Checkout errors when using zScaler with Harvest

Products

• CA Harvest Software Change Manager

Issue/Introduction

Harvest server was moved to a zScaler network and now clients can connect, but checkout operations fail with an error:

Unable to establish a remote connection (PEC ec=8)

The required ports are already open:

TCP - 13000/TCP to 15000/TCP

5101/UDP

Environment

CA Harvest Change Manager 14.x

Resolution

We have found an important ZScaler setting that could impact the use of Harvest, without which we run into many PEC issues.

Health reporting is a feature in AppConnector (of ZScaler) which probes the open ports in the system and checks for their health.

When the Harvest direct connection ports (that ones that PEC opens) are probed, they go into an inconsistent state (mostly CLOSE_WAITS) and that makes the connection unusable.

Therefore only Workbench browsing happens, but no check-ins or checkouts are possible.