Re: PVA connection problem

[Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov>]

On 9/14/23 22:52, Ignacio Arriagada via Tech-talk wrote:
> ...
> I can get it to work by disabling the firewall (systemctl stop firewalld). Then I get the following
>  From VM2, *caget* works without issues, with and without the firewall enabled
Because your firewall policy includes the CA ports.  (also 5065/tcp which is not used by default)

>    ports: ... 5064/tcp 5065/tcp 5064/udp 5065/udp
The equivalent for PVA would be allowing in 5076/udp and 5075/tcp ?


>     $ pvget testSCS:gcbTx
...
>     testSCS:gcbTx <undefined>              0 INVALID DRIVER UDF
...
>  From VM2, *caget* works without issues, with and without the firewall enabled
>
>     $ caget testSCS:gcbTx
>     testSCS:gcbTx                  0
fyi. caget by default is requesting DBR_DOUBLE, so it doesn't fetch alarm/time meta-data.
However, pvget does get alarm/time meta-data.  So the "<undefined>" and "INVALID DRIVER UDF"
are the expected output for a record which has not been processed.

A more exact comparison would be with:

> caget -d TIME_DOUBLE testSCS:gcbTx

>     $ cainfo testSCS:gcbTx
>     testSCS:gcbTx
>          State:            connected
>          Host: 192.168.1.140:5064 <http://192.168.1.140:5064>
>          Access:           read, write
>          Native data type: DBF_LONG
>          Request type:     DBR_LONG
>          Element count:    1
>
>
> The firewall config for the VMs is the following
>
> *VM1*:
> $ sudo firewall-cmd --list-all
> public (active)
>    target: default
>    icmp-block-inversion: no
>    interfaces: enp0s3
>    sources:
>    services: cockpit dhcpv6-client ssh
>    ports: 8888/tcp 8888/udp 5064/tcp 5065/tcp 5064/udp 5065/udp
>    protocols:
>    forward: no
>    masquerade: no
>    forward-ports:
>    source-ports:
>    icmp-blocks:
>    rich rules:
>
> *VM2*:
> $ sudo firewall-cmd --list-all
> public (active)
>    target: default
>    icmp-block-inversion: no
>    interfaces: enp0s3
>    sources:
>    services: cockpit dhcpv6-client ssh
>    ports: 8888/tcp 8888/udp
>    protocols:
>    forward: no
>    masquerade: no
>    forward-ports:
>    source-ports:
>    icmp-blocks:
>    rich rules:
>
> *For security reasons I need to be able to find a configuration for the firewall that works with PVAccess. Any idea what I could be missing?*