topic SandBlast Errors in Firewall and Security Management

SandBlast Errors

Hllrdm — Wed, 16 Mar 2022 07:45:57 GMT

We have encountered a problem with SandBlast TE250 equipment.
We have cases where letters from the MTA go to Bypass without waiting for a response from SandBlast. When such cases occur, we see the following errors in the ted.elg directory.

[TE (TD::Surprise)] te::Emulation::EmulationInvestigator::HandleFileEmulationFailed: {CA........} Failed to emulate file on image 'e........' (file status: VM assigned): Internal virtual sandbox communication error
[TE_TRACE]: {................} Run 3 for image: 'e50....' ended with verdict 'Error' (0 malicious runs, min:2), reason: Internal virtual sandbox communication error
[TE_TRACE]: {................} verdict 'Error' set for image: 'e50e...' (WinXP,Office 2003/7,Adobe 9) by: 1, reason: Internal virtual sandbox communication error
[TE_TRACE]: VM 272 KeyPoint: Terminating VM due to error: Failed to connect to SYMO client
[TE (TD::Surprise)] te::Emulation::EmulatingVM::TerminateWithError: VM 272 (Creation In Process): Terminating VM due to error: Failed to connect to SYMO client
[TE_TRACE]: VM 272 KeyPoint: Terminating (error occured? 1, detected events: 0 malicious, 0 benign)

We found similar sk120479 and sk135392, they don't fully correspond to our problem, but they are similar.
Both SKs say about TAS. Unfortunately our existing cases in TAS are going very long, so I would like to know if anyone has any experience with similar errors and how you can diagnose these errors?

Re: SandBlast Errors

G_W_Albrecht — Wed, 16 Mar 2022 08:33:30 GMT

TE250 is from Sep-2013 and out of any support since Jun-2020 !

Re: SandBlast Errors

Hllrdm — Wed, 16 Mar 2022 08:39:50 GMT

We did further analysis, similar problems also exist on other equipment that is fresher than 250.

Re: SandBlast Errors

G_W_Albrecht — Wed, 16 Mar 2022 08:47:02 GMT

sk114806: ATRG: Threat Emulation gives treoubleshooting help.

You should ask TAC to resolve the issue on other equipment that is still supported - not on the TE250 soon out of support for 2 years already...

Re: SandBlast Errors

Hllrdm — Wed, 16 Mar 2022 09:01:13 GMT

As I wrote earlier, while we do not see the point in contacting the TAC, as cases are delayed for a long time. I wrote this thread to find out if anyone had such a problem at SandBlast and how to solve it.

Re: SandBlast Errors

_Val_ — Wed, 16 Mar 2022 10:38:38 GMT

I am afraid, sometimes you do have to let TAC help you. There is always an option to escalate, if you believe you are not getting enough attention.

If you need any assistance, please feel free to PM me.