Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Troubleshooting
proxy rules
Appendix F: Basic Troubleshooting
Troubleshooting proxy rules
The following sections provide information on troubleshooting basic proxy rule
problems. For additional information on troubleshooting proxy rules, refer to
the cf_proxy man page.
Failed connection requests
If the Sidewinder G2 rejects a connection request that you feel should have
succeeded, you can take steps to determine why the connection was rejected.
The steps shown below will help you to locate and correct rule configuration
errors. They will also help you gain a better understanding of how those rules
work.
1 Start the Admin Console and select Services Configuration > Proxies.
Verify that the appropriate proxy is enabled. The most common mistake is
failing to enable the service type indicated by the proxy rule.
Tip: Verify that all appropriate servers are enabled as well.
2 Select Policy Configuration > Rules.
Verify that the proxy rule for the proxy or server specifies the correct network.
You need to enable the service type on the correct network to listen
for incoming connections. In the Rules Source/Dest tab, this corresponds to
the Source Burb column.
3 Verify the position of the rules within the Active Rules window. (Select
Policy Configuration > Rules > and then click View Active Policy).
The order of the rules in the Active Rules window is important. The
attributes of a connection request sometimes may match more than one
proxy rule. See “Creating proxy rules” on page 222 for a detailed example.
4 Check the audit log information.
If the connection still fails, scan the audit log to determine which proxy rule
denied the connection. See Chapter 19 for details on viewing audit.
The below displays a common scenario, a connection that failed to match a
rule:
Apr 29 16:52:29 2002 CDT f_nss a_server t_acldeny p_major
pid: 27122 ruid: 0 euid: 0 pgid: 188 fid: 2000001 logid: 0
cmd: ’nss’
domain: nss1 edomain: nss1 srcip: 172.17.9.27 srcburb: 1
dstip: 172.17.9.27 dstburb: 1 protocol: 6 service_name:
telnet agent_type: server user_name: authmethod:
acl_id: cache_hit: 0
5 Turn on verbose auditing of rule (ACL) checks.
To determine why no proxy rule matched the connection request, type the
following command to turn on verbose auditing of rule checks:
657