Firewall config for LSAgent relay

[phenning]

We have been using LS for years in an agentless installation.  With more devices going outside the building, I want to start using the LSAgent.  I am testing on a laptop, and installed the agent to use the relay server, with our key and the install defaults.  The server here has LSAgent scanning enabled, and it has an internet connection, which is behind our hardware firewall.  Ports 80 and 443 are wide open for browsing, and any other ports would require a rule.  I have opened the range of WMI ports from that server to anywhere.  My test laptop is not showing up as a scanned device.  What am I missing?  Thank you for your help!

[phenning]

I did find a message in the logs about it being excluded because of domain:WORKGROUP, as shown in the image attached.  So, I though I would set up a scan target for WORKGROUP.  The pre-defined WORKGROUP scan target is listed as deprecated and is not recommended.  Neither have I been able to get it to work.  I cannot figure out another way to include these non-domain company assets in the LSAgent relay scans.  Ideas?

[Obi_1_Cinobi · Accepted solution]

Hello there!

If you are using LsAgent to scan these assets, no additional agentless scan target is required. If you want to use agentless scanning instead of LsAgent, you can use an IP range scanning target to scan non-domain assets as documented here: https://www.lansweeper.com/knowledgebase/scanning-with-ip-address-range-scanning/

However, non of these scanning targets will add assets as long as the scanning exclusion on the WORGROUP domain is active.

[phenning]

Thanks again.  This comment did point me to discovering that there was a scan exclusion for domain:WORKGROUP in the list, that I had not noticed before.  I deleted that, and was pretty confident that we had resolved it.  But, I am still not seeing them appear in the list.  The server log entries shown in the LSRelay2 attachment above are dated yesterday, and there is nothing newer appearing.  I have the scan interval set to 5 minutes, but nothing seems to be happening.  Is there something I need to do to kickstart it?

[Obi_1_Cinobi]

Hello there!

Keep in mind that the minimum scan interval for LsAgent is 4 hours. If you choose a more frequent schedule, your LsAgent installations will still silently default to an interval of 4 hours. So you might just have to wait a bit longer for the scan results to appear after making your configuration changes.

[phenning]

I also discovered that I needed to add a scanning credential for the non-domain admin user, and map that credential to the WORKGROUP scan target.  I am not clear on why that would be needed for a client-initiated scan, but at that point, the assets began to appear.  So, I think maybe we have it working.  Thank you!

[phenning]

I did not realize that, but that makes sense.  I will wait and see what shows up later this afternoon.  Thank you!

[phenning]

Thank you Obi_1_Cinobi -- that is helpful.  I do have a successful connection between our LS server and the relay, as shown in the attached picture.  I looked at the logs, and the two laptops we are using for testing do appear in the log.  This tells me that the agent is working, and that our server is successfully contacting the relay, but that the data doesn't meet spec for some reason.  Can you shed any light on what the AssetID issue is, and where I correct it?  Thanks.  Here is the section of the logs:

[Obi_1_Cinobi]

Hello there!

The error in your logs indicates that the LsAgent scan was indeed successfully transferred to your scanning server, but the Lansweeper service did not create or update an asset with the scanned information. In our testing, we've found that this usually occurs when the assets have been excluded from scanning, either by name or by their IP. To make sure these assets can be scanned, please remove them from any of the configured scanning exclusions under Scanning\Scanning targets. 

[Obi_1_Cinobi]

Hello there!

Perhaps the troubleshooting tips in the following KB article could be of use to you: https://www.lansweeper.com/knowledgebase/the-relay-could-not-be-contacted/