CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. Come to CPUG CON 2008 EUROPE in Switzerland on September 8th - 9th!
    Two days full of technical content for Check Point administrators in the beautiful Swiss Alps!
    We already have sign-ups from twelve different countries!
2. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 7/14, 8/25, 10/6, 11/3, 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8.
3. Corrent S3500 SecureXL Turbocards For Sale - Last Six Remaining - Get Your Spares!
4. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > SmartCenter Server (Formerly Management Server)
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-04-14
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Cannot connect to SmartCenter

I have created a new SPlat VM on our ESX 3.5 server to take the place of another SmartCenter server. The VM is up and running properly, however, I can't connect to it via the GUI client.
I can ping to and from the host.
I have done cpstop & cpstart several times.
It is a management server only so there is no firewall policy applied to it.
It is listening on the correct ports, and the time and date are correct.
I can connect via SSH and HTTPS but not with the GUI.
Reply With Quote
  #2 (permalink)  
Old 2008-04-14
melipla melipla is offline
Senior Member
 
Join Date: 2006-01-25
Posts: 724
Rep Power: 3
melipla has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

Run cpconfig. Go into (3) Gui clients, make sure your IP is listed. Then check the logs and make sure your IP isn't NATed :)
__________________
Its all in the documentation.
Reply With Quote
  #3 (permalink)  
Old 2008-04-15
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

It is set to accept GUI client connections from any source. I've tried to connect from 3 different systems.

Thanks for the suggestion though.
Reply With Quote
  #4 (permalink)  
Old 2008-04-15
chillyjim chillyjim is offline
Senior Member
 
Join Date: 2005-08-29
Location: Upstate NY
Posts: 1,598
Rep Power: 4
chillyjim has an average reputation (10+)
Send a message via AIM to chillyjim Send a message via Skype™ to chillyjim
Default Re: Cannot connect to SmartCenter

On the SmartCenter, do a tcpdump and see if the connection is making it that far. You can also check the /var/log/messages file.

I would also try and run fwm by hand (I don't have access to a smartcenter to get the command line options) and make sure its not crashing.
Reply With Quote
  #5 (permalink)  
Old 2008-04-16
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

All of the entries in the /var/log/messages file look good. All of the modules are loading without errors. I ran a 'tcpdump | grep <GUI client>' command and the system with the GUI client is communicating with the SmartCenter VM. I'm guessing there's just some part of the connection process that is specific to the GUI clients which is failing. This SmartCenter is setup as a log master and is still receiving log entries from the firewall which makes me think SIC is still good.
Reply With Quote
  #6 (permalink)  
Old 2008-04-16
chillyjim chillyjim is offline
Senior Member
 
Join Date: 2005-08-29
Location: Upstate NY
Posts: 1,598
Rep Power: 4
chillyjim has an average reputation (10+)
Send a message via AIM to chillyjim Send a message via Skype™ to chillyjim
Default Re: Cannot connect to SmartCenter

Try to connect with both the Tracker and SmartUpdate clients. Let us know the exact error message you get.
Reply With Quote
  #7 (permalink)  
Old 2008-04-16
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

"Connection cannot be initated."
"Please make sure that the Server <name> is up and running and that you are defined as a GUI client."

That is the error I get when I try to connect with any GUI client app. The server is up and set to accept connections from any source.
Reply With Quote
  #8 (permalink)  
Old 2008-04-16
chillyjim chillyjim is offline
Senior Member
 
Join Date: 2005-08-29
Location: Upstate NY
Posts: 1,598
Rep Power: 4
chillyjim has an average reputation (10+)
Send a message via AIM to chillyjim Send a message via Skype™ to chillyjim
Default Re: Cannot connect to SmartCenter

Try these:

"netstat -an | grep 18190" this will show you what interfaces are looking for a CPMI connection.

"tcpdump -i <interface> host <HostIP> and port 18190" this will narrow down the traffic to just what we want to look at.

and just to make sure "fw unloadlocal", not that it should do anything but it won't hurt anything.

If you get nowhere with that, I think its time to call TAC.
Reply With Quote
  #9 (permalink)  
Old 2008-04-16
coldark coldark is offline
Member
 
Join Date: 2006-08-30
Location: Cheshire UK
Posts: 32
Rep Power: 0
coldark has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

Quote:
Originally Posted by mecarter View Post
It is set to accept GUI client connections from any source. I've tried to connect from 3 different systems.

Thanks for the suggestion though.
you say that you have configured "ANY" source - but what happens if you actually DO define a GUI Client in cpconfig, and then try to access the SmartCentre from the defined GUI IP?
Reply With Quote
  #10 (permalink)  
Old 2008-04-16
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

Same thing happens if I have the IP for the GUI client specifically defined. Now, I may know why.

"tcpdump -i <interface> host <HostIP> and port 18190" shows me that the client is trying to connect on port 18190

"netstat -an | grep 18190" shows me that the SmartCenter server is not listening on that port. "netstat -ln | grep 181" shows me that it is listening on ports 18191 & 18192 (among others).

So how do I either get the SmartCenter to listen on port 18190 or get the clients to try and connect on one of the ports that the server is already listening on?
Reply With Quote
  #11 (permalink)  
Old 2008-04-16
chillyjim chillyjim is offline
Senior Member
 
Join Date: 2005-08-29
Location: Upstate NY
Posts: 1,598
Rep Power: 4
chillyjim has an average reputation (10+)
Send a message via AIM to chillyjim Send a message via Skype™ to chillyjim
Default Re: Cannot connect to SmartCenter

Quote:
Originally Posted by mecarter View Post
So how do I either get the SmartCenter to listen on port 18190 or get the clients to try and connect on one of the ports that the server is already listening on?
It's possible I have the port wrong, but if I don't it sounds like fwm isn't starting correctly.

You are using the same client version as the server (R65) right?
Reply With Quote
  #12 (permalink)  
Old 2008-04-16
mecarter mecarter is offline
Junior Member
 
Join Date: 2006-05-18
Posts: 9
Rep Power: 0
mecarter has an average reputation (10+)
Default Re: Cannot connect to SmartCenter

Yep, everything is R65.

How do I check on the status of fwm? I didn't see any errors in the /var/log/messages.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -7. The time now is 14:55.


Powered by vBulletin® Version 3.7.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
LinkBacks Enabled by vBSEO 3.0.0