IBM Support

Adding QRadar Gateway Fails with an error "the connection was refused"

Troubleshooting


Problem

When an administrator adds a Data Gateway to QRadar on Cloud, an error is displayed:

Failed to connect to {GATEWAY} password may be invalid or the connection was refused.

Diagnosing The Problem

  • The password to the gateway is correct and typing it into the terminal displays as expected
  • 443 is not blocked:
    ​telnet {Console_IP} 443
    ​
    Example
    telnet x.x.0.95 443
    Trying x.x.0.95...
    Connected to x.x.0.95.
    Escape character is '^]'.

Resolving The Problem

  1. Use an SSH session and log in to the Data Gateway.
  2. On the Data Gateway, type the nslookup command:
    ​nslookup
    > server {IP_of_DNS}
    > {Console_IP}
    
    Example
     nslookup
    > 208.67.222.222
    222.222.67.208.in-addr.arpa     name = resolver1.opendns.com.
    
    Authoritative answers can be found from:
  3. The nslookup command needs to complete successfully for all DNS listed in /etc/resolv.conf. Remove any failed DNS server entries from the Data Gateway that display similar messages:
    ;; connection timed out; no servers could be reached
  4. Retry adding the Data Gateway by using the command:
    setup_qradar_host.py mh_setup interactive -r 

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSKMKU","label":"IBM QRadar on Cloud"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS003948340","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0"}]

Document Information

Modified date:
05 January 2021

UID

ibm16323291