Recently got an SSL certificate for our external domain and added to exchange, external clients are working fine, internal clients are getting the Security Warning when opening Outlook stating our internal server.domain.local "the name on the security certificate is invalid" and viewing the certificate shows our external domain.
How do I get this resolved? Both internal and external hostnames are set for external url for autodiscover.
So my goal here it to block only certain youtube channels.
If I do:
acl block_youtube dstdomain .youtube.com
http_access deny block_youtube
it blocks any access to youtube.
if I do:
acl block_youtube url_regex -i ^https://www.youtube.com/watch\?v=v2AC41dglnM
http_access deny block_youtube
it doesn't block that particular page, even though I see this in my access_log.
475862685.876 0 100.100.100.100 TAG_NONE/200 0 CONNECT www.youtube.com:443 - HIER_NONE/- -
1475862686.359 412 100.100.100.100 TCP_MISS/200 51182 GET https://www.youtube.com/watch\?v=v2AC41dglnM - HIER_DIRECT/216.58.192.238 application/json
Any one have any idea how to resolve this?
We have a sonicwall NSA 3500, x4 has 2 vlan interfaces so x4:v300 and x4:v301. Each vlan has an IP v300 is 192.168.100.1 and v301 is 192.168.101.1.
I then have x4 connected to a layer 2 only switch configured ports 1-12 v300 and 13-23 v301 and all 23 ports tagged port 24 then port 24 is tagged for v300 and v301.
I added a firewall access rule to allow subnets on v300 to talk to v301 and vice versa but all I can do is ping hosts on either subnet. Nothing else like ssh or http works.
Does anyone have any idea why?
Thanks
I have a custom application that accesses a remote range of IP addresses, lets say for example 206.0.0.0 - 206.255.255.255, this is UDP based traffic. The issue is, Sonicwall NSA has been configured to block all proxy-based access and is detecting this traffic as "PROXY-ACCESS Encrypted Key Exchange -- UDP Random Encryption(UltraSurf) sid=7" and is blocking the application. How would I go about getting this traffic unfiltered access to that ip range? I tried adding address object for that range and creating an access rule to allow it through, but it still seems to be blocked. Any assistance is welcome, thanks.
Just a quick little question here, i am trying to block exe's and such from running from users home drives but running into problems. Sure I can add a hash rule for all the exe's but this is tedious work. I can add a path rule as "H:*.exe" and this works, but only on the H:\ drive, if the exe is in "H:\SomeFolder2949\" then it isn't blocked. I tried wildcards etc as "H:**.exe" but this doesn't work... it specifically states on a technet artcile the following:
When a path rule specifies a folder, it matches any program
contained in that folder and any programs contained in subfolders.
and that to me says it will match anything in the folder and subfolders...then it goes on to contradict itself and says...
The administrator must define all directories for launching a
specific application in the path rule. For example, if the
administrator creates a shortcut on the desktop to launch
an application, then in the path rule, the administrator
must also grant the user Read access rights to both the
executable file and the shortcut paths to run the application.
If all the path information necessary for launching the
application in the path rule is not defined, it can trigger
the Software Restricted warning when the user attempts to run
the application.
So I am confused....can i get path rules to match on subfolders or not? If so, how?
Thanks.
I am trying to deploy adobe pro x extended to clients machines. The deploy is working fine except when you launch Adobe, it asks to enter the serial number. I have used the adobe customization x wizard and generated the MSI and MST files and they include the serial number but no matter what it still asks for the serial number.
Anyone know if there is a step I am missing here? I go into GPO, computer, software installs and new package and point it to the msi that the wizard has created but it seems it is not processing the MST file for some reason, its set to install english only and still installs as english french and german.
Any help would be great. Thanks.
Simple answer I am sure...I an trying to deploy Office 2010 to clients via the GPO startup script but am having issues. Soon as the computer starts, it prepares network connections then goes on to running startup scripts. Soon as my startup script runs to deploy offices, i get asked for a username and password to connect to the share...i have all permissions set for authenticated users can read and execute, and for testing purposes i put domain computers can do the same as authenticated users.
If anyone has any thoughts, that would be great.
I am not sure what's going on, but I have setup a gateway debian box with iptables and dhcpd server. The server is handing out the ip addresses to the clients just fine, gateway being set to the debian box and dns set to the ISP dns. Now I can't figure out why the net isn't working on the clients computers. The box is configured as eth0 (192.168.0.1) being the internal LAN and eth1 being the external to the internet. I have ip_forwarding set to 1, on as well. Here is my output from the iptables-save command. If anyone can help, please let me know!
UPDATE 1: I redid the rules to very very basic and it still is happening... tracert times out on the client and can't ping google on the client but can ping the gateway and other clients...and NET works fine on router box
UPDATE 2: As per Patricks suggestion, set forward to accept and still having same issues.
# Generated by iptables-save v1.4.8 on Mon Mar 5 20:46:23 2012
*mangle
:PREROUTING ACCEPT [8:608]
:INPUT ACCEPT [8:608]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:528]
:POSTROUTING ACCEPT [4:528]
COMMIT
# Completed on Mon Mar 5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar 5 20:46:23 2012
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Mon Mar 5 20:46:23 2012
# Generated by iptables-save v1.4.8 on Mon Mar 5 20:46:23 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:628]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -j ACCEPT
-A FORWARD -d 192.168.0.0/24 -i eth1 -j ACCEPT
COMMIT
# Completed on Mon Mar 5 20:46:23 2012