Unable to reach Internet Gateway: No connection could be made because the target machine actively refused it (10061)

Products

• IT Management Suite

Issue/Introduction

The customer is setting up new client machines. He is using a CEM installation package to do that since those machines are not currently at the office. However, after the agent gets updated with the CEM references, it is not able to connect in CEM mode.

The agent logs show the following error message:

Operation 'CEM: Connect' failed. 
Protocol: HTTPS 
Original host: mySMPserver.domain.com:443
Real host: 202.7.245.22:443
Path: / 
Connection id: 0.9956 
Communication profile id: {AA04FC45-18D2-4A27-89F8-29700A895926} 
Throttling: 0 0 0 
Error type: Connection error 
Error code: No connection could be made because the target machine actively refused it (10061) 
Error note: SocketIOStrategySyncSelect::Connect error 

Environment

ITMS 8.5, 8.6

Cause

The firewall was blocking connections that came from outside their country. 

Resolution

The following is provided as an example of what was identified from the agent logs. We compared the agent logs from a client machine that can connect with the one that is not.

1. Both client machines (I will call CompX the no-working one in CEM mode and CompY is the working one) have all TLS versions enabled:

The client supports TLS 1.0, TLS 1.1, TLS 1.2 connections

2. Both computers are using the same Agent Communication Profile:

connect to 'HTTPS://mySMPserver.domain.com:443/Altiris/WebSockets' using '{aa04fc45-18d2-4a27-89f8-29700a895926}' connection profile

3. Since CompX hasn't been able to connect via CEM mode, there is not a resource GUID yet:

Configure Server Mode: Initial machine resource GUID is '{00000000-0000-0000-0000-000000000000}'

while CompY has already one:

Configure Server Mode: Initial machine resource GUID is '{7A2CF7EF-F96C-4A6F-9F80-7DA84DD72778}'

4. Both machines fail to connect to the SMP server directly when are outside of the network. This is expected since they shouldn't be able to do that without going to the gateway server first:

Unable to resolve a hostname mySMPserver.domain.com to IP address, error: No such host is known (11001)

5. CompY is able to establish a connection to the gateway, then it sent the local client certificate info back and makes a successful connection to the gateway and then connects with the SMP Server:

Entry 1:
ClientHandshakeLoop. Local certificate:
  Serial number: 4c 67 e8 16 40 e9 17 b5 2b 21 d0 70 6b dc 7b b3 7c 12 3c 69,
  Thumbprint: 5f 2d 6b 80 59 a1 29 0d 7f 3c 15 97 2a e2 ef 2c 17 de 7b b3

Entry 2:
NegotiateConnect: SUCCESS (gateway: altirisGW.domain.com)

Entry 3:
ClientHandshakeLoop. Local certificate:
  Serial number: 4d 1e 1c da 5f fe 8d 70 e0 0d f2 93 65 4c a0 67 27 cd 1b f4,
  Thumbprint: 1e 90 f2 5e e0 91 4a d3 25 a3 bf 63 45 66 01 34 36 0f 82 c4

Entry 4:
NegotiateConnect: SUCCESS (host: mySMPserver.domain.com)

However, CompX is not reaching out to the gateway. CompX is never able to make the initial connection to send the requested certificate information.

6. After CompY can make the initial connection, the proper tunnel is opened with the gateway:

Entry 1:
Tunnel connection using IP: 202.7.245.22, Port: 443

Entry 2:
Operation 'CEM: Connect' was completed successfully. 
Protocol: HTTPS 
Original host: mySMPserver.domain.com:443
Real host: altirisGW.domain.com:443 
Path: / 
Connection id: 0.25320 
Communication profile id: {AA04FC45-18D2-4A27-89F8-29700A895926} 
Throttling: 0 0 0 
Server HTTPS connection info: 
   Server certificate: 
      Serial number: 45 62 47 ab 26 b7 7e 81 4d 1c 56 04 e7 4e 3f 36 
      Thumbprint: 05 16 bb 31 d0 29 1d df cf 20 8c e9 e6 c1 84 b3 5a 9e 85 a5 
   Cryptographic protocol: TLS 1.2 
   Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 
   Cipher algorithm: AES 
   Cipher key length: 256 
   Hash algorithm: SHA384 
   Hash length: 384 
   Key exchange algorithm: ECDH 
   Key length: 256 
Gateway HTTPS connection info: 
   Server certificate: 
      Serial number: 25 15 df ea 58 91 4c 66 1a d1 ed c3 4c 23 0c 3c a6 16 b3 dd 
      Thumbprint: cc 9e 6e ac 36 9c d0 fc 99 3d 1c ca 30 ce 1e d1 77 61 fe c9 
   Cryptographic protocol: TLS 1.2 
   Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 
   Cipher algorithm: AES 
   Cipher key length: 256 
   Hash algorithm: SHA384 
   Hash length: 384 
   Key exchange algorithm: ECDH 
   Key length: 256

While CompX is not:

Operation 'CEM: Connect' failed. 
Protocol: HTTPS 
Original host: mySMPserver.domain.com:443
Real host: 202.7.245.22:443
Path: / 
Connection id: 0.9956 
Communication profile id: {AA04FC45-18D2-4A27-89F8-29700A895926} 
Throttling: 0 0 0 
Error type: Connection error 
Error code: No connection could be made because the target machine actively refused it (10061) 
Error note: SocketIOStrategySyncSelect::Connect error 

 

When this type of behavior occurs on two different client machines using the same Agent Communication Profile and Certificates, usually is an indication of some device (switch, firewall, proxy, SSL offloader, load balancer, etc)  in the middle causing to redirect the request to somewhere else or blocking access to the Internet Gateway. 

CompY can reach out to the gateway and SMP server:

Operation 'CEM: Connect' completed successfully. 
Protocol: HTTPS 
Original host: mySMPserver.domain.com:443
Real host: altirisGW.domain.com:443 

while CompX is having a hard time even getting a response with the actual gateway external name: 

Operation 'CEM: Connect' failed. 
Protocol: HTTPS 
Original host: mySMPserver.domain.com:443
Real host: 202.7.245.22:443

 

The recommendation is to capture a Wireshark trace from the affected client machine and see if something is re-directing the expected response to some other device or if there is some routing issue when trying to reach the gateway server externally.