| CPUG | |
| The Check Point User Group | |
| A Resource For The Check Point Community. Fast. Useful. Independent. | |
|
| |||||||
![]() |
| | LinkBack | Thread Tools | Display Modes |
| |||
| I have created a new SPlat VM on our ESX 3.5 server to take the place of another SmartCenter server. The VM is up and running properly, however, I can't connect to it via the GUI client. I can ping to and from the host. I have done cpstop & cpstart several times. It is a management server only so there is no firewall policy applied to it. It is listening on the correct ports, and the time and date are correct. I can connect via SSH and HTTPS but not with the GUI. |
| |||
| On the SmartCenter, do a tcpdump and see if the connection is making it that far. You can also check the /var/log/messages file. I would also try and run fwm by hand (I don't have access to a smartcenter to get the command line options) and make sure its not crashing. |
| |||
| All of the entries in the /var/log/messages file look good. All of the modules are loading without errors. I ran a 'tcpdump | grep <GUI client>' command and the system with the GUI client is communicating with the SmartCenter VM. I'm guessing there's just some part of the connection process that is specific to the GUI clients which is failing. This SmartCenter is setup as a log master and is still receiving log entries from the firewall which makes me think SIC is still good. |
| |||
| "Connection cannot be initated." "Please make sure that the Server <name> is up and running and that you are defined as a GUI client." That is the error I get when I try to connect with any GUI client app. The server is up and set to accept connections from any source. |
| |||
| Try these: "netstat -an | grep 18190" this will show you what interfaces are looking for a CPMI connection. "tcpdump -i <interface> host <HostIP> and port 18190" this will narrow down the traffic to just what we want to look at. and just to make sure "fw unloadlocal", not that it should do anything but it won't hurt anything. If you get nowhere with that, I think its time to call TAC. |
| |||
| you say that you have configured "ANY" source - but what happens if you actually DO define a GUI Client in cpconfig, and then try to access the SmartCentre from the defined GUI IP? |
| |||
| Same thing happens if I have the IP for the GUI client specifically defined. Now, I may know why. "tcpdump -i <interface> host <HostIP> and port 18190" shows me that the client is trying to connect on port 18190 "netstat -an | grep 18190" shows me that the SmartCenter server is not listening on that port. "netstat -ln | grep 181" shows me that it is listening on ports 18191 & 18192 (among others). So how do I either get the SmartCenter to listen on port 18190 or get the clients to try and connect on one of the ports that the server is already listening on? |
| |||
| Quote:
You are using the same client version as the server (R65) right? |
![]() |
| Thread Tools | |
| Display Modes | |
| |