GeordieSteve Posted October 29, 2008 Share Posted October 29, 2008 Strange one here. I've got a number of laptops that connect through an RNA VPN connection which have windows firewall installed (all the normal exceptions made such as ICMP traffic, RDP, SMS blah blah blah). If I connect them up through the VPN and try to ping them from a PC on the LAN they eventually fail (it's intermittent). In order to re-establish the ICMP request I have to ping the machine on the lan from the laptop it's self. Is this some sort of handshaking and is there any reason you can think of why it drops the pings in the first place? I'm just busy trying to rule out Windows Firewall before I have to start looking into the head office for ISA, QoS etc. Cheers Link to comment Share on other sites More sharing options...
GeordieSteve Posted October 29, 2008 Author Share Posted October 29, 2008 p.s. pathping fails at the laptop... until you ping from the laptop of course Link to comment Share on other sites More sharing options...
MaveriK Posted October 29, 2008 Share Posted October 29, 2008 Are the laptops in the same location? Is the LAN your pinging from at the head office? Link to comment Share on other sites More sharing options...
JustGav Posted October 29, 2008 Share Posted October 29, 2008 It sounds like incoming ICMP might be blocked, and the firewall is allowing it throughly purely because a pre-established tunnel has been established.... Link to comment Share on other sites More sharing options...
GeordieSteve Posted October 29, 2008 Author Share Posted October 29, 2008 Not tried to ping from head office. ICMP is enabled from all machines on 10.0.0.0/8 Now... it gets strange: LAN machine pings VPN laptop fine LAN machine then tries an RDP connection Pings then fail constantly VPN laptop pings LAN machine then LAN machine can ping VPN machine once again EDIT: Tell a lie, Wireshark is showing ICMP requests going outbound Link to comment Share on other sites More sharing options...
JustGav Posted October 29, 2008 Share Posted October 29, 2008 Your VPN software isn't doing some strange splitdns/split tunnel thing by any chance, or perhaps blocking ICMP requests? Link to comment Share on other sites More sharing options...
GeordieSteve Posted October 29, 2008 Author Share Posted October 29, 2008 We're running over a pptp connection for VPN with RSA security. Can't understand why pings come through until a TS session is requested Link to comment Share on other sites More sharing options...
Thorin Posted October 30, 2008 Share Posted October 30, 2008 Have you tried turning it off and on again? Link to comment Share on other sites More sharing options...
tonyhawk Posted October 30, 2008 Share Posted October 30, 2008 Do you have a clustered firewall; you might be getting mismatched routing? Link to comment Share on other sites More sharing options...
GeordieSteve Posted October 30, 2008 Author Share Posted October 30, 2008 Ok we've worked out after plenty of testing that it IS infact windows firewall. It seems to block every port every now and again for no real reason. GAAAHHHH I hate this thing Link to comment Share on other sites More sharing options...
Branners Posted October 30, 2008 Share Posted October 30, 2008 I would suggest Windows Firewall sees it as an intrustion attack. Its an unknown system checking if the machine exists via a ping. Simplest option is to put in a rule to allow ping protocols to and from the machine and it should work. If I have an alternative firewall in place on the machine I tend to disable the windows one as it also stops remote control sessions and things like Symantec End-point from being able to see and update the laptop properly. Link to comment Share on other sites More sharing options...
GeordieSteve Posted October 30, 2008 Author Share Posted October 30, 2008 ICMP is allowed from 10.0.0.0/8 which is covers our whole internal infrastructure. It seems as though windows firewall turns off all ports when it's inactive and doesn't allow anything inbound until the laptop becomes active again (even pinging the outside world) Link to comment Share on other sites More sharing options...
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now