armani's questions

I've started sending Palo Alto logs to Graylog, and a stream rule picks them out by matching "Palo Alto" in a "tags" field (which is how all my stream rules are; a front-end Logstash instance does the tagging before shipping to Graylog).

I know the Graylog nodes are receiving these events on the network interfaces:

And the stream shows that it is getting events (note the "22 messages/second"):

Yet when I click into the Stream (or search --> tags:"Palo Alto") there are no events to be found.

The only common issue I've seen online is to with timezone settings putting these events into the future, but the time on our Palo Alto Panorama sender is correct (PST) and trying an absolute time search a day into the future reveals nothing.

Version info:

Graylog 2.2.2+691b4b7, codename Stiegl

Elasticsearch 2.4.4

Lucene 5.5.2

I've also got this question unanswered about the search feature not working properly to find events that actually are arriving okay. I doubt it has any relation but for sake of completeness I'll include that here.

All over the web I find examples for either (1) rsyslog to a remote server or (2) rsyslog with templates, but never both. When I have this /etc/rsyslog.conf on my Mac it sends to the remote server fine:

*.* @10.1.38.223

But when I change to this, no network traffic is sent out to the remote server (verified with tcpdump):

$template MyTemplate, "MacOSX %msg%"
*.* @10.1.38.223;MyTemplate

Is it not possible to append extra text like this to messages logged remotely?

I've got nxlog on my Windows servers shipping logs to Logstash (JSON-formatted). I want to clone off the security events to a SIEM, so I added the logic to catch certain Windows Event IDs:

Even though the "Windows Event Log" tag gets applied (via "add_tag"), the "Windows Security Event" is never added, even when I review the logs and find an EventID like 4624.

For reference here's the full plain-text logstash.conf:

input {tcp{port=>1514}}
filter {
        if "im_msvistalog" in [message] {
                json {source => "message"}
                mutate {add_tag => "Windows Event Log"}
                if [EventID]=="4688" or [EventID]=="592" or [EventID]=="4624" or [EventID]=="528" or [EventID]=="540" or [EventID]=="5140" or [EventID]=="560" or [EventID]==5156 or [EventID]=="7045" or [EventID]=="601" or [EventID]=="4663" or [EventID]=="567" { 
                        mutate {add_tag => "Windows Security Event"}
                }
        }
}
output {stdout{codec=>rubydebug}}

Edit: Here's what the output looks like:

Using the official latest HAProxy Docker container and the following config file:

frontend logging_frontend
    bind *:1514
    mode tcp
    timeout client 1m
    default_backend logging_backend

backend logging_backend
    mode tcp
    balance roundrobin
    timeout connect 10s
    timeout server 1m
    server logstash-collector-01 logstash-collector-01:1514 check
    server logstash-collector-02 logstash-collector-02:1514 check
    server logstash-collector-03 logstash-collector-03:1514 check

I'm getting logs (sent via nxlog to 1514 over TCP) which don't store the actual client IP but rather the Docker gateway IP. For example:

2017-03-02T15:57:41.585Z 172.18.0.1 {"EventTime":"2017-03-01 15:25:02","Hostname":"server.mycompany.net","Keywords":58096435992,"EventType":"ERROR","SeverityValue":4,"Severity":"ERROR","EventID":551,"SourceName":"Microsoft-Windows-SMBServer","ProviderGuid":"{D48CE617-33A2-4BC3-A5C7-11AA4F29619E}","Version":1,"Task":551,"OpcodeValue":0,"RecordNumber":5267740,"ProcessID":4,"ThreadID":5732,"Channel":"Microsoft-Windows-SMBServer/Security","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-184","AccountType":"User","Message":"SMB Session Authentication Failure\r\n\r\nClient Name: \\10.1.1.43\r\nClient Address: 10.1.1.43:54118\r\nUser Name: \r\nSession ID: 0xAF9FC8000015\r\nStatus: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xC000006D)\r\n\r\nGuidance:\r\n\r\nYou should expect this error when attempting to connect to shares using incorrect credentials.\r\n\r\nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.\r\n\r\nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled","Opcode":"Info","EventReceivedTime":1488470262,"SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"}

Note that the reporting server is 10.2.3.95, the Docker host is 10.1.38.223, and the Docker bridge interface (and local container subnet) is 172.18.0.0/16 (with 172.18.0.1, logged in the log, being the gateway).

From a tcpdump (modified to show interfaces):

1. The external interface, eno16777728, gets a PUSH packet (containing log data) from 10.2.3.95 to the host IP 10.1.38.223
2. This gets DNAT'd by Docker to go from 10.2.3.95 to HAProxy container (172.18.0.6)
3. HAProxy acknowledges the PUSH (final packet of screenshot shows the SNAT'd reply back on the external interface using 10.x.x.x IPs)
4. (Out of order in image - check timestamps) HAProxy decides on backend container 172.18.0.3 for load balancing destination
5. (Out of order in image - check timestamps) The Docker interface gateway SNATs the packet on its virtual ethernet interface (WHY?)
6. ACK from backend server to Docker gateway
7. ACK from backend server to HAProxy (?)
8. ACK from backend server to HAProxy (?)

When I try to make HAProxy pass on the client IP transparently using source 0.0.0.0 usesrc clientip in the backend stanza, nothing gets logged at all.

To me, this question has two avenues to success; either:

• How can the behavior of logging the Docker gateway IP be explained?

or more importantly:

• How can I get the original client IP to appear in these logs, preferably as the client IP field (at beginning of log following timestamp)?

I create a Docker container like this:

$sudo docker build -t "logstash-collector" ~/logging/logstash/

$sudo docker run -d \
--user=root \
--name="logstash-collector-01" \
--net=logging \
--cap-add=NET_ADMIN \
logstash-collector

And from there I can change its default gateway to an nginx container (for transparent load balancing):

$sudo docker exec -it logstash-collector-01 ip route delete default
$sudo docker exec -it logstash-collector-01 ip route add default via 172.18.0.10

And it works, and everything's fine:

$sudo docker exec -it logstash-collector-01 ip route 
default via 172.18.0.10 dev eth0 
172.18.0.0/16 dev eth0  proto kernel  scope link  src 172.18.0.3 

But when I try to automate this by putting those commands in my ~/logging/logstash/Dockerfile like:

FROM logstash
COPY logstash.conf /usr/local/share
CMD ["-f", "/usr/local/share/logstash.conf", "--config.reload.automatic"]
CMD ["ip", "route", "delete", "default"]
CMD ["ip", "route", "add", "default", "via", "172.18.0.10"]

I see them getting executed during build:

But the container fails to launch. sudo docker logs logstash-collector-01 tells me: RTNETLINK answers: File exists

That error happens if I issue the second ip route command without issuing the first one (Linux won't add a route if one is already in its active routing table). But how can this be? Are my Dockerfile's CMD commands processing out of order?

My logging setup is a single Docker host with UDP 514 exposed for syslog. An nginx container has its port published so when you send logs to 10.1.1.100 (in the image below) it first hits nginx, whose config for transparent load balancing to Logstash containers is:

user root;
events {worker_connections 32768;}
stream {
 upstream logstash_servers {
  server logstash-collector-01:514;
  server logstash-collector-02:514;
  server logstash-collector-03:514;
 }
 listen 514 udp;
 proxy_pass logstash_servers;
 proxy_bind $remote_addr transparent;
 }
}

This works fine. However, TCP 514 (or anything TCP, for that matter) doesn't. Even when I add the right listener and configs, I believe the TCP handshake does not complete because with nginx doing transparent load balancing, its proxy_bind passes along, e.g. 10.1.1.5 as a source IP to e.g. 172.18.0.4 (a Logstash instance). That instance then tries to complete the handshake but 10.1.1.5 (and any routers along the way) does not know how to route to the Docker network of 172.18.0.0/16.

Is there a solution here to be able to use TCP for logging?

This was caused by me forgetting about a switch. Continue reading only if you're very bored

SonicWALL NSA 3500 connected to Cisco Catalyst 3850. The SonicWALL has "sub-interfaces" (VLANs) V2, V800, and V802. The 2 and 802 have worked fine for forever, and I am now trying to add 800, but no traffic is working through the trunk. See the image for my configs. I can't get a downstream "switchport access vlan 800" port with a device to connect, and on the switch I can't ping 172.16.16.7, which is the SonicWALL sub-interface IP, whereas I can ping the IP for VLAN 802.

EDIT - Since configuring the Cisco with "ip classless" I was able to get Spanning-Tree to get out of "BKN" status and VLAN 800 now shows up as a non-pruned VLAN in "sh int gi1/0/2 trunk" but my main issue of not being able to pass traffic or connect an access device on that VLAN still persists.

Here's the link to the image in case it's too small to see here: http://oi60.tinypic.com/15cllp1.jpg

EDIT

Switch#sh span summ

Switch is in pvst mode
Root bridge for: VLAN0800
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default  is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
EtherChannel misconfig guard is enabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Configured Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001                     0         0        0          9          9
VLAN0002                     0         0        0         14         14
VLAN0003                     0         0        0          9          9
VLAN0004                     0         0        0         10         10
VLAN0005                     0         0        0         10         10
VLAN0006                     0         0        0          9          9
VLAN0007                     0         0        0          9          9
VLAN0008                     0         0        0          9          9
VLAN0009                     0         0        0          9          9

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0010                     0         0        0          9          9
VLAN0011                     0         0        0          9          9
VLAN0012                     0         0        0         10         10
VLAN0013                     0         0        0          9          9
VLAN0014                     0         0        0          9          9
VLAN0015                     0         0        0         11         11
VLAN0016                     0         0        0          9          9
VLAN0017                     0         0        0          9          9
VLAN0018                     0         0        0         11         11
VLAN0103                     0         0        0          9          9
VLAN0104                     0         0        0         10         10
VLAN0105                     0         0        0         10         10
VLAN0106                     0         0        0          9          9
VLAN0107                     0         0        0          9          9
VLAN0111                     0         0        0          9          9
VLAN0800                     0         0        0          9          9
VLAN0802                     0         0        0         10         10
VLAN0803                     0         0        0          9          9
---------------------- -------- --------- -------- ---------- ----------
27 vlans                     0         0        0        258        258

Switch#sh span vlan 800

VLAN0800
    Spanning tree enabled protocol ieee
    Root ID    Priority    4896
        Address     dca5.f433.4980
        This bridge is the root
        Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

    Bridge ID  Priority    4896   (priority 4096 sys-id-ext 800)
        Address     dca5.f433.4980
        Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
        Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/2             Desg FWD 19        128.2    P2p
Gi1/0/14            Desg FWD 4         128.14   P2p
Gi1/0/15            Desg FWD 4         128.15   P2p
Gi1/0/16            Desg FWD 4         128.16   P2p
Gi1/0/17            Desg FWD 4         128.17   P2p
Te1/1/3             Desg FWD 4         128.55   P2p
Te1/1/4             Desg FWD 4         128.56   P2p
Po1                 Desg FWD 3         128.2027 P2p
Po2                 Desg FWD 3         128.2028 P2p

Switch#sh int gi1/0/2 switchport

Name: Gi1/0/2
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

*See my top edit - VLAN 800 now shows up in "sh int gi1/0/2 trunk" as a non-pruned VLAN but that didn't change my issue of not being able to connect anything on that VLAN and I still cannot ping 172.16.16.7

In the image above, we use the SonicWALL NSA 3500 at our gateway and handle VPN with its SSL-VPN. Our Layer 3 Cisco switch is our core network switch and handles about a dozen VLANs. Most VLANs are 192.168.x.x/24 variants, so the SonicWALL actually sees the rest of the network underneath it as 192.168.0.0/16 (we are "supernetting"). The Cisco does the actual routing (inter-VLAN routing).

But now I've created a VLAN on the Cisco of 10.200.200.x/24 where I have set up a XenServer. Both with and without the ACL (see image) applied, I can communicate just fine from my work PC but cannot ping the device from my Home PC through the VPN.

I have allowed 10.200.200.0/24 as a Client Route in the SSL-VPN settings, and attempted different routing table configs to get it to work, but have so far been unsuccessful.

How do I get communication between the SSL-VPN clients (192.168.203.x/24) and Cisco's VLAN 111 (10.200.200.x/24)?

Errors in picture: Called the server an ESXi host instead of XenServer host, and from Home PC it fails to XenServer, not to "Virtual Server."

I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary:

wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1

I'm making a batch file out of it in order to send the event's contents as an attachment via email with Task Scheduler, as outlined in this post: http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx

The problem: I can do wevtutil qe System all day long, but if I do wevtutil qe Security like I need, I need to be at an elevated command prompt (same domain admin user credentials, just CMD ran as admin). So when my scheduled task calls the batch file, even though the task has the option set to "run with highest privileges" under the SYSTEM account, it fails to run in an elevated prompt, meaning it runs into an error: "Failed to open event query. Access is denied."

So either one of these things can fix my issue:

1. Open up the Security log to be like System log somehow, where you don't need an elevated prompt to access its contents using wevtutil

2. Run the Scheduled Task action in an elevated prompt, somehow

3. Some third thing I haven't thought of

We've been having issues with DNS records dropping. Usually it is from DHCP reservations, like printers. Yesterday it was two of our main servers, also DHCP-reserved. Right now I'm looking at a normal DHCP (non-reserved) computer that is not able to be ping'd by name or nslookup'd because the A records doesn't exist, but "ping -a IP_Addr" resolves the name successfully because the PTR record exists in the Reverse Lookup Zone. Records on both DNS servers match.

These are Windows DNS servers, by the way. Primary I think is 2003, and Secondary is for sure 2008 R2.

Scavenging Period: 4 days on primary DNS server, disabled on secondary

No-Refresh Interval: 12 hours in Forward Lookup Zone, 1 day in Reverse Lookup Zone, on both servers

Refresh Interval: 7 days for both Forward and Reverse, for both servers

DHCP Lease Time: 2 days for most subnets (including PC currently experiencing the issue), 1 day for servers (like the ones suffering the issue yesterday)

My fix yesterday was to add the A record manually. Since they now show up as static entries with no timestamp, I assume they'll never get scavenged (further assuming scavenging is my issue?), but as you can see this is happening more and more on my network, I need to figure out what's causing these DNS records to get lost.

Any pointers? I'm not going to add the A record to this problem PC right now so I can perform troubleshooting steps to figure this out, if need be.

EDIT: Last night some time, the A record came back for that PC, so I can't troubleshoot it in particular. But the underlying issue exists, and I'm afraid of the call where servers or printers randomly stop working for my users. What's going on?

I have two users that changed their last names months ago. Recently, I was troubleshooting why they weren't showing up in Global Address List. The reason was their ADSI property for "Mail" still had their old alias. I poked around in a couple other fields, but am pretty sure I set everything back correctly (minus that Mail field, and I think a field with the name "legacy" in it).

By the way, since I've started working here the procedure for name changes are to create a whole new AD and Exchange user, and exporting/importing data and .PST files, so we don't run into stuff like this. I'm treating that as a last resort for these users.

Since then, whenever other users try to email these people from Outlook, they get an undeliverable message like so:

Delivery has failed to these recipients or distribution lists:

Barbara NewLastName
The recipient's e-mail address was not found in the recipient's e-mail system. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try resending this message, or provide the following diagnostic text to your system administrator.

  _____  

Sent by Microsoft Exchange Server 2007 







Diagnostic information for administrators:

Generating server: mail.MyDomain.com

IMCEAEX-_O=MyDomain_OU=First+20Administrative+20Group_cn=Recipients_cn=bOldLastName@nbutexas.com
#550 5.1.1 RESOLVER.ADR.ExRecipNotFound; not found ##

Original message headers:

Received: from mail.MyDomain.com ([192.168.200.3]) by mail
 ([192.168.200.3]) with mapi; Mon, 11 Mar 2013 10:56:14 -0500
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: Sarah Sender <[email protected]>
To: Barbara NewLastName
    <IMCEAEX-_O=MYDOMAIN_OU=First+20Administrative+20Group_cn=Recipients_cn=bOldLastName@MyDomain.com>
CC: Daniel SomeoneElse <[email protected]>
Date: Mon, 11 Mar 2013 10:56:13 -0500
Subject: FW: The Subject
Thread-Topic: The Subject
Thread-Index: Ac4cTWKfaQjD6MaWTUOOIrrWlcn91AAAdmEwAIhri+A=
Message-ID: <3A90EE12812EA74ABCAF358A8B0C4264040724A0EA@proteus>
References: <[email protected]>
In-Reply-To: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <3A90EE12812EA74ABCAF358A8B0C4264040724A0EA@proteus>
MIME-Version: 1.0

Notice the old name still shows up at one point in that error message.

Here's the real kicker: If the sender sends through OWA it goes through fine. If I take the sender's Outlook off, then back on Cached Exchange Mode, AND I delete old auto-fill entries for the trouble recipients, then it fixes the problem for them.

The problem is that it's impractical to go around the company and do that to 230+ people's Outlooks. I'm wondering what's still happening on the server to make this issue occur.

I've used the cmdlet that updates the Offline Address Book, and that obviously hasn't worked. Issue has been going on for 4 or 5 days now.

I'm trying to replace an old Cisco Catalyst 2950 with a new Cisco 3750X. Unfortunately, these SFP's are so expensive, I'm trying to work with what I've got. Please note the diagram to see what connections I have. The core switch is SX, as is the old switch it was running to. When I hook a cable [had to be a different end connector to fit the new SFP, so it's really a different cable but attached to the same patch port] to the new switch, nothing happens and it reports the line is down [Physical Layer error]. This port reports that it is a 1000BaseLX, which from what I understand is Single-Mode fiber, instead of Multi-Mode like the rest of this network.

Knowing almost nothing about fiber optics, what would you propose is the easiest way to remedy this situation, getting connectivity to the new switch? I've heard that over short distances, a Single-Mode connection will work on a Multi-Mode cable -- Is this true?

Thanks in advance for your thoughts.

Edit: Of course I forgot the diagram:

I'm needing an experienced person to guide me on this little project :-)

We have one Domain Controller [Win2k8 R2] with the Active Directory Certificate Services role. Let's call it ServerOne.OurDomain.com.

I've got a second Windows 2008 R2 server, ServerTwo.OurDomain.com, that runs an Apache Tomcat web server. We are setting up an Outlook plug-in for all users that requires an SSL connection to an OAuth server. I fumbled through the instructions to add the OAuth module to Tomcat and enable a connector using SSL on port 8443 [default SSL port for Tomcat].

But now I don't know how to "put 2 and 2 together" -- How can I generate a certificate from our internal CA so there are no SSL certificate errors when connecting to ServerTwo.OurDomain.com? So far I made the "keystore" file on ServerTwo using the JRE "keytool.exe" program, and of course the certificate shows it [like, when you click the lock icon in a browser] as a self-signed cert with no CA chain.

Any help in this area is greatly appreciated.

Brand-new install of CentOS 6.3. Followed this guide: http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_1.htm And I got PPTPd running [v1.3.4]. I got the VPN to authenticate users against our Active Directory using winbind, smb, etc. All my tests to see if I'm still authenticated to the AD server pass ["kinit -V [email protected]", "smbclient", "wbinfo -t"].

VPN users were able to connect for like . . . an hour. I tried connecting from my Android phone using domain credentials and saw that I got an IP allocated for internal VPN users [which I've since changed the range, but even setting it back to the initial doesn't work]. Ever since then, no matter what settings I try, I pretty much consistently get this in my /var/log/messages [and the VPN client fails]:

[root@vpn2 ~]# tail /var/log/messages
Aug 31 15:57:22 vpn2 pppd[18386]: pppd 2.4.5 started by root, uid 0
Aug 31 15:57:22 vpn2 pppd[18386]: Using interface ppp0
Aug 31 15:57:22 vpn2 pppd[18386]: Connect: ppp0 <--> /dev/pts/1
Aug 31 15:57:22 vpn2 pptpd[18385]: GRE: Bad checksum from pppd.
Aug 31 15:57:24 vpn2 pppd[18386]: Peer armaniadm failed CHAP authentication
Aug 31 15:57:24 vpn2 pppd[18386]: Connection terminated.
Aug 31 15:57:24 vpn2 pppd[18386]: Exit.
Aug 31 15:57:24 vpn2 pptpd[18385]: GRE: read(fd=6,buffer=8059660,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Aug 31 15:57:24 vpn2 pptpd[18385]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
Aug 31 15:57:24 vpn2 pptpd[18385]: CTRL: Client 208.54.86.242 control connection finished

Now before you go blaming the firewall [all other forum posts I find seem to go there], this VPN server is on our DMZ network. We're using a Juniper SSG-5 Gateway, and I've assigned a WAN IP to the VPN box itself, zoned into the DMZ zone. Then, I have full "Any IP / Any Protocol" open traffic rules between DMZ<-->Untrust Zone, and DMZ<-->Trust Zone. I'll limit this later to just the authenticating traffic it needs, but for now I think we can rule out the firewall blocking anything.

Here's my /etc/pptpd.conf [omitting comments]:

option /etc/ppp/options.pptpd
logwtmp
localip [EXTERNAL_IP_ADDRESS]
remoteip [ANOTHER_EXTERNAL_IP_ADDRESS, AND HAVE TRIED AN ARBITRARY GROUP LIKE 5.5.0.0-100]

Here's my /etc/ppp/options.pptpd.conf [omitting comments]:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.200.42   # This is our internal domain controller
ms-wins 192.168.200.42
proxyarp
lock
nobsdcomp
novj
novjccomp
nologfd
auth
nodefaultroute
plugin winbind.so
ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1"

Any help is GREATLY appreciated. I can give you any more info you need to know, and it's a new test server, so I can perform any tests/reboots required to get it up and going. Thanks a ton.