2

I'm trying to access the NexentaStor web console via port 2000 from a different subnet than the system's main IP address. In my situation, this is either over a VPN or to access a remote Nexenta appliance over a private network. I can see the system via ping and telnet to port 2000, but the NMV interface does not work. Any ideas on how to accomplish this?

4 Answers 4

4

9 times out of 10, this is not NexentaStor at all, except that the default port, 2000, is one claimed by Cisco. Login to the appliance using SSH as root, and type "setup appliance init" and then hit No to the first question then it asks for HTTP/HTTPS and the port to use - you can use HTTP or HTTPS, but change the port to something else, I use 7878. Then try again. This is typically a Cisco ASA or other firewall filtering port 2000 that causes this symptom.

2
  • Wow. You hit it on the head! An nmap of my Nexenta Storage nodes shows 2000/tcp open callbook. So the IANA port number that Nexenta uses is already allocated. Changing the port does fix this issue, as I tend to have Cisco ASA firewalls installed in most places. Is there also a workaround on the Cisco side (fixup, etc?) in the event that I need to keep port 2000 on the Nexenta unit?
    – ewwhite
    Apr 15, 2011 at 23:42
  • I just wanted to echo Andrew's point about Cisco ASA, and add that officially, port 2000 is reserved for Cisco's SCCP == en.wikipedia.org/wiki/Skinny_Client_Control_Protocol, and that it is used by other Cisco devices. In general I think it is a good idea to change the default port for the management interface. Changing the port is quite trivial via NMC (CLI management console). You will simply need to run setup appliance init and follow the prompts, adjusting port to one you desire when prompted for it.
    – slashdot
    Jan 24, 2012 at 20:47
3
+25

I agree with those others who have suggested that it's likely the nexenta is ignoring requests from "offsite" addresses as some kind of half-arsed security feature. If the approaches others have suggested don't help, and nexenta can't tell you how to reconfigure the box to disable this feature, you might consider trying to "bounce" the connection off a local box (meaning one on the same subnet as the Nexenta) running sshd.

The details of ssh port forwarding are pretty widely-documented, but the upshot would be to make a connection from your desktop (client) to server (the box on the same network as nexenta) as follows:

client% ssh server -L 2000:nexenta:2000

then using a local web browser to visit

http://localhost:2000

(or https if that's what the nexenta speaks on port 2000).

2
  • This is a good suggestion, and I'd definitely recommend it for some people. In my case, I'm trying to deploy NexentaStor units to locations around the world, and wanted to make sure that some of the standalone units were accessible. That also means admins who may not be well versed in SSH tunneling. I've still yet to receive a response from Nexenta on this.
    – ewwhite
    Jan 16, 2011 at 23:30
  • I never got a real answer from Nexenta on this, so I'd stuck with ssh tunnels. For multiple devices, I'm varying the local port of the tunnel. I also have an option to manage multiple nexenta systems from one http console session. (the units link to each other via ssh keys)
    – ewwhite
    Feb 6, 2011 at 9:24
0

NexentaStor might be ignoring your traffic based on your IP. In which case, you will need to either reconfigure the NexentaStor to allow this (if possible), or use NAT so that the device will see you as coming from within its network.

I recommend contacting Nexenta support, or this is not an option, to reach out to #Nexenta on irc.freenode.org.

3
  • I've posted a few messages on the various Nexenta boards. No good solution has surfaced. I know it's a software-level filtering/firewall rule, but don't understand how or where to change the setting.
    – ewwhite
    Jan 13, 2011 at 1:39
  • You could try (as root): svcadm disable network/ipfilter
    – ewindisch
    Jan 13, 2011 at 1:43
  • I tried... No luck.
    – ewwhite
    Jan 13, 2011 at 20:58
0

We are able to access the NMV (port 80) on Nexenta Enterprise from a different network over a VPN tunnel without having done anything special in the Nexenta configuration. Be sure the netmask and default gateway are set correctly in the network configuration on your Nexenta server.

1
  • Browsing to: http://server.ip gives me the default "It works!" page, but going to the console at port 2000 doesn't work.
    – ewwhite
    Jan 13, 2011 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .