Version Control / Firewall Issues

[Tobie Joeckel]

I have several boxes in a DMZ that I'm trying to get configured to work with my CMS/VC server that's outside the firewall (trusted corp cloud). SIM monitoring works, I can access the SMH on the managed boxes, but I am unable to configure VC on the clients. When I try to configure the client, it says the repository is invalid or unreachable. I have the firewall setup as the doc states...

CMS/VC > DMZ tcp:80
CMS/VC > DMZ tcp:2301
CMS/VC > DMZ tcp:2381
CMS/VC > DMZ udp:161
DMZ > CMS/VC tcp 2381
DMZ > CMS/VC tcp:80
CMS/VC > DMZ tcp:22

I have run Netmon while on SMH and trying to configure the repository...all that port info is valid, tho Netmon also shows DMZ trying to comm back to CMS/VC on 2301 as well, which I don't see in the white papers. Can I get validation that this is correct, and is there any supporting documentation on this? Thanks!

[NJK-Work]

From what I recall, we need to set up ports to be open in BOTH directions, which it looks like you have already done. From your list, the only that is missing is:

DMZ > CMS/VC tcp 2301

Might be worth a try to allow that port open from DMZ to VC as well, just to eliminate it as a possibility. And who knows - you might get lucky and it will be the fix.

Nelson

[Tobie Joeckel]

I'm sure you're right; it's needs both ways on 2301, as proven by my netmon while doing it. I wish I could make the change, but unfortunately, I don't own the firewall and in order to get the change in, I need documentation to support the change. Every HP doc I've seen on managing it through the firewall shows 2301 unidirectional only from CMS to DMZ. I called HP, asked them to send me updated white paper and it still shows uni...I asked them to update it with bidirectional...waiting to hear back. Thanks!

[Ralph Frampton]

Are the DMZ servers using the same DNS servers as the internal ones?

If not, the verify you have proper name resolution for the CMS/VCRM server if you've configured the VCA to contact it by host name. If the DMZ servers are in a different domain then you may also have to specify the FQDN & not just the CMS host name.

Is the VCA account name correct? If it's a domain name then you must include that as well (eg. myCMSdomain\myCMSVCaccount) otherwise it will be attempted as a local account on CMS/VCRM server which will result in the same type message you've mentioned.

[Ralph Frampton]

BTW, SysInternals Process Explorer is a useful tool to observe what ports & protocol are used.

On DMZ side, select vcagent.exe properties, TCP/IP tab

On CMS/VCRM side, the VCA traffic is proxied through the SMH web ports so select the child hpsmhd.exe process properties (the parent one is monitoring http & https & forwards VCA traffic etc. to it), TCP/IP tab

I believe the 2301 traffic you are seeing from the DMZ is for the backward compatibility mode & from what I've observed in troubleshooting my CMS/VCRM/VCA issue today the VCA is only using https. FYI, My problem was resolved once I realized that the login account setup was not correctly using the required domain name.

[Ralph Frampton]

Speaking of login accounts, are you sure that the login credentials used are correct (ie. is the password case-sensitive & entered correctly)? This could be another reason for not being granted access to CMS VCRM.