three machines, ACC, ASG in front of the ACC
and one of the remote ASGs, the log files ips.log, afc.log and packetfilter.log
whether packets sent to the ACC (port 4433) are dropped.

Regards, Hakan
Senior Member
Join Date: Sep 2010
Posts: 131
#14 (permalink)  
Old 09-29-2011, 11:14 AM
Default

Sorry, I've just realized that you already run tcpdump on your remote
ASG:

Quote:
Originally Posted by Undel View Post
tcpdump on affected ASGs shows that no packets are actually sent to ACC from these ASGs.
So, ACC logs are clear as there are no packets being transmitted.
Could you please look on the affected ASG under "Management -> Central
Management" what the litte diagnosis window at the bottom states.
Also have a look in to the live log.

And as I mentioned in my previous post also check the log files afc.log, ips.log
and packetfilter.log.

Regards, Hakan
Member
Join Date: Sep 2010
Posts: 48
#15 (permalink)  
Old 09-29-2011, 11:51 AM
Default

logs from Remote ASG.
Quote:
[1] ACC SSL-connect: 'IO::Socket::INET configuration failederror:00000000:lib(0):func(0):reason(0)'.
Quote:
2011:09:29-15:50:23 SZ1001400 device-agent[5932]: [1] ACC connection failure, retrying (ip=10.0.161.30, port=4433). SSL-connect: 'IO::Socket::INET configuration failederror:00000000:lib(0):func(0):reason(0)'
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: [1] Connection failed (ip=10.0.161.30, port=4433).
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 1 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 2 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 3 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 4 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 5 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 6 not executing: denied by role
2011:09:29-15:50:24 SZ1001400 device-agent[5932]: timer2 -> module 7 not executing: denied by role
2011:09:29-15:50:26 SZ1001400 device-agent[5932]: Not reporting inotify: no role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 1 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 2 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 3 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 4 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 5 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 6 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: timer2 -> module 7 not executing: denied by role
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: 1 is not connected. Trying to connect
2011:09:29-15:50:29 SZ1001400 device-agent[5932]: [1] Connecting to ACC socket (ip=10.0.161.30, port=4433).
2011:09:29-15:50:34 SZ1001400 device-agent[5932]: [1] ACC connection failure, retrying (ip=10.0.161.30, port=4433). SSL-connect: 'IO::Socket::INET configuration failederror:00000000:lib(0):func(0):reason(0)'
2011:09:29-15:50:40 SZ1001400 device-agent[5932]: [1] ACC connection failure, retrying (ip=10.0.161.30, port=4433). SSL-connect: 'IO::Socket::INET configuration failederror:00000000:lib(0):func(0):reason(0)'
2011:09:29-15:50:41 SZ1001400 device-agent[5932]: [1] Connection failed (ip=10.0.161.30, port=4433).
Quote:
n #
SZ1001400:/home/login # cat /var/log/ips.log | grep 10.0.161.30
SZ1001400:/home/login #
SZ1001400:/home/login # cat /var/log/ips.log | grep 4433
SZ1001400:/home/login #
SZ1001400:/home/login #
SZ1001400:/home/login # cat /var/log/afc.log | grep 4433
SZ1001400:/home/login #
SZ1001400:/home/login # cat /var/log/afc.log | grep 10.0.161.30
SZ1001400:/home/login #
SZ1001400:/home/login #
SZ1001400:/home/login # cat /var/log/packetfilter.log | grep 10.0.161.30
SZ1001400:/home/login # cat /var/log/packetfilter.log | grep 4433
SZ1001400:/home/login #
Senior Member
Join Date: Sep 2010
Posts: 131
#16 (permalink)  
Old 09-29-2011, 01:24 PM
Default

Can you ping your ACC from your remote ASG and vice versa?
Member
Join Date: Sep 2010
Posts: 48
#17 (permalink)  
Old 09-30-2011, 05:35 AM
Default

Yes, I can.
Senior Member
Join Date: Sep 2010
Posts: 131
#18 (permalink)  
Old 09-30-2011, 08:19 AM
Default

Hi Undel,

if you like we could have a look on your system. I've sent you
a pm for details.

Regards, Hakan
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 10:14 PM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.