18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Troubleshooting proxy rules<br />

F-24 Basic Troubleshooting<br />

Failed connection requests<br />

If the <strong>Sidewinder</strong> <strong>G2</strong> rejects a connection request that you feel should<br />

have succeeded, you can take steps to determine why the connection<br />

was rejected. The steps shown below will help you to locate and<br />

correct rule configuration errors. They will also help you gain a better<br />

understanding <strong>of</strong> how those rules work.<br />

1. Start the Admin Console and select Services Configuration -> Proxies.<br />

Verify that the appropriate proxy is enabled. The most common mistake<br />

is failing to enable the service type indicated by the proxy rule.<br />

Tip:Verify that all appropriate servers are enabled as well.<br />

2. Select Policy Configuration -> Rules.<br />

Verify that the proxy rule for the proxy or server specifies the correct<br />

network. You need to enable the service type on the correct network to<br />

listen for incoming connections. In the Rules Source/Dest tab, this<br />

corresponds to the Source Burb column.<br />

3. Verify the position <strong>of</strong> the rules within the Active Rules window. (Select<br />

Policy Configuration -> Rules -> and then click View Active Policy).<br />

The order <strong>of</strong> the rules in the Active Rules window is important. The<br />

attributes <strong>of</strong> a connection request sometimes may match more than<br />

one proxy rule. See “Creating proxy rules” on page 7-4 for a detailed<br />

example.<br />

4. Check the audit log information.<br />

If the connection still fails, scan the audit log to determine which proxy<br />

rule denied the connection. See Chapter 18 for details on viewing audit.<br />

The below displays a common scenario, a connection that failed to<br />

match a rule:<br />

Apr 29 16:52:29 2002 CDT f_nss a_server t_acldeny<br />

p_major<br />

pid: 27122 ruid: 0 euid: 0 pgid: 188 fid: 2000001<br />

logid: 0 cmd: ’nss’<br />

domain: nss1 edomain: nss1 srcip: 172.17.9.27<br />

srcburb: 1 dstip: 172.17.9.27 dstburb: 1 protocol: 6<br />

service_name: telnet agent_type: server user_name:<br />

authmethod: acl_id: <br />

cache_hit: 0<br />

5. Turn on verbose auditing <strong>of</strong> rule (ACL) checks.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!