years
2018, 2019

lastupdated

2019-10-11

keywords

IBM CIS connection, CIS network connection, Origin web server, troubleshooting

subcollection

cis

{:shortdesc: .shortdesc} {:new_window: target="_blank"}

Troubleshooting your {{site.data.keyword.cis_full_notm}} network connection

{:#troubleshooting-your-cis-network-connection}

How do I know if my data is passing through my {{site.data.keyword.cis_full}} connection?

{:#how-do-i-know-if-my-data-is-passing-through-my-cis-connection}

{{site.data.keyword.cis_full_notm}} ({{site.data.keyword.cis_short_notm}}) uses HTTP headers, which it can read, add, or modify. The header lets us trace how a request was routed, using a CF-Ray number. The CF-Ray number can be found by a curl command or with a Google Chrome plugin in called "Claire".

To know whether data has passed through {{site.data.keyword.cis_short_notm}}, locate the Ray ID which will be present on every packet.

Unix command line tools:

curl for HTTP: $ curl -vso /dev/null http://example.com
dig for DNS: $ dig www.example.com
traceroute for network: $ traceroute example.com

For example:

Terminal command: curl -svo /dev/null YOUR_URL_HERE. -L

Results in: CF-RAY: 1ca349b6c1300da3-SJC

Adding CF-Ray headers

The CF-RAY header is added to help trace a request to a website through the network. Use it when working with Support to help troubleshoot any related issues with connectivity. You can reveal this "Ray ID" in your logs by making some edits to configuration files in Apache and nginx.

Apache

{:#troubleshooting-cis-apache}

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{CF-Ray}i" cf_custom

CustomLog log/access_log cf_custom

nginx

{:#troubleshooting-cis-nginx}

log_format cf_custom '$remote_addr - $remote_user [$time_local]  '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$http_cf_ray';

access_log  /var/log/nginx/access.log cf_custom;

What do I do if I use the Cloudflare Origin root certificate, and it's expiring?

{: #update-origin-root-ca}

Some origin web servers (such as IIS and cPanel) validate origin root CA certificates and require you to upload one.

If you are using the RSA version of the Cloudflare origin root CA, it expires on November 11, 2019 (2019-11-14T01:43:50Z). You must take the following actions to avoid site disruptions.

Download and install new certificate

{: #download-new-cert}

Select one of the following root certificates to download and install.

RSA version certificate. The previous version expires on 2019-11-14T01:43:50Z.
ECC version certificate. The previous version expires on 2021-02-22T00:24:00Z.

How do I trace a route?

{:#how-do-i-trace-a-route}

To see whether a route goes through your {{site.data.keyword.cis_short_notm}} pathway, you can perform a dig in a Terminal window for Mac or Linux or use nslookup in the Windows command prompt for Windows.

If the packet has a CF-Ray value, then it has travelled through {{site.data.keyword.cis_short_notm}}.

The traceroute command shows the entire path that an IP request has taken.

The support team makes use of these commands to assist you.

If you see a privacy warning

{:#troubleshooting-cis-privacy-warning}

The certificates issued by {{site.data.keyword.cis_short_notm}} cover the root domain (example.com) and one level of subdomain (*.example.com). If you’re trying to reach a second-level subdomain (*.*.example.com) you will see a privacy warning in your browser, because these host names are not added to the SAN.

Also, please allow up to 15 minutes for one of our partner Certificates Authorities (CAs) to issue a new certificate. You’ll see a privacy warning in your browser if your new certificate has not yet been issued.

What do I do if I’m under a DDoS attack?

{:#troubleshooting-cis-ddos-attack}

Step 1: Turn on "Defense Mode" from your dashboard
Step 2: Set your DNS records for maximum security
Step 3: Do not rate-limit or throttle requests from {{site.data.keyword.cis_short_notm}}

During "Defense Mode", each new visitor is met with a "Captcha" security challenge, which they must pass before being given a cookie for unchallenged access. That way, botnet traffic is blocked until the "Defense Mode" is turned off. Visitors that do not meet the security challenge are added to the (bad) IP Reputation database.

Other problems you might encounter

{:#troubleshooting-cis-other-problems}

Here are some common error messages that you or your support team might see:

Error Code	Reason
1001	DNS Resolution Error. Either the customer recently signed up and their DNS information has not yet propagated, or whomever is managing the DNS has a failure.
521	Origin web server refused connection from {{site.data.keyword.cis_short_notm}}. Either the origin web server is not running, or something is blocking {{site.data.keyword.cis_short_notm}} IP addresses.
522	Connection timeout to the origin server (30 second default). Either CIS may be rate-limited, the web server may be consuming all resources (shared server), or there may be network connectivity issues between the web server and {{site.data.keyword.cis_short_notm}}.
523	Origin server is unreachable. Ensure that the origin IP address for the DNS record is the same as the one appearing in the {{site.data.keyword.cis_short_notm}} DNS Settings page.
524	{{site.data.keyword.cis_short_notm}} could make a TCP connection but did not receive a response from the web server. A long-running application or database query is interfering.

Not seeing any network traffic

{:#troubleshooting-cis-network-traffic}

If you’re not seeing traffic, and you’re using a CNAME, make sure that there is a redirect in place, so the traffic is not being routed to the root domain. Remember that some DNS propagations can take up to 48 hours to complete.

Website offline

{:#troubleshooting-cis-website-offline}

Here is what you might see:

IBM CIS cannot connect to the origin server (error 521, 522, 523).

Website offline - no cached version

The server is online, but it is blocking the {{site.data.keyword.cis_short_notm}} request.
The origin server is offline and {{site.data.keyword.cis_short_notm}}S does not have a backup website image

What you can do:

Verify that the {{site.data.keyword.cis_short_notm}} IP addresses are whitelisted..
Make sure that {{site.data.keyword.cis_short_notm}} IPs are not being rate-limited.
Here is the list of IPs to whitelist

502 error “The dreaded 502”

{:#troubleshooting-cis-502-error}

This error is one of the most common ones you may see. It typically occurs when a portion of a network is unavailable, for example, at the start of a DDoS attack. A particular data center may be unavailable for a time. Traffic will be re-routed. Run a trace route.

Here is what you might see: Error 502 - bad gateway error

What happened:

A portion of the {{site.data.keyword.cis_short_notm}} network is having an issue.
Usually the problem is limited to one server in one data center.
It affects only a portion of the site's visitors.
The {{site.data.keyword.cis_short_notm}} Technical Operations team deals with these.