FireSight OT troubleshooting

A Cloud Connector doesn't come online

1. Check it has an address and can reach the Hub. At the device, run sudo fsot-connector status. It shows the network, the Hub it's trying and the last error.
2. The site blocks outbound 443. Add the fallback port: hub=https://hub.example.com:8443 in firesight.txt, or sudo fsot-connector set hub https://hub.example.com,https://hub.example.com:8443.
3. The site needs a proxy. Set proxy=http://proxy.site.local:3128 in firesight.txt, or sudo fsot-connector set proxy ….
4. The enrollment code expired or was already used. Create a new one on the Hub (New enrollment code) and enter it again.
5. Static address typo. Check uplink_ip includes the prefix (/24) and uplink_gateway is on the same subnet.
6. Firewalls that inspect TLS. Some sites break TLS for inspection, which also breaks the connector's mutual TLS. Ask the site to exempt the Hub's address.

A connector was online and dropped off

• Open it on the Hub: Status shows when it was last seen.
• If someone changed the network from the Hub and the device lost its connection, the change rolls back automatically.
• If its license has lapsed, it stays online; only new user sessions through it stop after 30 days of grace. See FireSight OT licenses.

A person can't reach a machine

1. Is it granted to them? Check the resource's grants, or the person's divisions and vendors.
2. Test from the site. On the connector's Remote management tab, use Test port with the machine's address and port, for example 192.168.1.20:502. If that fails, the problem is on the plant network: the machine is off, the port is wrong, or a local firewall blocks the connector.
3. Is the address allowed on site? The connector's local_allow list caps what it may reach.
4. Vendor hours. Vendor accounts are refused outside their working hours and after their end date.
5. Source network. If user_source_cidrs is set, people can only sign in from those networks.

The machine answers, but replies never come back

The machine has no route back to the virtual subnet. Turn masquerade on for the connector, so machines see the connector's own address, or add a route at the site.

The client won't sign in

• Certificate warning: the Hub uses a self-signed certificate. Check the fingerprint with your administrator, then trust it.
• "Too many sign-in attempts": sign-in is rate-limited. Wait a minute and try again.
• Lost your two-factor phone: an administrator can reset it.
• Version mismatch: download the client again from My access.

Uploads to file storage are refused

• File storage is off until an administrator allows it in the security settings and turns it on for the connector.
• Uploads only work on the connector's machine-network address, port 2222 for SFTP by default.
• Downloading over SFTP or FTP is refused by design; download on the Hub instead.
• If the area is full, wait for the clean-up or ask an administrator to raise the limit.

Collect information for support

When you contact support, include:

• the Hub's version (Overview) and serial (License);
• the connector's name and serial (sudo fsot-connector status);
• the output of Remote management → Network diagnostics and Recent logs;
• on the Hub server, journalctl -u fsot-hub --since "1 hour ago".