Unknown inbound traffic from 72.163.7.115

[marktrigg67]

Hi can anyone identify what this IP source 72.163.7.115 is that I am seeing inbound on my firewall and hence being denied. The destination IP is the outside global address of my collector. Source port is 8443 whilst destination is random high ports. I can find no refrence to it in any documentation.

Thanks

Mark

[adias]

The collector has a module that can be allowed to do RMC, typically used so that Services like Partner support can support the BOX, if the CSPC collector you are referring to is just for SNTC service this module is not required. Those connections I believe are heartbeats to verify if connection does exist.

72.163.7.115 cacsoapp-prd-22 ReverseProxy RMC

Using SSH you access the CLI user admin ( not the same authentication as the GUI ) you can enable/disable the Websocket process that do those attempts

admin# conf websocket *
-----------------------------
Usage:
admin# conf websocket <action>
Eg:
admin# conf websocket enable
admin# conf websocket disable

[marktrigg67]

Hi Adias,

Thanks for the prompt reply. I am assuming then the Cisco CSPC quick start guide from Feb 2018 I'd been handed is incorrect then. In it I had two outbouand addresses to allow through my firewall on 443 these being  72.163.7.113 and 72.163.7.125 whilst inbound for remote management I had concsoweb2prd.cisco.com allowed on TCP 442 which actually maps to 72.163.7.16.

 

Happy to turn off the websocket but still not clear now what addresses need to be open for the collector to reach the portal to register. There will be no remote inbound management.

Also from a different post when trying to test connectivity i found reference to the command below however when I try it I received an error no such command.

curl --tlsv1.2 https://concsoweb-prd.cisco.com/HeadEndWebAppServlet/ -v -k

I have also fell foul pof the recent issue og the gui upgrade button not working properly so have my collector stuck upgrading to 2.8.1.6 Apply-In -Progress although CLI access still working.

If I can confirm i can reach collector i can focus on upgrade.

Cheers

Mark

[adias]

Well not necessarily the collector (CSPC) itself is multi service and it provide a number of different option in itself. So it depend if the CSPC guide you saw was generic or specific for SNTC,  send me the link and I can review it for you.

[marktrigg67]

Hi,

The guide I had was

Cisco CSPC 2.7.x
Quick Start Guide
Feb 2018

Also are you able to answer my query regarding a cli command to test connectvity to the portal to prove the firewalls are open correctly. My  collector hung whilst doing the upgrade (started using the GUI button from 2.8.1.4 to 2.8.1.6) and so have asked customer to delete and go back to 2.8.1.4

Thanks

Mark