Endpoint Protection

SEP logs are reporting a number of errors or blockages over the last 2 days. It started just suddenly one evening, and AFAIK, no one was here to do anything at that time -

The two servers involved are in each case, a dev SQL server, and a sharepoint server. It happens between these two, and another SP server connected to the development SQL server.  (also note that once again, the SEP logs don't resolve host names for the IP address just like in the other firewall logs, but that's another item!)

Anyway, why are we seeing this thing in the last couple of days. Go back to last week and ANYthing prior, you don't see this but VERY rarely. Now it's regular.

This is one example:

Here is another:

This is the addressing involved: (SPS is sharepoint, SQL is SQL)

Name:    vrasdfsps3.dvrs.gov.state.ia.us
Address:  111.222.190.49

Name:    vrsdfs2.dvrs.gov.state.ia.us
Address:  111.222.197.42

Name:    vrdevghql2.dvrs.gov.state.ia.us
Address:  111.222.197.48
 

Shadows,

Your router(s) and or you NIC(s) inside of your machine have IPv6 enabled?

There is a large amount of information about how vulnerable IPv6 is and how it currently lacks security.  Due to this, by default, most Firewalls block IPv6 traffic.  I remember a few days ago, you were configuring FW rules. 

The blocked protocol is UDP (so most likely router or switch broadcasts looking for IPv6 capable hosts).

The blocking rule is encapsulated IPv6 packets broadcast over IPv4 layers. 

* * * * * * *

Verify your NIC(s) and turn off IPv6 -> Properties and Remove the check box for IPv6 or simply uninstall IPv6 protocols... 

I just checked the NICs, no IPv6 on any of them.

In fact, as far as I can tell, we don't have IP 6 on any server or desktop, nothing.

One computer in the field that VPNs into us is CONSTANTLY sending these messages in the log. Now for the last serveral hours, a VISTA computer used by a network admin here has been filling the logs with 'em. He's gone, not using the computer, and no IP6 on it either...........

Errors, or real?

Thanks.

"One computer in the field that VPNs into us is CONSTANTLY sending these messages in the log." 

What do you mean by this? 

The computer X has an ip address of 10.10.10.150 (DHCP from VPN connection) for example and connecting through a Router/VPN appliance at 10.10.10.165 and routes to your internal network.  From there, he accesses your file server at 10.10.10.250 and you see in your logs, 

- Traffic being blocked from 10.10.10.150 (computer X) to 10.10.10.250 (file server).

If this is the case, than one of a few possible things, first the VPN'ing machine has IPv6 broadcast (not likely).

Second, the network that he is connecting (his ISP) is using IPv6 in their back end network to route over the "cloud"

Third, your router/firewall/VPN appliance has IPv6 passthrough enabled.

Fourth, your ISP is using some IPv6 for their backend and you have not been informed (not likely either).

Just a few possible probabilities. 

Most likely culprit is your router/firewall/VPN appliance, in my opinion.

Symantec?  Paul?  Anyone have any insight on this?

For that particular user, I see a lot of these - or ones very similar. Perhaps several dozen to nearly 100 a day. Recently started seeing it on an internal VISTA machine, too.  Note the remote host IP.........

Now in THIS case, the fellow works at an office we have at a college. He rides the college network to get to the Internet and uses VPN software to get back here.

PERHAPS in this case, it's the college??

Do you have any staff on site at the remote office, that can tell you what model the router/firewall is on the other end, or better that can get into it and tell you if IPv6 is enabled by default on the device?

When the Vista machine connects to your network, can you verify with or without the user if IPv6 is enabled on his machine?

"By now, you have probably heard that Windows Vista features a dual stack, which allows it to run IPv4 and IPv6 simultaneously. Although Vista isn't the first Windows operating system to support IPv6 (I think Windows 2000 may have been the first), it is the first Windows OS to have IPv6 enabled by default."

Extract from: http://searchenterprisewan.techtarget.com/tip/0,289483,sid200_gci1348329,00.html

We only have 3 VISTA computers in our agency, they are all used by IT staff.

I found IPv6 on mine, unchecked it. Will look into doing that on the others, and check all servers as well, just in case.

Because of many other things I see coming from that machine that sits at our college office, I'm thinking of asking them to take a look at their firewall. There are days I get nearly 200 messages about addresses being blocked for 600 seconds because of this or that - more than any other computer, actually more than all 300 combined!