How to resolve offline or unreachable cloud connections

Overview

When a Site is connected to the Cloud service, you can reach it from the Desktop Client, Mobile Client, Web Admin, and the Cloud portal without configuring port forwarding. The Cloud uses a Mediator service to help Clients find the Site, and a Relay service to carry traffic when a direct connection isn't possible. For more information, see What is Cloud Connect?.

This article explains what the Offline and Unreachable statuses mean and how to resolve the most common causes.

Applies to: VMS version 6.1 and later

If your Site runs an earlier version, update to the latest version. If you can’t update, contact Support.

What Offline and Unreachable mean

Offline: The Site isn't communicating with the Cloud. Common causes are a stopped Server service or a Server with no internet access. If every Cloud-connected Site shows Offline, check the Client's internet connection.
Unreachable: The Site is online and connected to the Cloud, but the Client can't connect to it through the Cloud. This usually means something on the network is blocking traffic or a certificate can't be verified.

Before you begin

Check these first. They resolve many Offline and Unreachable cases without further troubleshooting.

Confirm that the Server service is running on every Server in the Site.
Confirm that the Site is still connected to the Cloud. Do one of the following:
1. In the Desktop Client, open the Main Menu > Site Administration > Cloud.
2. In Web Admin, open the general settings page and check the Cloud section.
Check that the Server's date and time are correct. If the clock is wrong, secure (TLS) connections to the Cloud fail.
Check the Maintenance and incidents feed for known Cloud issues.

Check for firewall and network restrictions

The Cloud works on most networks without extra configuration. Some corporate networks, though, block outgoing connections to addresses that aren't on an allow list, and that blocks traffic to the Mediator and Relay.

On the Server, run the Connectivity Service Checker. For the script and instructions, see Allowing Nx Cloud traffic through a firewall.
Review the results. Every endpoint should show AVAILABLE.
If any endpoint is blocked, ask your network administrator to add all of the listed FQDNs to the firewall allow list. Include every FQDN, not only the ones for your region.
If the firewall allows the traffic but endpoints are still blocked, check for antivirus or web-filtering software on the Server.

Check the Server certificate

By default, the Server generates its own self-signed certificate and renews it automatically. Some networks with strict security rules don't accept self-signed certificates for outside connections. In that case, install a certificate that your network trusts. For instructions, see How to generate and add a self-signed trusted certificate.

Regenerate the default Server certificate

Note: If the ssl folder contains a cert.pem file, the Server uses that custom certificate, not default.pem. Replace cert.pem with a valid certificate instead of following these steps.

Stop the Server service:
- Windows: Open services.msc, right-click Network Optix Media Server, and click Stop.
- Linux: Run sudo systemctl stop networkoptix-mediaserver.
Go to the Server's ssl folder:
- Windows: C:\Windows\System32\config\systemprofile\AppData\Local\Network Optix\Network Optix Media Server\ssl
- Linux: /opt/networkoptix/mediaserver/var/ssl
Delete default.pem.
Start the Server service. The Server generates a new certificate.

After the certificate changes, any Clients that connected before might show a certificate warning. For more information, see What is Nx Certificate Validation?

Note: These paths are for Nx Witness. For other VMS products, replace Network Optix and networkoptix with the name of your OEM product provider.

Related to