Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 26
  1. #11
    Untangle Ninja Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    1,017

    Default

    Well, this has been a bit of a disappointment.

    I'll guess I'll commit the Untangle mortal sin and try a reboot. If IPS is still borked, I'll make use of paid support.

  2. #12
    Untangle Ninja Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    1,017

    Default

    I've been working with IPS on my home machine so I can be as clear and accurate as possible when I start a ticket against the business machine.

    One of the puzzling aspects of trying to decide when IPS is working and when it isn't is a discrepancy in the logged events reporting.

    Over time the app metrics are no where near the same as the total reported events.

    Screenshot_2020-02-23 Graf Home Network - gateway.png

    Screenshot_2020-02-23 Graf Home Network - gateway(1).png

    And if the metrics don't literally mean logged events but all events, the numbers still don't align.

    Screenshot_2020-02-23 Graf Home Network - gateway(2).png

  3. #13
    Untangle Ninja Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    1,017

    Default

    So from when I last posted until now, the metrics make it seem as if IPS has been active.

    Screenshot_2020-02-24 Graf Home Network - gateway.png

    Very nearly double the reported sessions logged. Yet the Intrusion Prevention / All Events report for today is blank.

    Screenshot_2020-02-24 Graf Home Network - gateway(1).png

    Now to confirm that the business server is still exhibiting similar behavior and if so, start a support ticket.

  4. #14
    Untangler
    Join Date
    Sep 2018
    Posts
    47

    Default

    Please post back what you hear. Unfortunately, testing/validating the status of IPS isn't the easiest thing.

    On a potentially related note, yesterday my U25 stopped passing traffic and wouldn't respond even to pings. I checked it out and the appliance was off. My household was all watching 4K Netflix streaming when it happened (not that I have any evidence that this caused it). I'm going to post separately.

  5. #15
    Untangle Ninja Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    1,017

    Default

    Absolutely, will do.

  6. #16
    Untangler
    Join Date
    Sep 2018
    Posts
    47

    Default

    So an update: something is definitely weird with the IPS module. I have made zero configuration changes recently to UTGW but it has suddenly gone from scanning after network rules to scanning before.

    It happened on 03/05/2020. At 10:32AM E, it detected and blocked a known bad IP and the log lists the INTERNAL/NAT-forwarded IP and the single destination port I have open inbound. This is normal, and there are usually a handful per day. At 11:32A E, it detected and blocked a known bad IP and the log lists one of several static EXTERNAL IPs and a port other than one open. And from there, piles and piles of that type, which is not surprising given the huge range of possibilities. I verified IPS is still set to after other network processing.

  7. #17
    Untangle Ninja Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    1,017

    Default

    A quick update from me, then. I have a ticket on a server and support has been super but the server has, so far, refused to act up (I did a clean install of the app so I had a memory usage baseline). Support is leaving the ticket in a hold status and I'm checking the server daily. Until it acts up in an unambiguous way, we wait.

  8. #18
    Untangler
    Join Date
    Sep 2018
    Posts
    47

    Default

    A bit more update: disabling and enabling the IPS app did not fix the behavior. Rebooting the appliance did.

  9. #19
    Untangler
    Join Date
    Sep 2018
    Posts
    47

    Default

    Quote Originally Posted by Sam Graf View Post
    A quick update from me, then. I have a ticket on a server and support has been super but the server has, so far, refused to act up (I did a clean install of the app so I had a memory usage baseline). Support is leaving the ticket in a hold status and I'm checking the server daily. Until it acts up in an unambiguous way, we wait.
    Thanks.

  10. #20
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    24,513

    Default

    A little relevant entertainment... for the waiting.

    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2