IDP or Access Gateway appliance/service install in DMZ fails with message Unable to contact the Admin Console at the given IP Address XXX.XXX.XXX.XXX

  • 7016598
  • 11-Jun-2015
  • 23-Jun-2015

Environment

NetIQ Access Manager 4.1

Situation

Admin Console is on internal network. Installing IDP or MAG (appliance or service) in the DMZ. The installation fails with the error:

Unable to contact the Admin Console at the given IP Address XXX.XXX.XXX.XXX

This caused by the DMZ firewall blocking port 8443 between AC and component being installed as a check to https://${ADMIN_CONSOLE_IP}:8443/roma/rest/ac/acinfo is performed in the install_utility_function.sh script

Resolution

Open port 8443/2443 between AC and new components in the DMZ.

or you can use the following work around:

The HTTP calls during cluster creation of the install can be disabled by commenting out the following lines in the .sh files under installation files extracted_folder/scripts.

ma_install.sh 76: checkCompatibility "${MAIN_INSTALL_LOG}"

ag_install.sh 108: checkCompatibility "${MAIN_INSTALL_LOG}"

install.sh 167: checkCompatibility "${MAIN_INSTALL_LOG}"

install.sh 188: checkCompatibility "${MAIN_INSTALL_LOG}"

ac_install.sh 704: checkCompatibility "${MAIN_INSTALL_LOG}"


Cause

It is understood that it can be time consuming via change control requests as well as raise security concerns to open a well known port to accommodate this check. This has been reported to engineering and is set to be corrected in next major release 4.2.

Status

Reported to Engineering

Feedback service temporarily unavailable. For content questions or problems, please contact Support.