03/26/2020 10 People found this article helpful 455,223 Views
SMA (Secure Mobile Access) Appliance Management Console Troubleshooting: Part 4
This provides general troubleshooting instructions and discusses the troubleshooting tools available in the Appliance Management Console (AMC). Failure in core networking services (such as DHCP, DNS, or WINS) will cause unpredictable failures.
The User Sessions page in AMC can be used to monitor, troubleshoot or terminate sessions on your appliance or HA pair of appliances. You can sort through the summary of session details and, if needed, display details on how a device was classified, and why. About 24 hours worth of data is kept; even items that have been deleted or modified are displayed. See Viewing User Access and Policy Details in the SMA 11.3 Administration Guide.
SMA (Secure Mobile Access) Appliance Management Console Troubleshooting: Part 4
Topics in Part 4 will cover:
Troubleshooting Tools in AMC
You can monitor, troubleshoot or terminate sessions on your appliance, filtering them by user name, realm (authentication server), community, access agent, traffic load, and so on and then get a quick summary of particular sessions. Several basic network tools are also available, including ping, traceroute, DNS lookup, a routing table viewer, and a way to capture and filter network traces for backend connectivity troubleshooting.
Using DNS Lookup
You can use AMC's Lookup tool to determine how DNS is resolving an IP address or a host name. This tool is useful for troubleshooting various DNS problems (for example, it can determine whether your DNS server is running).
Use a fully qualified domain name or an IP address to specify a host in the Lookup tool. However, you can type a non-qualified host name as long as you have defined one or more default search domains on the Configure Name Resolution page (available from the Network Settings page in AMC). For details on name resolution, see Configuring Name Resolution in the Administration Guide.
To determine how DNS is resolving an IP address or host name
Viewing the Current Routing Table
You can view the current routing table from within AMC.
To view the current routing table
Capturing Network Traffic
This network traffic utility, which is based on tcpdump, allows you to capture a packet-by-packet list of the data going in and out of the appliance. If you are new to troubleshooting, you can use this utility to generate a file of network traffic data that can be sent to Technical Support for troubleshooting network issues. If you are familiar with troubleshooting and reading trace files, you can analyze the traffic using a network protocol analyzer, such as Wireshark.
Capturing all network traffic on your appliance can quickly result in files that are too unwieldy to analyze. Where possible, use filters to restrict the traffic to issues you are troubleshooting.
The following sample procedure demonstrates how to filter by host and port (in this example, an Exchange server and Web traffic).
To filter and capture network traffic to a file on the appliance
Comment: Internal interface, hosts: exchange.mycompany.com, selected ports
Internal interface (eth0): enabled
External interface (eth1): disabled
Protocol:
Hosts: exchange.mycompany.com
Ports: 80,443, 8080, 8443
Start time: Wed Aug 15 2007 17:56:52 GMT
Stop time: Wed Aug 15 2007 17:58:31 GMT
NOTE: Captured network traffic is not encrypted and may contain passwords and other sensitive information. If you have security concerns about storing a downloaded capture or sending it over an unsecured Internet connection, use Snapshot Tool in AMC instead. You can make a partial snapshot that includes only network captures, and then choose to encrypt the results. See Snapshot Tool on page 586 for more information.
You can capture network traffic on either of the appliances in a high-availability pair (the master node or the slave node).
Logging Tools for Network Tunnel Clients
To capture a session during which a user is running either of the network tunnel clients, have users follow these steps and email you the results. The Windows procedure differs from the one for Macintosh and Linux users.
To run ngutil on a Windows client computer
NOTE: You can also have users type the ngutil -tail=1000>client-log.txt command; this sends the most recent 1000 lines in the client log to a file named client-log.txt in plain text.
For more information on the syntax for the ngutil command, type ngutil -help at the command prompt.
To save session information on a client computer (Macintosh or Linux)
Ping Command
Use the ping command to verify a network connection. When you issue the ping command, it sends an ICMP ECHO_REQUEST packet to a target host and waits to see if the host answers.
To issue a ping command
Traceroute Command
Use the traceroute command to see the sequence of gateways through which an IP packet travels to reach its destination. This can help you find a network failure point.
To issue a traceroute
Snapshot Tool
A "snapshot " of your configuration can help Technical Support or other IT professionals diagnose any problems you are having with the appliance. This file, especially if it includes core dump files, can be quite large (the File Download dialog box in the final step will tell you how large).
To save a configuration snapshot
Using CEM Extensions
Technical Support may ask you to use Secure Mobile Access Configuration Extension Mechanism (CEM) advanced URL extensions.
These CEM extensions are used to access advanced AMC pages and should only be used when instructed to do so by Technical Support. For additional information, see Knowledge Base article at: https://support.sonicwall.com/sonicwall-e-class-sra-series/kb/sw10061
CEM Advanced Features
The Configuration Extension Mechanism (CEM) is a generic mechanism to allow simple configuration to be done for features that appear in maintenance releases or hotfixes. The CEM page allows the configuration of arbitrary key-value pairs for enabling advanced functionality. These key-value pairs are read from the extension config file by each service that has a patch generated for it (custom drop, hotfix, or maintenance release).
Advanced features should be used only under Support supervision. Please contact Support for additional instructions at:
Contact Support page at https://support.sonicwall.com/sonicwall-e-class-sra-series/ kb?k=Configuration+Extension Mechanism
Contact Support page at https://support.sonicwall.com/sonicwall-e-class-sra-series/ex9000