B
Troubleshooting
76
System Connectivity
A number of problems with EFW can be solved by checking the system connectivity and
the binding between the components of the EFW system.
Policy Server-to-NIC Communication Check
To determine if Policy Server-to-NIC communication is functioning as expected, follow the
steps below.
1
Verify that the Policy Server can reach the NIC.
a
From the NIC window in the Management Console, click the Status button to see if
the server can reach the NIC.
b
Ping from the Policy Server to the IP address of the NIC. If this ping fails, you may
have a network outage or a network routing issue to resolve.
c
Verify that any intervening firewalls allow UDP traffic from the Policy Server to the
NIC, as well as UDP traffic from ephemeral ports on the secured computer hosting
the NIC to the Policy Server's ports.
d
If you have network-monitoring software, use it to determine where the
communication breakdown is occurring. You can also view the domain settings in
the Management Console to determine which ports are being used by the Policy
Server for communication with the NICs. This information assists you in identifying
EFW traffic using your network-monitoring software.
2
Verify that the NIC identifies the Policy Server as its assigned Policy Server and
recognizes communication from this Policy Server.
■
Make sure the Policy Server is listed as the primary Policy Server on the NIC
information window, or as a backup for the NIC's primary Policy Server in the
Policy Server information window. If it isn’t listed, the NIC does not respond to
communications from that Policy Server. Therefore, you need to change the Policy
Server assignment. If the Policy Server assignment is correct, continue to the next
bullet.
■
Check the
embdfw.ini
file (under the system or system32 folder on the secured
computer) to verify that the IP address of the Policy Server is listed in this file. If it
isn’t listed, the NIC is unlikely to respond to communications from the Policy Server.
If you do not find the IP address for the Policy Server in this file, but the NIC
assignment to the Policy Server was correct in the Management Console, a
configuration update to the NIC could have failed due to network problems. This
failure is automatically corrected at the next heartbeat. To immediately correct the
problem, you can manually add the correct IP addresses of the NIC's Policy Servers
to the
embdfw.ini
file, and reboot the secured computer.
■
NAT boxes must preserve the Policy Server's IP address and ports in packets sent to
the NIC. Otherwise, the NIC does not recognize these packets as coming from its
Policy Server.
■
The NIC and Policy Server must agree on communication ports, or the NIC does not
recognize traffic from the Policy Server. The
embdfw.ini
file identifies the control
and audit ports the NIC uses for communication with the Policy Server. The Domain
Settings window in the Management Console identifies the Policy Server's ports.
If these are inconsistent, you should uninstall and then reinstall the EFW NIC.
NOTE:
Make sure to use an installation image that you created while connected to
a Policy Server in the domain to which your NIC belongs.
