Firebrick Users October 2021

firebrick-users@lists.firebrick.co.uk

3 participants
2 discussions

Firewall changes don't take effect until a reboot
by Paul Cooper 22 Oct '21

22 Oct '21

TLDR: Changes made to the firewall rules don't take effect until my FB2700 does a full reboot. I'm running a 2700 with Kaplan. I was wanting to track down which IP on my local network was generating a lot of traffic so I created a rule to graph certain IPs and then did a binary search on the source IP to identify the offending device. I didn't find it. So I widened the search criteria to the full allocated DHCP range and still nothing. I decided to reboot and suddenly the rule started working. I then tried other firewall changes such as creating a disable profile. Again, any changes I made had no effect until I rebooted the FireBrick. I then wondered whether it was a Kaplan 'bug' so I downgraded to Jacoby but the same behaviour occurred. I also tried power-cycling the Firebrick, but again the same behaviour. The next thing I want to try is a full factory reset but that will be awkward so I thought I'd first ask in this forum to see if anyone has any suggestions. Also, do the developers wish me to create any logs to send to them? Paul

3 4

Latest factory software and IPsec problems
by Andrew Hearn 01 Oct '21

01 Oct '21

Hello FireBrick users, FireBrick software version 1.57.010 (Kaplan) was released on Wednesday this week. One of the changes was the introduction of IKE message fragmentation support (RFC 7383). IKE message fragmentation support allows certificates to be sent in multiple messages rather than being fragmented at the IP level which has lead to additional problems with NAT/Firewalls etc. However, since the release there have been a number of reports of remote IPsec clients unable to connect in to their FireBrick, and the cause is related to this change. We are working on a fix. SHORT-TERM FIX: The short-term fix is to downgrade to the previous software release, "1.56.010 (Jacoby)" and you'll also want to disable automatic updates, instructions below: ------------------------------------------------------------ DISABLE AUTOMATIC SOFTWARE UPDATES: 1. Log in to your FireBrick's web interface 2. Edit the config 3. Go to: Setup, then System Settings 4. Set sw-update to false, click Test/Save. ------------------------------------------------------------ DOWNGRADE THE FIREBRICK SOFTWARE Download the "1.56.010 (Jacoby)" software file from: https://www.firebrick.co.uk/support/software/ or click: https://download.firebrick.co.uk/fbsoftware/2901/V1.56.010/FB2900/V1.56.010… 1. Log in to your FireBrick's web interface 2. Click Status, then the 'Upgrade available' or 'Manual Upgrade' link 3. In the 'Manual software upload' section, Choose the Jacoby file you downloaded 4. Click 'Upload & Reboot' You should now be on version 1.56.010, and your IPsec clients should be able to connect. ------------------------------------------------------------ We do apologise for this inconvenience this has caused and we'll post again once the problem has been resolved. -- Andrew Hearn, Andrews & Arnold Ltd.

1 0

2024

2023

2022

2021

Firebrick Users October 2021