Security

"Connection was reset" when trying to make an API request using CURL

tomapatan
Contributor

Hi,

I`m trying to make an API request from my local machine to our Splunk Cloud instance, without much success.
Checked the Firewall logs and I can`t see any blocked/denied traffic.

Using:
-  curl 7.29.0

- nss-3.90

Error received:

 

* Host myDomain.splunkcloud.com:8089 was resolved.
* IPv6: (none)
* IPv4: xx.xx.xx.xxx
*   Trying xx.xx.xx.xxx:8089...
* Connected to myDomain.splunkcloud.com (xx.xx.xx.xxx) port 8089
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* Recv failure: Connection was reset
* schannel: failed to receive handshake, SSL/TLS connection failed
* closing connection #0
curl: (35) Recv failure: Connection was reset

 

 

Labels (1)
0 Karma

99eaglez
Explorer

Depending on your environment you may need to add an environmental variable for a proxy server.

This allows apps to be "proxy aware" in cases where they are not.

You can test it out on windows using the setx command.

setx https_proxy <your proxy server ip>:443
setx http_proxy <your proxy server ip>:443

I know what your are thinking - "it is over port 8089" not "443" but try it out, it worked for me.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @tomapatan 

You mentioned that there are no blocks on your internal firewall - are there multiple egress IPs that your connection can connect out on? Are all possible egress IPs allow-listed in Splunk Cloud for Mgmt port / API access to the SHs? 

If you havent already, you can configure the allow list via:
Splunk Web - https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Admin/ConfigureIPAllowList

ACS API - https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Config/ConfigureIPAllowList

ACS CLI - https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Config/ACSCLI

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma

tomapatan
Contributor

Thanks Will,

I`ve already configured the allow list, although you made a valid point and there`s a high chance that I`ve not listed all possible IPs - something I need to look at.

I had another look at the firewall logs and found a field called vendor_action=server-rst - I would imagine this means the connection was reset by the server, although not entirely sure why.

tomapatan_0-1740582489049.png

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...