RedHat 7 Firewalld is Blocking BES Traffic - BES Client
| 0 Votes |
Versioning - This is the latest version.
| 1 | RedHat 7 Firewalld is Blocking BES Traffic - BES Client | 9/25/2015 12:56:38 PM |
| 2 | RedHat 7 Firewalld is Blocking BES Traffic - BES Client | 10/2/2015 6:43:30 PM |
Description
|
The listed computers have firewalld enabled and are not configured to allow inbound UDP traffic on the port used by BES (BES uses port 52311 by default). The BES Server and BES Relays send UDP packets to the BES Clients to notify them that there is new information available such as new Fixlet messages, actions, and computer refreshes. BES Clients on relevant computers will not receive UDP notification packets and therefore will not see new actions or new Fixlet messages until they gather the new actionsite, which is by default, once a day. After configuring firewalld to allow inbound UDP traffic on the BES Listen Port, BES Clients will resume normal communication with the BES Server and BES Relays. Note: After this action is applied, affected BES Clients will not report until they have performed their standard once-per-day gather or until the BES Client is restarted. Note: The firewalld configuration is modified by inserting a new service into /etc/firewalld/services and enabling it on the default zone. |
Property Details
| 6221 | |
| Beta - Preliminary testing ready for more | |
| RedHat 7 Firewalld is Blocking BES Traffic - BES Client | |
| Support | |
| 0 | |
| Important | |
| 10/2/2015 6:43:30 PM | |
| rexit1982 on 10/2/2015 6:43:30 PM | |
| rexit1982 on 2/19/2018 7:33:34 AM | |
| 10240 Views / 22 Downloads | |
* Average over 0 ratings.
** Log In or Register to add your rating.
|
Relevance
| Used in 223 fixlets | * Results in a true/false |
(if exists property "in proxy agent context" then ( not in proxy agent context ) else true )
| Used in 32 fixlets | * Results in a true/false |
(if (version of client >= "8.0") then (unix of it) else ((it does not start with "Win" AND it does not start with "Mac OS X") of name of it)) of operating system
| Used in 4 fixlets | * Results in a true/false |
exists file "/proc/net/ip_tables_names"
| Used in 6 fixlets | * Results in a true/false |
NOT exists file "/etc/firewalld/zones/public.xml" whose ( exists ( lines of it ) whose ( it does not start with "#" AND it contains "<service name=%22bigfix%22/>" ) ) AND exists file "/etc/firewalld/zones/public.xml"
| Used in 2 fixlets | * Results in a true/false |
exists match (regex "Linux Red Hat Enterprise (AS|ES|WS|Client|Server|Workstation) (7)") of name of operating system
Actions
Action 1 (default)
Action Link Click
here to leave firewalld enabled, but create a service and enable it on the default zone to allow incoming traffic on the port reserved for BES.
Script Type
BigFix Action Script
//Modify the iptables saved ruleset
delete __appendfile
appendfile #!/bin/bash
appendfile echo -e '"1.0" encoding="utf-8"?>\n\n ' > /etc/firewalld/services/bigfix.xmlbigfix \nThe BES Server and BES Relays send UDP packets to the BES Clients to notify them that there is new information available such as new Fixlet messages, actions, and computer refreshes. This service permits that traffic on the port designated by the server. \nport="{port number of selected server as string}"/>\n
appendfile firewall-cmd --reload
appendfile firewall-cmd --permanent --add-service=bigfix
appendfile firewall-cmd --reload
wait chmod +x "{(client folder of current site as string) & "/__appendfile"}"
wait "{(client folder of current site as string) & "/__appendfile"}"
//delete delete __appendfile
Success Criteria
This action will be considered successful when the applicability relevance evaluates to false.
Action 2
Action Link Click
here to disable firewalld.
Script Type
BigFix Action Script
//Disable iptables
delete __appendfile
appendfile #!/bin/bash
appendfile systemctl disable firewalld.service
appendfile systemctl stop firewalld.service
wait chmod +x "{(client folder of current site as string) & "/__appendfile"}"
wait "{(client folder of current site as string) & "/__appendfile"}"
//delete delete __appendfile
Success Criteria
This action will be considered successful when the applicability relevance evaluates to false.
Action 3
Action Link Click
here for information on how to make this action a "policy" action that will automatically open the BES port on any computer that has this Fixlet message relevant.
Script Type
URL
http://support.bigfix.com/cgi-bin/kbdirect.pl?id=113
Sharing
| Social Media: |
Comments
 |
|
| Replaced by "Unified" version for both RHEL and CentOS7 - https://bigfix.me/cdb/fixlet/25072 | |
 |
|
| @rexit1982 Oh, okay. I was confused because of the data in the fixlet since you copied and modified an existing one. I would recommend reading this about CentOS / RHEL relay firewalls. Even though it is about relays, some of it relates to the changes needed for a client as well: https://forum.bigfix.com/t/firewall-fix-when-setting-up-centos-rhel-fedora-relay/13697 | |
|
|
| @gregd7 - Thank you, that explains the somewhat inconsistent results I was getting in my tests. I only had about 5 el7 machines being managed and every time I would re-run the action or the command manually it would work. I'll update that with a couple minor tweaks to the description to be more accurate about the service placement. @jgstem - I do not see a RHEL7 firewalld fixlet show up for me in the BES Support Site, but I do not have any RHEL7 deployed yet all of my version 7 is CentOS. There is a fixlet for RHEL 3/4/5/6 running iptables that I copied out and jsut updated the relevance for CentOS 3/4/5/6. I took that logic and built this to work on CentOS7 and just reversed the relevance to create a separate fixlet for RHEL7. | |
|
|
| @gregd7 I believe this fixlet is actually provided by IBM in the console, so you should open a forum post with this suggestion and possibly file an RFE&PMR as well. The forum is here: https://forum.bigfix.com/ | |
 |
|
| Add a line "appendfile firewall-cmd --reload" before "appendfile firewall-cmd --permanent --add-service=bigfix" in action 1. | |
|
|
| We found that you need to do a reload after creating the bigfix.xml service. Without this the "firewall-cmd --permanent --addservice=bigfix" command doesn't work as it does not know what the bigfix service is. | |
