Bastionhost:Server connection issues

If the connectivity test fails

Check these items in order:

1. Non-standard server port. If the server uses a non-standard port, update it on the Assets page. Modify the service port of a host.

2. Security group rules. Verify that the security group allows traffic from the Bastionhost egress IP, shown in the instance list on the Bastionhost console. For more information about how to add a security group rule, see Manage security group rules.

3. Server-side security policies. Verify that no server-side policies block Bastionhost access. Check:

   • Network ACLs

   • Security groups

   • Cloud Firewall

   • Internal firewalls (iptables, Windows Firewall)

4. Host-based access control. Verify that /etc/hosts.allow and /etc/hosts.deny on the server do not block the Bastionhost instance.

5. Cloud Firewall policies. Verify that Cloud Firewall policies do not block the Bastionhost instance. Best practices for access policies in a joint deployment of Cloud Firewall and Bastionhost.

6. Internal network connectivity. If the Bastionhost instance cannot reach the server over the internal network, verify the network path. Best practices for hybrid operations and maintenance (O&M) scenarios.

7. IP address conflict. Verify that the server IP does not conflict with the Bastionhost egress IP or the IP resolved from the internal endpoint. Conflicts prevent server data from reaching Bastionhost.

8. Public IP on a private network. If the server uses a public IP for a private network, adjust the network settings in Configure Bastionhost.

If the connectivity test succeeds

1. Try connecting directly to the server by bypassing the Bastionhost instance.

   • If the direct connection also fails, the issue is server-side. Troubleshoot the server protocol connection:

     • Methods to troubleshoot failures to remotely connect to a Windows instance

     • Troubleshooting guide for failures to remotely log on to a Linux instance using SSH

2. If you can connect directly but not through Bastionhost, check the error messages in Common Bastionhost O&M errors.

If these steps do not resolve the issue, submit a ticket.

Symptom 1: The verification times out or fails

Cause

A verification timeout is usually caused by network inaccessibility.

Solution

Test connectivity between the Bastionhost instance and the asset using Network diagnostics.

• If the connectivity is abnormal, the network between the Bastionhost instance and host may be unavailable. For more information, see What do I do if I fail to access a server through Bastionhost?

• If the connectivity is normal but verification still fails, network sync may be delayed. Save the account password to Bastionhost and retry O&M. Configure a host account.

Symptom 2: The verification fails due to an incorrect password

Cause

The account password entered in Bastionhost does not match the password set on the asset.

Solution

• Verify that the password in Bastionhost matches the one set on the asset. Configure a host account.

• If you are performing O&M on a Linux host, check whether the root account or password authentication is disabled in the sshd_config file.