Resolving Connection Issues Between IT Sensor and Discovery Hub on different systems

[apiknowbler]

Summary

Description

An IT sensor on a Windows Server cannot connect to a Debian-based Discovery Hub. The sensor was installed with the Hub's IP address and a data transfer code. The connection failure suggests a certificate problem.

Cause 

A Hub certificate installation issue causes the connection failure. The IT Sensor cannot establish a secure connection because the certificate from the Debian system does not match the IP address used during the connection attempt. This discrepancy occurs if the Debian system's IP address changes from dynamic to static after the initial setup, resulting in a mismatch between the certificate's Subject Alternative Names (SAN).

Troubleshooting

• Check network connectivity from the IT Sensor to the Network Discovery Hub.
  • Open PowerShell on the Windows system.
  • Run the following command (replace with your actual Debian system FQDN or IP):

Test-NetConnection <FQDN-or-IP> -port 59525

• Look for TcpTestSucceeded: True in the output.
  • If the test fails, check firewalls on both systems and any network appliances between them.
• Verify certificate installation.
  • On the Windows system, press Windows + R, type certlm.msc, and press Enter.
  • Navigate to: Trusted Root Certification Authorities > Certificates.
  • Look for a certificate named "Lansweeper_Network_Discovery_Internal_Communication-ca".
• Validate the certificate (if present).
  • Double-click the certificate to open its properties.
  • Go to the Details tab and note the Thumbprint value.
  • On the Debian system, check the file in this directory: 
    /opt/lansweeper-network-discovery-hub/.dotnet/corefx/cryptography/x509stores/root
  • The certificate thumbprint should match the .pfx file name in this directory.
• Install the certificate (if missing or the thumbprint doesn’t match).
  • Copy the correct .pfx file from the Debian system to the Windows system.
  • Right-click the .pfx file and select "Install PFX".
  • Choose "Local Machine" and click Next.
  • Select "Place all certificates in the following store" and browse to "Trusted Root Certification Authorities".
  • Complete the installation.
  • Restart the Lansweeper IT Sensor service

Solution (if the IP address has changed since the Network Discovery Hub installation)

• Assign a static IP address to the Debian system.
• Remove the .pfx file from: /opt/lansweeper-network-discovery-hub/.dotnet/corefx/cryptography/x509stores/root
• Restart the Lansweeper Network Discovery Hub service:

systemctl restart lansweeper-network-discovery-hub.service

• This generates a new certificate.
• On the Windows system, if necessary, edit the file: Program Files\Lansweeper Network Discovery\sensors\IT\appsettings.json
• Confirm the HubUrl uses the correct IP address and port.
• Finally, restart the Lansweeper Network Discovery IT Sensor Service.

Allow some time for the IT Sensor service to retrieve the new certificate from the Debian system.