client hub can't connect to tunnel - error 10060 (-2)

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Client Tunnel hub does not communicate to its Hub Tunnel server

1. The hub.log captures error below:

SSL_CONNECT - CONNECT TO 'XXXXXXXX': 48003 FAILED (10060)
TSESS COULD NOT CONNECT TO TUNNEL 'XXXXXXX' 48003 (-2)

2. Telnet from the client HUB to the tunnel server via port 48003 fails eventhough the firewall shows an "accept".

3. Packet tracing (tcpdump/wireshark) on the tunnel server shows some communication on port 48003 from the client

Environment

Release : 9.0.2

Component : UIM - HUB

Cause

This is seen when incoming traffic on port 48003 to the Tunnel server is not completely open.

Resolution

***Client to tunnel hub communication had a missing route for the return packet. The client hub was able to reach the tunnel hub but the TCP handshake could not completed because the communication had blocked the route aggregate / route announcement so the return packet was going nowhere.

***Need to open incoming traffic on port 48003 to tunnel from client server per UIM Tunnel Configuration requirement:

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/unified-infrastructure-management/8-5/installing-ca-uim/pre-installation-planning/firewall-port-
reference.html