Troubleshooting Private Access Connections
Prerequisites for deploying Connectors
-
Provisioning Key - Copy the text string generated from the connector group from the Skyhigh Security UI (User Interface) and supply it as a parameter to the deployment script (infra.sh).
-
Proxy information - If you use a proxy server, then make sure to bypass the IP address of the proxy server along with certain domains. For the list of domains, see Deploy Connectors.
-
Gateway IP - Choose the nearest Gateway IP so that Connector establishes a secure tunnel with the private applications through Client Proxy. This is supplied as a parameter to the deployment script. Please refer to the product guide for list of Gateway URLs.
For information about deploying connectors, see Deploy Connectors.
Troubleshooting connectors
System DNS (Domain Name Service) resolve a URL
For a Connector to function, the system DNS should be able to resolve both Skyhigh Security URLs and Private Application URLs.
Perform the following to check if the system DNS is resolving both Skyhigh Security and Private Application URLs:
-
Log on to connector host as a privileged account (root user) using SSH (Secure Shell).
-
Execute the
pa_connector.sh
and enter 3.
-
Enter the domain name.
Restart connector services
Perform the following to restart all services that run in a connector:
-
Log on to connector host as a privileged account (root user) using SSH.
-
Execute the
pa_connector.sh
and enter 4.
Test the HTTP proxy set
Perform the following to test if a private application is reachable through a Connector:
-
Log on to connector host as a privileged account (root user) using SSH.
-
Execute the
pa_connector.sh
and enter 5.
-
Enter the URL
Displays the connection established message if the private application is reachable.
Test the system proxy
The Cloud API (Application Programming Interface) URLs are accessed through the system proxy.
Perform the following to test the system proxy, and verify that it is passed as HTTP_PROXY to a Connector:
-
Log on to connector host as a privileged account (root user) using SSH.
-
Execute the
pa_connector.sh
and enter 6.
-
Enter the URL to test the system proxy.
Works only when HTTP_PROXY is set.
Log collection
Collects logs, configuration, and state of processes, and generates /tmp/connector_state.tar.gz
- Log on to connector host as a privileged account (root user) using SSH.
- Execute the
pa_connector.sh
and enter 7.
-
You will find the archive file in
/tmp/
once the command is executed completely. -
Upload the latest file
connector_state_currentdate_time.tar.gz
to the support portal for review.
Stop a connector
- Log on to connector host as a privileged account (root user) using SSH.
-
Execute the
pa_connector.sh
and enter 8.
Start a connector
- Log on to connector host as a privileged account (root user) using SSH.
-
Execute the
pa_connector.sh
and enter 9.
Tips
- Get the Private Access connector pod name using
sudo kubectl get pods -n cwpp
- To log into the pod, run
sudo kubectl exec -ti <pod_name> -n cwpp -- bash
- To install a connector again on the same VM (Virtual Machines), then run the following commands:
sudo rm -rf /opt/McAfee/
snap remove microk8s
-
To bring up the VPN (Virtual Private Network) tunnel : Tunnels are created between the connector and Private Access Gateway.
-
Run
ifconfig
tun0
andtun1
are created with an IP address 10.8.0.x. -
Check
/mcafee/mount/logs/postRegistration.log
and/mcafee/mount/logs/openvpn_client.log
-
-
Monitor Health Updates: Check
/mcafee/mount/logs/healthUpdate.log
to ensure that the VPN tunnel is up. The health update requires the list of private applications monitored by the connector. So, check if the private application list sync is successful and/mcafee/private_apps.json
is present. -
Proxy to private applications: Check
/mcafee/mount/logs/debug.log
to ensure that an application is reachable and not blocked by the policy. Ensure that the DNS configured on the connector can access private applications and resolve their URLs.
Workaround - common errors
Task | When | Error | Workaround |
Connector Registration | Entered incorrect provision key | Incorrect provision key Error decoding the provisioning key |
Check the |
Expired/Invalid client credentials | Exception while refreshing access token | Download the new connector package from Skyhigh Security UI and ensure that right provisioning key is used. | |
Connection to registration endpoint | Connection to registration endpoint - failed |
|
|
Bringing up the VPN tunnel | GW or HTTP_PROXY are not reachable |
|
Connector maintains an outbound VPN tunnel with PA Gateway.
|
Private Application list sync |
|
Check the /mcafee/mount/logs/paListsync.log if McAfee cloud API is not reachable. If this is not reachable, then ensure it is reachable to synchronize the private application list with the connector. |
|
Accessing Private Application | Able to access Private Application using Firefox browser, but failed to access the same application on the Chrome browser | Google Chrome - Taking Too Long to Load |
Disable the Use secure DNS option on Google Chrome. The Use secure DNS option should be disabled to access the private applications. Go to Chrome browser > Settings > Privacy and Security > Disable the Use Secure DNS option. |