ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to MrChuckles
Re: NIS shuts off printing- Beware of Live Update 5/9
Just an additional heads up. NIS is broken in more than one way with this latest update. As stated it is blocking the print servers. It is also not reacting correctly to scans. Didn't notice at first because my machines are behind a router. Put a machine outside the router and get a scan from one of the testing sites. NIS will ask to make rules for each port scanned rather than generating security alerts. |
|
MrChuckles
Say What?
Premium
join:2000-11-19
Westminster, MD | reply to ThreeD
Thanks for the tip. I will try that one out. |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to HolmanGT
Figured out a work around for now if you are interested. I installed Netbeui, this lets the print server show up in network. Then configured printers as network printers. Not using the redirector from Linksys this way and by using Netbeui, the communications slip under the firewall. Not a perfect situation but a workaround until Symantec gets their act together. |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to MrChuckles
said by MrChuckles:
said by ThreeD:
It seems to only effect XP.
Nope. It hit mine too..
2kPro & Linky 1 port print server
Aren't you lucky. First Win2K machine I have heard of that got hit. Guess Symantec better get with it and fix the problem. |
|
MrChuckles
Say What?
Premium
join:2000-11-19
Westminster, MD
 ·Comcast
| reply to ThreeD
said by ThreeD:
It seems to only effect XP.
Nope. It hit mine too..
2kPro & Linky 1 port print server
--
Maryland SETI |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to gt7697c
said by gt7697c:
I have a Linksys 3 port print server, Win 2k SP2 and NIS 2002 updated. No problems printing. Either they pulled the update before I got it, or I am just extremely lucky and NIS 2002 does not want to update.;)
But then my O/S doesn't have all the pretty makeup that XP has.:D
Edit
I know you may have already tried this but, Delete the rule for spoolsv.exe from the rule set. Then let NIS re-detect spoolsv.exe trying to access out. If it still doesn't work here is the rule from my rule set:
said by Spollsv.exe Rule:
Rule 59 Spooler SubSystem App
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Either
Application: (Spooler SubSystem App)
..........Path: c:\winnt\system32\spoolsv.exe
........Access: Permit All
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address
I would suggest that if you create the rule again that you move it up so that it is the first rule in the rule stack. Once it works then you can start moving it down.
If it was working before the update then maybe what you should do is uninstall the firewall and reinstall it if it still does not work. However, don't get the update that is blocking access to the print server.
HTH.:)
--
Just my 2 bits.
[text was edited by author 2002-05-11 02:06:30]
It seems to only effect XP.
On the rules I tried deleting and recreating the spooler rule. I also tried creating a rule in spot one of the stack that allowed everything, and I mean everything. No help.
On the third suggestion, yes I could reinstall it and not update. I could also uninstall NIS and try a different firewall, which is what I will be doing if they don't get it fixed soon.
[text was edited by author 2002-05-11 13:31:14]
[text was edited by author 2002-05-11 13:31:54] |
|
gt7697c
Premium
join:2001-02-16
The Hive
| reply to ThreeD
I have a Linksys 3 port print server, Win 2k SP2 and NIS 2002 updated. No problems printing. Either they pulled the update before I got it, or I am just extremely lucky and NIS 2002 does not want to update.;)
But then my O/S doesn't have all the pretty makeup that XP has.:D
Edit
I know you may have already tried this but, Delete the rule for spoolsv.exe from the rule set. Then let NIS re-detect spoolsv.exe trying to access out. If it still doesn't work here is the rule from my rule set:
said by Spollsv.exe Rule:
Rule 59 Spooler SubSystem App
Category: General
Rule in use: YES
Logging: NO
Protocol: TCP or UDP
Action: Permit
Direction: Either
Application: (Spooler SubSystem App)
..........Path: c:\winnt\system32\spoolsv.exe
........Access: Permit All
Local service: Any Service
Local Address: Any Address
Remote service: Any Service
Remote Address: Any Address
I would suggest that if you create the rule again that you move it up so that it is the first rule in the rule stack. Once it works then you can start moving it down.
If it was working before the update then maybe what you should do is uninstall the firewall and reinstall it if it still does not work. However, don't get the update that is blocking access to the print server.
HTH.:)
--
Just my 2 bits.
[text was edited by author 2002-05-11 02:06:30] |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to HolmanGT
said by holmanGT:
ThreeD,
Well just to one up-ya I tried it on three machines. Two with XP Pro and one with XP Home. Yup you guessed it now none of my machines can print while NIS is running.
Does this mean that I only have 2/3's of a problem??  |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to HolmanGT
said by holmanGT:
EmilioG,
What is your OS and what type of print server are you running?
[text was edited by author 2002-05-10 18:08:23]
Windows XP pro and printing to a Linksys EPSX3 print server. Problem seems to be Windows XP and several different print servers. I was over at Symantec and there are complaints from Netgear print server users as well.
I thought we were supposed to be able to trust our firewall software  |
|
EmilioG
Whats This?
Premium
join:2000-09-19
New York, NY
| reply to HolmanGT
said by holmanGT:
EmilioG,
What is your OS and what type of print server are you running?
[text was edited by author 2002-05-10 18:08:23]
Running one printer through the PC and one through an SMC Barricade routers built in print server.
Windows 2000 Pro
Windows ME
Windows 98se |
|
HolmanGT
Premium
join:2001-11-20
Saint George, UT
·Baja Broadband
| reply to ThreeD
ThreeD,
Well just to one up-ya I tried it on three machines. Two with XP Pro and one with XP Home. Yup you guessed it now none of my machines can print while NIS is running.
It just drives me crazy, I take so much care not to install anything that will upset XP and probably the second most trusted piece of software on my machines has done me in. |
|
HolmanGT
Premium
join:2001-11-20
Saint George, UT
| reply to ThreeD
EmilioG,
What is your OS and what type of print server are you running?
[text was edited by author 2002-05-10 18:08:23] |
|
EmilioG
Whats This?
Premium
join:2000-09-19
New York, NY |  reply to ThreeD
No problems printing here.
NIS 2002 Pro w/NAV.
2 Networked printers. |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
| reply to HolmanGT
It is the 5/9 update. Tried it on two machines with the exact same results. Both machines are XP pro.
Symantec needs to fix something quickly. It is something outside the rules because as I mentioned, putting a rule that allows everything in slot one should effectively shut off the firewall. It does not fix the printing problem. |
|
HolmanGT
Premium
join:2001-11-20
Saint George, UT
·Baja Broadband
| reply to ThreeD
I have the same problem. My system is Win XP Pro and my print server is a Netgear PS110.
Also I have messed with everthing in NIS and the only way to get my printing back is disable NIS.
Sure would like to find an answer to this one!
PS - I asked a friend to update his NIS and give it a try, he had no problem. He uses the same "Everthing" I have except his OS is Win 2K Pro. Go figure. |
|
ThreeD
join:2001-05-19
Southern Cal
clubs:
|  I just ran live update this evening and now I cannot print to any of my printers on a Linksys print server. I can still file share on the LAN but cannot print to the print server. NIS event log says:
Date: 5/9/2002 Time: 23:00:02
Rule "Implicit block rule" blocked (255.255.255.255,34443). Details:
Outbound UDP packet
Local address,service is (testbed(192.168.1.222),1077)
Remote address,service is (255.255.255.255,34443)
Process name is "C:\WINDOWS\system32\spoolsv.exe"
Printing works if I disable NIS or if I turn security down to lowest level (allow everything).
Everything else works as far as the web, etc.
I have a rule in NIS allowing the spoolersv.exe access but this does not help. I cannot find an Explicit rule that blocks this service. Anyone have any ideas?
Edit:
Just an update. I just put a rule in allowing everything tcp/udp in position 1 in the ruleset. NIS still blocks the printing. Send a job, it is blocked, disable NIS, job prints from queue.
[text was edited by author 2002-05-10 02:54:39] |
|
