topic Re: Cluster Activegate Test Connection Fail in Open Q&A

Cluster Activegate Test Connection Fail

mohit_gupta — Thu, 09 Dec 2021 15:42:59 GMT

Dear All,

I am setting up a Cluster ActiveGate for Mobile RUM and Synthetic monitoring while Testing connection to URL I am getting below issue.

Is SSL certificate is a mandatory thing for Mobile RUM?

Re: Cluster Activegate Test Connection Fail

franz_soengen — Fri, 28 Sep 2018 07:32:34 GMT

Hi Mohit,

you are getting these errors because your Cluster ActiveGate is not reachable from the Internet. You need to set a publicly available URL that your Mobile Users can reach.

Regarding your second question: all communication is encrypted so you'll need a working SSL configuration.

best regards
Franz

Re: Cluster Activegate Test Connection Fail

mohit_gupta — Fri, 28 Sep 2018 07:40:00 GMT

Hi Franz,

Thanks for your quick reply

Here am not targeting users who are coming from the internet instead am focusing on the on-premises (Local users) for which I think a valid SSL certificate with the domain name will be sufficient.

Re: Cluster Activegate Test Connection Fail

Julius_Loman — Fri, 28 Sep 2018 08:04:37 GMT

As @Franz S. says, this test is performed from the internet. So if your cluster ActiveGate isn't reachable from the internet, this test will fail.
If you are targeting mobile apps on a private network, it's probably ok. For mobile apps, you definitely need to have the gateway reachable from mobile devices (can be on private ip addresses) and also the certificate, which is issued for the FQDN of your gateway and is trusted by your mobile devices. The default certificate is selfsigned and will not work.

Re: Cluster Activegate Test Connection Fail

mohit_gupta — Wed, 03 Oct 2018 04:42:28 GMT

Hi Julius,

Thanks for the answer.

Re: Cluster Activegate Test Connection Fail

kalle_lahtinen — Thu, 29 Aug 2019 09:06:58 GMT

Hi,

In order for Dynatrace's public synthetic monitoring nodes to send data to a Cluster ActiveGate, do we need port 443, 9999, or both to be open towards the internet?

It doesn't say here: https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-activegate/configuration/which-network-ports-does-activegate-use/

Re: Cluster Activegate Test Connection Fail

kalle_lahtinen — Fri, 30 Aug 2019 07:36:43 GMT

The below doc contains somewhat conflicting info, as the picture shows TCP 9999 but the text says "[Cluster ActiveGate] external communication is only supported in a secure manner using HTTPS (port 443)". So I'm still not sure which one 🙂

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-managed/installation/managed-deployment-scenarios/#scenario-2-pure-dynatrace-managed-setup

Re: Cluster Activegate Test Connection Fail

mohit_gupta — Fri, 30 Aug 2019 07:48:37 GMT

Hi Kallel,

Until mobile beacon for RUM and Synthetic monitoring servers is able to send data to cluster active gate every configuration is fine.

You will need only one port to be opened and accessible from the internet. It depends on your networking team and firewall team what they permit as per the policies. Dynatrace active gate only listens to port 9999.

Re: Cluster Activegate Test Connection Fail

kalle_lahtinen — Fri, 30 Aug 2019 14:07:44 GMT

Thanks for the response, I believe you're correct. The reference in the documentation to port 443 should probably be replaced with 9999...

Re: Cluster Activegate Test Connection Fail

rmeli — Fri, 30 Aug 2019 15:30:28 GMT

We are trying to do the exact same thing. Can someone explain how this whole process flow happens and what IP addresses it is generated from. We have to whitelist specific IP addresses.

Re: Cluster Activegate Test Connection Fail

kalle_lahtinen — Fri, 30 Aug 2019 15:41:31 GMT

I believe it's currently described like this:

Source: Internet

Port: TCP/9999

Destination: Cluster ActiveGate

So basically you'd need to allow all incoming connections from the internet for TCP/9999. I haven't seen any specific IPs mentioned (like there is for Mission Control), the requirement is to allow the whole internet in.

Re: Cluster Activegate Test Connection Fail

rmeli — Fri, 30 Aug 2019 15:46:20 GMT

We can't allow the whole internet access for the Test environment we are currently working in. We can when we get to our Production environment.

Re: Cluster Activegate Test Connection Fail

Babar_Qayyum — Thu, 05 Sep 2019 06:05:42 GMT

Dear All,

We are going through the same situation. In Scenario 3: Integration with existing IT landscape is mentioned that port # 443 will be used for external contents so we did the same. Even though with the Cluster ActiveGate URL test connection is failing.

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-managed/installation/managed-deployment-scenarios/

Any hint in this regard?

Regards,

Babar

Re: Cluster Activegate Test Connection Fail

Julius_Loman — Thu, 05 Sep 2019 06:29:57 GMT

Default is the 9999/tcp. So you either have to reconfigure the Cluster ActiveGate to use the 443/tcp which I think may not directly work since binding to privileged ports (<1024) requires root/administrative rights for the user. Gateway does not run as root.

443 is mentions as it typically is the port firewalls are passing for standard SSL communications. Thus you will need a load balancer before the Cluster ActiveGate that will listen on the 443 and pass it to the Cluster ActiveGate.

Re: Cluster Activegate Test Connection Fail

mohit_gupta — Thu, 05 Sep 2019 07:41:49 GMT

Hi Babar,

Julius is correct, I have implemented the same using Load Balancer. For your better understanding please find the below architecture diagram of what I have implemented for one of our clients.

Re: Cluster Activegate Test Connection Fail

rmeli — Thu, 05 Sep 2019 11:50:12 GMT

The diagram is exactly the configuration we have. How are people going about testing whether it works or not? What does the “Test connection to URL” do exactly so we can trace where communications are failing?

Re: Cluster Activegate Test Connection Fail

mohit_gupta — Thu, 05 Sep 2019 12:00:53 GMT

Hi Roger,

Follow below troubleshooting steps.

https://www.dynatrace.com/support/help/offline-doc/how-do-i-set-up-mobile-apps-for-real-user-monitoring/

Regards,

Re: Cluster Activegate Test Connection Fail

skrystosik — Thu, 05 Sep 2019 12:14:49 GMT

For test purposes if you want to collect data from agentless rum monitoring or mobile app, devices has to be in network that has access to activegate, so you can use vpn or just use corporate wifi. You can as well use F5 before ActiveGate to not expose it individually.

Sebastian

Re: Cluster Activegate Test Connection Fail

rmeli — Thu, 05 Sep 2019 12:32:53 GMT

Thanks for the answers. I am trying the mobile app now. I am also on the corporate network and I can ping the F5 that sits in front of the cluster activegates. Is there something I can do to test that part of the connection? This is all new to me.

Re: Cluster Activegate Test Connection Fail

Babar_Qayyum — Thu, 05 Sep 2019 12:37:09 GMT

Hello @Julius L. and @Mohit G.

Thank you for your reply.

We have the same setup. I meant traffic is terminating on the LB using port 443 and then natting with LB VIP and forwarding traffic to the Cluster ActiveGates.

Do we need to open the Firewall for TCP port 9999 between LB and Cluster AciveGates?

This is the different thing I found in @Mohit G. diagram.

Regards,

Babar