Failed logins problem
Hello, everyone....
OK, first of all, the players...
1. NetWare 6.5 SP7 servers: a half dozen at the main office. One at each of
three sites connected with an site to site VPN tunnel.
2. User laptop: Windows XP SP3, pretty well patched.
3. Other considerations: VPN tunnel is SonicWall, an NSA 3500 at the main
office and TZ210 at each VPN location. Also ZenWorks 7.x is involved. I'm
not sure of the exact version, but it is some variety of Zen 7.
My problem: this laptop is single-handedly generating dozens of failed
logins on at least two of the three VPN sites.I looked at the Remote Manager
logs for these locations and the Zenworks Workstation Object is shown as the
culprit.
Example log entry from Remote Manager (OrgName and TreeName withhelf for
security reasons):
Time: Thursday, 9-24-2009 10:35 am
Address: IP 172.26.100.04
User: .CN=AOS36816 WINXP
00:1F:E2:14:73:CC.OU=Workstations.O=<OrgName>.T=<T reeName>.
I checked the NSA3500 device and the TZ210 device. There are packets (TCP
524) going from the laptop to the NSA3500 device and then nothing is heard
from them again on the TZ210 device.
I'm wondering if the 524 packets are not getting send down the VPN tunnel.
And if that is the case, WHY is the server on the other end of this given me
failed logins?
Am I making myself clear about this?
Thanks in advance.
________________________________________
Delon E. Weuve
Senior Network Engineer
Office of Auditor of State
State of Iowa
United States of America
|
Threaded Mode
