解決 SCG 管理裝置的內部 Docker 網路或 SCG Policy Manager 之間的 IP 位址衝突

• 嘗試將裝置新增至閘道失敗
• 閘道未回應 ping 要求 
• 閘道未回應 telnet 要求 
• 閘道記錄中未顯示任何通訊嘗試的證據 

• 嘗試將閘道連線到原則管理員失敗。
• 原則管理員在閘道時不會回應 ping 要求。 
• 在閘道的策略管理員中，無法回應透過連接埠 8443 的 telnet 要求。 
• 閘道或 Policy Manager 記錄中不會顯示任何通訊嘗試的證據。 

1. 使用 SSH 或虛擬機器主控台，以 root 登入安全連線閘道的安全連線閘道或 Policy Manager。
2. 確認 docker0 虛擬網路配接卡的 IP 位址：

# ifconfig

docker0  Link encap:Ethernet  HWaddr <removed> 

               inet addr:172.17.0.1  Bcast:172.17.255.255  Mask:255.255.0.0 

               UP BROADCAST MULTICAST  MTU:1500  Metric:1 

               RX packets:0 errors:0 dropped:0 overruns:0 frame:0 

               TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 

               collisions:0 txqueuelen:0 

               RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

3. 如果您的裝置在 IP 位址中使用相同的子網路，則該裝置無法與閘道通訊。

# cd /etc/docker

4. 在編輯之前閱讀檔以查看原始內容。它看起來與此非常相似：

# cat /etc/docker/dockerdCfg.json 
{ 
  "hosts" : ["unix:///var/run/docker.sock","tcp://0.0.0.0:2375"], 
  "insecure-registries" : ["127.0.0.1:9443","localhost:9443"] 
} 

5. 備份 即將編輯的檔案：

cp dockerdCfg.json dockerdCfg.json.<year.month.date>

6. 編輯 檔案的方式 vi：

# vi /etc/docker/dockerdCfg.json 
{ 

  "hosts" : ["unix:///var/run/docker.sock","tcp://0.0.0.0:2375"], 
  "insecure-registries" : ["127.0.0.1:9443","localhost:9443"],
  "bip": "10.10.10.1/24"  

} 

Note the following:

1. A comma must be inserted at the end of the 2nd line, after 9443"]
2. The bip line should be typed exactly as you see it, with an IP address and subnet mask of your choosing, with a subnet that does not conflict with any devices on your network that will be managed by the gateway.
3. The bip line sets the IP address of the internal docker network interface identified as "docker0".
3. For readability, the first quote mark on the bip line should line up with the previous line and quote mark.

After edits are complete, run:

# systemctl restart docker

Run ifconfig again to verify the IP address of the docker0 network adapter. 

----

The remaining steps below should not be necessary in most cases. If after completing the above steps, you still do not have connectivity, continue with the steps below.

The SAE to SRS Network Bridge

In this section, we will modify the Docker bridge between the sae and srs containers.

Change BridgeSubnet value in esrshost.conf, modify this file below command:
vi /etc/esrshost.conf

Now we will change BridgeSubnet value with the desired IP address.
See the example below:

IpAddress=xx.xx.xx.xxx
MacAddress=xx:xx:xx:xx
TimeZone=US/Central
HypervisorType="VMware Virtual Platform"
OperatingSystem="SUSE Linux Enterprise Server xx SPx"
Environment=INTPROD
HostName=linux
Version=x.xx.xx.xx
BridgeSubnet=172.28.0.1/29
OSPatchVersion=x

Ensure to Save the above file, you can use.

List the bridges:

docker network ls

# docker network ls
NETWORK ID     NAME             DRIVER    SCOPE
aa670bac1703   bridge           bridge    local
1521cf7b980b   host             host      local
b246dde1c191   none             null      local
d0dc3ac05fc4   sae-srs-bridge   bridge    local

Now we will modify the sae-srs-bridge by disconnecting it, removing it, and replacing it.

Disconnect the sae-srs-bridge in both directions:
docker network disconnect sae-srs-bridge esrsde-app
docker network disconnect sae-srs-bridge saede-app
docker network disconnect sae-srs-bridge esrsalert-app

Remove the bridge:
docker network rm sae-srs-bridge

Recreate the bridge with the desired IP address:
docker network create --driver bridge --subnet <new IP address>/<subnet mask> --opt com.docker.network.bridge.name=sae-srs-bridge sae-srs-bridge

See the example below:
docker network create --driver bridge --subnet 172.28.0.1/29 --opt com.docker.network.bridge.name=sae-srs-bridge sae-srs-bridge

Or, to use default IP, define by name only, example:
docker network create --driver=bridge sae-srs-bridge

Once the network bridge has been created, connect each container to the sae-srs-bridge:
docker network connect sae-srs-bridge esrsde-app
docker network connect sae-srs-bridge saede-app
docker network connect sae-srs-bridge esrsalert-app

Verify your work with the following command:
docker network inspect sae-srs-bridge

Review the output by checking on the following fields:

 "Config": [
                {
                    "Subnet": "172.18.0.1/29"
                }
            ]
        },

 "IPv4Address": "172.18.0.2/29",

run ifconfig again to verify the IP address assigned to docker0.

When the edits are complete, restart the Docker containers:

# systemctl restart docker

Test the new configuration by adding a device to the gateway that previously could not communicate with the gateway. Then open a browser to connect to the gateway. Navigate to Device Management > View to confirm that the new device has been registered.

unable to configure the Docker daemon with file /etc/docker/dockerdCfg.json: the following directives are specified both as a flag and in the configuration file: bip: (from flag: 172.17.0.1/24, from file: 192.168.48.1/24)

--bip=172.17.0.1/24

/etc/sysconfig/docker 
## Path           : System/Management
## Description    : Extra cli switches for docker daemon
## Type           : string
## Default        : ""
## ServiceRestart : docker
#
DOCKER_OPTS="--config-file /etc/docker/dockerdCfg.json --bip=172.17.0.1/24"