evolvd's questions

I have a file server that will stop sharing a particular folder once the server is rebooted. This problem happened after the server went through a p2v migration. There are no events that seem to correlate to this issue.

I was reading http://support.microsoft.com/default.aspx/kb/870964 but I don't think this applies and there are other shares on the same drive that are still there after a reboot.

To be clear about the issue;

When the server reboots share x is no longer shared any more but share y and z are still there.

This has nothing to do with users not being able to see the share. On the server its self the folder that was shared is no longer shared. I wish I had more information to post but after hours on this issue I can't find a way to move forward.

Print server is a VM on Xen The VM is Windows 2003 32bit. During the issue the VM is not being taxed in anyway, cpu, memory, hd read/write, and network speed is all good.

The problem that I see is the transfer of the print file from the print server to the printer. The 80Mb file is transferred from the client to the print server in about 2 minutes but then it takes about 2 hours for that file to be sent to the printer. I can't figure out why this would just start to happen.

The printer is rebooted every evening and is just used for one large print job in the morning. The server has been rebooted with no effect I changed the spool option to send the entire spool to the server before printing starts and it had no effect.

This printer problem did happen to come about after some changes to the Xen environment. The Xen servers changed from using HBA NIC cards to software iscsi and a new switch was put in. I don't think this is related to the problem since all the speeds on the VMs are better now. The changed happened on Saturday and the first print to this printer happened on Monday morning. I'm just putting that out there but like I said I don't think it is related but I don't want to rule it out.

At this point I don't have many other options besides the physical layer. I can switch out network cable that goes to the printer and I might be able to print the same job to another printer. I wont be able to test those things out till this afternoon though.

Any other ideas or test I could do to try to find the reason for the slow speed?

I forgot to say that this is only happening when printing to this one printer.

===Update=== I found out that there are a few printers that currently have this issue, not just the one. There are over 30 printers on the server though so I know it's not happening to all of them.

I printed a large pdf doc from the server and it was able to print at the normal speed.

If the machine sends the large print request it gets to the server fine but then slow to get from the server to the printer. If sent directly from the printer it gets to the printer at the normal speed.

The question now is why is there a speed difference when it comes from the machine and why would it start now?

Xen Server 5.6 Sp2 The VM is Windows Server 2008 R2 Standard 4 vCPUs have been allocated

The machine has been rebooted and has correct version of xen tools installed.

In the device manager I see 4 cpus but in the task manager I only see one. In the performance monitor for xen I only see one cpu being utilized.

I have read that this issue could be attributed to single vs multi processor mode in windows but that seems to only be the case for 2003?

I need to allow a user to RDP to a Win 2003 server (not currently a TS) and lock that user down to just have access to one folder and to run the app in that one folder. I feel like there is a few different ways of going about this but would like to get some guidance on the "best". The app doesn't work via a network share so it seems the only option is for the user to RDP to the server.

Let me first say that my knowledge of Presentation Server and Secure Gateway is very limited. Many thanks to any one who can help me out here.

Alright on to the problem:

We are changing the network design at the main office where the citrix servers are located. The Secure Gateway was on a server that has 2 NIC interfaces, one in the LAN and one in the DMZ. The DMZ is being taken out so I disabled the DMZ interface on the SG. I had to change the listening address but after doing that everything seemed fine, then I realized that apps could not be loaded any more from the Secure Gateway web site.

Users would get the following error when trying to load an app: Cannot connect to the Citrix Presentation Server. Protocol Driver error. Accessing the web site external or internal yields the same problem.

How I assume this works is the user goes to the SG, logs in, launches the app, the SG then sends the request to the Presentation Server then that server communicates directly with the user?

Another change that was made was changing out the firewall / router. All of the NATs should be the exact same as the old firewall but there could be a missing port forward.

I have followed a couple of citrix articals making sure the 1494 and 2598 port are open and responding (they are).

We have two presentation servers and then the SG. Here is some inforamtion about the servers:

Windows 2003 SP2
Secure Gateway 2.0
Presentation Server 4.5.0.0

Assumptions on what could be wrong
Incorrect / absent port forward
A reference in one of the severs that is using the DMZ address instead of the LAN address

I'm not really sure even where to start troubleshooting at this point.

Edit: Here is a diagram of before and after (left is before, right is after)

What I think might be going on is that the Secure Gateway is trying to communicate with the other citrix servers via the public IP address instead of the lan address. This request gets denied by the ASA. Still just an idea and not sure how to fix it if it was what is wrong.

Attached is a simple network diagram and some example public IP space I would have.

The Cisco 1800 is currently not being used but can be used (or new hardware can be purchased) The firewall is a German firewall and documentation is a bit hard to find on it.

• I don't think BGP is an option since there it is a small block of IP space.
• NAT is currently being done by the firewall

As far as I know my only option would be to use 2 default routes with SLA tracking.

Any other ideas or suggestions?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the IP address. It needs to be able to access one server in the LAN.

Old unix server crashed and now will not boot up, the drives are still accessible though. I need to move the data from that server to a Red Hat server. I was going to use a boot cd to copy the data to a USB drive but I coulnd't find one that can read VxFS file system. I ended up taking an Acronis image of the disk.

Now I don't know what I should do next, any ideas?

Not sure why the unix system wont boot because it gets a kernel panic during start up. This is an old server that is getting replaced with the red hat server.

Edit:

Forgot to mention that the drives are SCSI drives in a RAID so I can only read the drives on the old UNIX server.

Edit2: I copied the partition to a USB drive now I just need to mount and read it.

I want to adjust my failover poll timing.

The proposed column is what I am wanting to set it up as.
I believe the following commands will obtain what I want from the first two rows but Im not sure how to adjust the remaining.

failover polltime unit msec 500 holdtime 2
failover polltime interface msec 400 holdtime 2

It would seem that only a standby address that would be needed is for the "failover" interface. This is given with the following command for example:

failover interface ip failover_link 10.99.99.253 255.255.255.252 standby 10.99.99.254

Most config examples I look at have the outside int having a stand by address as well:

Interface ethernet0
Nameif outside
Ip address 10.5.1.1 255.255.255.0 standby 10.5.1.2

Why would the outside interface need a standby address if when failover happens it would be using the IP from the primary ASA?

When I first started working on this issue the only test that was failing was it not advertising as a time server now the following is coming up:

 Warning: LEX-DC01 is not advertising as a time server.
 ......................... LEX-DC01 failed test Advertising
 Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
    Replicating Directory Changes In Filtered Set
 access rights for the naming context:
 DC=ForestDnsZones,DC=ja,DC=com
 Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
    Replicating Directory Changes In Filtered Set
 access rights for the naming context:
 DC=DomainDnsZones,DC=ja,DC=com

I have tried:

Check the announceflags registry setting from

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
annd verify that it is set to 10 in decimal (0x0000000A), then use w32tm /config /update

I have also tried:

w32tm /config /syncfromflags:domhier /update

then:

net stop w32time 
net start w32time

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ACL. Well if you take a look at that there are 3,412 networks I would have to block.

What I'm really asking is there a way around making a super large ACL? If it was contiguous IP space I could just supernet but that is not the case.

Users are logging into one of three 2003 Terminal Servers. This problem is only for the users logging in and doesn't effect if an Admin account logs in. I'll try to describe the problem.

When the user clicks on My Computer the screen pops up and then the flight light will appear. This will stay up for about 10 seconds, then if they they click on any drive to browse further it will go to the next screen and then a hourglass will appear. The amount of time this takes to load can be anywhere from 10 seconds to 2 minutes. The problem is more apparent on the network shares but like I said if I am logged in as a admin there is no delay. Any idea what could be causing this?

If there is any other details you need to help me on this let me know and I will add it below.

I have been working on converting a config over from a PIX to a ASA 8.2 but I am running into some trouble with the site to site vpn part of it. The PIX has both a client VPN and site to site. Since some of the configs for the site to site cross over the client VPN I'm getting confused. Any help would be apperciated.

Belows are excerpts of just the related VPN commands from the PIX.

access-list Remote_splitTunnelAcl permit ip 192.168.0.0 255.255.0.0 any 
access-list inside_outbound_nat0_acl permit ip any 192.168.0.160 255.255.255.240 
access-list inside_outbound_nat0_acl permit ip host Zenoss_OS NOC 255.255.255.0 
access-list inside_outbound_nat0_acl permit ip host SilverBack NOC 255.255.255.0 
access-list inside_outbound_nat0_acl permit ip host enoss_Hardware NOC 255.255.255.0 
access-list outside_cryptomap_dyn_20 permit ip any 192.168.0.160 255.255.255.240 
access-list outside_cryptomap_20 permit ip host Zenoss_OS NOC 255.255.255.0 
access-list outside_cryptomap_20 permit ip host SilverBack NOC 255.255.255.0 
access-list outside_cryptomap_20 permit ip host Zenoss_Hardware NOC 255.255.255.0 

ip local pool DHCP_Pool 192.168.0.161-192.168.0.174

nat (inside) 0 access-list inside_outbound_nat0_acl

sysopt connection permit-vpn
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 205.x.29.41
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL 
crypto map outside_map interface outside
isakmp enable outside
isakmp key KEY address 205.x.29.41 netmask 255.255.255.255 no-xauth no-config-mode 
isakmp nat-traversal 180
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption des
isakmp policy 40 hash sha
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
vpngroup GHA_Remote address-pool DHCP_Pool
vpngroup GHA_Remote dns-server 192.168.0.11
vpngroup GHA_Remote wins-server 192.168.0.11
vpngroup GHA_Remote default-domain x.org
vpngroup GHA_Remote split-tunnel Remote_splitTunnelAcl
vpngroup GHA_Remote idle-time 1800
vpngroup GHA_Remote password KEY

I guess what I am really asking is if someone can convert the site-to-site version of this VPN config to ASA 8.2 so I can compare it to what I have. I need to have this so I can just drop it in place and work.

Also it doesn't seem that isakmp policy 40 is being used, correct?

The following command is the only command I can't enter directly:

crypto map outside_map 20 ipsec-isakmp

I get a ERROR: % Incomplete command I then see that I need to add dynamic "dynamic map name" I'm unsure of what dynamic map I need to tie this to.

Windows pc can go to http://servername:8085 and get to the site fine The Macs go to the same page and get a time out error

DNS on all machines point to the DC at that branch, the second DNS entry points to the DC at the main branch.

Any ideas what could be going wrong?

On Windows Server 2008 R2 I am getting a DCOM event error 10009 "DCOM was unable to communicate with computer X" I can't ping computer X, I don't know what computer X is, and computer X is not in AD. What can I do to either fix this or make it so the events are not logged.

Samba share is on Ubuntu 8.04
Samba config is below:

# Name mangling options
;   preserve case = yes
;   short preserve case = yes


# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/speed.html
# for details
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
   socket options = TCP_NODELAY


#======================= Share Definitions =======================

[public]
        comment = Public Directory
        path = /home/public
        # inherit permissions = no
        # public = yes
        read only = no
        # writeable = yes
        # force create mode = 0775
        # force directory mode = 6775
        # force user = nobody
        # force group = users
        guest ok = yes
        guest only = yes

Out put from samba error log when I try to connect to the share over vpn:

[2011/04/07 15:01:23, 0] lib/access.c:check_access(327)
  Denied connection from  (10.0.1.2)
[2011/04/07 15:01:23, 1] smbd/process.c:process_smb(1062)
  Connection denied from 10.0.1.2
[2011/04/07 15:01:23, 0] lib/access.c:check_access(327)
  Denied connection from  (10.0.1.2)
[2011/04/07 15:01:23, 1] smbd/process.c:process_smb(1062)
  Connection denied from 10.0.1.2
[2011/04/07 15:01:31, 0] lib/access.c:check_access(327)
  Denied connection from  (10.0.1.2)
[2011/04/07 15:01:31, 1] smbd/process.c:process_smb(1062)
  Connection denied from 10.0.1.2

I'm trying to access this share on Windows 7.
If anyone request any other information I'll post here: When connecting via VPN my ip will be 10.0.1.x
On site it would be 10.0.0.x
IPTABLES -L shows no rules set up

Just wondering there is any kind of stress test I can put the ASA through. I'm asking this not to help with a problem but just for reference.

I know I could use iperf to send a bunch of traffic through it but was thinking there might be something more I could do.

I wan't to be able to login via ssh with a password and not the key file.
Yeah I know it's totally insecure but at this point in the config I was turning variables off and on left and right trying to get this to work.

 
#       $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

Port 22
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords yes


# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
GSSAPIAuthentication no
#GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
UsePAM no

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner /some/path

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server

A Dell x346 server crashed (motherboard went bad) and I need to get a few files off of the hard drive. They are 2 SCSI hard drives in RAID 1. As far as I know both drives are fine.

Can I just put one of the drives in another computer and get the data off?