Troubleshooting Private Access Connections

Last updated
Save as PDF

Prerequisites for deploying Connectors

Provisioning Key - Copy the text string generated from the connector group from the Skyhigh Security UI (User Interface) and supply it as a parameter to the deployment script (infra.sh).
Proxy information - If you use a proxy server, then make sure to bypass the IP address of the proxy server along with certain domains. For the list of domains, see Deploy Connectors.
Gateway IP - Choose the nearest Gateway IP so that Connector establishes a secure tunnel with the private applications through Client Proxy. This is supplied as a parameter to the deployment script. Please refer to the product guide for list of Gateway URLs.

For information about deploying connectors, see Deploy Connectors.

Troubleshooting connectors

System DNS (Domain Name Service) resolve a URL

For a Connector to function, the system DNS should be able to resolve both Skyhigh Security URLs and Private Application URLs.

Perform the following to check if the system DNS is resolving both Skyhigh Security and Private Application URLs:

Log on to connector host as a privileged account (root user) using SSH (Secure Shell).

Execute the pa_connector.sh and enter 3.
Enter the domain name.

Restart connector services

Perform the following to restart all services that run in a connector:

Log on to connector host as a privileged account (root user) using SSH.

Execute the pa_connector.sh and enter 4.

Test the HTTP proxy set

Perform the following to test if a private application is reachable through a Connector:

Log on to connector host as a privileged account (root user) using SSH.

Execute the pa_connector.sh and enter 5.
Enter the URL
Displays the connection established message if the private application is reachable.

Test the system proxy

The Cloud API (Application Programming Interface) URLs are accessed through the system proxy.

Perform the following to test the system proxy, and verify that it is passed as HTTP_PROXY to a Connector:

Log on to connector host as a privileged account (root user) using SSH.
Execute the pa_connector.sh and enter 6.
Enter the URL to test the system proxy.
Works only when HTTP_PROXY is set.

Log collection

Collects logs, configuration, and state of processes, and generates /tmp/connector_state.tar.gz

Log on to connector host as a privileged account (root user) using SSH.
Execute the pa_connector.sh and enter 7.
You will find the archive file in/tmp/ once the command is executed completely.
Upload the latest file connector_state_currentdate_time.tar.gz to the support portal for review.

Stop a connector

Log on to connector host as a privileged account (root user) using SSH.
Execute the pa_connector.sh and enter 8.

Start a connector

Log on to connector host as a privileged account (root user) using SSH.
Execute the pa_connector.sh and enter 9.

Tips

Get the Private Access connector pod name using sudo kubectl get pods -n cwpp
To log into the pod, run sudo kubectl exec -ti <pod_name> -n cwpp -- bash
To install a connector again on the same VM (Virtual Machines), then run the following commands:
- sudo rm -rf /opt/McAfee/
- snap remove microk8s
To bring up the VPN (Virtual Private Network) tunnel : Tunnels are created between the connector and Private Access Gateway.
- Run ifconfig to check if the tunnels tun0 and tun1 are created with an IP address 10.8.0.x.
- Check /mcafee/mount/logs/postRegistration.log and /mcafee/mount/logs/openvpn_client.log
Monitor Health Updates: Check/mcafee/mount/logs/healthUpdate.log to ensure that the VPN tunnel is up. The health update requires the list of private applications monitored by the connector. So, check if the private application list sync is successful and /mcafee/private_apps.json is present.
Proxy to private applications: Check/mcafee/mount/logs/debug.log to ensure that an application is reachable and not blocked by the policy. Ensure that the DNS configured on the connector can access private applications and resolve their URLs.

Workaround - common errors

Task	When	Error	Workaround
Connector Registration	Entered incorrect provision key	Incorrect provision key Error decoding the provisioning key	Check the`/mcafee/mount/logs/postRegistration.log` for incorrect provision key and copy the correct provision key from Skyhigh Security UI and provide it to`infra.sh` while deploying a connector.
	Expired/Invalid client credentials	Exception while refreshing access token	Download the new connector package from Skyhigh Security UI and ensure that right provisioning key is used.
	Connection to registration endpoint	Connection to registration endpoint - failed	Check whether McAfee Cloud API reachable Check the existence of tun0 and tun1
Bringing up the VPN tunnel	GW or HTTP_PROXY are not reachable	Error while resolving hostname Exception while checking Proxy Exception while checking PA Gateway Unable to connect to Proxy Unable to connect to PA Gateway	Connector maintains an outbound VPN tunnel with PA Gateway. Run `ifconfig` to check `tun` adapter and the IP address assigned by the Private Access Gateway. Check whether the gateway port 443 provided to `infra.sh` is reachable from the connector.
Private Application list sync		Error: - Exception connecting to https://api.wgcs.mcafee-cloud.com/pa/v1/connector-registration: HTTPSConnectionPool(host='api.wgcs.mcafee-cloud.com paList-Sync Failed	Check the `/mcafee/mount/logs/paListsync.log` if McAfee cloud API is not reachable. If this is not reachable, then ensure it is reachable to synchronize the private application list with the connector.
Accessing Private Application	Able to access Private Application using Firefox browser, but failed to access the same application on the Chrome browser	Google Chrome - Taking Too Long to Load	Disable the Use secure DNS option on Google Chrome. The Use secure DNS option should be disabled to access the private applications. Go to Chrome browser > Settings > Privacy and Security > Disable the Use Secure DNS option.