Strange OWA issue

[Simcfc73]

Hi,

 

Just wondered if anyone else has seen this before I delve into troubleshooting tomorrow.

 

Our OWA access (and outlook over seems to stop all of a sudden for external clients. I first thought it was Smoothwall and port forwarding but they looked art it and the traffic is going through fine.

 

Accessing emails timed out but I rebooted it tonight and it sprang back to life. its never failed inside the school just externally.

 

I haven't looked at the logs in anger yet, just curious if anyone has seen something similar.

[soapyfish]

I have a similar problem and we are also using Smoothwall and OWA 2010. From our investigation with Smoothwall it looks to be to do with the Smoothwall's arp table receiving an update for the OWA server that is wrong. If I reboot the OWA server it comes back to life for awhile maybe 30 mins maybe 12 hours then fails again from clients accessing from outside.

 

To get around this in the short term Smoothwall have setup a small script that refreshes the arp cache on a schedule, this is not a permanent fix but it is keeping things working at the moment

Edited February 22, 2016 by soapyfish

[Simcfc73]

Thanks for this, just contacted Smoothwall and they are looking into it but it looks like the engineer that did your fix didn't document what he did so mines been elevated to second line.

 

I actually thought it was Exchange as rebooting the SW didn't help, but I suppose if the ARP cache isn't cleared on reboot it will still be stuck.

[soapyfish]

It would be good if you could update us once this is fixed for you as it could help us achieve a permanent fix for the issue

[Simcfc73]

Still frustrated. I have uploaded a packet capture and the arp table logs to Smoothwall support to look at but still waiting for them to look at them. They said they didn't think it was them.

 

I need to do some reading up of the tcp logs as when I look at them in wireshark I am getting some error but need to know if they are the cause.

 

1769 23.711858 **.**.**.* *.*.*.* TCP 56 443 → 53195 [RST, ACK] Seq=1461 Ack=230 Win=0 Len=0

 

and

 

1777 23.749663 **.**.**.* *.*.*.* TCP 56 443 → 53195 [RST] Seq=1 Win=0 Len=0

[soapyfish]

Hi

I thought you might find the script that smoothwall have implemented on our box useful,

 

If you ssh to the smoothwall box in the following path

 

/etc/actions/cronhourlybyfour/

 

we have a file called cleararpscript

 

the contents of which is as follows

 

#!/bin/sh

date >> /var/log/arplogs1.txt

arp -n >> /var/log/arplogs1.txt

echo "----" >>/var/log/arplogs1.txt

ip neigh flush all

 

We currently have this running on a schedule using crontab and so far this has keep things working although the base problem is still present.

 

I also have been using the following command by hand which also fixes although you would need to run this each time the problem occurs

 

ip neigh flush all

Edited February 25, 2016 by soapyfish
Grammar

[soapyfish]

Did you get any further with this ?

[Simcfc73]

Nope, nothing yet. Have sent a few dumps to them but they haven't found anything.

 

I am starting to wonder if its something else, just put EST on my server so wondered if that breaks something.

[Simcfc73]

This is happening to another server too which is running Magellan (Gucamole) so I don't think its a Exchange issue which is even more baffling.

 

Smoothwall have had loads of packet captures and found nothing wrong, I've ploughed through the event logs and found nothing.

 

So logically, if I cannot connect from home on my WIFI to certain school servers its my broadband... except other users are having the same issues.

 

On my phone I can try connecting to school via the WIFI and it fails... I switch to 4G and it whizzes through.

 

I've not worked out how to tracert using my phone as I wanted to see if they go the same route. Rebooting the SW box doesn't help and I can see the traffic hitting the logs.

 

I have paid for additional static IPs to go on my secondary Fibre line so I can test that and I turned off the BT modems for 10 minutes this morning to clear them up.

 

If I had hair it would be pulled out by now as I am baffled.

[soapyfish]

When the problem occurs have you tried running the following command in a terminal on the smoothwall box, ip neigh flush all

When I had this issue it fixed it for a short period and suggests that the issue is the smoothwall box,

[Simcfc73]

I'll try it tonight, the guacamole server hasn't worked for me since Edinburgh (huge coinkydink)