ERA Agent (no replication to webconsole)

[ernestodelisi 0]

Good afternoon, we have a problem with the agents. Agents do not replicate to the web console.

The ERA Proxy has IP 10.100.8.67
The ERA Server has IP 10.100.8.65

The Agent endpoint pc has IP 10.0.4.166

 

If I point the agent to 10.100.8.65 (it was server) they replicate correctly and they appear to me perfect on the web console, but those who replicate against 10.100.8.67 (were proxy) lose the connection for some reason.

In the case of the equipment that attaches the captures (10.0.4.166), the agent must connect to the proxy era, 10.100.8.67, in the tracelog of the proxy era we see that it was connected today:

 

2017-04-25 17:43:37 Information: NetworkModule [Thread cbc]: Socket accepted. Remote ip address: 10.0.4.166 remote port: 39530
2017-04-25 17:43:37 Information: NetworkModule [Thread cbc]: Resolving ip address: 10.0.4.166
2017-04-25 17:43:37 Information: NetworkModule [Thread cbc]: Receiving ip address: 10.0.4.166 from cache
2017-04-25 17:43:37 Information: NetworkModule [Thread cbc]: Successfully received ip address: 10.0.4.166 from cache
2017-04-25 17:43:37 Information: NetworkModule [Thread 1c0c]: Socket connection (isClientConnection: 0) established for id 7395636

-------------------------------------------------- -----------------------------

Here I leave a part of the tracelog of the team 10.0.4.166 that has drawbacks to appear in the console:

2017-04-25 17:03:38 Error: CReplicationModule [Thread 1bd8]: CReplicationManager: Failed to start replication, replication link '00000000-0000-0000-7007-000000000001' (Automatic replication (REGULAR)) is already in use
2017-04-25 17:04:38 Error: CReplicationModule [Thread b68]: CReplicationManager: Failed to start replication, replication link '00000000-0000-0000-7007-000000000001' (Automatic replication (REGULAR)) is already in use
2017-04-25 17:05:38 Error: CReplicationModule [Thread 12ec]: CReplicationManager: Failed to start replication, replication link '00000000-0000-0000-7007-000000000001' (Automatic replication (REGULAR)) is already in use
2017-04-25 17:06:16 Warning: NetworkModule [Thread a78]: The connection will be closed due to timeout. SessionId: 116 Ip address: 10.100.8.67 Port: 2222 Resolved name:
2017-04-25 17:06:16 Error: CReplicationModule [Thread 1160]: CReplicationManager: Stopping replication scenario due to network connection close (scenario type: Regular, scenario status: Running)
2017-04-25 17:06:16 Error: CReplicationModule [Thread 1160]: CReplicationManager: Failure of scenario (type = Regular, task_id = '00000000-0000-0000-7005-000000000001', link = 'Automatic replication (REGULAR) '(00000000-0000-0000-0000-0000-0000-0000-0000-000000000001), current_step = Transmitting [DataLogsImportant], current_step_phase = Transmitting, remote_peer = host: "10.100.8.67" port: 2222, remote_peer_type = 2, remote_peer_id = 0c53eb7c-016b-483a-8964 -be9853cb2052, remote_realm_id = 6f00364c-91d8-4993-bbac-354fa1d455f2)
2017-04-25 17:06:16 Error: NetworkModule [Thread 13cc]: User context does not exist for id 116

[Gonzalo Alvarez 66]

Hi Ernesto,

Usually the "Agent not report to ERA" is a problem with the ports in use, then we suggest to check the KB3608 (http://support.eset.com/kb3608/).
Do you check already the ports in both sides (on ERA and on terminal)?

Give us some data about your case:

• Version of ERA
• Version of the Agents
• Version of ESET Endpoint on terminals
• Any third party firewall or appliance? (related to network traffic control)