FVS336G v2 Locks up with printed report

[tjwhitejr]

This one has me cpmpletely baffled. I have a FVS336G v2 - latest firmware 3.0.7-24 and it is a pretty simple setup. One VPN tunnel to our corporate office, a dozen or so users.

When we print a report, just a common, ordinary sales report, the router locks up. No VPN access, no internet access. Must reboot the router and it works again - until we print the report. Other reports work just fine. This one is only about 7 pages.

This router will run fine for days until this report is printed.

I changed out the router with a second one, same results.

There seems to be some control code in this printed report job that is locking up the router. I can recreate this at will.

Tried a brand new printer, different IP address and cable. Same lockup. The print job runs through the VPN. I unchecked everything except ping under Attack Checks.

Could it be something with the encryption? Has anyone seen this before?

[hynt20]

Just for clarification, are you trying to print the report across the VPN tunnel to a remote printer at the office?

How big is the report, is it a specific format type? Does it have large graphics?
does the firewall simply stop responding and you have to power off/on or can you restart from the UI?

[jmizoguchi]

Make sure to use MTU value of 1430.

Usually large file transfer or even spool size large will cause bu he MTU values and lock up the tunnel

[tjwhitejr]

Thanks.

Just changed it. Will see what happens tomorrow!

[tjwhitejr]

It is about a 5 page print job. All text. No graphics. Unix server remote print job. Server is at one end of the VPN and the printer is at the other. We have cable modem and there is a ton of bandwidth available. I am thinking it may have some old Unix printer control codes buried in there that are messing with the encryption. I changed it from the default (MD5???) to AES-128. Our server sessions are via Telnet - old school. I could (and have) run this on dialup. I can print other reports, longer ones. It is something about this report. Happens every time. I had a FVS338 on there and a storm took it out, so I had to go to the 336G.

Just odd.

[jmizoguchi]

I changed it from the default (MD5???) to AES-128.

usually MD5 or SHA-1

and


usually AES-128 or DES, 3DES, AES-256

[tjwhitejr]

Changed 3DES to AES-128. Also changed the MTU to 1430. Had them run the report for the last several days and they all printed fine.

I am not sure which resolved the problem, but have a couple of routers (various Netgears) that absolutely will not VPN with 3DES. AES-128 is fine.

The VPN Wizard uses 3DES as the default.

I had a similar unexplained lockup occurring with the 336 at a remote office in Chesapeake, VA - about 100 miles away. It worked fine for several days at a time, then locked up. At the time, I had a FVS-338 as a spare and when I replaced the 336 with the 338, the problem went away.

A storm took out the 338 I had at the location in Richmond, VA - where I am located, and I ordered a couple more, but could only get the 336's. When I replaced the dead 338 with the 336, I had the same lockup problem, but this was the unit I pulled out of Chesapeake and was the only "working" box I had until my order arrived. When I replaced the "bad" 336 with a new one, I still had the lockup problem. As this site is local, I spent a lot of time at this site and found out that every time a certain report was printed, the 336 locked up requiring a power off reset.

I imagine a similar situation was happening in Chesapeake, but I had not connected the print job to the outage.

I also have a 336 installed in Yorktown and Williamsburg, but the reports are all most likely done by the Chesapeake office. I am going to make the MTU and AES-128 change to those as well.

Odd that 3DES and default MTU size work on the FVS-338 but not on the 336. All of them have the latest available software load.

I was beginning to think the 336's were all buggy. I have been using Netgear VPN's for nearly 9 years and have been through some really cranky and buggy software. Especially the earlier releases for the FVS-538, which is doing OK now with 3.0.6-29. I think I will leave the FVX alone.

Thanks for the help on this. I will make the AES-128 and MTU 1430 the default from now on.

[jmizoguchi]

I am not sure which resolved the problem, but have a couple of routers (various Netgears) that absolutely will not VPN with 3DES. AES-128 is fine.

I use AES-256 over 3des. AES is faster over 3DES.

post back if you have more issues

[adit]

Assuming you are dealing with a networked Line Printer, I discovered this bug last October in the UTM routers. We had a hell of a time (6 months) figuring it out (nothing in the logs or the packet captures).

The UTM firmware that fixed the issue was 1.3.8.3. The problem existed up until released version 1.3.7-0 and supposedly affected all 2.0.0-0 and above Netgear ProSafe firmwares.

The issue exists between the router and the LPR (Line Printer Remote) protocol. When certain documents are printed over a VPN it just locks the router up, usually in the beginning of the print job.

My print jobs were on the order of 4000 pages each. Once we got past the first 50 or so pages the problem would go away, until the next print job started. We are using networked OKI 4410 line printers.

The ProSafe (336) and the ProSecure (UTM's) use the same core firmware. I believe that the first core firmware with the fix is 3.0.7-30. I do not know if they have a beta firmware on this core for the 336G's.

The latest version I have for the 336Gv2 is 3.0.7-27 (and 3.0.7-24 for the 336Gv1), and they do not have the included fix.

You can contact support with this extra information and they may be able to provide additional assistance.

[tjwhitejr]

Adit;

Thank you for the response. I changed a couple of things and it has been working for about a week.

Until today.

I just got a call and found out they were printing the same report that has been killing it all along. I thought it was resolved, but I guess not.

I will contact support and see if there is any update for the 336G I can get my hands on. This sounds like the same problem and I really appreciate your taking the time to respond.