Troubleshooting and Best Practices

In This Section: Service Registration: Not connected to a known vCenter Service Registration: Failed to Create Service Service Registration: Failed to Locate OVF File Service Deployment Failure Cannot Call Security Solution Agent VM on Host is Expected to be Powered On Agent VM is Missing on Host Agent VM Settings on Host are Missing Automatic Provisioning Failed to Create Management Network Objects

These are some errors that you can experience. For more troubleshooting information, see the sk111060 - ATRG: vSEC / CloudGuard for VMware NSX.

Service Registration: Not connected to a known vCenter

Symptom

This error shows when you select an NSX Security Gateway for Service Registration:

The NSX Manager you selected is not connected to a known vCenter

Solution

Make sure that the host name of the vCenter (which was registered to the NSX Manager) is used when creating the vCenter Data Center object. If the names are different, then the CloudGuard CLI cannot recognize the connection between the NSX Manager Server and the vCenter Server.

Service Registration: Failed to Create Service

Symptom

This error shows:

Error during rest callback

• "PUT to the registered ServiceManager at:https://<Service Manager IP>/vmware/2.0/si/serviceprofile/serviceprofile-<ID> caused by : I/O error: No route to host; nested exception is java.net.NoRouteToHostException: No route to host.
• "PUT to the registered ServiceManager at : https:<Service Manager URL>/vmware/2.0/si/serviceprofile/serviceprofile-55 caused by : I/O error: Connection refused; nested exception is java.net.ConnectException: Connection refused."
• "Failed to create service"

Solution

Make sure that the NSX Manager and the CloudGuard Controller can communicate using port 443.

Service Registration: Failed to Locate OVF File

Symptom

This message shows:

OVF file https://<IP_Address>:<Port>/ve/Security_Gateway_R80_10CloudGuard.ovf is inaccessible or doesn't exist. resolve the issue or choose different OVF

Solution

• Make sure you have a /ve folder is configured.
• You can also download the OVF file to a different folder location.

  Go to CloudGuard VMware Service Manager > Change Global Configuration > Manage Service OVF's and configure as necessary.

Service Deployment Failure

Symptom

This error shows when there is a service deployment failure:

Error Service deployment failed with the message

Installation of deployment unit failed, please check if ovf/vib urls are accessible, in correct format and all the properties in ovf environment have been configured in service attributes. Please check logs for details.“

Solution

Make sure the OVF files can be reached from the vCenter Server.

Make sure you are using the correct OVF files.

To confirm that the OVF files can be reached:

1. In the VMware vSphere Web Client, navigate to Home > Networking and Security > Installation > Service Deployments.
2. Click on Status in the Installation status column of the relevant service.
3. Click Resolve to power on the CloudGuard Gateway.

Cannot Call Security Solution

Symptom

This error shows when you cannot call a security solution:

Error "Unable to call security solution , please check security solution configuration: Error during REST callback : PUT to the registered ServiceManager at : https://<Service Manager Address>/vmware/2.0/agents/ caused by : I/O error: No route to host; nested exception is java.net.NoRouteToHostException: No route to host. Deployment Plugin execution failed"

Cause

The NSX Manager Server failed to correctly communicate with the Check Point CloudGuard Controller.

Next steps:

1. Make sure the Check Point CloudGuard Controller is powered on.
2. Make sure the CloudGuard Controller process is up and running:

   netstat –nap | grep 8443

3. Make sure the NSX Manager Server can communicate with the CloudGuard Controller using port 443. Communication to the Check Point CloudGuard Controller goes to port 443, and then is redirected to port 8443. Port 8443 is used by the CloudGuard Controller process.

Agent VM on Host is Expected to be Powered On

Symptom

This error shows when there is a powered off CloudGuard Gateway Virtual Machine on one of the hosts:

Agent VM {vSEC Gateway VM NAME} on host {host} is expected to be powered on ({agencyName})

Solution

1. In the VMware vSphere Web Client, go to Home > Networking and Security > Installation > Service Deployments.
2. Click Status in the Installation status column of the relevant service.
3. Click Resolve to turn on the CloudGuard Gateway.

Agent VM is Missing on Host

Symptom

This error shows when there is an ESXi host server without a CloudGuard Gateway deployed on it:

Agent VM is missing on host {host.name} ({agencyName})

Solution

1. In the VMware vSphere Web Client, open Home > Networking and Security > Installation > Service Deployments.
2. Click Status in the Installation status column of the relevant service.
3. Click Resolve to try the CloudGuard Gateway deployment again.

Agent VM Settings on Host are Missing

Symptom

This error shows:

No agent datastore/network configuration on host

Solution

The CloudGuard Gateway cannot be deployed, due to missing host server configurations. Set Agent VM settings.

If the Service VM agent is not deployed, follow these steps to re-initiate the deployment:

1. In the VMware vSphere Web Client, open Home > Networking and Security > Installation > Service Deployments.
2. Click Status in the Installation status column of the relevant service.
3. Click Resolve to try the CloudGuard Gateway deployment.

Automatic Provisioning Failed to Create Management Network Objects

Symptom

After three failures, the auto provisioning feature stops trying to create objects in SmartConsole. Every 10 minutes all the deployed CloudGuard Gateways are matched with the NSX Manager database and created or deleted.

This error shows:

Error Failed creating cluster object. Maximum retries exceeded for object. Please configure the object manually

Solution

1. Edit the ObjectsMap.C file.

   Set retries_left to 999.

2. Make sure the CloudGuard Controller and the CloudGuard Gateway have the same date, time, and timezone.

   Run: show {timezone | time | date}

   If they are not the same, run: set {timezone | time | date}

3. Remove failed objects in SmartConsole or the GuiDBedit Tool.
4. Reset SIC initialization. On the CloudGuard Gateway, run:

   cp_conf sic init <Secret One-Time Password>

5. Wait at least ten minutes for the objects to be created.