There are no errors in the eWON logs to indicate any type of issue there.
I went over the PCAPs. The first one was very large and it showed traffic between 172.16.10.30 (FactoryTalk Server?) and 10.213.19.232 (Talk2M VPN Server), the second looks like more of the same but is very short, and the 3rd seems to be from another network because it shows a device (I assume it’s the laptop running Wireshark and eCatcher) connected to various device on the internet including a Talk2m VPN server. I’m not seeing any problems in them, but I’m not familiar with the FactoryTalk information and whether or not it’s correct. For example, this stream:
HMISERVICE.txt (66.2 KB)
I don’t see any errors, but I’m not sure what I’m looking for. I think this is something you will have to bring to Rockwell Support. It’s using DCOM so it’s can be hard to tell what is going on. Here are other streams that seem to be running concurrently:
FT_pcap_stream.txt (469.8 KB)
FT_pcap_stream-2.txt (17.5 KB)
That last one had some “spurious re-transmissions” which means packets that were already sent and ack’d were sent again fro some reason from the FT Server (or 172.16.10.30), but that shouldn’t be corrupting the configuration.
I think it’s possible that the configuration is getting corrupted during transport, but I’d have to see the errors from the FactoryTalk server or software to confirm. I’m not sure if there are settings in that software that may help. I would recommend contacting Rockwell support as well.