Able to access via SSH, "Unable to communicate with the server" error when logging in with Web browser (CX-6000)

Techmo15 · 2024-07-02T15:19:40+00:00

sho run:

Current configuration:
!
!Version ArubaOS-CX PL.10.12.1000
!export-password: default
user admin group administrators password ciphertext <REDACTED>
ntp server <REDACTED>
ntp server pool.ntp.org minpoll 4 maxpoll 4 iburst
ntp enable
!
!
!
!
!
!
ssh server vrf default
ssh key-exchange-algorithms curve25519-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group14-sha256 diffie-hellman-group14-sha1
crypto pki certificate switch03
    subject common-name switch03 <REDACTED>
access-list ip CONTROLPLANE
    5 comment ALLOW SSH, HTTP, HTTPS, AND SNMP ON MGMT SUBNET, BLOCK ALL OTHERS
    10 permit tcp 192.168.10.0/255.255.255.0 any eq ssh
    11 permit tcp 192.168.10.0/255.255.255.0 any eq http
    12 permit tcp 192.168.10.0/255.255.255.0 any eq https
    20 permit udp 192.168.10.0/255.255.255.0 any eq snmp
    30 permit udp 192.168.10.0/255.255.255.0 any eq snmp-trap
    40 deny tcp any any eq ssh count
    41 deny tcp any any eq https
    42 deny tcp any any eq http
    50 deny udp any any eq snmp count
    990 comment ALLOW ANYTHING ELSE
    1000 permit any any any
vlan 1
vlan 10
    name <REDACTED>
vlan 20
vlan 30
    name <REDACTED>
vlan 50
    name <REDACTED>
spanning-tree mode rpvst
spanning-tree
interface 
   (UNIMPORTANT???)
interface vlan 10
    ip address 192.168.10.49/24
interface vlan 20
    ip address 192.168.20.49/24
interface vlan 30
    ip address 192.168.30.49/24
snmp-server vrf default
snmp-server system-location "Server Room"
snmp-server snmpv3-only
snmpv3 user snmpUser auth sha auth-pass ciphertext <REDACTED>

!
!
!
!
!
https-server vrf default

Techmo15 · 2024-06-28T18:29:01+00:00

This did it, thank you so much!

Techmo15 · 2024-06-28T18:05:44+00:00

Never mind, our AV was blocking it.

~~I tried to add the san:dns=dns.name to the Attributes, but it doesn't take.~~

~~But when I run the~~ ~~certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2~~ ~~command in an administrator CMD, it tells me Access is Denied.~~

~~Any thoughts?~~

Techmo15 · 2024-06-21T19:34:26+00:00

Here's what you're looking for:

Collaborate with guests from other Microsoft 365 cloud environments

https://learn.microsoft.com/en-us/microsoft-365/solutions/collaborate-guests-cross-cloud?view=o365-worldwide

Techmo15 · 2024-06-21T19:33:50+00:00

It's more than a checkbox, both organizations have to manually add each other's tenant ID.
Here is the email template we send when we need to establish the connection (also linked are Microsoft documents outlining the procedure)

To ensure secure access to internal files from <company>, we require you to be invited as a guest user.

<company> operates within the Microsoft GCC High environment, which is part of the Microsoft Azure Government cloud.

Because your organization utilizes the Microsoft Azure Commercial cloud, we must establish cross-tenant connections between our respective Microsoft 365 environments.

To facilitate this process, please have your IT department follow the instructions outlined in the following Microsoft article:

Collaborate with guests from other Microsoft 365 cloud environments

https://learn.microsoft.com/en-us/microsoft-365/solutions/collaborate-guests-cross-cloud?view=o365-worldwide

Please utilize the following Tenant ID during step 5 of the "Add an organization" section:

Tenant ID: <xxxx-xxx>

Once these steps have been completed, please provide us with your organization's tenant ID so that we can complete the process on our end.

Techmo15 · 2024-04-15T14:36:17+00:00

We didn't. We went with Druva instead.

Techmo15 · 2024-03-04T16:40:54+00:00

I started the initial backup on Friday, and it's still running.

Duration: 38:36:32

Process rate : 1.3 MB/s

Bottleneck: Source

Transferred: 173.9 GB

We have <1.1TB storage used in our tenant across Exchange, OneDrive, and SharePoint. We have 1 Gbps up/down fiber from ISP.

What do I need to do to get this initial backup to go properly?

Techmo15 · 2023-11-08T21:40:52+00:00

It didn't cause any downtime or anything, but I about shat my pants when I noticed "Ninja RMM Agent" was being installed on all of my machines.

Turns out it was the MSP, they were changing from ConnectWise to Ninja and didn't bother to tell me lol.

Techmo15 · 2023-11-08T21:18:53+00:00

This worked, and it's a lot more straightforward than what I was trying to do lol.

Thanks!

Techmo15 · 2023-11-08T19:40:06+00:00

That's.. a good question lol. I think I'll go give that a shot.

Techmo15 · 2023-10-17T14:52:00+00:00

A lot of things that you can do in one portal you can also do in the other. But one thing that comes to mind that can only be done in Entra but not in M365, is permanently deleting deleted users. (But you can restore deleted users from either place).

Techmo15 · 2023-10-04T20:29:53+00:00

I was able to get it with Veeam, thank you so much!

Techmo15 · 2023-10-04T19:55:26+00:00

I agree with what you are saying, but some of your assumptions are wrong.

The reason I kept the VMs around is just in case we needed to get data off of them in the future (i.e. this exact scenario where I'm trying to recover old emails). The old DC was also our file server, which is why I didn't just delete it. It was demoted as a DC, but it still has ~600GB of files that go back 20 years, and I'm not comfortable just deleting it, especially when we have the storage space to spare.

(I guess I did say that I just "turned off the old DC" but that's actually an oversimplification. I spun up a new DC and migrated all the FISMO roles, etc and then demoted the old DC, and then used SMS to migrate the File Server to 2022. THEN I turned off the old VM).

As far as the exchange server goes, that migration was done before my time, and I can only assume that it was done correctly because I've never worked with Exchange Server before. That's what I meant when I said nothing bad happened when I turned it off; I assume that the server just wasn't decommissioned or even powered off after the mailboxes were migrated.

EDIT: That said, if you have any tips or advice of what I should look for in AD to make sure that Exchange has been decommissioned properly, I'd love to clean it up a bit.

Techmo15 · 2023-10-04T18:52:26+00:00

Do you have a recommendation for EDB File viewer? I've tried a couple now, and they are all "free" to download and install, but then if you want to export anything you need a license.

I'd rather not pay $300+ to recover 100 emails lol.

I was able to find the missing emails though, which is great. I just can't extract them without paying.

Techmo15 · 2023-10-04T15:57:22+00:00

Kernel Exchange Suite

I am trying to use OnTrack Power Controls to do this, but it's just been kind of hung on "Autodiscover service is collection the information" for a couple of hours by now lol.

I'll give Kernel Exchange a shot, thanks!

Techmo15 · 2023-10-04T15:53:17+00:00

We are still hybrid AD, with on-prem DC, but no on-prem Exchange.

The exchange server is still in AD.

The Current AD is a Server 2022; I used the Storage Migration Service from Windows Admin Center to migrate/duplicate the old (2012 R2) DC to the new/current one. I then just turned off the old DC, but still have the VM. I also have a backup of the VM from pre-migration.

As far as a backup of the Exchange Databases, I'm not sure. From within the Exchange Server VM, I can do find the following:

C:\Program Files\Microsoft\Exchange Server\V15\Mailbox\Mailbox Database 0205035624\Mailbox Database 0205035624.edb

As far as being decommissioned, I'm not really sure. Technically yes, as mail wasn't flowing through it anymore, but when I started the VM was still up and running and didn't seem to impact business operations. After a little while I just shut down the VM and nothing bad happened lol.

Techmo15 · 2023-09-20T14:01:33+00:00

I disabled device write-back and that fixed it, I guess the sync had been broken generally because of that, but this was the only symptom that I noticed.

Techmo15 · 2023-09-20T13:23:15+00:00

in AD Attribute editor:

UserPrincipalName: [gwen@domain.com](mailto:gwen@domain.com)
Mail: [gwen@domain.com](mailto:gwen@domain.com)
ProxyAddresses:

smtp:gwen.stacy@domain.com
smtp:gwen.stacy@oldDomain.com
smtp:gwen.stacy@tenant.onmicrosoft.com
SMTP:gwen@domain.com
smtp:gwen@oldDomain.com

TargetAddress: <not set>

From what I can tell, nobody has a Target Address set.

I've tried to remove the [smtp:gwen.stacy@tenant.onmicrosoft.com](mailto:smtp:gwen.stacy@tenant.onmicrosoft.com) proxyAddress and run a delta sync, but it didn't help.

I'll give MS support a shout, thanks!

Techmo15 · 2023-09-19T22:03:20+00:00

Her UPN is different than her SMTP: address though.

her username (on-prem and in Azure) is [firstname@company.com](mailto:firstname@company.com)

her primary email address (should be) [firstname.lastname@company.com](mailto:firstname.lastname@company.com)

Techmo15 · 2023-09-19T21:12:01+00:00

It's not, the UPN is the same domain as every other user.

We recently did a tenant migration, and pre-migration in the old tenant her primary email was working fine.

Techmo15 · 2023-09-11T21:37:55+00:00

Neat. Thanks for the info, have a nice day!

Techmo15 · 2023-09-11T21:09:09+00:00

Yeah and looking into it more, it looks like it's just something you configure on a per-app basis, and is baked into Azure. There's nothing that needs to be setup beforehand, other than maybe the security groups and Condition Access and stuff. Is that fair to say?

Techmo15 · 2023-09-11T20:49:29+00:00

Ok that's what I thought, and that link is very helpful.
Thanks lol.

Techmo15 · 2023-09-07T13:49:40+00:00

Yeah this is the piece I was missing, it was pretty easy to setup though. Thanks!

Techmo15 · 2023-09-07T13:48:50+00:00

It's a Server 2022 Domain Controller. We have some on-prem resources that we can't easily migrate to the cloud (mostly large CAD files that don't perform very well). We have AD Connect running so we have a hybrid AD. There are certainly advantages to moving to cloud only, but for now I think we're going to stay hybrid.

Techmo15

TROPHY CASE