NetXMS Forum

Issue:
Windows agent tunnel binding fails on every attempt
Server log: IssueCertificate: certificate request verification failed (0 ms — fails at parse, not signature)
Agent log: certificate request failed (923)
Linux agents on same server bind successfully

NetXMS Server Info:
AlmaLinux 9.7
System OpenSSL 3.5.1
NetXMS server 6.1.1, build 6.1-452-gc20a8a4247
Self-signed CA, valid 2036
netxmsd.conf has TunnelCertificate, TunnelCertificateKey, InternalCACertificate, InternalCACertificateKey configured

Tested against:
Win 10 Pro 22H2 (19041)  | Agent v6.1.1 | Fails with 923
Win 11 Home 24H2 (26200) | Agent v6.1.1 | Fails with 923
Win 11 Home 24H2 (26200) | Agent v5.2.8 | Fails with 923
AlmaLinux 9.7            | Agent v6.1.1 | Binds Successfully

Steps to Produce:
AlmaLinux 9.7 + OpenSSL 3.5.1 + NetXMS 6.1.1 server
Self-signed CA per standard tunnel setup
Install Windows agent, configure ServerConnection + TrustedRootCertificate
TLS handshake completes, tunnel appears Unbound
Right-click → Create node and bind → error 923

See attached logs from tests above.

Please advise if you need any further information. I have not tried on the latest 6.1.2, as there doesn't appear to be an direct fix for this issue.

Thanks,

cert-issue-logs.txt

Hi Filipp,

I ran this on the entire network and the only match for 0.0.0.0 was 10.0.0.0/24: 10.0.0.0/24.

Thanks,

Hi Filipp,

Thanks for the quick response, I have checked under both my user and the sytem user and the 0.0.0.0 subnet does not exist. I have also checked via nxadm -c "show objects" for any match on 0.0.0.0 and nothing matches apart from a 10.0.0.0/24 network, so this doesn't look to be the cause of the issue, unless I am missing something.

Thanks,

I am trying to add a group of nodes by active discovery of their subnet, whilst I can add the nodes manually and they pass all the discovery filters and the snmp strings pass, it fails to add on poll.discovery AcceptNewNodeStage2, see below log file:

I've changed/removed IP's or strings for sanity.

2025.06.25 09:26:36.825 *D* [poll.discovery    ] AcceptNewNodeStage1(A.B.C.D): MAC address not found
2025.06.25 09:26:36.825 *D* [poll.discovery    ] AcceptNewNodeStage1(A.B.C.D): filter flags=0303
2025.06.25 09:26:36.825 *D* [poll.discovery    ] AcceptNewNodeStage1(A.B.C.D): filter - checking address range
2025.06.25 09:26:36.826 *D* [poll.discovery    ] AcceptNewNodeStage1(A.B.C.D): filter - range check result is true
2025.06.25 09:26:36.828 *D* [agent.conn.450171  ] New connection created (address=A.B.C.D port=4700 compression=allowed)
2025.06.25 09:26:36.830 *D* [agent.conn.450171  ] Cannot establish connection with agent at A.B.C.D:4700
2025.06.25 09:26:36.830 *D* [poll.discovery    ] HostIsReachable(A.B.C.D): agent connection check failed with error 910 (Connect failed)
2025.06.25 09:26:36.830 *D* [snmp.discovery    ] SnmpCheckCommSettings(A.B.C.D): starting check (proxy=0, originalPort=0)
2025.06.25 09:26:36.830 *D* [snmp.discovery    ] SnmpCheckCommSettings(A.B.C.D): checking port 161
2025.06.25 09:26:36.831 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): trying
2025.06.25 09:26:36.845 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): trying
2025.06.25 09:26:36.854 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): trying
2025.06.25 09:26:36.868 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): trying
2025.06.25 09:26:36.879 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): trying
2025.06.25 09:26:36.894 *D* [snmp.discovery    ] SnmpCheckV3CommSettings(A.B.C.D): failed
2025.06.25 09:26:36.894 *D* [snmp.discovery    ] SnmpCheckCommSettings(A.B.C.D): trying version 1 community 'removed'
2025.06.25 09:26:36.898 *D* [snmp.discovery    ] SnmpCheckCommSettings(A.B.C.D): success (version=1)
2025.06.25 09:26:36.898 *D* [poll.discovery    ] HostIsReachable(A.B.C.D): SSH connection probe disabled
2025.06.25 09:26:36.903 *D* [ndd                ] FindDriverForNode(A.B.C.D): found potential device driver PING3 with priority 63
2025.06.25 09:26:36.907 *D* [poll.discovery    ] AcceptNewNodeStage1(A.B.C.D): selected device driver GENERIC
2025.06.25 09:26:38.229 *D* [ndd.common        ] NetworkDeviceDriver::getInterfaces(0x7f7b1024fe00): no prefix reference for A.B.C.D
2025.06.25 09:26:38.281 *D* [poll.discovery    ] DiscoveredAddressPoller: stage 2 processing for address A.B.C.D/24 in zone 0 (source type Active Discovery, source node
[o])
2025.06.25 09:26:38.282 *D* [poll.discovery    ] AcceptNewNodeStage2(A.B.C.D): interface list available, checking for duplicates
2025.06.25 09:26:38.282 *D* [poll.discovery    ] AcceptNewNodeStage2(A.B.C.D): IP address is a broadcast address for subnet 0.0.0.0/0
2025.06.25 09:26:38.282 *D* [poll.discovery    ] ProcessDiscoveredAddressStage2(A.B.C.D): address discarded
[o]

OS - AlmaLinux release 9.5 (Teal Serval)
NetXMS Version - 5.2.0
Node Device - Ruckus ICX7150-24-POE
Node Version - Version 08.0.90jT211
I can add this node manually without issue and other nodes in the same discovery subnet add via discovery poll, it's just nodes that meet this criteria that fail.

snmpwalk from the server gives the following:
snmpwalk -v 2c -c removed  A.B.C.D 1.3.6.1.2.1.2.2.1.2
IF-MIB::ifDescr.1 = STRING: GigabitEthernet1/1/1
IF-MIB::ifDescr.2 = STRING: GigabitEthernet1/1/2
IF-MIB::ifDescr.3 = STRING: GigabitEthernet1/1/3
IF-MIB::ifDescr.4 = STRING: GigabitEthernet1/1/4
IF-MIB::ifDescr.5 = STRING: GigabitEthernet1/1/5
IF-MIB::ifDescr.6 = STRING: GigabitEthernet1/1/6
IF-MIB::ifDescr.7 = STRING: GigabitEthernet1/1/7
IF-MIB::ifDescr.8 = STRING: GigabitEthernet1/1/8
IF-MIB::ifDescr.9 = STRING: GigabitEthernet1/1/9
IF-MIB::ifDescr.10 = STRING: GigabitEthernet1/1/10
IF-MIB::ifDescr.11 = STRING: GigabitEthernet1/1/11
IF-MIB::ifDescr.12 = STRING: GigabitEthernet1/1/12
IF-MIB::ifDescr.13 = STRING: GigabitEthernet1/1/13
IF-MIB::ifDescr.14 = STRING: GigabitEthernet1/1/14
IF-MIB::ifDescr.15 = STRING: GigabitEthernet1/1/15
IF-MIB::ifDescr.16 = STRING: GigabitEthernet1/1/16
IF-MIB::ifDescr.17 = STRING: GigabitEthernet1/1/17
IF-MIB::ifDescr.18 = STRING: GigabitEthernet1/1/18
IF-MIB::ifDescr.19 = STRING: GigabitEthernet1/1/19
IF-MIB::ifDescr.20 = STRING: GigabitEthernet1/1/20
IF-MIB::ifDescr.21 = STRING: GigabitEthernet1/1/21
IF-MIB::ifDescr.22 = STRING: GigabitEthernet1/1/22
IF-MIB::ifDescr.23 = STRING: GigabitEthernet1/1/23
IF-MIB::ifDescr.24 = STRING: GigabitEthernet1/1/24
IF-MIB::ifDescr.25 = STRING: Management
IF-MIB::ifDescr.65 = STRING: GigabitEthernet1/2/1
IF-MIB::ifDescr.66 = STRING: GigabitEthernet1/2/2
IF-MIB::ifDescr.129 = STRING: 10GigabitEthernet1/3/1
IF-MIB::ifDescr.130 = STRING: 10GigabitEthernet1/3/2
IF-MIB::ifDescr.131 = STRING: 10GigabitEthernet1/3/3
IF-MIB::ifDescr.132 = STRING: 10GigabitEthernet1/3/4

snmpwalk -v 2c -c removed A.B.C.D 1.3.6.1.2.1.4.20.1.2
IP-MIB::ipAdEntIfIndex = No Such Instance currently exists at this OID

snmpwalk -v 2c -c removed A.B.C.D 1.3.6.1.2.1.4.20.1.3
IP-MIB::ipAdEntNetMask = No Such Instance currently exists at this OID
It looks like this specific device or firmware is not using ip-mib or it's filtered?

Checking the ndd folder, there is no specific Brocade/Ruckus ndd file. Is this something you have come across before or have a potential workaround for?

Note, we have thousands of these devices in the field and have not come across it on other switch types or versions.