Rename Windows Computer

Plex Media Server
61

Should be mostly Ireland. That’s where big AWS datacenters are.

62

I think I have it narrowed down. DPI was intercepting the SSH over port 443 and interpreting it as non-HTTPS traffic, and dropping it. A long series of tests seem to validate that was a large part of the issue.

Last time it initially connected, then lost the long timeout connection after 2 hours and could not reconnect. So, going to let it bake for a couple hours and see if we made some progress.

As for the global connectivity, the FQDN filtering appears to not have stayed in-sync with the frequent/rapid AWS changes, so it was failing on that as well.

Still walking this in, but I think I have narrowed it down to those two things.

63

I was on to this yesterday, but the nuance is that PMS has to be recycled to clear the stale broken connections. At least it appears so. Without doing that, results are hit or miss. So yesterday, when I relaxed filtering and retried without recycling, the issue persisted. A red herring. I still have pretty tight inbound and outbound controls on now and things look good, so going to let it bake through a session reestablishment cycle or two (2-4 hours) and see if it stays healthy.

64

I believe the connection failures were primarily related to ssh over port 443. Combined with the rolling IPs for AWS/Linode and cache latency on my FW, it was a couple layers of issues that appeared to discredit the obvious. Not to mention the need to recycle PMS to reestablish the long duration connections after FW changes. I think that was the single biggest confusion.

Does make sense now. I plan to document well for the future.

Hope this thread helps others. Here are my lessons learned.

  1. PMS talks outside the US.

  2. PMS sends SSH traffic over port 443. Do not use DPI on outbound connections unless you define a special service object.

  3. PMS uses AWS, Linode and other shared/cloud service providers whose service endpoint DNS records update faster than your security software’s FQDN cache. FQDN filtering will be problematic.

  4. PMS service should be recycled after ANY connection change to reset the long duration connections and pickup the changes. Every time.

Follow those 4 rules and you should be good.

Really appreciate everyone’s time and input on this one. I think a lot of good came from this discussion and I hope it helps others in the future. You guys are the best !!!