Very newbie questions, I apologize...

Question

Hi to all, 
 we are trying to configure SPS / SPP for our environment, that is based on a DMZ, where we have placed SPS, with one network interface in DMZ and another one in Corporate LAN, with the aim to use only SPS to generate connections to our target servers. 
 Now ,we are trying to reach an SSH server (Ubuntu) inside the DMZ from SPP, that is placed in Corporate LAN, using SPS as vector. At the moment we are blocked becouse SPP cannot discover SSH host Key. 
 Is it possible, or SPP must "see" directly the SSH Target? 
 And another question: how can i see in SPP changes from SPS (e.g.: if i configure a new SSH connection in SPS, how can i propagate it to SPP, in order to see in Access Request Policies -> SPS Connection Policy? 
 THX 
 Silvio

tim westcott · Answer

Hi Silvio 
 So it sounds like you are talking about using an SPP originated session. 
 As you do not want to reset password then SPP would not need to access the target system/asset. 
 In this case then you NEED to use the SPP - SPS Join function. 
 Once you have the "Join" configured and working you will need to enter the details for the target system (asset) and account into SPP. You will also need to define the various policies and entitlements needed for the user who authenticates to SPP to allow a session to be requested. 
 You should then be able to make a request in SPP and have the session started from SPS. 
 Now for you things get a little more difficult as you want to have SPS effectively proxy the session but also route it to another segment. 
 Have to admit I have never done this , I don't know how to do this and I do not know for sure if this is possible. Still learning SPS myself.. I would have to "play" or ask somebody who does know... 
 ANY SPS GURU's out there care to comment? 
 If I was going to investigate this I would start by getting the "Join" function working correctly. 
 I would be looking at the SPS configuration to make sure that the networking configuration and routing is working to allow the SPS to be able to access the DMZ. You can use the troubleshooting tools in SPS to ensure that SPS can connect to the relevant target in the DMZ. 
 Now the "Join" will create the SPS policy in SPP to allow a session to be started via SPP. I would then expect SPS to handle the routing of the session to the DMZ. 
 Your local SSH clinet would then connect to the front of the SPS proxy but the SPS will then male the connection to the back end. 
 Finally you have not mentioned if you are clustering the SPS appliances. If so and IF this is possible then you would potentially have to configure all cluster members to be able to route traffic to the DMZ target or create a second Join with a single SPS to allow this connectivity. The SPS cluster used its own "load Balancing" algorithm to decide which cluster member handled the session so if each cluster member cannot route the traffic you could have another problem here. 
 Sorry I cannot be more help. 
 Good luck 
 Tim

tim westcott · Answer

Hi Silvio 
 So have you joined SPS to SPP? 
 IF not then I think this is your next step. 
 Without Join you cannot start an SPP originated session/. 
 The join process will add the required policy to allow you to communications between SPP and SPS you do not need to create on yourself. 
 You need to enable SPS cluster even if you have only 1 SPS to be able to get the join to work. 
 IF you do already have the Join setup correctly see if you can start an SPP originate session to a local rather than DMZ resource. 
 Good luck 
 All the best 
 Tim.

tim westcott · Answer

Hi Silvio 
 From an SPP point of view there is no difference in requesting an RDP to an SSH except the Access policy will be for SSH rather than RDP. 
 When you request the session via SPP the details of the target and the protocol to start the session will be passed to the SPS. This will then initiate the session. 
 You need to use the SPP thick client to be able to have a play/start button as for RDP. If you login via a browser session then you need to cut and paste the connection string into PuTTY or similar. 
 If you an start an RDP session via SPP the Join is working. 
 If you have a local Linux/Unix machine you could try connecting to this. just to make sure that you have all the settings and configurations correct for both SPP/SPS and the target system. 
 You will at least know that issue is down to the DMZ and not the connection policy on SPS or an SPP configuration. 
 I have seen old encryption protocols cause issue connecting to some unix system so it would be good to check all is working first. 
 As I mentioned in an earlier post I am still learning SPS myself and I am afraid I am running out of ideas of things to suggest so I think it is reaching the time where we both need one of the SPS guys to comment. 
 Good luck and if you do find a resolution please update this thread. 
 Best regards 
 TIm

tim westcott · Answer

Hi Silvio 
 Can you open port 22 between the SPP and your SSH target long enough to allow SPP to discover the key? 
 There is a KB 250836 that describes the error you are seeing. 
 I do not know for sure but I wonder if you allow SPP to discover the key for your asset if you could then create a session. via SPS. 
 I am thinking that if you can get the key into SPP you may then be able to start your session. Maybe SPS needs the key transferred to it as a part of the connection stream and because it cannot retrieve the key via SPS the process fails 
 If this does work you could then turn off the port 22 between the SPP and your target in the DMZ. 
 Hopefully one of the SPS guys who know will jump in to clarify what is going on. 
 All the best 
 Tim

Very newbie questions, I apologize...

Top Replies