Enrollment issues

Typically, an asset on which the agent is successfully installed must show up on the Assets page as Reachable (State column) in two to three minutes after the agent is installed. This process is called enrollment, also referred to as registration in the mtoken*.log file.

At times, you may see that the agent is not connected to Xshield even after a few minutes. This topic lists some of the causes and solutions for failed enrollment.

Incorrect installation parameters

Cause

Solution

All or one of the FQDN, tenant name, or installer key you supplied during the installation is incorrect.

Check the contents of the instance.lgm file on the asset by using a text viewer app.

See if the Notaries, TenantName, and authKey parameters in this file are for the correct instance.
Uninstall the agent.
Start the installation with the correct parameters.

No connectivity to Enterprise DNS servers

Cause	Solution
Enterprise DNS server(s) is/are unreachable to the asset.	Run the nslookup <FQDN of the instance> command on Windows or Linux assets. Run the dig <FQDN of the instance> command on macOS assets. Check the mtoken*.log file for information about DNS resolution-related issues (error messages such as FQDN update getaddrinfo: failed No such host is known). Make the necessary changes to your DNS setup.

No connectivity to the Xshield instance

Cause	Solution
Enterprise firewall is blocking connectivity to the Xshield instance or other routing issues.	Check the Enterprise firewall logs and allow outbound connectivity on HTTPS on port 443 to the Xshield instance. Check the mtoken*.log file for information about connectivity issues and fix the issues.

Expected outcome

Assets show up on the Assets page as Reachable. If you face issues that are not listed in this topic or if the solutions in the topic did not help you fix the issue, use the Logcollect utility to collect logs from the asset, and contact ColorTokens Customer Support