How to fix ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden?

[dm1]

We have Splunk MISP 42 installed which was working until a few days ago. However, after installing Splunk Sec Essentials app, neither did the SSE app work from the get go but looks like it also messedup something that cause MISP42 app "config" page not to load and connection to MISP

Since then, I have tried many things like uninstalling SSE app, updating MISP app to latest version from 4.0.1 and then reverting back to 4.0.1 when it was working fine. But despite of all this, issue is still there.

I noticed similar proxy related message for Palo Alto addon in Splunkd logs which suggests this is more of a Splunk internal issue than MISP 42.

Splunk Core - 8.1.5

Issue is on single instance Splunk ES version 7.0.1

Can someone please help fix this ?

09-28-2022 00:05:06.486 +0000 ERROR AdminManagerExternal - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last):\n  File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 667, in urlopen\n    self._prepare_proxy(conn)\n  File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 930, in _prepare_proxy\n    conn.connect()\n  File "/opt/splunk/lib/python3.7/site-packages/urllib3/connection.py", line 316, in connect\n    self._tunnel()\n  File "/opt/splunk/lib/python3.7/http/client.py", line 927, in _tunnel\n    message.strip()))\nOSError: Tunnel connection failed: 403 Forbidden\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/adapters.py", line 449, in send\n    timeout=timeout\n  File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 725, in urlopen\n    method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]\n  File "/opt/splunk/lib/python3.7/site-packages/urllib3/util/retry.py", line 439, in increment\n    raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/misp42splunk/configs/conf-misp42splunk_instances/_reload (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper\n    for name, data, acl in meth(self, *args, **kwargs):\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 175, in all\n    self.reload()\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 259, in reload\n    action='_reload',\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 289, in wrapper\n    return request_fun(self, *args, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 71, in new_f\n    val = f(*args, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 679, in get\n    response = self.http.get(path, all_headers, **query)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 1183, in get\n    return self.request(url, { 'method': "GET", 'headers': headers })\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 1241, in request\n    response = self.handler(url, message, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/splunk_rest_client.py", line 145, in request\n    verify=verify, proxies=proxies, cert=cert, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/api.py", line 60, in request\n    return session.request(method=method, url=url, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/sessions.py", line 533, in request\n    resp = self.send(prep, **send_kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/sessions.py", line 646, in send\n    r = adapter.send(request, **kwargs)\n  File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/adapters.py", line 510, in send\n    raise ProxyError(e, request=request)\nsolnlib.packages.requests.exceptions.ProxyError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/misp42splunk/configs/conf-misp42splunk_instances/_reload (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden')))\n".  See splunkd.log for more details.

[dm1 · Accepted solution]

set this in splunk-launch.conf

no_proxy=127.0.0.1,localhost