Why Am I Seeing Login Errors of Code: C_519 When I Use a Web Browser for Resource O&M?

Symptoms

When a user attempts to log in a managed host using a web browser, a login error (Code: C_519) is reported, indicating that the resource cannot be accessed because the resource connection fails or the resource is unreachable. If the problem persists, contact the system administrator or check the system log.

Possible Causes

• The network is broken because the network connection between the CBH system and the resource server is abnormal.
• The connection is broken because the network between the CBH system and the managed host is blocked.
• The connection is unreachable because the server does not respond.
• The IP address of the managed host is not configured in the subnet where the eth1 NIC of the bastion host is located. When the CBH instance is connected to the host, the route to the target host cannot be found. So, the connection is unreachable.

Check the Network Connection

Log in to the CBH system, ping the managed host and TCP port, and check whether the network connection is normal.

• If the network connection is normal, the issue was caused by unstable network.

  Restart the managed host. The network recovers after the managed host is restarted. If the fault persists after the host is restarted, check by referring to ECS Failures or Slow ECS Responses.

• If the network connection is still abnormal, the network between the CBH system and the managed host is restricted. Perform the following operations to rectify the fault:
  1. Check whether the current user is an intranet user and whether the user's access permission is restricted.
  2. Check Whether the CBH System Environment Is Properly Configured
  3. Check Whether the Managed Host Is Properly Configured
  4. Checking Whether the Managed Host Can Be Accessed by the CBH System
  5. Check Whether the IP Address of the Managed Host Is in the Subnet of the CBH eth1 NIC

Check Whether the CBH System Environment Is Properly Configured

1. Log in to the CBH system and check whether the IP address and port number of the managed resource are correct.
2. Check whether IP address restriction is configured in the access control policy associated with the resource. Modify ACL rules to remove the restrictions on the source IP address of a user.
3. Check the security group associated with the CBH instance and check whether the port configuration of the security group is correct. It is recommended that you configure CBH instance security group based on the recommended CBH ports.

   If you log in to the managed host using a web browser, manually add an inbound rule that allows all access to TCP port 443 in the security group to which the CBH instance belongs.

4. Check whether the network ACL associated with the CBH instance on the intranet is correctly configured.

   Remove the access restriction on the IP address of the CBH instance and add the resource IP address to the destination address to allow the CBH instance to access resources.

5. After the reconfiguration, log in to the managed host again through the CBH system.

Check Whether the Managed Host Is Properly Configured

1. Log in to the management console of the managed host as an administrator.
2. Check whether the host resource and the CBH instance are in the same VPC and region. The CBH instance can only directly access resources in the same VPC and region.
3. Check whether the security group rules associated with the managed host are properly configured.

   Remove the access restriction on the IP address of the CBH. Add the IP address of the CBH to the source address to allow CBH to access resources.

4. After the reconfiguration, log in to the managed host again through the CBH system.

Checking Whether the Managed Host Can Be Accessed by the CBH System

1. Log in to the managed host as an administrator.
2. Run the route -n command to check whether the CBH route is missing from the routing table.
3. Check the login method and login security hardening measures of the managed host by referring to the following content:
   • Enhancing Security for SSH Logins to Linux ECSs
   • Windows ECS Login Overview
   • Linux ECS Login Overview

4. Remove the login restriction by referring to the following content:
   • Why Cannot I Log In to My Linux ECS?
   • Why Cannot I Log In to My Windows ECS?

5. After removing the security hardening restrictions, log in to the managed host through the CBH system again.

Check Whether the IP Address of the Managed Host Is in the Subnet of the CBH eth1 NIC

1. Check whether the IP address of the managed host is in the subnet of the CBH eth1 NIC.
   1. Log in to your bastion host.
   2. Choose System > System Config > Network.
   3. In the Network Interfaces area, check whether the IP address of the managed host is in the subnet of the eth1 NIC.
      • If no, rectify the fault by referring to 2.
      • If yes, contact technical support.

2. Add a static route, and add the IP address of the managed host to the subnet where the eth1 NIC is located.
   1. In the Static Route area on the Network page, click Add. The Add static route dialog box is displayed.
      Configure required parameters according to the following requirements:

      • Destination: Enter the IP address of the managed host or the subnet segment where the managed host IP address is located.
      • Netmask: If the destination address is an IP address, set the mask to 255.255.255.255. If the destination address is a network segment, set the mask to the mask of the corresponding network segment.
      • Next Hop: Enter the next-hop address of eth1.
      • Outgoing: Select eth1.
      • Remarks: You can leave a remark or leave this parameter blank.
      • Sync To Standby Machine: You can enable or disable this function based on your site requirements.
   2. Click OK.

If the problem persists, click Service Tickets in the upper right corner of the management console and submit a service ticket.