Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to access the NexentaStor web console via port 2000 from a different subnet than the system's main IP address. In my situation, this is either over a VPN or to access a remote Nexenta appliance over a private network. I can see the system via ping and telnet to port 2000, but the NMV interface does not work. Any ideas on how to accomplish this?

share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

9 times out of 10, this is not NexentaStor at all, except that the default port, 2000, is one claimed by Cisco. Login to the appliance using SSH as root, and type "setup appliance init" and then hit No to the first question then it asks for HTTP/HTTPS and the port to use - you can use HTTP or HTTPS, but change the port to something else, I use 7878. Then try again. This is typically a Cisco ASA or other firewall filtering port 2000 that causes this symptom.

share|improve this answer
    
Wow. You hit it on the head! An nmap of my Nexenta Storage nodes shows 2000/tcp open callbook. So the IANA port number that Nexenta uses is already allocated. Changing the port does fix this issue, as I tend to have Cisco ASA firewalls installed in most places. Is there also a workaround on the Cisco side (fixup, etc?) in the event that I need to keep port 2000 on the Nexenta unit? –  ewwhite Apr 15 '11 at 23:42
    
I just wanted to echo Andrew's point about Cisco ASA, and add that officially, port 2000 is reserved for Cisco's SCCP == en.wikipedia.org/wiki/Skinny_Client_Control_Protocol, and that it is used by other Cisco devices. In general I think it is a good idea to change the default port for the management interface. Changing the port is quite trivial via NMC (CLI management console). You will simply need to run setup appliance init and follow the prompts, adjusting port to one you desire when prompted for it. –  slashdot Jan 24 '12 at 20:47
add comment

I agree with those others who have suggested that it's likely the nexenta is ignoring requests from "offsite" addresses as some kind of half-arsed security feature. If the approaches others have suggested don't help, and nexenta can't tell you how to reconfigure the box to disable this feature, you might consider trying to "bounce" the connection off a local box (meaning one on the same subnet as the Nexenta) running sshd.

The details of ssh port forwarding are pretty widely-documented, but the upshot would be to make a connection from your desktop (client) to server (the box on the same network as nexenta) as follows:

client% ssh server -L 2000:nexenta:2000

then using a local web browser to visit

http://localhost:2000

(or https if that's what the nexenta speaks on port 2000).

share|improve this answer
    
This is a good suggestion, and I'd definitely recommend it for some people. In my case, I'm trying to deploy NexentaStor units to locations around the world, and wanted to make sure that some of the standalone units were accessible. That also means admins who may not be well versed in SSH tunneling. I've still yet to receive a response from Nexenta on this. –  ewwhite Jan 16 '11 at 23:30
    
I never got a real answer from Nexenta on this, so I'd stuck with ssh tunnels. For multiple devices, I'm varying the local port of the tunnel. I also have an option to manage multiple nexenta systems from one http console session. (the units link to each other via ssh keys) –  ewwhite Feb 6 '11 at 9:24
add comment

We are able to access the NMV (port 80) on Nexenta Enterprise from a different network over a VPN tunnel without having done anything special in the Nexenta configuration. Be sure the netmask and default gateway are set correctly in the network configuration on your Nexenta server.

share|improve this answer
    
Browsing to: http://server.ip gives me the default "It works!" page, but going to the console at port 2000 doesn't work. –  ewwhite Jan 13 '11 at 20:46
add comment

NexentaStor might be ignoring your traffic based on your IP. In which case, you will need to either reconfigure the NexentaStor to allow this (if possible), or use NAT so that the device will see you as coming from within its network.

I recommend contacting Nexenta support, or this is not an option, to reach out to #Nexenta on irc.freenode.org.

share|improve this answer
    
I've posted a few messages on the various Nexenta boards. No good solution has surfaced. I know it's a software-level filtering/firewall rule, but don't understand how or where to change the setting. –  ewwhite Jan 13 '11 at 1:39
    
You could try (as root): svcadm disable network/ipfilter –  ewindisch Jan 13 '11 at 1:43
    
I tried... No luck. –  ewwhite Jan 13 '11 at 20:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.