Server Management - Systems Insight Manager
cancel
Showing results for 
Search instead for 
Did you mean: 

Version Control / Firewall Issues

 
Tobie Joeckel
Occasional Contributor

Version Control / Firewall Issues

I have several boxes in a DMZ that I'm trying to get configured to work with my CMS/VC server that's outside the firewall (trusted corp cloud). SIM monitoring works, I can access the SMH on the managed boxes, but I am unable to configure VC on the clients. When I try to configure the client, it says the repository is invalid or unreachable. I have the firewall setup as the doc states...

CMS/VC > DMZ tcp:80
CMS/VC > DMZ tcp:2301
CMS/VC > DMZ tcp:2381
CMS/VC > DMZ udp:161
DMZ > CMS/VC tcp 2381
DMZ > CMS/VC tcp:80
CMS/VC > DMZ tcp:22

I have run Netmon while on SMH and trying to configure the repository...all that port info is valid, tho Netmon also shows DMZ trying to comm back to CMS/VC on 2301 as well, which I don't see in the white papers. Can I get validation that this is correct, and is there any supporting documentation on this? Thanks!
5 REPLIES
NJK-Work
Honored Contributor

Re: Version Control / Firewall Issues

From what I recall, we need to set up ports to be open in BOTH directions, which it looks like you have already done. From your list, the only that is missing is:

DMZ > CMS/VC tcp 2301

Might be worth a try to allow that port open from DMZ to VC as well, just to eliminate it as a possibility. And who knows - you might get lucky and it will be the fix.

Nelson
Tobie Joeckel
Occasional Contributor

Re: Version Control / Firewall Issues

I'm sure you're right; it's needs both ways on 2301, as proven by my netmon while doing it. I wish I could make the change, but unfortunately, I don't own the firewall and in order to get the change in, I need documentation to support the change. Every HP doc I've seen on managing it through the firewall shows 2301 unidirectional only from CMS to DMZ. I called HP, asked them to send me updated white paper and it still shows uni...I asked them to update it with bidirectional...waiting to hear back. Thanks!
Ralph Frampton
Frequent Advisor

Re: Version Control / Firewall Issues

Are the DMZ servers using the same DNS servers as the internal ones?

If not, the verify you have proper name resolution for the CMS/VCRM server if you've configured the VCA to contact it by host name. If the DMZ servers are in a different domain then you may also have to specify the FQDN & not just the CMS host name.

Is the VCA account name correct? If it's a domain name then you must include that as well (eg. myCMSdomain\myCMSVCaccount) otherwise it will be attempted as a local account on CMS/VCRM server which will result in the same type message you've mentioned.
Ralph Frampton
Frequent Advisor

Re: Version Control / Firewall Issues

BTW, SysInternals Process Explorer is a useful tool to observe what ports & protocol are used.

On DMZ side, select vcagent.exe properties, TCP/IP tab

On CMS/VCRM side, the VCA traffic is proxied through the SMH web ports so select the child hpsmhd.exe process properties (the parent one is monitoring http & https & forwards VCA traffic etc. to it), TCP/IP tab

I believe the 2301 traffic you are seeing from the DMZ is for the backward compatibility mode & from what I've observed in troubleshooting my CMS/VCRM/VCA issue today the VCA is only using https. FYI, My problem was resolved once I realized that the login account setup was not correctly using the required domain name.
Ralph Frampton
Frequent Advisor

Re: Version Control / Firewall Issues

Speaking of login accounts, are you sure that the login credentials used are correct (ie. is the password case-sensitive & entered correctly)? This could be another reason for not being granted access to CMS VCRM.