Version Control through firewalls ?

[Mikael Rönnbäck]

I have been trying to set up Version Control through one of our internal firewalls.
The manual states :

"Version Control. This discussion is based on the assumption that the Version Control Repository (VCR) is behind the firewall with CMS, and likely on the CMS. Discovering the software available on the managed system requires SNMP over port 161. After receiving a command to update some component, the system must retrieve the component from the VCR, which it does using HTTPS over port 2381 to the VCR. To communicate its update status back to the CMS, the agent uses HTTP over port 80"

I have been allowed these ports opened between the specific nodes and the CMS with VC repository, and after that status works perfect on the nodes, in addition SIM detects and displays status fine, except that you cannot click on its links to be taken to the server homepage. Seems natural in a secure environment.

However, from neither place can I get downloads to work, i.e. if a server status is that several components are outdated I am still unable to retrieve the update as the downloads don't seem to be permitted.

I have asked our firewall team for a trace of this, but I wanted to ask if anyone's done this setup yet and already know what ports are missing from the documentation ?

[Mikael Rönnbäck]

I think I have found out the problem, the documentation states that all communication takes place over https port 2381, while in fact only the initial communication goes that way, once connection is established (I assume user/password auth.) the agent switches over to http port 2301, i.e. the settings from the "old" vcagent, before it started to use https some versions ago... :)

I have requested our firewall team to approve opening this port for me for a test machine and if accepted I will then have confirmation of this. Just thought I'd make a note of it in case anyone else should be trying to do the same thing with firewalls.

[James D. Young]

This document is exactly what you need. It has all the issues with working thru firewalls with HP System Insight Manager.

http://h200001.www2.hp.com/bc/docs/support/SupportManual/c00210041/c00210041.pdf

[Mikael Rönnbäck]

Thanks, but that is actually the document I was referring to, in its previous version it stated (see page 9)

"Discovering the software available on the managed system requires SNMP over port 161. After receiving a command to update some component, the system must retrieve the component from the VCR, which it does using HTTPS over port 2381 to the VCR. To communicate its update status back to the CMS, the agent uses HTTP over port 80. Additionally, the CMS polls the system for its status every 15 minutes for up to 2 hours."

I.e. no mention of port 2301, only port 2381 and port 80 (incl. snmp port 161)
The version you point me to seems to be slightly updated, as it now says

"Discovering the software available on the managed system requires SNMP over port 161. After receiving a command to update some component, the system must retrieve the component from the VCR, which it does using HTTPS over port 2381 to the VCR. To communicate its update status back to the CMS, the agent uses HTTP over port 280. Additionally, the CMS polls the system for its status every 15 minutes for up to 2 hours."

I.e. the change is from port 80 to port 280, still no use of port 2301, which our firewall logs/traces show us the server is attemtping to use.

Meaning that I'm now only more confused, since we do have traffic on port 2381, port 80 and port 2301, the old document could just have missed port 2301, but now the new one states another port which is not in use and still does not mention the one used.
I guess I'll just wait for our firewall logs for a conclusion instead, since I trust neither of the documented versions to be complete ;-)

[James D. Young]

Page 8 shows 2301 as being used for system identification for VC and RAS.

This is the document I used to comunicate with my servers in the DMZ. I am able to do everything i need thru my firewall with the ports listed on page 8.

[Mikael Rönnbäck]

Yes, well what I fail to understand in this is that system identification and version control inventory/status seemingly works fine without port 2301, i.e. with only snmp/161 and https/2381, it is only for actual download of new drivers that I really need http/2301.

I may be interpreting this wrong, as English is not my native language (you'd never guess from the non-english characters in my name... ;-P) but the way I read the information on page 8 was that port 2301 was required for identification (especially since id. worked with just 2381), and version control used its own separate port, but I may be wrong there, and either way, since it now works in our test setup using snmp, http/80,2301 and https/2381, I'll just assume I have misinterpreted the manuals intentions.

[David Claypool]

2301 is a valid discovery port; it was used by earlier agents for Windows that did not support SSL and current versions that also do not support SSL such as agents for NetWare, SCO, OpenVMS, etc.

[Mikael Rönnbäck]

Yes, I know that, but my point here is that I am using the newest agents, they are configured for trust by name or trust by cert, they contact HP SIM 4.1 (not 4.2 yet...) and they will only get status when using https/2381, they will NOT retrieve any updates, as this still runs on http/2301, and I can find no setting to reconfigure this to only use https/2381 for downloads as well as for status ?