Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

IPS Rule 1000128 blocks the communication between Deep Security Manager and Control Manager

    • Updated:
    • 4 Jul 2016
    • Product/Version:
    • Deep Security 9.0
    • Platform:
    • CentOS 6 32-bit
    • CentOS 6 64-bit
    • IBM AIX 5.3
    • IBM AIX 6.1
    • Linux - Red Hat RHEL 5 32-bit
    • Linux - Red Hat RHEL 5 64-bit
    • Linux - Red Hat RHEL 6 32-bit
    • Linux - Red Hat RHEL 6 64-bit
    • Linux - SuSE 10
    • Linux - SuSE 10 64-bit
    • Linux - SuSE 11
    • Linux - SuSE 11 64-bit
    • N/A N/A
    • Ubuntu 10.04 64-bit
    • Ubuntu 12.04 64-bit
    • VMware ESXi 5.0
    • VMware ESXi 5.1
    • VMware ESXi 5.5
    • VMware vCenter 5.0
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Server R2
    • Windows 2008 Datacenter 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server R2
    • Windows 2008 Server R2 Datacenter
    • Windows 2008 Server R2 with Hyper-V(TM)
    • Windows 2012 Enterprise
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows 8 32-bit
    • Windows 8 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional 64-bit
    • Windows XP SP2 32-bit
    • Windows XP SP3 32-bit
Summary

When a computer is assigned with Intrusion Prevention Rule 1000128 "HTTP Protocol Decoding", the following known issues might be encountered:

  • Deep Security Manager (DSM) and Control Manager (TMCM) communication will be blocked.
  • The connection issued by WGET command will be blocked.

The DPI Rule "HTTP Protocol Decoding" is triggered for the HTTP POST request below:

POST /webservice/Manager HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Host: 172.21.4.194:4119
Accept: */*
Referrer:
SOAPAction: ""
Content-Length: 331
Content-Type: application/x-www-form-urlencoded

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:Manager">
<soapenv:Header/>
   <soapenv:Body>
      <urn:authenticate>
         <urn:username>masteradmin</urn:username>
         <urn:password>11111111</urn:password>
      </urn:authenticate>
   </soapenv:Body>
</soapenv:Envelope>

Since "\x0A" (new line character) is included in the set of illegal characters, the rule is triggered at the end of pattern "urn:Manager".

Details
Public

To resolve the issue, do any of the following:

  • Create a bypass rule between DSM and TMCM.
  • On the Properties page of IPS Rule 1000128 HTTP Protocol Decoding, go to the Configuration tab and untick Use URI Normalization in body of HTTP POST.

    Use URI Normalization in body of HTTP POST

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1104051
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.