Skip to main content
Solved

Palo Alto firewall config issue

  • September 20, 2022
  • 4 replies
  • 739 views

Forum|alt.badge.img+1

Hi All,

 

I have Palo Alto firewall, able to cvping ports but socket read is failing

 

11284 2cd4 09/20 15:34:32 OT:00008 ######## [Mediaagent] ERROR: cvfwd_iot_wait(): Socket READ failed. Got READ error on ON_DEMAND control tunnel from "client" to "mediaagent" via (x.x.x.x.x, y.y.y.y): The specified network name is no longer available.

Best answer by Onno van den Berg

Make sure to leverage a Commvault network topology configuratie to restricted the amount of TCP ports being used by default to a single TCP port which is 8403 by default. check name resolving and in case this is all working than I would loo into specific firewall features like deep packet inspection.

View original
Did this answer your question?

4 replies

Forum|alt.badge.img+14

Hello @SGMak 

Thank you for your post. The error is suggesting that DNS cannot convert the Hostname of the remote machine that it is trying to connect to. Can you confirm DNS is working and there are no stale entries configured in the Hosts file?

It would also be good to confirm ports 8400 and 8403 are open at least one way between the two machines. If allowed one way we can configure a network tunnel so that we have the pipeline started in the direction that the ports.

 

Thank you,
Collin


Mike Struening
Vaulter
Forum|alt.badge.img+23

Hi @SGMak , thanks for the post!  

Can you confirm with your Firewall team that the Palo Alto is allowing traffic for web browsing, http-proxy  Bi-Directionally between client and Commserve?

https://applipedia.paloaltonetworks.com/

Thanks!


Onno van den Berg
Commvault Certified Expert
Forum|alt.badge.img+19
  • Commvault Certified Expert
  • 1227 replies
  • Answer
  • September 20, 2022

Make sure to leverage a Commvault network topology configuratie to restricted the amount of TCP ports being used by default to a single TCP port which is 8403 by default. check name resolving and in case this is all working than I would loo into specific firewall features like deep packet inspection.


KurtLO
Byte
Forum|alt.badge.img+3
  • Byte
  • 12 replies
  • January 23, 2025

FYI - had the same issue after switch to a Palo Alto and http-proxy was the app blocking the communication.


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings