Errors deploying an APE

Hi,

I'm encountering an error when attempting to install a new APE on a remote network, down a vpn tunnel but using a NAT rule

The issue also occurs when using the Orion SDK tools

I can see in the log the following exception

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at System.ServiceModel.ICommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.ClientSecurityChannel`1.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout)
   at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout)
   at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)
   at System.ServiceModel.Security.SecuritySessionClientSettings`1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open()

We've tested ports tcp/17777, tcp/17778, tcp/5671 from the APE to the MPE, using PowerShell to confirm connectivity, and using a PowerShell listener confirmed the MPE can reach the APE using tcp/17777

We've also logged a ticket with solarwinds support, but they are taking a while to resolve

Has anyone encountered this?

To my understanding, especially with the orion sdk, that should only make an outbound connection on tcp/17777? Which we confirm via powershell is working, and the firewalls support it as we can see the traffic reaches the MPE

Find more posts tagged with

error

installation error

orion

network

troubleshooting

ape

Accepted answers

All comments

bobmarley

Try Port 17774 for the SDK

SolarWinds Port Requirements

narzsa

Hi, using port tcp/17774 (Orion (v3) over HTTPS) we get;

An error has occurred while making the http request to [https://URL]. This could be due to the fact that the server certificate is not configured properly with http.sys in the https case. This could also be caused by a mismatch of the security binding between the client and the server

Testing with powershell, confirms connectivity

narzsa

Also as a control, i tried to deploy the agent, which i know 100% does support NAT as it references it for the remote collector

When i tried to connect it i get

ecklerwr1

I wonder if there's some security device in between somewhere shutting the session down? Ask me how I know this... ZScaler o.O!

narzsa

We can see it land via wireshark on the MPE, so if there is something it must be local to the box?

Seashore

Not sure if a NAT connection will work at all.

I mean the APE will register it's address in the database but will actually have another one from the Mail Pollers perspective. (Might be that it's only connecting by hostname, if so make sure both parts can connect via hostname. Not FQDN, just hostname)

narzsa

There's articles regarding it such as the below. So my understanding is it will work so long as you a) use the host names as you say and b) the NAT supports bidirection

https://thwack.solarwinds.com/resources/b/product-blog/posts/orion-distributed-deployments-672181452

Presently it's not even getting that far. I've got the host names there and resolvable but no dice

What's very troubling is it happens to the agent too, which by all account 100% supports NAT per

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-agent-communication-modes.htm?utm_source=chatgpt.com

and the fact remote collections (an agent function) support NAT

We ran a wireshark and can see the connection take place on the MPE, but then it closes with a RST ACK

bobmarley

Another thing you can try as a good measure is put all of your SolarWinds servers in the Hosts file. Both long and short name. Adding static entry for hosts that are not resolving by DNS on Orion Platform

narzsa

Alas, that's already done, as i've seen that issue before, so prepped for it. The APE has all the host file entries for the MPE etc and the MPE includes the APEs NAT IP for it's reference

narzsa

Hi All,

We think we may have gotten to the bottom of it

With the agent failing we were able to dig a little deeper. Looks like it was a hub policy on the firewall.

We created a new policy, and it looks like that resolved the issue. Despite ports being open on both side and communication being there, it appears the old policy was dropping some part of the TLS handshake

Since we've added it, both APE's have been able to now connect and communicate with the MPE, and the agent on the test box, also was able to register with the MPE and show itself

HerrDoktor

Thanks for sharing your solution.