AIX Client unable to report to IEM Server

Hi,

I’ve few AIX servers(5.3) were the agents are unable to report to their parent.
The agents are configured to connect directly to IEM. The Client connects successfully to IEM server and it downloads content and creates Sites folder, but when it tries to report the log shows following:

Current Date: June 24, 2015
Client version 9.0.835.0 built for AIX 5.3 ppc32
Current Balance Settings: Use CPU: True Entitlement: 0 WorkIdle: 10 SleepIdle: 480
ICU data directory: '/var/opt/BESClient’
ICU deployment character set: ISO_8859-1:1987
ICU local character set: ISO_8859-1:1987
ICU transcoding between deployment and local character sets: DISABLED
At 18:34:37 -0500 -
Starting client version 9.0.835.0
FIPS mode disabled by default.
Cryptographic module initialized successfully.
Using crypto library libBEScrypto_1_0_0_1 - OpenSSL 0.9.8f-fips-dev xx XXXX xxxx
Restricted mode
Beginning Relay Select
At 18:34:38 -0500 -
RegisterOnce: Attempting secure registration with 'https://172.19.159.24:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe&ClientVersion=9.0.835.0&Body=0&SequenceNumber=0&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://SMEXEPM01.mexeo.BNS%3A52311&AdapterInfo=00-1a-64-91-e6-b2_172.18.185.0%2F26_172.18.185.13_0
At 18:34:39 -0500 -
Unrestricted mode
Scheduling client reset; Computer id changed to 15637188
Configuring listener without wake-on-lan
Registered with url 'https://172.19.153.32:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe&ClientVersion=9.0.835.0&Body=0&SequenceNumber=0&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://SMEXEPM01.mexeo.BNS%3A52311&AdapterInfo=00-1a-64-91-e6-b2_172.18.185.0%2F26_172.18.185.13_0
Registration Server version 9.0.787.0 , Relay version 9.0.787.0
Relay does not require authentication.
At 18:36:13 -0500 -
Failed automatic client authentication key exchange with server message: General transport failure.
Relay selected: 172_19_159_24.mexeo.BNS. at: 172.19.159.24:52311 on: IPV4
Client resetting
Unrestricted mode
At 18:36:14 -0500 -
PollForCommands: Requesting commands
At 18:36:15 -0500 -
PollForCommands: commands to process: 1
Entering service loop
Beginning Relay Select
At 18:36:16 -0500 -
SetupListener success: IPV4/6
RegisterOnce: Attempting secure registration with 'https://172.19.159.24:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=9.0.835.0&Body=15637188&SequenceNumber=1&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://SMEXEPM01.mexeo.BNS%3A52311&AdapterInfo=00-1a-64-91-e6-b2_172.18.185.0%2F26_172.18.185.13_0
At 18:36:17 -0500 -
Unrestricted mode
Configuring listener without wake-on-lan
Registered with url 'https://172.19.159.24:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=9.0.835.0&Body=15637188&SequenceNumber=1&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://SMEXEPM01.mexeo.BNS%3A52311&AdapterInfo=00-1a-64-91-e6-b2_172.18.185.0%2F26_172.18.185.13_0
Registration Server version 9.0.787.0 , Relay version 9.0.787.0
Relay does not require authentication.
At 18:37:48 -0500 -
Failed automatic client authentication key exchange with server message: General transport failure.
Relay selected: 172_19_159_24.mexeo.BNS. at: 172.19.159.24:52311 on: IPV4
At 18:38:05 -0500 - actionsite (http://SMEXEPM01.mexeo.BNS:52311/cgi-bin/bfgather.exe/actionsite)
Downloaded ‘http://172.19.159.24:52311/bfmirror/bfsites/manydirlists_1/__fullsite_99eb7b96cf7152635a2783e84c3b30343ad98290’ as '__TempUpdateFilename’
At 18:38:07 -0500 - actionsite (http://SMEXEPM01.mexeo.BNS:52311/cgi-bin/bfgather.exe/actionsite)
Gather::SyncSiteByFile adding files - count: 362
At 18:38:10 -0500 -
Successful Synchronization with site ‘actionsite’ (version 8619) - 'http://SMEXEPM01.mexeo.BNS:52311/cgi-bin/bfgather.exe/actionsite
ShutdownListener
SetupListener success: IPV4/6
GatherHashMV command received.
Already have this version of site.
At 18:38:10 -0500 - actionsite (http://SMEXEPM01.mexeo.BNS:52311/cgi-bin/bfgather.exe/actionsite)
Relevant - AIX_Group (fixlet:213)
Relevant - Universal Properties (fixlet:3)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/softwaredistribution (fixlet:2130715620)
Relevant - Role 416 Subscription (fixlet:5034)
Relevant - Role 221 Subscription (fixlet:4362)
Relevant - Role 1036 Subscription (fixlet:5024)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport (fixlet:2130714582)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/aixpatches (fixlet:2130706551)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/ibmsoftwareinventory (fixlet:2130717635)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/ibmforsua (fixlet:2130719446)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/bessupport (fixlet:2130706433)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/besinventory (fixlet:2130709525)
Relevant - Subscribe to Site http://IEMServerIP.mexeo.BNS:52311/cgi-bin/bfgather.exe/actionsite (fixlet:2131875462)
Relevant - (fixlet:4)
Relevant - (fixlet:5)
Relevant - (fixlet:6)
Relevant - (fixlet:7)
Relevant - (fixlet:8)
Relevant - (fixlet:9)
Relevant - (fixlet:10)
Relevant - (fixlet:11)
Relevant - (fixlet:12)
Relevant - (fixlet:13)
At 18:45:38 -0500 -
Error posting report to: ‘http://172.19.159.24:52311/cgi-bin/bfenterprise/PostResults.exe’ (General transport failure.
socket timeout error)

The telnet connection trough IEM port works.

Have you seen something similar?

You should remove the IP address of your root/relay from the above.

Is outbound tcp over 52311 restricted? Also, it could be that the client does not have direct network access to send the root/relay data, though neither of these seem to be the case if telnet is working.

I also see this error:

Failed automatic client authentication key exchange with server message: General transport failure.

I am also getting same socket timeout error …everything is getting good on AIX server to relay(i.e we are able to do telnet from server to relay)…

outbound tcp over 52311 is also not restricted.Kindly suggest

Are your AIX servers behind a DMZ?

We had to use static routes on the OS so the AIX Servers communicate directly with the BigFix Relay.

yes, they are and the same issue is occurring on solaris box also.Kindly suggest.

Probably the network maps the IP Address to a different route.
I would suggest that validate with you network specialist and ask him about static routes. I solved the problem using them.