IBM Support

Adding QRadar Gateway Fails with an error "the connection was refused"

Troubleshooting


Problem

When an administrator adds a Data Gateway to QRadar on Cloud, an error is displayed:

Failed to connect to {GATEWAY} password may be invalid or the connection was refused.

Diagnosing The Problem

  • The password to the gateway is correct and typing it into the terminal displays as expected
  • 443 is not blocked: 
    ​telnet {Console_IP} 443
​
    Example 
    telnet x.x.0.95 443
Trying x.x.0.95...
Connected to x.x.0.95.
Escape character is '^]'.

Resolving The Problem

  1. Use an SSH session and log in to the Data Gateway.
  2. On the Data Gateway, type the nslookup command: 
    ​nslookup
> server {IP_of_DNS}
> {Console_IP}
    Example 
     nslookup
> X.X.222.222
X.X.67.208.in-addr.arpa     name = resolver1.opendns.com.

Authoritative answers can be found from:
  3. The nslookup command needs to complete successfully for all DNS listed in /etc/resolv.conf. Remove any failed DNS server entries from the Data Gateway that display similar messages: 
    ;; connection timed out; no servers could be reached
  4. Retry adding the Data Gateway by using the command: 
    setup_qradar_host.py mh_setup interactive -r

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSKMKU","label":"IBM QRadar on Cloud"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS003948340","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0"}]

Document Information

Modified date:
16 May 2024

UID

ibm16323291

Page Feedback