The users device's tunnels are terminated on the Gateways. Here cz-vpnd@x handles the majority of the traffic (NGiNX handles HTTP up), cz-sessiond controls the user's session; cz-gonamed or cz-dnsfwd resolves the resource names in Entitlements.
To list tun device
ip tuntap show
Capture traffic on a tun device, for example tun3
tcpdump -i tun3
View DNS forwarder details
cz-console -i
Shows the current status of the DNS Forwarder. This will include:
This will perform an http GET - the results will confirm NGiNX is operating as expected and will list the URIs in the [ ] for the specified for the user.
* Trying 127.0.0.1..... .....{"uris":[{"uri":"<hostname>:80","name":"<app name>","rule":"allow"},{"uri":"<hostname>:80/<subnet>","name":"<app name>","rule":"block"}],"dn":"CN=<deviceID>,CN=<username>,OU=local"} * Connection #0 to host 127.0.0.1 left intact
The Portal uses theAppgate SDP Client under the covers. Since they are buried within an Appliance, a set of troubleshooting tools are available to help diagnose any user access issues that might arise.
Webd is the daemon that controls the session usage within the Portal. To get to the webd admin console:
sudo nc -U /var/run/cz-webd/cz-webd-admin.socket
Then enter:
help > prints help
status > prints statistics for webd
sessions list > lists active sessions
session <SHORTID> info > prints info about specific session
session <SHORTID> remove > force removal of session
To see the specific client logs for a user's session.
journalctl -t cz-webclient@<ClientID>
ClientID can be obtained from the session list.
To check on the DNS settings being applied to each user use:
sudo cz-memcachedump
(Because this is a view of a live cache the results can be a bit unpredictable - so you may need to run this a few times to capture the information you are interested in.)
For a general overview of the Portal's Clients and the related memory consumption use:
sudo cz-clients status
An appliance that acts as an enforcement point, controlling user access to protected resources.
The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.
A web-based interface that allows users to access resources without requiring a standalone Client. It serves as a reverse proxy for user traffic.
Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model.
The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions.
