Enclave Gateway¶

IP connectivity not working¶

If you find an Enclave Gateway isn't routing traffic as expected, please start by following this troubleshooting checklist:

Check your systems (sender systems and gateways) are all enrolled, connected and approved in the portal.
Check that the sender system(s) can ping the Gateway using the Gateway's Enclave address.
Check the subnets which the Gateway is advertising.
Check the output of enclave status on all systems has the correct Gateway for subnets.
Check that the Gateway itself can reach (i.e. ping) other devices on its local subnet.
Check the routing table has been correctly configured on the relevant Sender systems of the policy.

The routing table is configured automatically by Enclave so it's unlikely to be the source of a problem unless there are other conflicting routes already in place. The Interface address is the client's local Enclave IP address.
```
C:\> route print | findstr 172.26.0.0
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination         Netmask     Gateway         Interface    Metric
172.26.0.0            255.255.240.0     On-link    100.119.20.243        26
```
Check that iptables is correctly installed on the Enclave Gateway system (sudo apt install iptables) and correctly configured.

Run sudo iptables -t nat -n -L ENCLAVE --line-numbers.

In particular pay attention to the to: field on the postrouting chain, which should be the local (non-enclave) IP address of your Enclave Gateway.
```
user@gateway:~$ sudo iptables -t nat -n -L ENCLAVE --line-numbers
Chain ENCLAVE (1 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  100.64.0.0/10        100.64.0.0/10
2    SNAT       all  --  100.64.0.0/10        172.26.0.0/20            to:172.26.0.3
```
Check that the iptables pkts and bytes counters are incrementing.

If they're not then the iptables configuration may be incorrect or the routing table on the sender system may not be correct.
We may also ask you to try running Enclave as a foreground process with high log verbosity to capture detailed diagnostic information.

Run enclave directly with sudo enclave run -v 5 to inspect traffic flows on the sender and Enclave Gateway.
We may also ask you to try running tcpdump on your Enclave Gateway to capture a packet trace.

Run a tcpdump trace on your Enclave Gateway to capture traffic sent to the host you're trying to communicate with via the Enclave Gateway, for example a printer at 172.26.0.250.

Using tcpdump on the network interface which your Gateway would use to reach the target subnet (in this example, we're capturing on eth0. In this example, you can see a successful ICMP echo request originate from an Enclave sender on the Gateway's eth0 interface (172.26.0.3) destined for the printer (172.26.0.250), followed by an ICMP echo reply showing the Gateway is working.
```
$ sudo tcpdump -ni eth0 host 172.26.0.250
11:28:12.444590 IP 172.26.0.3 > 172.26.0.250: ICMP echo request, id 1, seq 4208, length 40
11:28:12.444995 IP 172.26.0.250 > 172.26.0.3: ICMP echo reply, id 1, seq 4208, length 40
```

Periodic disconnection¶

If you find an Enclave Gateway is working as expected, but periodically disconnects from the Enclave platform, please follow this troubleshooting checklist:

Check there are no IP conflicts on the local network. We suggest using arp-scan. To detect IP conflicts, run the following:

$ sudo arp-scan –I eth0 -l

As an output example, in this instance, the 192.168.1.39 IP is in conflict since it appears twice.

192.168.1.10   00:1b:a9:63:a2:4c       BROTHER INDUSTRIES, LTD.
192.168.1.30   00:1e:8f:58:ec:49       CANON INC.
192.168.1.33   00:25:4b:1b:10:20       Apple, Inc
192.168.1.37   10:9a:dd:55:d7:95       Apple Inc
192.168.1.38   20:c9:d0:27:8d:56       (Unknown)
192.168.1.39   d4:85:64:4d:35:be       Hewlett Packard
192.168.1.39   00:0b:46:e4:8e:6d       Cisco (DUP: 2)
192.168.1.40   90:2b:34:18:59:c0       (Unknown)

DNS names not resolving¶

If there are issues resolving the names of systems behind an Enclave gateway, try these steps.

Check that the systems you wish to resolve addresses for are reachable by a configured Enclave policy. Gateways will only return results for systems they can route to.
If you are using single-label hostnames (e.g., printer instead of printer.corp.example.com), see single-label hostnames not resolved by Enclave Gateway.
If you have a .local domain suffix in your network, check our information on gateway DNS and the .local domain.
Check whether any other VPN or Zero Trust Network Access software is installed on the system running Enclave Gateway. Consider removing it and restarting the system to rule out interoperability issues affecting DNS resolution.
Check if latency to the Enclave Gateway host is reporting as greater than 1000ms. Windows allows 1 second for local DNS queries to complete. If the gateway is not able to receive and respond to DNS queries from the local OS in 1 second, Windows will failover to the next available resolver, giving the appearance that Enclave Gateway is not correctly resolving hostnames.

If you're still experiencing gateway issues after working through this checklist, see collecting logs and contact support.