This indicates that you do not have network connectivity.
Make sure all cables are functional, the firewall is powered on, and the connected computers are correctly configured.
You may have selected the wrong network connection type. Check Network Information to ensure the appropriate connection type is selected. If you have selected one of the specific settings, try resetting to Auto, the factory setting.
2. Why can't all hosts (computers and devices) behind the firewall reach the Internet?
This is usually a routing problem. The traceroute facility can be very useful in debugging routing problems. Check for these prob- lems:
• Are the hosts that can’t reach the Internet on a different network subnet from the firewall?
• Have you added a static route on the firewall to tell it which router is used to reach the Internet? Have you set the rout- er’s default route to be the firewall? Have you set the default route for hosts on the problem network to be the router or firewall?
• Is the wrong IP address assigned to the hosts or firewall? All network interfaces on the firewall must be on different logical networks.
• Is the default route assigned incorrectly? The default route should always be on the same subnet as the network interface of the host (this is true for all hosts, not just the firewall). For a firewall, the default route must be an IP address on the network which is attached to the network interface.
Note
When using PPP, PPTP or PPPoE, the default route is not necessarily on the same subnet. The route is assigned by your PPP provider.
3. Why can't one host (computers and devices) behind the firewall reach the Internet?
This may indicate that the default route is assigned incorrectly (or not at all) to hosts on the protected or Private Service Networks. All hosts protected by the firewall must use the IP address of the firewall’s network interface for the respective network. Hosts that reside behind routers or other gateways on these networks generally use the IP address of the gateway or router instead.
128 GB-OS 3.7 User’s Guide
4. Why can't I access the web user interface from the protected network?
The default remote access filter set is generated from the configuration parameters entered in the Network Information screen. It is possible that the firewall’s protected network interface is on a different subnet from your host. Check the remote access filter for the web interface; it may need to be adjusted.
5. Why do I get errors when starting GBAdmin? Why is online help not displayed?
GBAdmin requires Microsoft Windows and Microsoft Internet Explorer 5.x or later. Components from Internet Explorer are used to display the online help information. Errors will occur if Internet Explorer for Windows is not correctly installed.
6. Why can't I “see” or ping the protected network interface?
First check for proper network configuration settings. If the network configuration is correct for the network interface, you may have the wrong cable for your connection.
• For a direct connection (firewall to host or router), you need a crossover cable. • For a connection through a hub or switch, you need a straight-through cable.
A yellow crossover cable and grey straight-through cable may be included with firewall appliances. See product specifications or packaging materials for a list of included firewall accessories.
Note
Distinguish between crossover cables and straight-through cables by comparing the connection ends. On a straight-through cable, the wire order matches; on a crossover cable, the first three of the four wires are in reverse order.
7. I forgot my user name and/or password. How can I log on to my firewall ?
If login information has been irretrievably lost, a firewall can be reset to factory defaults, erasing all current configuration data and resetting both the case-sensitive user name and password to “gnatbox”.
Caution
Resetting the firewall will cause it to lose current configuration data. The configuration data can only be restored by loading a saved configuration with a known user name and password, or by manually entering the information.
To reset your firewall to factory defaults, attach either a terminal (using a serial console cable), or a computer with terminal emula- tion software (using a DB-9 null-modem cable). Enter these settings for the console connection:
EMULATION VT-100
PORT COM port connected via DB-9 cable to the firewall BAUD RATE 38400
DATA / BIT RATE 8 PARITY None
STOP 1
FLOW CONTROL Hardware*
* Set flow control to “None” as an alternative to hardware flow control.
Power on the GTA firewall. The following words will display: GB-OS System Software x.x.x
loading ...
When the word “loading” appears, immediately press CONTROL-R. The system will begin to load, and configuration and hardware data will appear on screen. Finally, a confirmation question displays:
Are you sure you want to reset your firewall configuration?: (“yes” or “no”)
To reset to factory defaults, type the word “yes” in lower case letters. Typing any other key will reboot the system without resetting to defaults. There is no time out; the reset confirmation question will remain until a key is pressed.
8. How do I revert to my previous configuration after a version update?
The firewall’s flash memory is in two sections (“slices”); one contains the current software version plus any saved configuration, the other contains the previous software version and configuration. A new firewall’s two memory slices are identical.
When the firewall is updated to a new runtime (software version), the update process automatically overwrites the memory slice not in use with the new software version and the existing configuration, leaving the production firewall version and configuration intact. When the firewall is rebooted, the updated memory slice will load by default.
To select a memory slice other than the default, set up the console interface as described in Troubleshooting question #7. When the firewall boots up, the memory slice information will load. When the word “Default” appears, immediately type the number of the slice you wish to load.
1 GB-OS slice 1 2 GB-OS slice 2 Default: 1
default until another is selected.
6. To revert to the last configuration, reboot the firewall using the console interface and select memory slice 1.
Note
For more Troubleshooting suggestions, see GTA's web site at www.gta.com. 10. I can’t access a tunnel that I have created. Why?
There are a few key points to remember about Tunnels:
• You cannot access a tunnel from the protected network, since you can access the host directly (use the real IP address of the host).
• The source side of the tunnel must have an IP address that is on the external network for tunnels from the external net- work to the PSN or to the protected network.
• The source side of the tunnel must have an IP address that is on the Private Service Network for tunnels from the PSN to the protected network.
• You must have a remote access filter that allows access to the tunnel from the host in question. A tunnel that has no re- mote access filter, or an improperly configured filter assigned to it, will generate a blocked packet message to the log file. Use the default option in the filter set to create disabled filters matching your defined tunnels, then customize and enable them.
• Ensure that your tunnel is active. Check the Configuration Report to verify that both your tunnel and remote access filters are active.
• Check the log messages for filter blocks when a remote host attempts
to access the tunnel. If you see a block message, your remote access filter is most likely not configured correctly. If no block message appears, check the host that is specified as the target in the tunnel definition. The target host should have a default route configured, with the service in question running on the specified port. From the target host try to ping the remote host.
11. My Microsoft Exchange server located on the PSN can’t find the PDC (Primary Domain Controller) on the protected network. Why?
Normally, NetBIOS locates the primary domain controller (PDC) and other peer hosts by using broadcast packets. Since the firewall blocks all broadcast packets, another method of locating the PDC needs to be used. The solution is to use an LMHOST file and add an entry for the PDC providing a conduit for NetBIOS traffic to the PDC via a tunnel and allow access via remote access filters.
1. Create a LMHOST file and insert an entry for the PDC. This entry will use the PDC’s NetBIOS name, the NetBIOS domain name, and the PSN interface IP address where the tunnel will be created.
2. Create three tunnels from the PSN interface to the PDC for NetBIOS services. UDP 137 - NetBIOS name resolution
UDP 138 - NetBIOS datagrams TCP 139 - NetBIOS data transfer
3. Create three remote access filters that allow the MS Exchange server on the PSN to access the three tunnels you created in step 2.
4. Reboot the Microsoft Exchange server.
Example GB-OS System EXT 199.120.225.2 PRO 192.168.1.1 PDC 192.168.1.50 PSN 192.168.2.1 EXCHANGE SRV 192.168.2.100 LMSHOST Entry
130 GB-OS 3.7 User’s Guide
192.168.2.1 PDCSERVER #PRE #DOM:GTANET
Tunnels
UDP 192.168.2.1 137 192.168.1.50 137 UDP 192.168.2.1 138 192.168.1.50 138 TCP 192.168.2.1 139 192.168.1.50 139 Add Remote Access Filters
1. Allow Exchange Server to access via NetBIOS UDP. Accept UDP PSN
2. Allow Exchange server to access via NetBIOS TCP. 192.168.2.100/32 192.168.2.1/32 137 138 Accept TCP PSN 192.168.2.100/32 192.168.2.1/32 139 Windows NT/2000 Sample: C:\WINNT\System32\drivers\etc\LMHOSTS.SAM Real File: C:\WINNT\System32\drivers\etc\LMHOSTS
Windows 95/98
Sample: C:\Windows\LMHOSTS.SAM Real File: C:\Windows\LMHOSTS
12. Why doesn't the feature I enabled (email proxy, RIP, etc.) work?
The correct filters may not be installed/enabled for the selected features.
The initial configuration of the firewall will create a set of all possible default filters. Depending on which options are enabled, filters may be disabled. To enable a feature, activate it then supply the required data (if needed) and enable or disable the appropriate remote access filters.
Example: RIP
1. Enable RIP and the options in the RIP section and save. 2. Disable the “DEFAULT RIP” remote access filters. 3. Save the remote access filter set.
Example: Mail Sentinel email proxy
1. Enable the email proxy.
2. Set the IP address of the primary email server. 3. Save the section.
4. Enable the DEFAULT EMAIL PROXY remote access filter. 5. Save the remote access filter set.
10. I get a bridging loop error message when I am in bridging mode.
A bridging loop message indicates a physical loop in the network cabling.
Feb 2 02:04:30 pri=4 msg=”Bridging loop (13) 00:00:5e:00:01:60->01:00:5e:00:00:12 fxp1->fxp0 (muted)” src=199.120.225.53 dst=224.0.0.18
Check physical wiring of hubs and switches to be sure no wire is crossed. Bridged networks must be physically isolated.
11. I get an “alarm: Interface down” message.
An interface down error message indicates that an interface has failed.
Feb 2 13:44:18 pri=4 msg=”alarm: Interface EXTERNAL (rl1) down” type=mgmt This could be caused by a loose or disconnected cable or disconnected Internet service.
12. Why can't I see or ping the protected network interface?
You may have the wrong cable for your connection.
• For a direct connection (firewall to host or router) you need a crossover cable. • For a connection to a hub or switch you need a straight-through cable.
Mail Sentinel Anti-Spam and Mail Sentinel Anti-Virus require Internet access over TCP port 443 (SSL) in order to authorize and update from GTA servers. If Mail Sentinel cannot access GTA servers (*gta.com) on TCP port 443, or if there is no DNS Proxy or Service enabled, the email proxy may wait for Mail Sentinel option authentication that it cannot get; if the SSL connection times out, the email proxy will disable Mail Sentinel options and continue processing email according to standard ACL rules.
The Mail Sentinel email proxy will then log that it has disabled Mail Sentinel options, and will periodically check for Internet SSL connection restoration. If the connection is restored and Mail Sentinel feature activation codes are valid, the email proxy automati- cally re-enables those Mail Sentinel options that were automatically disabled.
To correct this problem, check that your network allows SSL connections to the Internet over an external network interface (no routing rules may deny port 443). Use ping and traceroute to verify connectivity to the Internet, including gta.com and its sub- domains, and check all routers that may block Internet SSL access.
15. My email quarantine does not work. Why?
An email quarantine object must be an address object that contains only a single email address such as email-quarantine@gta. com. It is not valid to enter only the domain name of your email server; your quarantine object must have a full email address that contains an account as well as a domain name. Use of wild card (regular expression) characters is also not allowed.
If you wish to use multiple email addresses as quarantines in different firewall configuration areas, you should create one quar- antine address object per quarantine email address. For example, if you wish to separate suspect spam email and virus email, you might create address objects named “Suspect Quarantine” (containing [email protected]) and “Virus Quarantine” (containing [email protected]).
16. Mail Sentinel rejects too little email. Why?
First check that your email proxy ACLs reject those domains or IP address ranges that are known spam servers. Remember that email proxy ACLs evaluate in the order they are listed. Make sure that an all-accepting ACL is listed underneath those exclusion ACLs to ensure that every email is not accepted before being tested for a spam domain.
Check the specific ACL that you expected the email to match for configuration errors that may cause failed matches. Correct con- figuration errors in any ACLs before it that may cause a premature match.
To rule out either Mail Sentinel Anti-Spam or Mail Sentinel Anti-Virus options as a source of the problem, un-check all of the ENABLE check boxes in the Anti-Spam and Anti-Virus sections of your email proxy’s access control lists (ACLs). When you re- enable Mail Sentinel Anti-Spam and Mail Sentinel Anti-Virus in each ACL, be sure to do it one at a time so you can narrow down the source of the misconfiguration.
Note
The Mail Sentinel System Activity report can provide useful diagnostic information to determine whether Mail Sentinel options are causing email rejection.
Indicating a large maximum email file size in either the EMAILTO BLOCK or Mail Sentinel Anti-Virus sections of your email proxy ACL will allow larger email through. To limit the size of email that your firewall accepts for transmission, reduce the maximum file size to a small, non-zero number.
Be sure to allow external Internet access from your firewall to the Internet. Mail Sentinel uses various servers to keep its Mail Sen- tinel options up-to-date; if you have routing rules preventing this access, your Mail Sentinel options may lapse or use old spam and virus definitions, allowing newer spam and viruses through.
Note
A maximum size of zero does not mean that only zero-sized email will be considered; instead, it means that the size limit consideration has been removed from the ACL.
If you notice that some spam email is still not being caught by Mail Sentinel Anti-Spam, consider adjusting your Mail Sentinel Anti-Spam threshold to a more aggressive setting. You might also choose to restrict Suspect category email as well as Confirmed category email. Additional use of a MAPS (a kind of real-time black list, or RBL) can also help.
132 GB-OS 3.7 User’s Guide
17. Mail Sentinel rejects too much email. Why?
When the firewall evaluates a packet for acceptance or rejection, many rules may be used. It is important to check other rules such as routing rules before investigating Mail Sentinel ACL rules.
Remember that email proxy ACLs evaluate in the order they are listed. Make sure that any white list ACLs are listed above any black list ACLs to ensure that all email is not rejected before being tested for a known-good email address.
To rule out Mail Sentinel features as a source of the problem, un-check the ENABLE check box in the MAIL SENTINEL ANTI-SPAM and MAIL SENTINEL ANTI-VIRUS headings of your email proxy’s access control lists (ACLs). When you re-enable Mail Sentinel Anti-Spam and Mail Sentinel Anti-Virus, be sure to do it one at a time so you can narrow down the source of the misconfiguration.
Note
The Mail Sentinel System Activity report can provide useful diagnostic information to determine whether Mail Sentinel options or other ACL rules are causing email rejection.
Indicating a small maximum email file size is also a common cause for rejected email. Indicating a low threshold for too many Mail Sentinel Anti-Spam categories can also be a common cause.
18. Mail Sentinel rejects all email. Why?
If your firewall rejects all email, first check to see that email TCP ports (especially the standard SMTP port 25) have not been filtered out in other rules, and that your email proxy is enabled. If your firewall accepts port 25 connections but still rejects all email, check your email proxy’s ACL settings. If your ACL is set to reject email fitting your rules and all email matches your rules, all email will be rejected. Make sure you have at least one email proxy ACL set to accept email; denial-type ACLs or an absence of ACLs will cause email to be rejected.
Note
The Mail Sentinel System Activity report can provide useful diagnostic information to determine whether Mail Sentinel options or other email proxy ACL configurations are causing email rejection.
Additionally, if all email servers are listed on your MAPS, all email could be rejected.
19. My Surf Sentinel 2.0 firewall is behind another firewall. What ports should I allow for the Surf Sentinel 2.0 service?
Allow UDP port 9020 to server ccs.sc.surfsentinel.net for the Surf Sentinel 2.0 web content filtering service.
20. I get errors when using GBAuth. What do they mean?
GBAuth requires use of remote access filters, users, SSL certificates, and authorization services on your firewall; it also requires GBAuth 1.1.0 (Java version) installed on the client computer. If any of these things are set up improperly, if your password or other entry was incorrect, or if you are using an old version of GBAuth, errors may be generated.
RMCAuth: Command ‘authLoginGet’ (400) rejected, incorrect size errors may be caused by using an old version of