Xserve blocks all ports after reboot - Firewall related

Question

Level 1

18 points

Xserve blocks all ports after reboot - Firewall related

So I have two Xserves that love to just decide that upon rebooting, they will block their external ethernet port as well as their fiber ports after rebooting.

I can confirm this is a firewall bug because the problem is fixed when I do a "sudo serveradmin stop ipfilter" and reboot, and keeping the firewall off prevents the issue entirely.

Now of course this isn't safe and I want the firewall on all the time.

How do I fix this? I have noticed this bug persists even after a total clean reinstall of OSX Server.

Intel Xserve 2011, Mac OS X (10.6.6)

Posted on Oct 20, 2011 7:09 AM

Reply

Answer 1

Oct 20, 2011 9:14 AM in response to evets90

If this is two systems and involves a disk wipe and install hasn't cured it, then this is usually not the servers, but something else on the network that's common. Though I don't have a way to explain all of what you're describing, and particularly the effects on the "fiber ports". This effects the fibre channel (optical) SAN ports? That's definitely odd. What happens? Or do you have fiber-optic network connections?

How are you testing for blocked ports here? Using dig and ping and related tools, or using a higher-level application?

I have seen cases where some firewall process goes nuts and clogs up a server. But that's not usually both servers.

Check the server logs for any related details, and see if there are any rogue CPU-bound processes.

And check the local area network for problems with DNS services, with errors with IP routing, with errors around subnet routing configuration (use unique IP addresses in distinct subnets for both controllers, unless you're using link aggregation), etc.

Reply

Answer 2

evets90 Author

Level 1

18 points

Oct 20, 2011 12:56 PM in response to MrHoffman

I have duplicated the settings from the old G5 Xserve on the two Intel Xserves, and the G5 never had this issue. The Intel Xserves are hooked up directly to our university's ethernet (in the wall in the office) without any switches. We have an Xsan volume, yes, and when I say fiber ports, we can't get any sign of life form the Xsan volume when we first reboot with the firewall on.

I'm not convinced it's a DNS issue nor a networking issue as everything else works fine and the G5 never had this problem.

Reply

Answer 3

Oct 20, 2011 6:05 PM in response to evets90

'Trust, but verify', as that famous old Russion proverb states.

A Fibre Channel SAN does not itself run IP. It uses its own SCSI-based protocols. If you're not making connections to whatever storage controller(s) are in use on the SAN, then definitely check the SAN settings (as some controllers can filter and select and permit access based on WWID/UUID values), and see if you're having issues connecting to the metadata controllers (if this box isn't the metadata controller).

If you're connected to a university network, then you're probably on a managed network, and if you're on a managed network, you should assume that the switches are actively hostile and configured to prevent your access until proven otherwise. Check that any media access control (MAC) hardware address registrations match any expectations set on the switches or the DHCP servers, check that you have static IP addresses in different subnets, and verify your DNS services.

Reply