[SOLVED] Half of our servers won't connect to the internet after installing...

[link470]

Original Title: Half of our servers won't connect to the internet after installing yesterday's update


Alright guys. This is wierd. Things have been going great for quite some time, and tonight I figured well, there's an out of band security update that Microsoft is pushing as "pretty darn urgent" in the category listings [k I made that category up], I may as well install this update and get things patched. Like any Patch Tuesday, I roll out microsoft update and pull down the new update on all my servers. Then restart.

This is when things get interesting.

The servers come back online, and I notice that in the corner of one of them, our antivirus program is showing an exclaimation mark. So I check it out, sure enough, it can't connect. So I figure "lolol how wierd" and open IE to see if the server can get out to the internet. Nope. Nadda. So I immediately think "oh no what have I done" and I check the other servers. 3 of the servers can access the internet, the other 4 can't. I tried shutting down, restarting, removing the update, and nothing can make those other 3 access the internet. I can RDC them perfectly. In fact, I'm at home right now because I couldn't figure it out at school and I was already 4 hours overtime and wanted to get home and have dinner. I'm sitting here at my desk in my house, eating dinner, and connected via RDC to the exact same server remotely that can't access the internet. I'm extremely confused.

My only guess is that it has something to do with DNS. However, we have 2 domain controllers. One can access the internet, our secondary. Our primary cannot. Has anyone else had any issues with this recent update?

I updated 2 of our windows xp labs with this update, and they're all perfectly fine. No issues. The internal network is still great, and nothing appears to be down. Just those servers can't access the internet. Which takes out our antivirus updates and really, that's it.

Thanks so much for any replies. I'm hoping to get it fixed before Monday morning.

[SYNACK]

Have not had this issue but some things that might help in the diagnosis would be:

• attempt DNS lookup of an external site on an effected server using nslookup
• check all settings in ipconfig /all to make sure they are pointing to the right places
• check to make sure that it has not decided to enable a firewall setting that is blocking the application
• attempt a trace route to an external site with the tracert command and see where it stops
• check the RSoP (Resultant Set of Policy) snapin on the server to see if it has enabled the firewall or it has set the computer to restrict access to the internet

These are in no particular order but are the first things that I would try.

[jsnetman]

Sounds to me that it's something as simple as proxy settings. It obviously depends on your network setup and I presume you are using a proxy for http requests. My AV is setup to download updates using the default proxy settings of IE. Check out the proxy settings in IE.

[joe90bass]

Sounds to me that it's something as simple as proxy settings. It obviously depends on your network setup and I presume you are using a proxy for http requests. My AV is setup to download updates using the default proxy settings of IE. Check out the proxy settings in IE.

If that's okay you could check the default gateway settings are still there. I spent a while scratching my head the other day with one of our servers with a similar issue only to find the default gateway setting had disappeared

[link470]

Hi everyone, thank you very much for the time you've taken to put in these replies. Unfortunately, I'm still having the same issue on those 4 servers. IPCONFIG /ALL shows nothing out of the ordinary and matches the other servers. The default gateway is set correctly, haha and I'm glad someone else mentioned that, I checked that first cause I've seen it not there before [this was back when the DHCP option for default gateway was an incorrect IP several months ago, easy fix]. Performing NSLOOKUP on a server yielded the same results as if I used a server WITH internet access. I put both command line windows side by side, one background in a remote terminal to another server that DID have internet, and one active on the server that wasn't working with internet, and viewed them side by side. Again, this is all via RDC from my house at the moment, they respond great, they can ping the gateway, and other servers, it's all very confusing. Any other suggestions?

Thanks!

[joe90bass]

Sledgehammer, it won't fix the problem, but it will make you feel better albeit briefly

[bizzel]

Double and triple check the proxy settings. I've seen romaing accounts where the setting will be lost on the servers at logoff simply because it's being updated elsewhere as well.

[link470]

Double and triple check the proxy settings. I've seen romaing accounts where the setting will be lost on the servers at logoff simply because it's being updated elsewhere as well.

Thanks for the suggestion. Good call, however we don't run a proxy server. We run a web filter in front of the gateway, and the gateway is configured correctly.

[torry_loon]

Which Anti-virus are you running on those servers?

[link470]

Which Anti-virus are you running on those servers?

AVG 8 Network Edition

[torry_loon]

AVG 8 Network Edition

I thought so!

I had a similar problem on Friday with two computers that would not load anything in a web browser. We also use AVG 8.0 Network Edition.
I spent ages trying to work out why. I still don't understand why it only affected those 2. Other computers had the latest MS and AVG updates before those computers.

Anyway, to get it to work I had to disable the Web Shield component in AVG. If you find a better solution, let me know.

[PiqueABoo]

We run a web filter in front of the gateway

Other protocols work & HTTP doesn't... I would definitely scrutinise the "web filter". What is it? Does it or can it made to show active connections, denied ones etc?

[link470]

I thought so!

I had a similar problem on Friday with two computers that would not load anything in a web browser. We also use AVG 8.0 Network Edition.
I spent ages trying to work out why. I still don't understand why it only affected those 2. Other computers had the latest MS and AVG updates before those computers.

Anyway, to get it to work I had to disable the Web Shield component in AVG. If you find a better solution, let me know.

AVG also won't update though. One of our servers that's affected is the AVG Admin server, and it can't even pull down updates.

[link470]

Other protocols work & HTTP doesn't... I would definitely scrutinise the "web filter". What is it? Does it or can it made to show active connections, denied ones etc?

That's a good call too, however I don't think it's the Web Filter. We run the Barracuda Web Filter 310, and we would normally get a different page if the connection was blocked. AVG Admin still won't connect to AVG for updates, and the website seems to be working fine from outside.

Still very stumped. I've tried restarting the firewall too, we run Smoothwall Express 3.0.


EDIT:

Wow, so that was it. I uninstalled completely AVG 8 Network Edition, and after restarting the servers after school, everything was back up and running. What a strange issue. I'm still wondering whether or not it was actually caused by the critical security update Microsoft released on Friday October 24th or if it was due to something else, that maybe AVG did with their updates. I'm not sure, but whatever it is I hope it's fixed soon! I haven't tried installing AVG 8 Network Edition yet on the servers, I'm going to do that tonight and see if I'm successful. I don't want to leave them without AntiVirus for too long. The one thing I'm still puzzled about is that if it was AVG that caused the update, even AVG Admin couldn't access the internet for updates. I'm assuming because it's making a connection via HTTP to AVG's main update servers.

Anyway, thanks guys for your help! Special thanks to torry_loon for your advice on AVG 8 Network Edition. I'll post back here if I find anything out, and to let you know how the reinstall of AVG 8 went on the 4 affected servers.

[somabc]

I think there may be a problem under certain circumstances after applying MS08-067

This patch may not have been tested as much as we would like as MS were in a big rush to get it out once news broke?

MS08-067 (Issues?) in Windows Update