discussion but no real answer re: protocol ethernet type=0x806
We are at 12.1 RU2 on the servers - most of them anyway so I replaced the existing 11.xx and original early 12.1.xx firewall rules with the new, fresh default firewall supplied with the latest SEP/SEPM install for RU2. It had totally different rules. Allow local, then block, next rule was allow local, then block all the way down to "block all other IP traffic and log", then the last rule, "block all other traffic and don't log". This last rule is the question.
We are troubleshooting a lot of DNS and other issues - our servers are stating things don't exist that do exist, a lot of workstation logs are filled with "DNS server did not respond" type messages. I find the DNS servers never received the question, the client never received a reply and so on.
First suspect - FIREWALLS. Since there are BUILT-IN rules to allow server-type traffic, I wasn't really thinking it was an issue, but the folks helping us troubleshoot our on-going and vast issues with DNS and AD, I said what the heck, let's tell that last rule to LOG - I made no changes to the last rules, other than check logging on the very last "block all other traffic and don't log" rule.
The logs on the servers started filling up fast. All are showing constant hits on the last "block all other traffic" rule. Last I looked on just one server there were 12 hits on that last rule inside of 9 seconds, and ALL to and from the DCs, which are also our DNS servers. The folks working this issue don't like the fact SEP is blocking all this. So I must find out WHAT it is blocking and why, and what is the impact. So far, no replies to this question exist here.
The question - I have searched several times over the last year and see a lot of threads on this topic, but not a single one was actually SOLVED. OK, solved in "make the log entries go away" - sure, but that's like putting a blindfold over your eyes while someone takes your dinner - you just can't see it but your dinner is still missing. Maybe this rule blocks good traffic, but by not logging it, you simply can't see SEP doing it. That's what I need to know.....
Please - I'm not wanting another "uncheck the logging and it will go away" replies, please. Well-meaning, well-intentioned, but it does nothing to address the real problem or question.
In a nutshell - WHY is SEP blocking this traffic ETHERNET [type=0x806], and what is the result - what are the possible side-effects of SEP blocking this traffic?
Is there any harm or risk in allowing this traffic it calls ETHERNET [type=0x806]?
What is ETHERNET [type=0x806] and why is there so much of it?
What is the impact on domain controllers and DNS servers if all ETHERNET [type=0x806] is blocked by SEP - like it is due to that last "block all other traffic and don't log" rule in SEP 12.1 RU2
I am hoping that in this thread we can help dozens, even hundreds of others who have asked, but made it go away by simply not logging the blocking that still goes on even though they can't see it.