Secure App Connector V2 CLI

Last updated
Save as PDF

Connector V2 CLI enables admins to know the status, manage, run diagnostics, and troubleshoot their secure app connectors by connecting to the host using SSH (secure shell)

Log on to the connector host using SSH (Secure Shell) and execute the required commands to troubleshoot a connector.
If you are a a root user or a non-root user, execute pa_connector the script from anywhere on the host.

Verification of Secure App Connector V2

Provides the list of commands you can execute:

Run the Status option to verify the status of the connector deployment.

Check tunnel status:

The connector shows the status as Normal when tunnels are up.
The connector shows the status as Critical when tunnels are down.

Run the Diagnostics tests option to verify the connector setup.

Troubleshooting Secure App Connector V2

Provides the list of commands you can execute:

Run the Troubleshooting option to help you troubleshoot the Secure App Connector-related issues.

image (21).png

Select Download Logs to download all logs and configuration details to a temp (/tmp/) folder on the host once diagnostics tests are completed.

Option 6.png

Download Logs

You can download all logs and configuration details to /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz

Log on to the connector host using SSH.
Execute pa_connector > enter 6.
Downloads /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz file to the temp (/tmp/) folder once the command is executed completely.
You can upload the latest file /tmp/Connector-logs-2023-07-12_06-32-26.tar.gz to the support portal for review.

Resolving Host Names

For a Connector to function, the system Domain Name Service (DNS) should be able to resolve both Skyhigh Security URLs and Private Application URLs. You can do the following to resolve host names using the system DNS:

Perform the following to check if the system DNS is resolving both Skyhigh Security and Private Application URLs:

Log on to the connector host using SSH (Secure Shell).

Execute pa_connector > enter 3 > enter a > enter the domain name.

Resolving Host Names .png

Test the system proxy

Perform the following to test if a private application connection is established with the connector via the system proxy:

Log on to the connector host using SSH.

Execute pa_connector > enter 3 > enter b > enter the system proxy address.
Displays if the private application connection is established with the connector via system proxy.

image (32).png

Test Ping

Perform the following to test ping:

Log on to the connector host using SSH.

Execute pa_connector> enter 3 > enter c.

Test Ping (2).png

Test Connectivity to Private App and Capture Packets

Perform the following to check the private application connectivity:

Log on to the connector host using SSH.

Execute pa_connector > enter 3 > enter d.
Downloads .pcap file to the temp (/tmp/) folder once the command is executed completely.
You can upload the latest file pa_capture-currentdate.pcap to the support portal for review.

image (33).png

Enter command on ztna pod

Perform the following to execute command on ztna pod:

1. Log on to the connector host using SSH.

2. Execute pa_connector > enter 3 > enter e.

Enter command on ztna pod .png

Manage Secure App Connector V2

Perform the following to manage connectors:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter <g or h or i or j>.

image (23).png

Start health update

Perform the following to start all connector services:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter h.

Note: This action will bring the connector back online, and traffic will restart being directed to this connector

Restart connector services

Perform the following to restart all services that run in a connector:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter i.

Stop health update

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter g.

Note: Stopping health updates will stop any PA app traffic coming to this connector. Effectively, the connector will be offline.

Update host DNS

Perform the following to update host DNS:

Log on to the connector host using SSH.

Execute pa_connector > enter 4 > enter j.

Select the About option to know the Secure App Connector version.

image (20).png

Enter 0 to exit from the command console.

MicrosoftTeams-image (11).png

Tips

Note: Any new /etc/hosts entries, the connector must be restarted.

To log into the pod, run sudo kubectl exec -it <ztna_pod_name> -n ztna -- bash
Login to ztna pod and monitor health Updates: Check/skyhigh/mount/logs/healthUpdate.log to ensure that the VPN tunnel is up. The health update requires the list of private applications monitored by the connector. So, check if the private application list sync is successful and /skyhigh/private_apps.json is present.
Proxy to private applications: Check/skyhigh/mount/logs/debug.log to ensure that an application is reachable and not blocked by the policy. Ensure that the DNS configured on the connector can access private applications and resolve their URLs.

Common Errors and Workaround

Task	When	Error	Workaround
Private Application list sync		Error: - Exception connecting to https://api.wgcs.skyhigh.cloud.com/pa/v1/connector-registration: HTTPSConnectionPool(host='api.wgcs.skyhigh.cloud.com paList-Sync Failed	Check the `/.../mount/logs/paListsync.log`if Skyhigh cloud API is not reachable. If this is not reachable, then ensure it is reachable to synchronize the private application list with the connector.
Private Application is not reachable			Run the command on the connector pod: `curl -v -k https://app-server` If curl also fails, then ensure that the IP of the connector pod and host IP are not on the same subnet (10.254.254.x)
Accessing Private Application	Able to access Private Application using Firefox browser, but failed to access the same application on the Chrome browser	Google Chrome - Taking Too Long to Load	Disable the Use secure DNS option on Google Chrome. The Use secure DNS option should be disabled to access private applications. Go to Chrome browser > Settings > Privacy and Security > Disable the Use Secure DNS option.
Dual stack VMs/Hosts	Connector installation in a dual stack VM/host	Pods don't come to running state	If the VM/host is enabled for both IPv4 and IPv6, ensure that it gets proper IP addresses for both the IPv4 and IPv6 interfaces. If IPv6 is disabled in the network, then the IPv6 interface on the host should also be disabled.
Connector Registration	Connection to registration endpoint	Connection to registration endpoint - failed	Check whether Skyhigh Cloud API reachable Check the existence of tun0 and tun1
Bringing up the VPN tunnel	GW or HTTP_PROXY are not reachable	Error while resolving hostname Exception while checking Proxy Exception while checking PA Gateway Unable to connect to Proxy Unable to connect to PA Gateway	Connector maintains an outbound VPN tunnel with PA Gateway. Run `ifconfig` to check `tun` adapter and the IP address assigned by the Private Access Gateway. Check whether the gateway port 443 provided to `infra.sh` is reachable from the connector.