Smoothwall IPSEC browsing to a printer on another subnet

[chrisjako]

We have 2 smoothwall boxes setup on IPSEC to talk to each other

 

I can ping devices from site A to site B but i have a printer on site B which doesnt load the web gui from a workstation on site A, it does load from site B directly workstations

 

Firewall for IPSEC on both smoothwall boxs is set to allow anything inbound and outbound to the IPSEC interfaces

 

Any suggestions as to why web browsing devices is getting blocked?

 

What i have found so far

 

- Wireshark suggests there is packet loss

- Setting the client internet options to manual proxy on port 8081 works - however this isn't a viable resolution

- Smoothwall itself returns the correct GUI pages when using putty to test

[MatthewL]

Remove the proxy set does it work?

[chrisjako]

Remove the proxy set does it work?

 

No, when I remove the manual proxy setting from client on site A, it cannot connect to the printer gui on site B

[SchoolsBroadband]

are there some DNS lookups going wrong somewhere?

[chrisjako]

are there some DNS lookups going wrong somewhere?

 

No, my DNS setup is golden with proper name servers, reverse zone and zone transfers configured - diagnostics have been run and its all fine

 

I've just run a port scan (from site A) to site B printer and it finds tcp 21,80,443,515,631 also returning back the DNS name from the IP scan

 

The GUI i'm trying to access from site A is the IP anyway, not the DNS name, neither work regardless

 

waiting for the day end now so I can plug a laptop directly into my main Smoothwall lan interface to remove any of the procurve switches we use out of the equation

[ibpalle]

That does sound weird - the VPN is obviously working but having to use the proxy in order to access the device on network B is odd. Is the port number used when using http(s) non-standard?

[chrisjako]

That does sound weird - the VPN is obviously working but having to use the proxy in order to access the device on network B is odd. Is the port number used when using http(s) non-standard?

 

In this instance, its just https with no port however, I can connect to our 3CX server from site A to B which uses https 5001 and also unifi controller using https 8443

[chrisjako]

Update: After 38 hours of having my head buried in this issue, a simple out of hours restart of site B smoothwall box fixed the problem - still don't know what the underlying issue was but at least i know my configuration was correct

 

My smoothwall fanboy karma score died a little today

[tom_newton]

Could have been an ARP cache issue I guess? "Random fix on reboot" is often that

[chrisjako]

Yes my thoughts where only entries on the ARP cache where working, nothing new could resolve though - I've asked SW to dig into the logs however no response so far