Shulou(Shulou.com)06/02 Report--

Fault phenomenon

The system of a branch of a Saudi chemical enterprise was transformed, and the original H3C router was replaced by Juniper enterprise firewall. After the transformation, the operation and maintenance management rights of all network and server equipment were transferred to the headquarters IT.

After the completion of the transformation, both the internal and external networks can be accessed normally, and the finance needs to be reinstalled due to the upgrade of the invoice authentication program. After the installation is completed, it is prompted to register and cannot connect to the server due to the error of the registration times:

Troubleshooting

For quick troubleshooting, we can connect to other networks for testing, such as connecting to the hotspots of your phone. This is a desktop computer, so it is not convenient for testing.

Before the network transformation, the access policy of the old router has a high degree of freedom, but after the transformation, it is necessary to follow the unified policy standard of IT, and the special network and ports can only be accessed by setting the permission policy. Therefore, the reason for the above failure is that when the updated invoice authentication program needs to contact the registration server, the link cannot be established successfully. So the key to solving the problem is that we need to know the invoice authentication software registration server and the port number needed to establish a connection, and then send it to the headquarters IT security group to allow colleagues to access.

Solution method

Consult to be responsible for the technical support of space tax control in this park, they are not very clear about this registration server, contact the space tax control display queue. In fact, we can check it ourselves, and the effect should be the same.

Troubleshooting steps:

1. Exit invoice certification software

two。 Enter: netstat-an at the command line

3. Run the invoice verification software and follow the prompts to register

4. Type again at the command line box: netstat-an

5. Compared with the newly established session under the command line, because the registration server cannot be connected, the connection status should be to send a packet to attempt to establish a session (SYN_SENT). As shown in the following figure, I can get the IP address and port number of the registration server is X.X.X.63 7001:

6. Provide this information to the headquarters IT security group. After activation, you can use telnet to test whether the port is enabled successfully:

7. Go to the customer site to complete the registration operation, and let the customer test the use confirmation to complete the Case:

Experience summary

If abnormal access occurs after changes in the company's network, it is necessary to take into account the policy settings on the router or firewall. Commonly used ports will be opened, such as port 80 to access the Internet, and other unconventional ports are generally disabled. We can locate the IP address and port number through the simple DOS command netstat, and then go to the user site after passing the Telnet test, which is very practical.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.