Troubleshooting Connectivity

Below are some common steps you can take to troubleshoot connectivity problems between Sensor Collector and Cisco Provider Connectivity Assurance.

Checking Sensor Collector Logs

To check Sensor Collector logs

1. Confirm Sensor Collector container is running:

sudo docker ps

CONTAINER ID | IMAGE | COMMAND | CREATED | STATUS | PORTS |NAMES

a1a7e7d0b0cc gcr.io/npav-172917/adh-roadrunner:latest "/docker-entrypoint.…"   2 hours ago Up About an hour 2222/tcp aod-connector-for-<some name>.npavlabs.accedian.net`

2. Tail logs:

sudo docker logs -f <container id>

2019/01/28 15:58:33 Using config file: /tmp/config/adh-roadrunner.yml
15:58:33.392 Run ▶ INFO 001 Runner pointing to <some name>.npavlabs.accedian.net:443
15:58:33.392 certExpiryChecker ▶ INFO 002 checking certs for renewal
15:58:33.393 certExpiryChecker ▶ INFO 003 no need for cert renewal
15:58:33.393 connect ▶ INFO 004 Attempting to establish meta connection with DH on host <some name>.npavlabs.accedian.net in zone: ChrisLab
15:58:33.393 GetCerts ▶ INFO 005 found cert and private key
15:58:33.632 connect ▶ INFO 006 Successfully connected to DataHub (meta connection) on host: <some name>.npavlabs.accedian.net in zone: ChrisLab.`

3. Check for errors.

Checking Cisco Provider Connectivity Assurance Reachability

By default, Sensor Collector requires outbound connectivity to Cisco Provider Connectivity Assurance via port 443 . Here are some things to check:

• Confirm the URL to which your Sensor Collector is trying to connect. This can be found in your Sensor Collector config file as the dhHost parameter. Note that this may not be the same URL that you're using to access your Cisco Provider Connectivity Assurance tenant.

cat /opt/roadrunner/adh-roadrunner.yml | grep dhHost

dhHost: "<some name>.npavlabs.accedian.net"

• Try to ping it. If reachable, move on to checking if the port is blocked.

ping <some name>.npavlabs.accedian.net

PING <some name>.npavlabs.accedian.net (111.222.222.111) 56(84) bytes of data.
64 bytes from 227.169.193.35.bc.googleusercontent.com (111.222.222.111): icmp_seq=1 ttl=63 time=35.7 ms`

• Try to Telnet to it on port 443. This port needs to be open for outbound connections by the customer's IT department.

telnet <some name>.npavlabs.accedian.net 443

Trying 111.222.222.111...
Connected to <some name>.npavlabs.accedian.net.

• Try to interact with port 443 via cURL:

> curl -fv https://<some name>.npavlabs.accedian.net

* Rebuilt URL to: https://xyz.npavlabs.accedian.net/
* Trying 35.239.xyz.xyz...
* TCP_NODELAY set
* Connected to xyz.npavlabs.accedian.net (35.239.xyz.xyz) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* Successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
<more text cut off for verbosity>

• We have seen cases where even though the cURL/Telnet test works, the container is still not able to reach the target and times out. In those cases it is recommended to restart (stop/start) the Docker service on your system, so it would reset proper routing rules internally. If using Linux, here is an example:

sudo service docker stop; sudo service docker start

or

sudo systemctl stop docker; sudo systemctl start docker