winxp cannot login into domain

Help for v2
21

disable the network monitor in CF

22

  1. On rule #3 change the Destination IP address to 10.2.194.10 and on rule #4 change the Source IP address to 10.2.194.10.

  2. Add a new rule to the very bottom of the Network Monitor rules list as you are not protected from inbound traffic. Make sure this rule is the very last rule in the list.

BLOCK-check the check box
IP
IN/OUT
Source IP: ANY
Destination IP: ANY
Source Port: ANY
Destination Port: ANY

  1. Go to Security>Advanced>Advanced Attack Detection and Prevention>Configure>Misc. Tab and uncheck “Block Fragmented IP Datagrams” and "Do protocol analysis

Ok try the 3 things that I listed above and when you post again include your log and a screenshot of the Network Monitor rules again.

I have one question: Do you have any software installed that is monitoring routers or parts of the network?

Hang in there you cleaned part of the log out.

jasper

23

Hi Midori and welcome to the forum,

Could you please start a new thread with your questions as it will make both sets of problems easier to keep track of and someone will be glad to help you. It also helps users to find solutions easier when they can see a thread that fits the problems they are having.

thanks,

jasper

24

actually, i don’t think allow all traffic' is the same as disable network monitor’.
i supposed they would do the same…but they didn’t.
i tried myself.

25

jasper, yes, this time, my win box can connect to the domain server. :BNC :BNC :BNC
would you please provide me some details or analysis on my issue?
u’ll be appreciated. :■■■■

26

jasper,

i noticed that you asked me to put two separated rules for the traffic from and to the ip address 10.2.194.11 (and 10.2.194.10). can i merge them to one rule, say In/Out option?

as i understand, 10.2.194.11 is the domain server. 10.2.194.10 could be a backup domain server (balance the traffic). what does 10.2.194.25 do? you (or LM) asked me to put this in the rule list.

instead of having special rules for those particular servers, can i set up a rule to enable all traffic within the local network? will it do the same (allow me to connect to the domain server)? is it safe?

27

Good to hear that hamburger.

You can get rid of rules 3 and 4 and either leave rules 1 and 2 and change the IP addresses to a range that includes the network IP addresses, if you know what that range is for sure OR make it one rule that in IN/OUT. I like the 2 separate rules so I can see it easier but either way will work just fine.

There is something else we need to test. I had you uncheck some checkboxes at the location below in my last post:

3. Go to Security>Advanced>Advanced Attack Detection and Prevention>Configure>Misc. Tab and uncheck “Block Fragmented IP Datagrams” and "Do protocol analysis

What I need you to do is to go back there and check the “Do protocol analysis” checkbox and see if it still works. Something is sending fragmented packets to your machine and I had you uncheck it to try and get you up and running. You really need this part working if possible as it is a big part of your protection. So if you could test that part to see what happens and post back the results that would be great. Leave the fragmented packets checked for now.

What we did was just go to each log entry that was being blocked and wrote a rule for it.

I don’t know what the 10.2.194.25 address is connected to so you might want to find out from the admin why that address is sending packets to you. It is sending you packets on port 712. It could be a network monitoring program on some machine possibly.

jasper

28

as soon as i checked that option, i’m blocked away from the domain server…

29

unchecked the analysis option and checked the ‘fragmented ip packet’ option, my win box can connect to domain server without any problem. is this a bug of CF?

30

I was hoping that the protocol analysis would work. That part is what checks all of the packets that come in. Without it you basically don’t have much protection. You can get by with the fragmented packets unchecked.

Both 10.2.194.10 and 10.2.194.11 are sending these types of packets for some reason. I don’t know your network but it could be CFP doesn’t recognize the protocol. If it was a bad NIC or switch then everybody would be having trouble connecting to the network without the firewall.

You could use a packet sniffer such as WireShark to see what is really going on but I would talk to your network admin first.

jasper

31

I didn’t notice if Jasper responded to this question specifically, so I thought I’d weigh in on it.

I would advise against it. If you enable all traffic within the LAN, that means any other computer on the LAN would have free access to your machine. That might not be an issue, but let’s say for example that one of those machines has been remotely accessed and controlled… then someone else completely has free access to your machine… Not the scenario I’d like, myself.

As Jasper has advised, I agree that you need to talk to your network admin to find out about the fragmented/malformed packets, and what the IP’s are. You may want to be prepared to mention that CFP is a true Stateful Packet Inspection (SPI) firewall; not all actually are (the level of checking that CFP performs is normally reserved for hardware firewalls, such as in a router).

LM