|
| 1 | +--- |
| 2 | +applies_to: |
| 3 | + deployment: |
| 4 | + self: |
| 5 | + ece: |
| 6 | + eck: |
| 7 | +navigation_title: Firewalls blocking {{agent}} |
| 8 | +products: |
| 9 | + - id: cloud-kubernetes |
| 10 | + - id: cloud-enterprise |
| 11 | +--- |
| 12 | + |
| 13 | +# Troubleshoot firewalls blocking {{agent}} |
| 14 | + |
| 15 | +If you are running into issues connecting your cluster to AutoOps, a corporate firewall might be blocking {{agent}}. |
| 16 | + |
| 17 | +There are [three main components](/deploy-manage/monitor/autoops/cc-autoops-as-cloud-connected.md#how-your-self-managed-cluster-connects-to-autoops) of {{agent}}'s connection with your system: |
| 18 | + |
| 19 | +:::{include} /deploy-manage/monitor/_snippets/autoops-cc-components.md |
| 20 | +::: |
| 21 | + |
| 22 | +The following subsections describe how to test each of these components to find out where the problem lies, and then implement an appropriate solution. |
| 23 | + |
| 24 | +:::{tip} |
| 25 | +Run the following tests within the context of your execution environment. That is, if your chosen installation method is Kubernetes, run the commands from within the pod; for Docker, run the commands from within the container, and so on. |
| 26 | +::: |
| 27 | + |
| 28 | +## 1. Test {{agent}}'s connection with your cluster |
| 29 | +If there is an issue with the first component, {{agent}} cannot connect to your cluster. |
| 30 | + |
| 31 | +To test if your organization is not allowing this connection, run the following command depending on your chosen authentication method: |
| 32 | + |
| 33 | +:::::{tab-set} |
| 34 | +:group: api-key-or-basic |
| 35 | + |
| 36 | +::::{tab-item} API key |
| 37 | +:sync: api-key |
| 38 | + |
| 39 | +```json |
| 40 | +curl -XGET -i $AUTOOPS_ES_URL \ |
| 41 | +-H "Authorization: ApiKey $AUTOOPS_ES_API_KEY" |
| 42 | +``` |
| 43 | +:::: |
| 44 | + |
| 45 | +::::{tab-item} Basic |
| 46 | +:sync: basic |
| 47 | + |
| 48 | +```json |
| 49 | +curl -XGET -i $AUTOOPS_ES_URL \ |
| 50 | +-u $AUTOOPS_ES_USERNAME |
| 51 | +``` |
| 52 | +:::: |
| 53 | + |
| 54 | +::::: |
| 55 | + |
| 56 | +The command returns a response similar to the following: |
| 57 | + |
| 58 | +```json |
| 59 | +{ |
| 60 | +"name" : "1c72f00a6195", |
| 61 | +"cluster_name" : "my-ccm-cluster", |
| 62 | +"cluster_uuid" : "2O_EjO6kTR6AEVYwL5fPEw", |
| 63 | +"version" : { |
| 64 | +"number" : "9.1.3", |
| 65 | +"build_flavor" : "default", |
| 66 | +"build_type" : "docker", |
| 67 | +"build_hash" : "0c781091a2f57de895a73a1391ff8426c0153c8d", |
| 68 | +"build_date" : "2025-08-24T22:05:04.526302670Z", |
| 69 | +"build_snapshot" : false, |
| 70 | +"lucene_version" : "10.2.2", |
| 71 | +"minimum_wire_compatibility_version" : "8.19.0", |
| 72 | +"minimum_index_compatibility_version" : "8.0.0" |
| 73 | +}, |
| 74 | +"tagline" : "You Know, for Search" |
| 75 | +} |
| 76 | +``` |
| 77 | + |
| 78 | +If you do not receive a similar response, your system returns an error indicating one or more reasons for the failure as outlined in the following table. Use the corresponding proposed solution to fix the issue. |
| 79 | + |
| 80 | +| Reason for failure | Proposed solution | |
| 81 | +| :--- | :--- | |
| 82 | +| The {{es}} endpoint URL you specified is incorrect/not reachable | - Make sure you are using the correct protocol in the cluster URL:`http` or `https`. <br> - Make sure you are providing the correct port. The default port is **9200**. <br> - If you have verified that the URL is correct, your network team might need to open the firewall to allow-list this URL. | |
| 83 | +| Your API key is incorrect | - Recheck for typos. <br> - If your cluster is on versions 9.1.0 through 9.1.3, ensure that you have the base64-decoded version of the key by running the following command: <br><br> `echo $AUTOOPS_ES_API_KEY | base64 -d` <br><br> If your key has a colon (:), it is not base64 encoded. If your key has an equal sign (=), it is base64 coded. <br> For versions 9.1.4 and above, both formats work.| |
| 84 | +| Your username or password is incorrect | - Recheck for typos. <br> - Ensure that your provided user has the [necessary privileges](/deploy-manage/monitor/autoops/cc-connect-self-managed-to-autoops.md#configure-agent). We do not recommend providing a privileged superuser like `elastic` for this purpose.| |
| 85 | +| You are providing both the API key and username/password | Choose one type of authentication only. | |
| 86 | +| A proxy is blocking communication with your {{es}} cluster | You might have to [configure `NO_PROXY`](/reference/fleet/host-proxy-env-vars.md). | |
| 87 | +| You are using a custom SSL/TLS configuration with {{es}} | Disable SSL/TLS verification so that your system trusts all certificates. We do not recommend disabling verification in production environments. <br><br> If you are using API key authentication, run the following command: <br><br>`curl -XGET --insecure -i $AUTOOPS_ES_URL \ -H "Authorization: ApiKey $AUTOOPS_ES_API_KEY"`. <br><br> If you are using username/password authentication, run the following command: <br><br> `curl -XGET --insecure -i $AUTOOPS_ES_URL \ -u $AUTOOPS_ES_USERNAME` <br><br> If the issue is resolved, you need to configure your custom SSL/TLS settings with {{agent}}. If the issue persists, contact [Elastic support](https://support.elastic.co/).| |
| 88 | +| You are connecting a local development cluster using Docker without specifying `--network host` | - Make sure you are following all the steps to [connect your local development cluster to AutoOps](/deploy-manage/monitor/autoops/cc-connect-local-dev-to-autoops.md#connect-your-local-development-cluster-to-autoops). <br> - In the [Install agent](/deploy-manage/monitor/autoops/cc-connect-self-managed-to-autoops.md#install-agent) step, make sure you are replacing `docker run -d \` with `docker run -d --network host \`. | |
| 89 | + |
| 90 | +## 2. Test your cluster's registration with {{ecloud}} |
| 91 | + |
| 92 | +If there is an issue with the second component, the agent stops working and your logs might show the following error: |
| 93 | + |
| 94 | +```sh |
| 95 | +... failed to register Cloud Connected Mode: ... Post \"https://api.elastic-cloud.com/api/v1/cloud-connected/clusters\": ... |
| 96 | +``` |
| 97 | + |
| 98 | +To test if your organization is not allowing the agent to register your cluster with {{ecloud}}, run the following command: |
| 99 | + |
| 100 | +```json |
| 101 | +curl -XPOST -i \ |
| 102 | +https://api.elastic-cloud.com/api/v1/cloud-connected/clusters \ |
| 103 | +-H 'Content-Type: application/json' \ |
| 104 | +-d '{"self_managed_cluster": {"id": "my-cluster-uuid", "name": "my-cluster-name", "version": "9.1.0"}, "license": {"uid": "my-license-id", "type": "basic"}}' |
| 105 | +``` |
| 106 | + |
| 107 | +The command should return an HTTP 401 response: |
| 108 | + |
| 109 | +```json |
| 110 | + {"UnauthorizedMessages":["Invalid credential headers"],"Cause":null} |
| 111 | +``` |
| 112 | +If you do not receive a similar response, configure your HTTP proxy to allow it to reach the URL (with headers and a JSON body): |
| 113 | + |
| 114 | +```json |
| 115 | + POST https://api.elastic-cloud.com/api/v1/cloud-connected/clusters |
| 116 | +``` |
| 117 | +:::{note} |
| 118 | +If you are using Docker, you might need to complete this configuration directly using the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. |
| 119 | +::: |
| 120 | + |
| 121 | +## 3. Test if {{agent}} is able to send metrics |
| 122 | + |
| 123 | +If there is an issue with the third component, the agent attempts to establish the connection and your logs might show the following error: |
| 124 | + |
| 125 | +```sh |
| 126 | +... Exporting failed. Dropping data. ... no more retries left: failed to make an HTTP request: Post \"https://otel-collector.auto-ops.eu-west-1.aws.cloud.elastic.co:4318/v1/logs\": ... |
| 127 | +``` |
| 128 | + |
| 129 | +To test if your organization is not allowing the agent to send metrics from your cluster to {{ecloud}}, run the following command. The command uses AWS eu-west-1 as the CSP (cloud service provider) region, but you should replace it with your chosen CSP region before running the command. |
| 130 | + |
| 131 | +```json |
| 132 | +curl -XPOST -i \ |
| 133 | +https://otel-collector.auto-ops.eu-west-1.aws.cloud.elastic.co:4318/v1/logs \ |
| 134 | +-H 'Content-Type: application/json' |
| 135 | + |
| 136 | +``` |
| 137 | +The command should return an HTTP 401 response: |
| 138 | + |
| 139 | +```json |
| 140 | + {"code":16,"message":"no auth provided"} |
| 141 | +``` |
| 142 | + |
| 143 | +If you do not receive a similar response, configure your HTTP proxy to allow it to reach the URL (with headers and an arbitrary body): |
| 144 | + |
| 145 | +```json |
| 146 | + POST https://otel-collector.auto-ops.${REGION}.${CSP}.cloud.elastic.co:4318/v1/logs |
| 147 | +``` |
| 148 | +:::{note} |
| 149 | +If you are using Docker, you might need to complete this configuration directly using the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. |
| 150 | +::: |
0 commit comments