Technical Note: Lost Contact with Persistent Agent After Updating From Version 2.x to 3.x or Higher

[FortiKoala]

Description

Lost Contact with Persistent Agent After Updating From Version 2.x to 3.x or Higher

Scope
Version: Persistent Agent version 3.x and higher
Solution

Version: Persistent Agent version 3.x and higher


Issue:  After updating hosts with Persistent Agent 2.x to version 3.x or higher, the agent stops communicating to Network Sentry.  Symptoms include:

• Network Sentry reports "Lost contact with Persistent Agent" events/alarms (indicates Network Sentry can no longer communicate to agent).
• Network Sentry Hosts View does not reflect new agent version (even though the new version is installed).
• Unable to scan host in Hosts View.
• Unable to send message via Hosts View.
• On affected endstation, the error message "SSL Certificate verification result: unable to get local issuer certificate" is printed in the following Persistent Agent log file (%ProgramData%Bradford Networksstderr.log on Windows, /var/log/bndaemon_stderr.txt on Mac OSX)
  

Possible Causes:

Missing Intermediate Certificate in Network Sentry.

To verify:

1. Login to the Administrative UI and navigate to System > Settings > Security > Certificate Management.  
2. Highlight the Persistent Agent Certificate Target and click Details.
3. Drill down on the Certificate Hierarchy and review the certificates listed.  See Identify Missing SSL Certificates via Administrative UI.  

Solution:  Install the missing intermediate certificate.  If customer does not have the original; certificate files, the Intermediate Certificate files can be obtained.  See Identify Missing SSL Certificates via Administrative UI.  

Root certificate is not installed on affected host (which allows the certificate to be trusted).

Check to make sure that the host has the same root certificate as the one installed in Network Sentry for Persistent Agent communication.

To verify:
In the Administrative UI, navigate to System -> Settings -> Security -> Certificate Management and refer to the "Issued By" field for the Persistent Agent target (Example certs.godaddy.com).

Compare against certificates installed on endstation.  See Solution Verify Trusted Certificate Authorities on Windows or Mac OSX for instructions.

Solution:  Install the Root certificate on the endstation.  This can be done by either browsing to certificate authority or installing latest OS updates to acquire the root certificate.



See also Solution 1767: Login Prompt Does Not Appear After Downloading Persistent Agent 3.x or Higher