Cortex XSOAR server not responding, listening only on IPv6

[idelconsulting]

Dear all,

wanted to explore some features in the community edition, but the Web GUI doesn't come up.

Checking from the console, I see that the server is only listening on IPv6:

netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
tcp6 0 0 :::443 :::* LISTEN

I already disabled IPv6 on eth0, but that didn't help.

Any ideas what else to check?

Regards,

    Andreas

[JohnLeon · Accepted solution]

It's possible the server has a local firewall blocking it. This is common in Fedora/Centos/Redhat.

[GShriki]

Is this an .sh installer, or the OVA machine?

Can you check if you see in the server.log (/var/log/demisto) the following line:

info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)

Gilad

[idelconsulting]

Hi Gilad,

this is an .sh installer, not an OVA

And yes, I can see similar lines in the log file:

/home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3298)
2020-12-07 21:26:58.4503 info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3298)
2020-12-08 22:31:31.9763 info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)
2020-12-08 22:45:04.7332 info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)
2020-12-08 23:19:27.6428 info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)
2020-12-08 23:35:48.5214 info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)

Regards,

     Andreas

[GShriki]

Seems like server keeps restarting. can you please upload the full server.log? 

[Collegee]

Cloaken, Unshorten URLs onsite using the power of a Tor proxy server to prevent ... IronDefense, The IronDefense Integration for Cortex XSOAR allows users to interact ... Mail Listener v2, Listens to a mailbox and enables incident triggering via e-mail. ... This playbook supports CIDR notation only (1.1.1.1/32) and not range .

[JohnLeon · Accepted solution]

It's possible the server has a local firewall blocking it. This is common in Fedora/Centos/Redhat.

[idelconsulting]

Hi John,

great, thanks for that.

Not sure why I didn't think about the firewall

Disabling the firewall solved the issue.

Regards,

    Andreas