Solved

Telnet IP/port - Testing for connectivity question

Posted on 2016-07-25
11
113 Views
Last Modified: 2016-07-27
I'm trying to install some timeclocks at a site, and the clock is having connectivity issues.  I'm thinking it's the clock because we've already installed 15 of them at different sites, but need to confirm why its the clock.  This switch is sitting behind a firewall and needs to go out the internet into the vendor's server in their DMZ (172.156.69.22, port 443).  

I did a telnet 170.146.69.22 443 from the switch and get the following output:

Core_Switch>telnet 170.146.69.22 443
Trying 172.156.69.22, 443 ... Open


Does this telnet test prove that the routing is good from my switch out to their server and back?  

Another question:  If I see traffic leaving my FW, but no hits on return traffic, what are some possible root causes?
0
Comment
Question by:PeraHoman
  • 4
  • 4
  • 2
  • +1
11 Comments
 
LVL 18

Expert Comment

by:Akinsd
ID: 41727961
It looks like connectivity is okay from the core switch if the telnet was successful
Is the vendor using a NATed address for the clock (verify address is typed and mapped correctly)
Verify the vlan on the port switch the clock is connected to as well
0
 

Author Comment

by:PeraHoman
ID: 41727978
To make sure, the telnet test is proof that the vendor's server is reachable and has a route back into my network.



We are using a private address in our network for the time-clock.  It then gets routed through our shared internet circut we use for small sites.  The clock is pingable within our network, but there's an issue reaching their server.  Our security guy said he sees traffic leaving, but not returning (not sure how this is happening)
0
 
LVL 14

Assisted Solution

by:frankhelk
frankhelk earned 250 total points
ID: 41728216
The classic test for routing issues would be PING, if that failes, traceroute would be the next stop on the road.

If traffic goes out, but didn't come back, I presume the returning route is affected. Keep in mind:

Setting a route tells a station who will accept packets to be transported to a remote destination. That doesn't include information for the remote destination's station how to send packets back to you, so the clock on the other side needs routing info, too. And that's not a weakness, it's one of the strongest powers of the internet.

So be sure that the clock on the other side has a ruting entry that tells it how to reach your system .... most routing problems I stumble upon emerge from such config errors.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 18

Expert Comment

by:Akinsd
ID: 41728296
The telnet results eliminates routing issue from core to the server as well as confirm that the port is open. If the test had failed, then a trace route or port testing would be necessary.

With that said, can you ping the clock from the switch?
0
 

Author Comment

by:PeraHoman
ID: 41728300
Ping and trace routes won't work on my case because they are disabled at the FW whenever traffic is trying to leave the network and out to the Internet.

I don't think routing is an issue because we are able to open a telnet session to the ADP server at the switch where the clock is hanging from. What I really wanted to know is: if I'm able to telnet from my switch to the vendors clock server then is it justifiable to say that IP routing is good between the two and the issue lies elsewhere.
0
 

Author Comment

by:PeraHoman
ID: 41728311
Yes. I can ping the clock. It's confusing because  the FW guy said he sees traffic leave but no return traffic. If it's the clock then shouldn't we see a hit on the return traffic at the firewall or does it have to hit the clock to count it as a hit?  The FW guy did say there was no NAT involved, but the ADP server is located out through the Internet so there should be NAT...right? -- maybe he doesn't know what he's saying?
0
 
LVL 18

Accepted Solution

by:
Akinsd earned 250 total points
ID: 41728318
Yes, from the core to the server.
It doesn't include connectivity from the clock to the switch - That wouldn't be a rout issue but a layer 2 issue
0
 

Author Comment

by:PeraHoman
ID: 41728320
The clock to the switch is fine. We can ping it and it shows up on the arp table. I'm thinking it's the clock -- maybe that clock doesn't have certain ports opened or faulty.
0
 
LVL 18

Assisted Solution

by:Akinsd
Akinsd earned 250 total points
ID: 41728328
Ok
Was the clock pre programmed?
Check the configuration on the clock and maybe compare with one of the ones that are working.
There' a chance something is wrong on the clock config

If a known working clock is available for testing, it won't hurt to try that from that location as well
0
 
LVL 9

Expert Comment

by:Ian Arakel
ID: 41730977
Hi There,

A confusion.
i)

This switch is sitting behind a firewall and needs to go out the internet into the vendor's server in their DMZ (172.156.69.22, port 443).

Is 172.156.69.22 IP of the clock server that you refer to?

ii)
Core_Switch>telnet 170.146.69.22 443

The IP that you have updated out here is incorrect.


I somehow feel that there is some IP mismatch since the routing is appropriate and return traffic would fail primarily during routing issues.
0
 
LVL 9

Expert Comment

by:Ian Arakel
ID: 41732293
Hi Author,

Could you share what exactly fixed your issue?
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question