topic Re: Oneagent is trying to communicate with a strange IP address in Alerting

Oneagent is trying to communicate with a strange IP address

juanrergis — Mon, 27 Nov 2023 07:43:10 GMT

I have a oneagent that is trying to communicate to the following IP address 11.100.XXX.XXX, 11.100.XX.XXX. Should I consider it a security threat?

Re: Oneagent is trying to communicate with a strange IP address

sujit_k_singh — Sat, 25 Nov 2023 09:24:54 GMT

@juanrergis Did you get a chance to verify from your network team?

Is this SAS environment or Managed?

Thanks,

Tijust

Re: Oneagent is trying to communicate with a strange IP address

Julius_Loman — Sat, 25 Nov 2023 11:31:25 GMT

First check if the IP address is not within the list of endpoints for OA by running oneagentctl --get-server

If this is the case, then most likely the IP address comes from one of your ActiveGates which you can confirm in Deployment status.

Re: Oneagent is trying to communicate with a strange IP address

juanrergis — Tue, 28 Nov 2023 17:16:50 GMT

Hello, it is an on-premise environment, the ip you mention is within the environment that raise the kubernets in Rancher, apparently the agents do not see as first option and try to connect through the other interface, is there any way I can define the ip addressing that raises or if this is corrected by assigning a network zone

Re: Oneagent is trying to communicate with a strange IP address

Julius_Loman — Tue, 28 Nov 2023 19:01:13 GMT

Hey @juanrergis ,

Sure it's possible by defining the dnsEntryPoint for the ActiveGate in custom.properties. If it's a containerized ActiveGate in Kubernetes, then you need to specify that in the DynaKube resource as shown here.