ZTNA - no healthy upstream

Hello.

I`m using Sophos Firewall as a Gateway.

Im trying to access a agentless resource using ZTNA, the configuration process was OK and the DNS configurations OK as well.

When we try to access a resource that is on port 9001 we get a no healthy upstream.

Authentication is happening fine before accessing the resouce and the internal FQDN leads to the internal IP.

Maybe im missing something in the Firewall to let access by to those ports?

Edited TAGs
[edited by: Raphael Alganes at 6:06 AM (GMT -7) on 5 Sep 2024]

Top Replies

LuCar Toni 23 days ago +1 suggested

No healthy upstream basically means, the app is not reachable from the firewall. Check the IP / FQDN you used as "internal" in ZTNA. Then check if the firewall can reach this IP.

0 LuCar Toni 23 days ago

No healthy upstream basically means, the app is not reachable from the firewall.

Check the IP / FQDN you used as "internal" in ZTNA. Then check if the firewall can reach this IP.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Leonardo Mota 23 days ago in reply to LuCar Toni

Hello, thanks for your answers.

Yes, we can reach the ip from the firewall. And the Internal FQDN points to the internal IP as well.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Prism 23 days ago in reply to Leonardo Mota

Is the resource HTTP or HTTPS based? Did you check if It's configured correctly at Sophos Central? Mismatching the protocol can cause a "no healthy upstream" error.

Can you send a screenshot of the resource, showing it's configuratios?

Also, you can verify if the Firewall has connection to the resource by SSH'ing to the Firewall, going to advanced shell, and doing a "curl -v resource.domain".

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 EAP @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel