Sensor is disconnected from SSP
search cancel

Sensor is disconnected from SSP

book

Article ID: 408906

calendar_today

Updated On:

Products

VMware vDefend Firewall VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

The "Sensor is disconnected from SSP" alarm is triggered when the Security Services Platform (SSP) has not received a heartbeat from the sensor for 15 minutes. This indicates a potential connectivity issue between the sensor and the SSP.

Environment

  • vDefend SSP >= 5.1
  • NDR Sensor >= 5.1

Cause

1. Sensor appliance is down: The sensor appliance is restarting or powered off.

2. Connectivity issues: There is a temporary or permanent network disruption between the sensor and the SSP, which could include issues with firewalls, routers, or switches.

3. DNS misconfiguration: Incorrect DNS settings on the sensor are preventing it from resolving the SSP Ingress FQDN.

4. Certificate issues: The SSP certificates has been updated, and the sensor does not have the new certificates.

5. Sensor restored from backup: The sensor certificate was missing in SSP after it was restored from backup because the sensor had been deleted after the backup was performed. This applies only to backups and restores performed on the same SSP instance.

Resolution

Please follow these troubleshooting steps from the NDR Sensor CLI using admin credentials to diagnose and resolve the issue

  1. Check for temporary issues: The sensor may be restarting or experiencing a temporary network issue. Wait for 15 minutes to see if the sensor reconnects on its own.

  2. Verify the power state of the sensor: Check if the sensor is powered off in vSphere. Power on the Sensor and wait for 15 minutes for the alarm to be auto-resolved.

  3. Verify Network Connectivity: Ensure the sensor has a valid network path to SSP. Check for any firewalls or network devices that might be blocking traffic between the sensor and SSP.
    Note: The SSP FQDN/IP cannot be ping-ed or traceroute-d for security reasons. So, running diagnostic tools like ping and traceroute from the sensor to the SSP FQDN/IP will not work.

  4. Verify DNS configuration: Verify the Sensor's DNS configuration and ensure it can resolve the SSP's FQDN.  Please follow these troubleshooting steps from the NDR Sensor CLI using admin credentials to diagnose and resolve the issue:
ndr-sensor> nslookup <ssp-ingress-FQDN>

Verify if name-servers are set in case the management interface is configured with static IP.

ndr-sensor> get name-servers
ndr-sensor> get search-domains

If not configured, add required name-servers and search domains when management interface is configured with static IP. 

ndr-sensor> set name-servers <ip-address>
ndr-sensor> set search-domains <domain>

5. Check connectivity status on the sensor : The SSP's certificates may have been changed recently due to certificate rotation or updation of ingress certificate. It might be worth checking, if the certificate change has caused any issues. 

Run the command the below command to check the communication status of sensor with SSP

ndr-sensor> get sensor details

If the "Error message" in the output of the above CLI is either -"I/O error on PUT request for "https://<ssp-ingress>:443/sensors/appliances/<sensor-id>/status": PKIX path building failed" or "Access to SSP from this sensor is unauthorized or forbidden. If this error persists, then it is likely that this sensor may have been off-boarded from SSP", the recommendation is to re-register the sensor.

Then invoke the reset of registration. 

ndr-sensor> reset registration

Generate a new registration token from the SSP under System > NDR Sensors > Sensor Registration Tokens. Register the sensor again.

ndr-sensor> register sensor registration-manifest <registration-token> sensor-name <Sensor-name>
passphrase:

Note: Even after a sensor's registration is reset via the command line or the sensor is off boarded from SSP, the data it generated for verticals - NDR, NTA, and MPS will be retained by the verticals within SSP. The time for which the data is retained is driven by the vertical's data retention policies.

6. Off board unused Sensors: If the Sensor is no longer required, and is intentionally powered off, then "off board" the Sensor under System > NDR Sensors. The Sensor is not required to be in "Powered on" state for the off boarding process. The unused Sensor VM can be deleted from vSphere manually. 

If Sensor still remains in disconnected state after following these steps, then it is advisable to collect the NDR Sensor support bundle (refer documentation for how to collect support bundle) and raise a support ticket.

Powered by Wolken Software