Showing posts with label Troubleshooting. Show all posts
Showing posts with label Troubleshooting. Show all posts

Wednesday, October 14, 2009

BGP router down


We have a Global Crossing line. It is a dual router BGP setup with HSRP between the local routers in my office and BGP fall back on the Global Crossing infrastructure.
This morning, few minutes before the opening bell the primary circuit died. As a result the connection failed over to the backup line, which is what you'd expect. The problem started when the primary line started to bounce. Whenever it came back the connections bounced for a second and the users had to reconnect. Then it failed again and they started to get irritated. They are totally right.
As I called the Global Crossing support I found a very efficient service that was listening to my problem and had the will to help (sound obvious but usually this is not the case with big vendors). They started by checking the logs and found that it is bouncing every few minutes. I asked if they can change the HSRP priority to be higher then the primary router, they had no problem doing the configuration change. Problem resolved!
Now this is how HSRP priority work: the primary router get a higher priority and both get the preempt command which allow change of active state if there is a higher priority router online. By changing the priority on the backup router and changing the preempt to manual we ensured that even when the circuit is fixed and stable online it will not become the primary active line unless we manually change it back. This ensure that users will not get kicked off when the line is fixed or when the telco work on the circuit and bounce it constantly.
The circuit was fixed few hours later and after hours we switched back. It is nice to work with good cooperative service for a change!

Thursday, October 8, 2009

Yahoo! Mail screen resolution

A user called in with a problem: she can't open her Yahoo! Mail account. She does log in and see the main template, it show "3 unread messages" at the screen title but the messages are not loading.
When I stepped to her desk I noticed that her iexplorer.exe process uses 99% of the CPU. I killed it and asked her to try again. Same problem, same solution. I tried a different approach and used my test account on Yahoo! (I never use it but this is why I keep it). Unlike her, I was able to get a message error (is it because my mailbox is empty?) which provided me with the solution as you can see in the picture.
When I changed her screen settings to 1024 x 768 she had no problems loading her mail. Now it is up to her to decide if she want her 15" monitor to show large fonts with the existing 800 x 600 which she like with no personal mail or change it to the smaller font with Yahoo! Mail working...

Tuesday, September 29, 2009

552 552 Message exceeds fixed maximum message size



A client sent a 6MB email to one of my users and got the following message:
This is an automatically generated Delivery Status Notification

Delivery to the following recipient failed permanently:

Username@MyDomain.com

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 552 552 Message exceeds fixed maximum message size (state 18).

Checking my Trend Micro IMSS log I couldn't find any reference to this email.
Now I know IMSS will not send a notification anyway even if the size limit exceeds my 10MB limit per message and it should log it. 2 points that sent me off track with this.
I asked the client to contact her email provider (she is using an Exchange based hosting solution) and they sent me the following response:
Title: NDR: Message rejected; too large
Created: 09/29/2009 12:03:36
Summary of issue(s): Receiving a NDR that states that the recipient is rejecting the message because of its size.

Steps taken: Had her send the message to our test account. It works. The email is about 6 MB. The limit of outgoing on our servers it around 52 MB's. It is an issue on the recipients end. She will get in contact with them.

At this point I asked her to forward the original email to a test GMAIL account I hold. From there I forwarded the email to my user and got a similar failure message.
Calling Trend Micro was the next step. I had a technician on the line in no time and he Webex'd my IMSS server to find no logs and tell me that it must be something before IMSS, maybe my firewall. The only way to prove him wrong was bypassing IMSS and forwarding all SMTP directly at my Domino server. yeah, exactly what I need...

Googling gave me nothing. It was all around Exchange 2007.
So I was thinking again about IMSS settings and started playing with the settings. When I doubled the message size limit from 10MB to 20MB I was able to receive the email and see it in the log.
I guess that is a bug in the IMSS software. Great product but it is the 2nd bug I found in it this year...

Friday, August 7, 2009

My Tractor Story (aka ASA)


This is my personal Tractor Story

Remember how my firewall died?
The next morning around 10am Fedex arrived with the new box.
I opened the box and wondered if it is the hardware or the power cable. It was the hardware. Not even 2 years old piece of hardware just lost it.
I copied the config (finally all those tedious Cisco backups pay back!) and it looked fine. Easy. Maybe too easy.
I wanted to use this opportunity to upgrade my software version from 7.2(3) to 8.2(1) and also upgrade the ASDM (which is the GUI console for PIX\ASA). I usually avoid major changes at these situations but how often you get your production firewall offline for such a job?
Reading all about the upgrade it looked like a straight forward upgrade where none of the configs will be affected. To make sure it is as easy as it looks I called TAC and they told me the same thing: copy the software, reload, good to go. So I did.
Reloading the software was easy, quick and worked just fine. Would it be a short happy afternoon?
Afterhours arrived and it’s time for switching. When I finished all adjustments on the network (remove the backup firewall, change back the D\G and cabling) I started testing with one of my out of network colleagues. She was happy about everything but the VPN.
I was looking and searching and found few missing lines. Copying those lines prompt errors. So WTF is wrong? Took me a while to figure it out (how could I not remember? Because I only did it once when I bought the ASA and never again): the Activation Key was missing hence all the Security Plus features didn’t work and the related config failed to load. Lost few hours for the reminder.
At that point I had to reload all the missing configuration that now loaded like a charm. Line by line I got everything back to work and finished this task successfully.
The only thing I still do not understand is the way Cisco handle this. You guys do it everyday with thousands of clients. When you send me a new box you know I’ll have to reload the Activation Key but even more important, you know that the key I received with the original box will not work. Why don’t you automatically create a new key and email it so when the box is here I’ll be able to use it???

Wednesday, August 5, 2009

Cisco ASA just died

My firewall lost power around 1:30PM, an out of the blue surprise...
Cisco already shipped a new firewall and lucky me, I have my ISA proxy in a working condition just in case. So the case is here!!!
15 minutes later and we're up again via ISA
Stop. Pray. Breathe.