VMware Workstation VMs Web Traffic Being Blocked

dfinjr

I went line by line on the Cisco ASA config and found nothing that would be special by any means. I'll start looking at the analysis difference between the two sets of captures.

johnpoz

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

but I hard set the MTU on the labsystems interface to 1500 MTU

what is this labsystems exactly - there is nothing labeled that in your drawing.

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

just keeping everyone up to speed.

What I recently got a warning from a "vexpert" line that there are problems with the I219-V Intel stuff in virtualization environments from the beginning, problems all over the place....

these are only somewhat mitigated by the Fling community driver, it may be related(?)

https://flings.vmware.com/community-networking-driver-for-esxi/
https://www.virten.net/2017/02/heads-up-esxi-not-working-on-7th-gen-kaby-lake-intel-nuc/

same is the case for some Linux flavours with this Intel
maybe there is something in this

dfinjr

@johnpoz
Labsystems is the vlan where my VMs live. 172.16.0.0/24. Connects from PFsense to the TPlink switch to the vm hosting system and the rpi.

DaddyGo

@johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

what is this labsystems exactly

supposed to be port 4 of SG2100

johnpoz

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

Labsystems is the vlan where my VMs live. 172.16.0.0/24

And where did you set the mtu exactly - on what? What was it that it wasn't the standard and you had to "hard code" it?

dfinjr

@johnpoz

It only somewhat helped. Afterward I could get speedtest.net to render.

johnpoz

@dfinjr and if you ssh to your pfsense and do a ifconfig - what are all the mtu for all the intefaces showing?

Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

dfinjr

@johnpoz
doesn't look like this output shows the MTU:

is there another command I can run in order to give you what you're after?

Yeah I bet the frame sizes were still off. No idea how the ASA was compensating for it.

johnpoz

@dfinjr that is not an ifconfig command

from the main pfsense menu, do 8 and then run the command

dfinjr

@johnpoz

DaddyGo

@dfinjr

rather so, enter the shell (8)

dfinjr

@daddygo
my bad!

DaddyGo

@dfinjr

this looks good....
we're not moving forward, we're stuck in one place, I can think of two things:

do you have a good quality USB NIC in your hands?
VirtualBox temp install

dfinjr

@daddygo
I agree. breaking out another system with mint/virtual box on it to test. stand by for a sec and let me build something up.

stephenw10

@johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

Yeah, interesting. Something is restricting the MTU there.

Also interesting is that the pcap on the VM host sees the traffic both ways with the Cisco in there.

Steve

dfinjr

While we're waiting...

Would you expect to see a block between two systems on these two vlans?

got something interesting going on here and I wonder if it is the same thing we've been seeing...

As I mentioned once before, I am a Bigfix sales engineer.

The DMZ client can ping/curl everything I would expect for the system to connect to the Bigfix management server yet I am seeing it fail.

stephenw10

What's the advanced option you have set on the LABSYSTEMS rule?

I would not expect anything blocked, do you see blocks in the firewall log?

dfinjr

@stephenw10
It's likely this, from troubleshooting:

Maybe so:

stephenw10

You shouldn't need that TCP flags setting unless you have an asymmetric route and it would be a lot more broken if you did.

Those blocked packets look like the host at 10.10.0.10 sending acks after the state has closed, which is usually not an issue.
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets