Apple Service Toolkit Firewall Rules

Question

Level 1

0 points

Apple Service Toolkit Firewall Rules

I have been charged with setting up a Mac Mini server with the Apple Service Toolkit v. 1.0.9 for our Hardware Support department. I have a 2010 Alumninum Mac Mini Server as well as an Apple USB Ethernet adapter. The machine is configured to connect to the LAN via the built-in ethernet port and serve DHCP and NetBoot via the Apple USB Ethernet.

I followed the directions in the documentation to set up the server, but there is no mention of setting up the firewall, which concerns me. The box will only be handling diagnostics with the Apple Service Toolkit, but I still don't want it completely open to the world.

When I set up the firewall and enable it, the Gateway Manager.app cannot find the Diagnostic Gateway server. In the /var/log/system.log, I get the following errors, repeating:

(/var/log/system.log)
[...]
Aug 16 15:19:16 hostname com.apple.gw_datad[76]: socket bind: Can't assign requested address
Aug 16 15:19:16 hostname com.apple.gw_controld[77]: socket gind: Can't assign requested address
[...]

Has anyone had an experience with a similar setup? Do you have the software firewall (through Server Admin or command line ipfw) enabled?

Thanks!

Posted on Aug 16, 2011 1:18 PM

Reply

Answer 1

Best reply

ClassicII

Level 4

1,097 points

Aug 17, 2011 7:13 AM in response to wesmason

Is the server inside a protected network? If so you should be fine. We have our AST server on a mini with in our internal network. Also vesion 1.1 is out now. 🙂

When you start the gateway manager it says "connecting to diagnostic gateway" right?

Reply

Answer 2

wesmason Author

Level 1

0 points

Aug 17, 2011 7:28 AM in response to ClassicII

I figured it out.

It looks like the configuration file for the Gateway Manager was set to look for the server on the wrong ethernet adapter, so it wasn't getting a connection.

Also, thanks for the heads up on 1.1.

<3

Reply

Answer 3

ClassicII

Level 4

1,097 points

Aug 17, 2011 7:56 AM in response to wesmason

Good find, what file were you looking at? I would like to take a look at that.

Reply

Answer 4

Jan 16, 2012 10:05 AM in response to wesmason

Does anybody know what file wesmason was referring to?

Thnx

Reply

Answer 5

ClassicII

Level 4

1,097 points

Jan 17, 2012 10:09 AM in response to Hopkins_Tech

Good question I am going to take a look at the gateway manager plist file and see if its in there.

Reply

Answer 6

Jan 17, 2012 10:16 AM in response to ClassicII

Thank you!

I have AST installed on a server with bonded NICs, which Apple doesn't support at the moment. I wanted to see if I could simply tell the configuration file instead of going to en1 or en0, to go to "bond0".

Reply

Answer 7

Feb 26, 2012 8:26 PM in response to Hopkins_Tech

Hopkins_Tech I also have an xServe with bonded NICs and have been trying to set the gateway manager to use bond0 with no luck. Have you gotten anywhere with this?

Reply

Answer 8

Feb 27, 2012 6:12 AM in response to Andy Boutte

Andy,

This is the reply I got from AST's support:

Unfortunately AST currently does not support bonded ethernet which is why Gateway Manger is not launching. As AST shares it's configuration settings this is also why Gateway Manager on your portable did not launch. There is currently no work around besides to unbind the ethernet port or to use a separate NIC for AST/Netbooting.

I actually have another open NIC on the server and I would go that route, except our switches don't allow any more iphelpers, which is required to netboot across subnets. So we are out of luck.

Reply

Answer 9

Feb 27, 2012 1:43 PM in response to Hopkins_Tech

That is really unfortunate. I really want to use bond0 for NetRestores and NetBoots but I also have AST running on the same box. I have an extra availble NIC but when I enable that for AST all NetBoots get broadcasted twice on the network and users would have the ability to choose the non bond0 interface which defeats the purpose of having it.

Looks like I will have to move AST to another box or try and find a workaround. Thanks for the confirmation though.

Reply