How do I test from TR7 whether a server's port is reachable?

Short answer

In WEB-CLI, the Route Table value of the Backend Service is first selected with sys-cmd route-table set. Then, with sys-cmd nmap (sys-cmd nmap -Pn -p <port> <address>), it is seen whether the port is open, closed or filtered: closed indicates that there is no service listening on that port on the target, and filtered indicates that a firewall in between or on the target drops the packet. To connect to the port manually and see the first response of the service, sys-cmd telnet (sys-cmd telnet <address> <port>) is used; Connected to … shows that the connection was established, and Connection refused shows that there is no service listening on the port. System commands run only for a user whose User Type is Admin.

Problem: Is the Server Reachable from TR7's Network?

The Backend Service appears down in the health check or the vService returns 503, while the server appears to be working on its own. To tell whether the problem is on the server, in a firewall on the path, or in a wrong port or route table, the port must be connected to from TR7's own network, not from the client's computer.

Solution: Two Methods

The two commands complement each other: nmap shows the port status, and telnet shows the first response of the service. Both run from the route table selected in WEB-CLI.

Your situation	Suitable method
I want to find out whether the port is open, closed or filtered; I will check more than one port together	Method 1: sys-cmd nmap
I want to connect to the port and see what the service responds	Method 2: sys-cmd telnet
I want to see the server's HTTP response and status code	sys-cmd curl → It works when the backend is accessed directly but not through TR7; why?

Method 1: sys-cmd nmap Recommended

• How it workssys-cmd nmap scans the target's ports from the selected route table and writes the open, closed or filtered result for each port; it closes by itself when the scan ends.
• Where it is openedWEB-CLI
• Requirement A user whose User Type is Admin; system commands run only for this user type (System Commands).
• Scope Device-wide; not bound to a vService. The result is the status as seen from the selected route table.

Step-by-Step Configuration

1

Adım 1 Select the Backend Service's route table

The value in the Route Table field of the Backend Service is selected; for the device itself, Host is written in the v-device field, and the route table name is taken from the Tab list:

sys-cmd route-table set v-device Host route-table <route-table>

The current selection is seen with sys-cmd route-table show (route-table show).

2

Adım 2 Scan the port

In the example, ports 8080 and 8443 of the server with the address 192.0.2.21 are scanned; -Pn does not first test with ICMP whether the target is up, and it is required for servers that block ICMP:

sys-cmd nmap -Pn -p 8080,8443 192.0.2.21

A port range is written in the -p 8000-8100 format. To also see the name and version of the service, -sV is added; for a UDP port, -sU is used (frequently used parameters).

3

Adım 3 Interpret the result

Result	Meaning	Where to look
open	The port was reached and a service responded	The health check or the vService settings (A backend shows as down; how do I diagnose it?)
closed	The port was reached, but there is no listening service	The service on the server or the Port value of the Backend Service
filtered	No response came to the probe packet	The firewall on the path or on the server, the route table selection

Verification

1Port statusTR7 side

The port line in the sys-cmd nmap output is checked.

Command: sys-cmd nmap -Pn -p 8080 192.0.2.21

Expected8080/tcp open

The output can be written to a file with | to-file; it is kept to be attached to the support ticket.

Method 2: sys-cmd telnet

• How it workssys-cmd telnet is an interactive client that opens a TCP connection to the target's port from the selected route table; if the connection is established, each line written is sent to the server and the response is seen on the screen.
• Where it is openedWEB-CLI
• Requirement A user whose User Type is Admin.
• Scope A single address and port; not bound to a vService.

Step-by-Step Configuration

1

Adım 1 Select the Backend Service's route table

As in step 1 of Method 1, sys-cmd route-table set v-device Host route-table <route-table> is run.

2

Adım 2 Connect to the port

The address and the port are written separated by a space:

sys-cmd telnet 192.0.2.21 8080

telnet opens a full terminal session; keys such as Ctrl+C go to the tool, not to the CLI, and | cannot be written after the command.

3

Adım 3 See the service's response (optional)

Many services first wait for the client to speak; the screen staying empty after the connection is not an error. For an HTTP service, the request is written manually, and then Enter is pressed for an empty line:

GET /health HTTP/1.1
Host: www.example.com

4

Adım 4 Exit the session

With Ctrl+], the tool's command line is entered and quit is written. When the server closes the connection, the session ends by itself.

Verification

1ConnectionTR7 side

The line right after the command is checked.

Command: sys-cmd telnet 192.0.2.21 8080

ExpectedConnected to 192.0.2.21

Connection refused shows that there is no service listening on the port; waiting for a long time and falling into a timeout shows that the packet may be dropped by a firewall on the path or on the target.

Common Mistakes

• Running the test from the wrong route table. When a server in an isolated route table is tried from the default context, it looks as if there is no access; before starting the diagnosis, the context is verified with sys-cmd route-table show.
• Thinking that the port is open because ping responds. ping only shows that the address was reached; the service port is tried separately with nmap or telnet.
• Expecting a meaningful response with telnet on a TLS port. On ports such as 443, the connection is established but no plain-text response is received; for a TLS check, sys-cmd sslscan is used (How do I test from TR7 which TLS versions and ciphers a server supports?).
• Scanning wide port ranges and subnets. Scanning can create load on the servers and can trigger intrusion detection systems; only the required address and port are scanned.
• Generalizing the result to the SNAT address of the Backend Service. nmap and telnet do not use the SNAT setting of the Backend Service; if a specific address is selected in SNAT, it is checked separately that this address is also allowed in the server's firewall.

How it is done in the documentation

• sys-cmd nmap · What the Results Mean
• sys-cmd telnet · Connection Results
• Connection, Port & Scan · Which Command When?
• sys-cmd route-table · route-table set

Related questions

• A backend shows as down; how do I diagnose it?
• It works when the backend is accessed directly but not through TR7; why?
• Which IPs should I allow on the server firewall for health checks?
• Can I capture packets on TR7 and download them as a pcap (tcpdump)?