Cannot Play YouTube Videos on VodaFone iPhone - Cannot Play Back Not Supported

iPhone - iPhone

Issue

You may find that if you have a iPhone with Vodaphone that when you try and play a video from within YouTube you receive the error :      

           "Cannot Play Back Not Supported"

You may also encounter issues with other apps such as the inbuilt weather app.

Please Note : You may also find that you can access YouTube videos through you iPhone when connected to WiFi.

Cause / Solution

This is down to Vodafone enforcing something called a "content bar". This restriction prevents the playback of YouTube videos on your iPhone via 3G. In order to remove this you will need to :

1. Contact Vodafone and request they turn off "content bar" on your account.
2. They will then send you a message to say that this has been removed.
3. Once you have the message reboot you phone by holding down the top button and sliding the bar on your screen to power off the phone.
4. Hold down the top button to then power the phone back on.
5. You should now be able to view YouTube videos.

ASA L2L VPN is not passing traffic when a VPN Filter is applied

Firewalls - Cisco - ASA

Within the Cisco Adaptive Security Appliance Software Version 8.2(2) you may find that when you have a group-policy (vpn filter) applied to your tunnel group that some traffic is not being allowed through the VPN.

This is a bug with 8.2(2) for which to resolve the issue you will need add the destination ports to the group-policies access-list. 

Examples

Your previous access-list entry for your group-policy may of look liked this :

access-list ACL_Filter extended permit ip object-group Local-LAN object-group Remote-LAN

Below is an example of the config that you would need to add in order to get traffic working which is being affected by this bug,

ASA(config)# object-group service Ports
ASA(config)# service-object icmp echo
ASA(config)# service-object icmp echo-reply
ASA(config)# service-object tcp range 4060 6700
ASA(config)# service-object udp range 4060 6700
 
ASA(config)# access-list ACL_Filter extended permit object-group Ports object-group Local-LAN object-group Remote-LAN
ASA(config)# no access-list ACL_Filter extended permit ip  object-group Local-LAN object-group Remote-LAN

Below is an example of the complete config. Please note this only includes the complete config for the group-policy and the relevant tunnel group and not the vpn configuration) :

object-group service Ports 
 service-object icmp echo
 service-object icmp echo-reply
 service-object tcp range 4060 6700
 service-object udp range 4060 6700

access-list ACL_Filter extended permit object-group Ports object-group Local-LAN object-group Remote-LAN
access-list ACL_Filter extended permit ip  object-group Local-LAN2 object-group Remote-LAN2
access-list ACL_Filter extended deny ip any any 

group-policy Example_Policy internal
group-policy Example_Policy attributes
  vpn-filter value ACL_Filter
      default-group-policy VPN_Filter

tunnel-group [Peer IP] general-attributes
  default-group-policy VPN_Filter

Please Note : If this does not resolve your issue please refer to the Cisco Bug Tracker. This is just one of a number of bugs included within the vpn filter feature.

Endpoint Connect Installation / Troubleshooting Guide

Firewalls - Checkpoint

What is EndPoint Connect ?

Checkpoint`s Endpoint Connect software provides a number of client side security based features such as Anti-virus/Anti-spyware. Firewall/Email Protection, Program Control and Remote Access VPN. This document will only details and discuss the Remote Access VPN section of the Endpoint Connect Software. Note : This document will refer to the Endpoint Connect Remote Access VPN as just Endpoint Connect.

Endpoint Connect is built into the software for mangers and gateways running R70 and above. For R65 gateways that require Endpoint Connect a few additional configuration steps are required which are included within this document.

Advantages

• Lightweight Client if you are using a single site or single entry point setup.
• Can be installed onto Windows 7 64-bit.

Disadvantages

• An additional SNX (SSL Network Extender License) is required due to that in which it authenticates across HTTPS (vistor mode)
• Link Selection is disabled (this is due to sites being defined via a single IP address).
• MEP configurations can only be achieved by using Geo-Cluster DNS name resolution.

Installation on an R65 Gateway

Upgrading a R65 Gateway to R65 Endpoint Connect:

1. Ensure that you are running HFA40 or higher.
2. Ensure that you are managing the gateway with R70 or higher.

You will now be able to configure the require Endpoint Connect settings via the Smart Dashboard.

Configuration

To enable Endpoint Connect configure/enable the following settings :

Under the Checkpoint Gateway Object

1. Enable VPN

2. Create a VPN domain

3. Enable NAT-T

4. Enable Visitor Mode :

5. Enable Office mode

6. Enable SSL Network Extender

7. Endpoint connect doesn`t support DES. If this is set please re-configure.

Additional Settings

Further settings can be set within the Global Properties:

Troubleshooting

Issue : Authenticating failed: GEN_application_error(0)

You may receive this error when trying to login.

This is down to your client being unable to authenticate with the VPN gateway using HTTPS. This can be caused by the following:

            1.      Port 443/tcp on the firewall is assigned to a web management GUI (WEBUI/Voyuger) instead of VPND.
            2.      Port 443/tcp is not listening due to no SNX (SSL Network Extender) License being present.

Issue : Failed to download topology

Endpoint Connect fails to connect to NGX R65 Security Gateways that are managed by an R70 Security Management server with error: "failed to download topology".

/opt/CPNGXCMP-R70/lib/vpn_table.def

/* Slim Client gateway tables */

ccc_sessions            = dynamic expires 900 keep sync kbuf 1;

Further details can be found within the Checkpoint KB article sk43124

Licensing

Details on licensing can be found within Checkpoints KB article sk43329.

Checkpoint Web Visualization only provides part of the policy

Firewalls - Checkpoint

When using the Checkpoint Web Visualization tool and trying to obtain the policy for a Cluster object you may receive one of the following errors/issues :

1. The policy is saved as an .html file but it is only showing part of the policy.
2. You receive one of the following errors when running the Web Visualization syntax:

Querying tables...

Error Reason: Inconsistency problem: table communities is not recognized by serv
er.

An error occurred while synchronizing with server tables.

        1 file(s) copied.
        1 file(s) copied.

XSLT warning: Fatal Error at (file <unknown>, line 0, column 0): An exception oc
curred! Type:RuntimeException, Message:The primary document entity could not be
opened. Id=file:///d:/temp/temp/Security_Policy.xml (, line -1, column -1)

Querying tables...

Failed to open DB.
Error Reason: A disk error occurred during a read operation

Failed to get data from the management server "10.18.10.6"!

Solution

To resolve the issue use the cluster object name rather then the individual cluster node name when using the Web Visualization command. An example would be :

C:\Program Files\CheckPoint\SmartConsole\R65\PROGRAM>cpdb2html.bat . C:\temp\ [manager ip] [username] [pw] -o fw-policy.html -m [cluster object name]

Running a packet capture on a SourceFire Sensor

IDS - Snort / Sourcefire

Below shows you the required steps for running a packet capture on a SourceFire Sensor.

Which Interfaces are Sniffing ?

First of all we get a list of interfaces that is are sniffing for malicious traffic. Note : the fps normally relate to eth. Though you still use the fps reference within the tcpdump.

ps -ef | grep snort | grep fp | awk -F -i ' { print $2 } ' | awk '{print $1}' | head -n1

Tcpdump the Interface

Using the interface numbers output from the last command you can now use these to run a tcpdump.

root@3d:/#tcpdump -ni <interface>

root@3d:/#tcpdump -ni fp2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
 listening on fp2, link-type EN10MB (Ethernet), capture size 68 bytes
 15:35:51.477839 802.1d config 8001.00:15:13:de:a9:80.8001 root 8001.00:15:a3:ee:h5:80 pathcost 0 age 0 max 20 hello 2 fdelay 15 

We can also get an overview of the traffic by running the following command,

root@3d:/# watch 'netstat -ani'