Netskope Community
08-10-2023 08:45 AM - edited 08-10-2023 08:46 AM
I have a private app configured to allow port 22 and users are able to use SSH and SCP successfully. Users are observing an intermittent issue when trying to SSH/SCP into the app and getting this error:
kex_exchange_identification: Connection closed by remote host Connection closed by 191.1.1.3 port 22
This error prevents user from starting a new SSH/SCP session, but all existing SSH/SCP sessions are fine when this error occurs. Usually if user retry's ssh after a while, the error goes away.
Is there any kind of SSH connection limiting in the NS Client or Publisher?
08-10-2023 09:37 AM - edited 08-10-2023 09:39 AM
I don't believe there is any limit within NPA itself to the number of SSH or other connection types. I'm wondering if the end application itself has a limit on the number of connections from a single host which could cause the behavior you're seeing. You could validate by taking a packet capture on the Publisher itself. If the reset is seen there from the remote host then that tells you that it's from the app itself rather than anything in NPA. One way you could also test or further validate this if you can't get details from the application administrator is to add additional Publishers to the app definition so connections will be load balanced meaning less connections from individual IP addresses. Just ensure that the additional Publishers can resolve the hostname and route/reach the IP address of the app.
08-14-2023 08:16 AM - edited 08-14-2023 08:17 AM
HI, we have 8 dedicated SSH Publishers already, so I don't think thats the issue. I am in the process of trying to enable packet capture on one of the them for troubleshooting. Also, I am trying to see if they have a load balancer in front of the apps and get the SSH logs from the app server itself. Thanks.
08-14-2023 09:17 AM
Additionally, this issue occurs due to a large number of SCP sessions being established by individual users and movement of large files up and down. I am researching whether the OSX file descriptor setting is set too low. Not sure what this setting is exactly since there is limited info talking about it.
In order to view this content, you will need to sign in to your account. Simply click the "Sign In" button below
Sign In