Odd issue since snort installed
-
I'm at a loss here. I installed the Snort package on 4 PF Boxes, 2 are at other sites, 2 are on our core network.
All the boxes are configured pretty much the same, other than different OpenVPNs, BGP AS Numbers…etc.
How ever the two that are on the core network. Will drop off the world. NO PING. NO Trace Route. I have to reboot the boxes in order for them to come up. But then in about 15 minutes the boxes go dead again.
The odd thing is if I am remote, I am unable to get to the boxes, even if I attempt from several different ISP connections/locations. BUT if I am local to the CORE boxes I am able to ping out/traceroute no problem. Also all the VPN are still up and functional between all sites, with no issues.
The boxes at the other sites do not experience this problem.
This started as soon as I installed the Snort Package, I thought to ask here for advice, before I pull the snort packages off completely.
I can provide logs....just let me know what logs are helpful.
-
Please post snort package version.
Best guess, enabled block hosts and your ips are getting blocked by the firewall.James
I'm at a loss here. I installed the Snort package on 4 PF Boxes, 2 are at other sites, 2 are on our core network.
All the boxes are configured pretty much the same, other than different OpenVPNs, BGP AS Numbers…etc.
How ever the two that are on the core network. Will drop off the world. NO PING. NO Trace Route. I have to reboot the boxes in order for them to come up. But then in about 15 minutes the boxes go dead again.
The odd thing is if I am remote, I am unable to get to the boxes, even if I attempt from several different ISP connections/locations. BUT if I am local to the CORE boxes I am able to ping out/traceroute no problem. Also all the VPN are still up and functional between all sites, with no issues.
The boxes at the other sites do not experience this problem.
This started as soon as I installed the Snort Package, I thought to ask here for advice, before I pull the snort packages off completely.
I can provide logs....just let me know what logs are helpful.
-
I was using 2.8.4.1_5 pkg v.1.7 of Snort, which is the package available.
Since the post I have pulled/removed the package and everything has returned to normal.
Prior to removing, I checked the settings, I did not have the Block Hosts option enabled.
I tried to reinstall snort, as soon as it is installed…ALL traffic is blocked...regardless if I have rules to let it in and port forwards. Both outgoing or incoming, is blocked. Even if I unselect WAN and/or LAN it remains blocked, until I reboot... then I am able to get traffic to pass in and out of my PF box, but this only last 15 minutes before it is blocked again. It seems the only way to fix it is to remove Snort altogether or every 15 minutes reboot the box....neither will help my intended use.
I was hoping to use Snort to block attempts at inappropriate sites/sites with exploits. But alas, Snort seems broke.
At this point it has been removed. I'll have to look into other ways to filter sites.
-
Snort is working fine for me at customer sites, including sites with multi-wan.
There must be some other contributing factor causing the loss if you don't have snort blocking enabled.
Have you checked the RRD graphs for spikes in CPU usage or throughput once the blockages occur?
If you have console access at the time you can check the snort2c table to see if there are any block entries despite your settings by using something like this:
pfctl -t snort2c -T showThe snort alert log should also have entries corresponding to any of those actions.
-
Reinstalled on a test Box, same issues. On this new test box…
I've checked the RRD for CPU and Net Util, nothing over 25% actually most are at a steady 1%
I've done "pfctl -t snort2c -T show" at the command line
There is nothing showing up at all. Just drops back to the command line with nothing.There are no logs either....but the Snort Daemon is running if I Grep it. And it shows up in TOP...however in a WAIT state.
Under top there are no zombie processes....so nothing seems to have hung/croaked/or died.
I have snort working fine at our branch sites, it is the core site that only experiences this issue. I thought it might be hardware related, so I removed snort from the actual COREs and made a LAB (well other than IP Pools and petc.) similar as the CORE, just isolated from the production network...I get the same issues....and they are running on same hardware, so I changed to other hardware....still same problem. It seems to only be the CORE that SNORT will not work on, it blocks all traffic in or out, unless the hardware is rebooted...or Snort is removed completely.
Odd thing is the hardware at the branch sites is the EXACT same as the COREs, the only differance is that the Branch Sites had one ISP connection, and the COREs (the cores are 2 separate boxes- Firewall01 and Firewall02) have each has a diverse ISP connection to each PF box and one connection each to a separate CORE switch, the two switches are interconnected with MLT/STP via two cross-over cables. All Branch sites have two site to site VPNs (OpenVPNs) to each CORE (One to 01 and one two 02). The CORE LAN is one /24 network. Each Branch LAN is also a different /24. BGP is enabled on all of them. Each PF box is it's own AS.
When the COREs go "down" the VPNs still work....just all other WAN traffic stops. I can ping anything on the CORE LAN or out to any of the Branch LANS, BUT I am not able to ping google...or any thing out side of the CORE LAN, other than other side of the VPNs. If I go to another location (say a coffee shop) I am unable to ping the WAN address. BUT the VPNs are UP as I can roadwarrior in to a branch site and ping the CORE LAN and Branch LAN with no problems, but again I can't ping anything out in the CORE WAN. However if I am actually on the Branch LAN, no problems pinging google or the out to the Branch's WAN/ISP. There are no roadwarriors set up on the COREs only site to site VPNs.
All sites have static IPs. Roadwarriors do not they are dynamic.
It is as if the when Snort is installed on the COREs, anything destined for the WAN coming from the CORE LAN is BLOCKED, but anything within the CORE LAN and via the VPN to Branch LAN is OK.
However nothing is blocked on the WAN at Branch Sites other than what is specified (porn...etc) and nothing at all is blocked to/from the Branch LAN or CORE LAN from/to the Branch Site LAN.
I'm at a loss....until I can figure this out Snort will not be on the CORE LAN Boxes. I would think if the SNORT configurations (Rules enabled/selected) are the SAME on all the PF boxes, that all the same traffic would be BLOCKED....so everything would break, but here only the CORE WAN breaks, but everything else works the way it should...I am just confused!