As it turns out, I found the problem to be in the firewall. I reasoned that since I could get to the web GUI on the SonicWall while I could not get to www.google.com (when the problem happened). I think thats logical. So I called up SonicWall, who was NOT real willing to be helpful. By taking a packet capture off the firewall, I proved to SonicWall tech support that their firewall was the problem. You see, the same traffic which is allowed is also blocked. You see it being blocked below, then allowed. No difference in source, destination, port, etc. All the same. See below.
===============
Dropped Header
Ethernet Header
Ether Type: IP(0x800), Src=[00:24:38:c2:56:00], Dst=[02:17:c5:d8:36:44]
IP Packet Header
IP Type: UDP(0x11), Src=[10.168.6.10], Dst=[12.29.157.29]
UDP Packet Header
Src=[80], Dst=[80], Checksum=0xb7bb, Message Length=64 bytes
Application Header
HTTP:
Value:[0]
DROPPED, Drop Code: 39, Module Id: 26, (Ref.Id: _4719_uyHtJcpfngKrRmv) 1:0)
===============
Allowed Header
Ethernet Header
Ether Type: IP(0x800), Src=[00:24:38:c2:56:00], Dst=[02:17:c5:d8:36:44]
IP Packet Header
IP Type: UDP(0x11), Src=[10.168.6.10], Dst=[12.29.157.29]
UDP Packet Header
Src=[80], Dst=[80], Checksum=0xd698, Message Length=80 bytes
Application Header
HTTP:
Value:[1]
Forwarded 5:2)
So I have SonicWall tech support telling me it is NOT their problem. Its the network. Ok, LOOK AT THIS CAPTURE! Are you kidding me? I was nice, but I had to argue with this guy that it was a firewall issue. I have no ACLs on the core switch. Nothing on the internal network would cause this. But again, look at this capture. I sent him the wireshark capture. I sent him this screenshot, and he still says its wasnt his problem.
Well, when I finally convince him it IS his problem, he has to get a senior tech to look at it with him. The senior tech ends up telling me is a SSO (single sign on) issue. It turns out that since these particular computers and fire alarm monitoring system does not actually log into AD, for some reason the SonicWall behaves the way I described above.
So here is what I did to fix the issue. This was provided to me by the SonicWall tech support. Man, I am not a SonicWall fan.
Hi Brother!
ReplyDeleteWhat are you SSO agent version ??
Let me know it please.
Hi Nander. I do not recall. Ive never done any SonicWall firewall work until this unit. I didnt even think to check the version.
DeleteAnother Thing....
ReplyDeleteWhat kind are you using port 80 with UDP protocol ?
No, it was 80/TCP.
DeleteOh Sorry about that.
ReplyDeleteBut in your LOGs, the Drop packet are UDP in port 80. Did you check this?
maybe it's a another kind of problem.
Att
Ernander
Certified SonicWall Security Administrator
Well, that is interesting. Im trying to recall what I was doing. Im can recall for sure what they were trying to send to the remote site, but you are right, it does say UDP in the log file. However, I couldnt even go to yahoo.com or anything like that. It was really strange to me, but I dont recall doing any UDP traffic. Interestingly though, the example packets show UDP. Ill have to think about that one. Again, all I did was regular web traffic to test with, so Im not sure why it shows up as UDP.
DeleteNot sure if it is still an issue with you or not, but I found a solution on another Blogger's page. Not certain why it works (or why the whitelist feature doesn't work 100% of the time) but according to "Clyde" the module in "CFS" where it says "Enable HTTPS Content Filtering" causes the issue that you were mentioning. I turned it off (to my dismay) and it did work 100% of the time.
ReplyDeleteGood info Stephen. Thank you. The 'fix the issue' link is what I did to fix it. But your post will help others. Thank you again.
DeleteGood Stuff!!! Helped me out with a scan-to-email issue we were having. Added the printers to the white list and worked like a charm!!
ReplyDelete