The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.
Difference between revisions of "Tools/Manuals/TS22"
< Tools
Jump to navigation
Jump to search
(Created page with '{{TOC_right}} Category:FAQ ------ Back to the Troubleshooting Guide ------ BR = 425 425 Can't open data connection. timed out() f…') |
|||
| Line 2: | Line 2: | ||
[[Category:FAQ]] | [[Category:FAQ]] | ||
------ | ------ | ||
Back to | Back to [[Tools/Manuals/SiteProblemsFollowUp|Troubleshooting Guide]] | ||
------ | ------ | ||
= 425 425 Can't open data connection. timed out() failed. = | |||
== Full message == | == Full message == | ||
$ lcg-rep --vo dteam lfn:my-test-lfn -d my-SE.my-domain | $ lcg-rep --vo dteam lfn:my-test-lfn -d my-SE.my-domain | ||
the server sent an error response: 425 425 Can't open data connection. timed out() failed. | the server sent an error response: 425 425 Can't open data connection. timed out() failed. | ||
== Diagnosis == | == Diagnosis == | ||
Typical scenario: on a WN | |||
Typical scenario: on a WN <font face="Courier New,Courier">lcg-rep</font> from a remote SE to the close/default SE fails. | |||
This can have various causes: | This can have various causes: | ||
# At the time of the command the target SE was down or unreachable from outside, e.g. shielded by some firewall on the way. | |||
e.g. shielded by some firewall on the way. | # The GLOBUS_TCP_PORT_RANGE is not defined on the target SE, or the range is not allowed by some firewall on the way. | ||
# Some firewall on the way to the SE has a problem with connections in rapid succession that all use the same source and destination ports, e.g. rapidly repeating occurrences of <font face="Courier New,Courier">source:20000 --> SE:20000</font>, which used to be normal when a file is copied onto the SE. | |||
or the range is not allowed by some firewall on the way. | |||
in rapid succession that all use the same source and destination ports, | |||
e.g. rapidly repeating occurrences of | |||
which used to be normal when a file is copied onto the SE. | |||
The idea is that normally the source port will be assigned by the OS to | The idea is that normally the source port will be assigned by the OS to | ||
| Line 38: | Line 30: | ||
== Solution == | == Solution == | ||
# Check definition of GLOBUS_TCP_PORT_RANGE on the target SE and if the GridFTP server was (re)started with that definition. | |||
the GridFTP server was (re)started with that definition. | # Check the rules of firewalls on the way to the SE. | ||
# Use a recent version of Globus on the source host (SE, UI, WN). | |||
# Do not define GLOBUS_TCP_SOURCE_RANGE (sic). | |||
Revision as of 08:57, 31 March 2011
Back to Troubleshooting Guide
425 425 Can't open data connection. timed out() failed.
Full message
$ lcg-rep --vo dteam lfn:my-test-lfn -d my-SE.my-domain the server sent an error response: 425 425 Can't open data connection. timed out() failed.
Diagnosis
Typical scenario: on a WN lcg-rep from a remote SE to the close/default SE fails. This can have various causes:
- At the time of the command the target SE was down or unreachable from outside, e.g. shielded by some firewall on the way.
- The GLOBUS_TCP_PORT_RANGE is not defined on the target SE, or the range is not allowed by some firewall on the way.
- Some firewall on the way to the SE has a problem with connections in rapid succession that all use the same source and destination ports, e.g. rapidly repeating occurrences of source:20000 --> SE:20000, which used to be normal when a file is copied onto the SE.
The idea is that normally the source port will be assigned by the OS to a different value for each connection, so that a firewall may conclude that rapid repetitions are abnormal/illegal, so should be blocked.
Recent versions of Globus (e.g. as used in gLite 3.2) let the OS pick random source ports unless the environment variable GLOBUS_TCP_SOURCE_RANGE (sic) is defined; that variable should never be set.
Solution
- Check definition of GLOBUS_TCP_PORT_RANGE on the target SE and if the GridFTP server was (re)started with that definition.
- Check the rules of firewalls on the way to the SE.
- Use a recent version of Globus on the source host (SE, UI, WN).
- Do not define GLOBUS_TCP_SOURCE_RANGE (sic).