Using Powershell to check for blocked network connections

Identifying bad network routes or firewall issues affecting Server nodes or data source hosts
 

Prerequisites

• Alteryx 
  • Server
• PowerShell
  • Admin access

Potential Use Cases

 

• Scenario A : The customer has updated their SSL cert in MMC but after binding SSL cert to 443, Gallery will not load on the FQDN the cert was issued to

• (caveat) SSL has been setup with binding successfully to port 443 (see KB here ) and SSL certificate has been confirmed properly issued with CN name and the DNS Names listed in the details for Subject and SAN respectively have been confirmed to match and be correct

• Scenario B : One or more Server worker nodes are not listed in Gallery UI > Admin > Diagnostics > Workers > Available Workers

• (caveat)  Missing Workers have been confirmed to be up and running with AlteryxService running

Procedure

Test-NetConnection -ComputerName "domainname.local" -Port 80
Test-NetConnection {IPADDRESS} -port {PORTNUMBER}
Test-NetConnection -Port 80 -InformationLevel "Detailed"

Use examples

Scenario A, 'Gallery will not load on the FQDN the cert was issued to'

• Even though the Alteryx Service is running, the Gallery it’s not listening, or inaccessible remotely
• Server has been set up correctly bound to SSL, but there are network issues preventing remote machines from reaching the new server.
• Alteryx Server may or may not be listening on port 443 (see spoilers)
• Server machine can be accessed via RDP to confirm AlteryxService is up and running, and that the Gallery/Server UI can successfully be loaded in a web browser (from the Server's RDP session), but user's are reporting that their laptops hit a not found on Gallery URL.
• Running Test-NetConnection -ComputerName "domainname.local" -Port 443 shows TCP connection failed although Gallery has been confirmed to be listening, accessible locally from a browser on Server (and with a valid HTTPS connection. A network security rule is blocking outside connections to 443. 
• The customer would need to work with their IT team to have 443 (and 80) opened.

Scenario B, 'One or more Server worker nodes are not listing in Gallery'

• The missing worker node from Gallery Admin UI Available workers, has been confirmed up and with AlteryxService running, and accessible via RDP
• Logs show the following error: 

• A connection attempt failed because the connected party did not respond after a period of time, or establish connection failed because connected host has failed to respond. (10060)> worker <AlteryxNode2>
  

• Running Test-NetConnection -ComputerName "domainname.local" -Port 80 from Worker2 returns TCP connect to … failed (see spoilers for an example output of failed TCP connection)
• Worker 2 is unable to communicate with The Controller/Gallery/Worker1 due to port 80 being blocked by a network security rule.
• The customer would need to work with their IT team to have port 80 (and 443) opened and then confirm that both nodes can reach each other, by reviewing the Available Worker list in Admin UI Diagnostics.
   

Spoilers

**

 

To double confirm that TCP connection is failed not due to port listening, you can run from Windows Command Line (not PowerShell)

netstat -an | find ":80 " | find "LISTENING"

Example usage where 80 is not listening but port 8079 is listening