No connection Wazuh agent with Manger

[jozb09]

Hello Team,

Sorry, am getting the below error on my endpoint wazuh agent

ERROR: (1216): Unable to connect to 'XX.XXX.XXX.XXX:1514/tcp': 'No connection could be made because the target machine actively refused it.'.

Kindly, help me how to fix it.

The deployment is distributed with three nodes

[dougburks]

Have you run so-allow to allow the traffic?
https://docs.securityonion.net/en/2.3/so-allow.html#so-allow
https://docs.securityonion.net/en/2.3/wazuh.html

[jozb09]

Yes, I did, but the problem still exist

[dougburks]

Is there a network firewall or some other network device that may be interfering with the traffic?

Which of your three nodes are you trying to send to?

Have you run tcpdump on that particular node to verify that the traffic is reaching the management interface?

[jozb09]

I have a server which is mail server. I managed to install wazuh agent with version 3.13

I run the command tcpdump -i any -nnvv host and dst port 1514 in manager node

The traffic was coming. But I can't see the events on soc alert dashboard.

When I do telnet form the mail server (Wazuhagent) to port 1514 I get Unable to connect to remote host: Connection refused

[jozb09]

@dougburks, Can you share the options, please? still am not able to send data to the manager. No Firewall between

[jozb09]

@dougburks, I sort it after looking at the log file on the manager and saw an issue with the rule I configured. So, it's sorted now.

Thanks!