logoChat01.ai

DHA Enrollment Timeout Error

Creado el: 3 de diciembre de 2024

Respondido usando O1 Preview por Chat01

Pregunta

2024-12-02 15:08:15.216898 csc_zta_api[0x00000814, 0x00001ad4] I/ ZtnaApiImpl.cpp:235 ZtnaApiImpl::InitiateUnenrollment() Initiating Unenrollment
2024-12-02 15:08:45.118612 csc_zta_api[0x000007ac, 0x00002bf0] I/ ZtnaApiImpl.cpp:235 ZtnaApiImpl::InitiateUnenrollment() Initiating Unenrollment
2024-12-02 15:08:45.118612 csc_zta_agent[0x00001bc0, 0x00001b50] I/ ZtnaClientManager.cpp:550 ZtnaClientManager::OnReceivePayload::<lambda_9befe096aa7b204799a7e41dd7251430>::operator ()() Handling InitiateUnenrollment from client
2024-12-02 15:08:45.228415 csc_zta_agent[0x00001bc0, 0x00001b50] I/ ZtnaClientManager.cpp:857 ZtnaClientManager::OnZtnaUnenrollmentStateChanged::<lambda_a42990a86bee30fa4cbc498fb3fdf6b0>::operator ()() Handling Pending notification from enrollment driver
2024-12-02 15:08:45.228415 csc_zta_agent[0x00001bc0, 0x00001b50] I/ ZtnaEnrollmentService.cpp:203 ZtnaEnrollmentService::OnConfigsChanged::<lambda_26ce5fd52fb1a867f03d76f4eb30bbc8>::operator ()() Config not found for deleted Enrollment[5528beef-29da-4bfc-a0fa-0f04ba0f63cb] notifying unenroll completion
2024-12-02 15:08:45.228415 csc_zta_agent[0x00001bc0, 0x00001b50] I/ ZtnaClientManager.cpp:857 ZtnaClientManager::OnZtnaUnenrollmentStateChanged::<lambda_a42990a86bee30fa4cbc498fb3fdf6b0>::operator ()() Handling Unenrolled notification from enrollment driver

Later performed 3 attempts to enroll the device back but got internal error:

Below are the three attempts:

2024-12-02 15:08:46.988184 csc_zta_agent[0x00001bc0, 0x00001b50] I/ HttpClient.cpp:38 HttpClient::PerformAsync() start request: method=POST url=https://enroll.ztna.sse.cisco.com/enrollInit
2024-12-02 15:18:43.572960 csc_zta_agent[0x00001bc0, 0x00001b50] I/ HttpClient.cpp:38 HttpClient::PerformAsync() start request: method=POST url=https://enroll.ztna.sse.cisco.com/enrollInit
2024-12-02 15:21:58.816127 csc_zta_agent[0x00001bc0, 0x00001b50] I/ HttpClient.cpp:38 HttpClient::PerformAsync() start request: method=POST url=https://enroll.ztna.sse.cisco.com/enrollInit

So, let’s look at the first ENROLL attempt logs:

2024-12-02 15:09:24.511833 csc_zta_agent[0x00001bc0, 0x00001b50] I/ HttpClient.cpp:434 HttpClient::checkMultiInfo() request complete for url=https://enroll.ztna.sse.cisco.com/dhaEnrollInit
2024-12-02 15:09:24.511833 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:365 SSEZtnaEnroller::HandleRequestComplete() processing DHA registration response
2024-12-02 15:09:24.511833 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:1243 SSEZtnaEnroller::parseDhaRegResponse() received DHA registration response with http_status:200 and headers statusCode=OK_200 Connection=keep-alive Content-Length=1641 Content-Type=application/jwt Date=Mon, 02 Dec 2024 07:06:40 GMT Server=ZTNA-Proxy Sse-Enroll-Jwt-Type=dha-enroll-init-jwt Vary=Origin X-Request-Id=vqsb4R7PS3ywStcbPKxCwtf7wVTYVjeF
2024-12-02 15:09:24.511833 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:1460 SSEZtnaEnroller::actionSendDhaEnrollCommand() Sending DHA enrollment command
2024-12-02 15:09:24.511833 csc_zta_agent[0x00001bc0, 0x00001b50] I/ DhaPostureClient.cpp:782 CDhaPostureClient::sendDhaRequest() 'DhaRequestEnrollment' context cached with GUID '28074c39-cb69-4512-89b5-a0a88c629b30'
2024-12-02 15:09:29.537313 csc_zta_agent[0x00001bc0, 0x00001b50] W/ IpcPipesConnection.cpp:820 CIpcPipesConnection::OnAsyncSendTimeout() '\.\pipe\com.duosecurity.messagebroker.sc' client: AsyncSend request timed out
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] E/ DhaPostureClient.cpp:473 CDhaPostureClient::OnAsioTimerExpired() DHA Posture request timed out. Request type 'DhaRequestEnrollment(5)', Request ID '28074c39-cb69-4512-89b5-a0a88c629b30'
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] I/ DhaPostureClient.cpp:1074 CDhaPostureClient::issueRequestCallback() Reporting 'failed' enrollment result to concluded callback. Error: RequestTimedOut
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:1487 SSEZtnaEnroller::OnEnrollmentConcluded() processing DHA enrollment completion
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] E/ SSEZtnaEnroller.cpp:1491 SSEZtnaEnroller::OnEnrollmentConcluded() DHA enrollment has failed: RequestTimedOut
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:1917 SSEZtnaEnroller::actionNotifyCompletion() Notifying enrollment completion with result: InternalError
2024-12-02 15:11:24.523009 csc_zta_agent[0x00001bc0, 0x00001b50] I/ SSEZtnaEnroller.cpp:1921 SSEZtnaEnroller::actionNotifyCompletion()
Enrollment Stats

Bootstrap : success (0.313 sec)
Authentication : success (34.248 sec)
DeviceRegistration : success (1.985 sec)
DHARegistration : success (0.987 sec)
DHAEnrollment : failure (120.003 sec)

Overall result : failure (157.536 sec)
2024-12-02 15:11:24.527934 csc_zta_agent[0x00001bc0, 0x00001b50] I/ ZtnaClientManager.cpp:739 ZtnaClientManager::OnZtnaEnrollmentStateChanged::<lambda_2f48727dc7ac0ceeecc676d1b03f868f>::operator ()() Handling InternalError notification from enrollment driver

Pensamiento

分析日志数据

用户提供一个过程中涉及 ZTNA 解除和重新注册的日志。我在查看初次解除的成功情况，以及尝试重新注册失败的三次记录，特别关注初次注册的特定日志序列。

查看错误信息

我看到日志中包括 "DHA Posture request timed out"，整体结果是失败，失败发生在 "DHAEnrollment: failure (120.003 sec)" 步骤。

审查失败原因

用户显然在理解DHAEnrollment失败的原因和解决方法，具体日志显示设备成功解除注册，但重新注册三次都失败了，其中DHAEnrollment环节堵塞。

探查问询的底层

"可能是 Duo Security 消息代理服务未运行或未响应，导致 DHA Posture 请求通过 IPC 管道超时。"

推测故障原因

重启Duo Security服务或检查防火墙和配置，可能会解决与Duo Security Message Broker通信时的超时问题。

思考 花的時間為 12 秒

Respuesta

Based on the logs you've provided, the enrollment process is failing during the DHAEnrollment phase due to a timeout error. Here’s a breakdown of the key points and recommendations to resolve the issue:

Key Observations:

  1. Successful Unenrollment:

    • The device was successfully unenrolled, as indicated by the logs: 
      Handling Unenrolled notification from enrollment driver

  2. Enrollment Attempts Failing at DHAEnrollment:

    • All three enrollment attempts failed during the DHAEnrollment step: 
      DHAEnrollment                 : failure (120.003 sec)

  3. Timeout Errors:

    • The logs show that the DHA Posture request timed out: 
      E/ DhaPostureClient.cpp:473 CDhaPostureClient::OnAsioTimerExpired() DHA Posture request timed out. Request type 'DhaRequestEnrollment(5)', Request ID '28074c39-cb69-4512-89b5-a0a88c629b30'
    • There is also a timeout related to IPC (Inter-Process Communication) pipes: 
      W/ IpcPipesConnection.cpp:820 CIpcPipesConnection::OnAsyncSendTimeout() '\\.\pipe\com.duosecurity.messagebroker.sc' client: AsyncSend request timed out

  4. Communication with Duo Security Service:

    • The IPC pipe \\.\pipe\com.duosecurity.messagebroker.sc suggests that the system is attempting to communicate with the Duo Security Message Broker Service.

Possible Causes:

  • Duo Security Service Not Running or Unresponsive:

    • The timeout indicates that the Duo Security service responsible for handling DHA (Device Health Attestation) requests is either not running or not responding.

  • Firewall or Security Software Blocking Communication:

    • Security software or firewall settings may be blocking the IPC communication between the enrollment client and the Duo Security service.

  • Corrupted or Misconfigured Duo Security Components:

    • The Duo Security components may be corrupted or improperly configured, leading to communication failures.

Recommendations:

  1. Verify Duo Security Services:

    • Check if the Duo Security services are running on the device.
      • Open the Services management console (services.msc) and look for services related to Duo Security or Device Health.
      • Ensure that the services are set to Automatic startup and are currently running.
    • Restart the Duo Security services to reset any potential hang-ups.

  2. Review Security Software and Firewall Settings:

    • Whitelist the necessary IPC pipes and executables in your security software or firewall settings.
      • Ensure that \\.\pipe\com.duosecurity.messagebroker.sc is not being blocked.
    • Disable security software temporarily to determine if it is interfering with the enrollment process.

  3. Check for Software Updates:

    • Update the Duo Security software to the latest version.
      • Outdated software may have known issues that have been resolved in newer releases.
    • Update the ZTNA client software to ensure compatibility with the Duo Security components.

  4. Repair or Reinstall Duo Security Components:

    • Repair the installation of the Duo Security software through the Control Panel.
    • Reinstall the Duo Security software if repairing does not resolve the issue.

  5. Examine System Logs for Additional Errors:

    • Check the Windows Event Viewer for any related error messages or warnings that could provide more insight.
    • Look specifically under Application and System logs for entries related to Duo Security or the enrollment process.

  6. Validate Device Compliance Policies:

    • Ensure that the device meets all compliance requirements for enrollment.
      • Check for any missing updates, required software, or configurations that might cause the DHA to fail.

  7. Test on Another Device:

    • Attempt enrollment on a different device to determine if the issue is device-specific.
      • If enrollment succeeds on another device, the problem is likely isolated to the original device.

  8. Contact Support:

    • If the issue persists after attempting the above steps, contact your organization's IT support or the vendor's technical support for further assistance.
      • Provide them with the logs you've collected for a more in-depth analysis.

Summary:

The enrollment failure is occurring because the DHAEnrollment step cannot complete due to a timeout in communication with the Duo Security Message Broker service. This is likely caused by the service not running, being unresponsive, or being blocked by security settings.

By verifying that the Duo Security services are operational and ensuring that no security policies are obstructing the necessary communication channels, you should be able to resolve the enrollment issue.

Feel free to ask if you need further clarification or assistance with any of these steps.

Compartir este Q&A