Connector V2 CLI

Last updated
Save as PDF

Limited Availability: Connector V2 CLI is a Limited Availability feature. To enable admins to know the status, manage, run diagnostics, and troubleshoot their secure app connectors, contact Skyhigh Support.

Connector V2 CLI enables admins to know the status, manage, run diagnostics, and troubleshoot their secure app connectors by connecting to the host using SSH (secure shell)

Log on to the connector host using SSH (Secure Shell) and execute the required commands to troubleshoot a connector.
If you are a a root user or anon-root user, execute pa_connector the script from anywhere on the host.

Verification of Secure App Connector V2

Provides the list of commands you can execute:

Run the Status option to verify the status of the connector deployment.

Check tunnel status:

The connector shows the status as Normal when tunnels are up.
The connector shows the status as Critical when tunnels are down.

Run the Diagnostics tests option to verify the connector setup.

MicrosoftTeams-image (84).png

Troubleshooting Secure App Connector V2

Provides the list of commands you can execute:

Run the Troubleshooting option to help you troubleshoot the Secure App Connector-related issues.

Option 3 .png

Select Download Logs to download all logs and configuration details to a temp (/tmp/) folder on the host once diagnostics tests are completed.

Option 6.png

Download Logs

You can download all logs and configuration details to /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz

Log on to the connector host using SSH.
Execute pa_connector > enter 6.
Downloads /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz file to the temp (/tmp/) folder once the command is executed completely.
You can upload the latest file /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz to the support portal for review.

Resolving Host Names

For a Connector to function, the system Domain Name Service (DNS) should be able to resolve both Skyhigh Security URLs and Private Application URLs. You can do the following to resolve host names using the system DNS:

Perform the following to check if the system DNS is resolving both Skyhigh Security and Private Application URLs:

Log on to the connector host using SSH (Secure Shell).

Execute pa_connector > enter 3 > enter a > enter the domain name.

Test the system proxy

Perform the following to test if a private application connection is established with the connector via the system proxy:

Log on to the connector host using SSH.

Execute pa_connector > enter 3 > enter b > enter the system proxy address.
Displays if the private application connection is established with the connector via system proxy.

Test Ping

Perform the following to test ping:

Log on to the connector host using SSH.

Execute pa_connector> enter 3 > enter c.

Run TCP dump for Private Application

Perform the following to check the private application connectivity:

Log on to the connector host using SSH.

Execute pa_connector > enter 3 > enter d.
Downloads .pcap file to the temp (/tmp/) folder once the command is executed completely.
You can upload the latest file pa_capture-currentdate.pcap to the support portal for review.

Manage connectors

Perform the following to manage connectors:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter <g or h or i>.

Start connector services

Perform the following to start all connector services:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter h.

Restart connector services

Perform the following to restart all services that run in a connector:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter i.

Stop a connector

Log on to the connector host using SSH.

Execute pa_connector> enter 4 > enter g.

Manage Secure App Connector V2

Provides the list of commands you can execute:

Run the Manage option to manage (start or stop) Secure App Connector.

Option 4.png

Select the About option to know the Secure App Connector version.

Option 1 .png

Enter 0 to exit from the command console.

MicrosoftTeams-image (11).png

Common Errors and Workaround

Task	When	Error	Workaround
Private Application list sync		Error: - Exception connecting to https://api.wgcs.skyhigh.cloud.com/pa/v1/connector-registration: HTTPSConnectionPool(host='api.wgcs.skyhigh.cloud.com paList-Sync Failed	Check the `/.../mount/logs/paListsync.log`if Skyhigh cloud API is not reachable. If this is not reachable, then ensure it is reachable to synchronize the private application list with the connector.
Private Application is not reachable			Run the command on the connector pod: `curl -v -k https://app-server` If curl also fails, then ensure that the IP of the connector pod and host IP are not on the same subnet (10.254.254.x)
Accessing Private Application	Able to access Private Application using Firefox browser, but failed to access the same application on the Chrome browser	Google Chrome - Taking Too Long to Load	Disable the Use secure DNS option on Google Chrome. The Use secure DNS option should be disabled to access private applications. Go to Chrome browser > Settings > Privacy and Security > Disable the Use Secure DNS option.
Dual stack VMs/Hosts	Connector installation in a dual stack VM/host	Pods don't come to running state	If the VM/host is enabled for both IPv4 and IPv6, ensure that it gets proper IP addresses for both the IPv4 and IPv6 interfaces. If IPv6 is disabled in the network, then the IPv6 interface on the host should also be disabled.