Central Manager is connecting to sensors but not showing 'blue' status.

Products

• Security Analytics

Issue/Introduction

After an upgrade to Security Analytics 8.4.1.x, the sensors show up as "Not Connected" to the Central Manager (the installed version appears), but the status never turns 'blue'.  It remains 'gray'.

Running 'scm cmc test_connection' fails while trying to communicate with the sensors.  

The VPN tunnel is up and the CMC can ping the sensors via their VPN IP address just fine.  

Cause

Even though IP connectivity was established, the connection to receive status such as whether the sensor is capturing or not or to see the alerts from the sensor, the CMC uses a web API call for that information.  If a web API connection cannot be made, the sensor will never turn 'blue'.

In this specific case, there was a web proxy that was blocking the API calls.

Resolution

There should be no need to include the sensor's IPs in the proxy since all communication should be internal only.  If a proxy is required, exclude the IPs from the sensors in the 'No Proxy' section under Settings > Network.  

Restart apache by running:  systemctl restart httpd php-fpm.service

Additional Information