# Unable to reach Internal Application via Connector from the Endpoint

## Problem

Managed endpoints are unable to establish a connection with the internal application via the Connector, resulting in a reachability failure.

**Note:**  
The term **Connector** in this document refers to both the **Application Connector** and the **Edge Connector**, and the steps below apply equally to both.

## Cause

The reachability failure occurs due to a break in the secure communication chain at one of two specific network legs:

- Connectivity issue between the Managed Endpoint and the Connector
- Connectivity issue between the Connector and the Internal Application.

## Resolution

### Check Endpoint to Connector Reachability

Run the following commands on your managed endpoint to verify connectivity to the Connector:

```plaintext
curl -v -k -I --connect-timeout 10 https://domain_name:8443
```

- If the output indicates an established connection or a connection aborted message, the connectivity between the Endpoint and Connector is confirmed. Proceed directly to Step 2 to check reachability between the Connector and the Internal Application.
- If the output shows a connection timed out error, there is a connectivity issue. There are two possible causes:
  1. **Firewall blocking traffic**  
     The firewall may be blocking outbound traffic on port 8443.  
     **Resolution:** Allowlist port 8443 in the firewall for traffic between the managed endpoint and the Connector.
  2. **WAF inspecting the traffic**  
     A Web Application Firewall (WAF) may be inspecting the traffic between the endpoint and the connector, breaking the connection.  
     **Resolution:** Provide direct access between the managed endpoint and the Connector, bypassing the WAF for this traffic path.

### Check Connector to Internal Application Reachability

If the endpoint-to-connector connection is confirmed healthy, run the following command to verify connectivity to the internal application:

```plaintext
curl -v -k -I --connect-timeout 10 https://domain_name:port
```

- If the output indicates an established connection or a connection aborted message, the connectivity between the Connector and the Internal Application is confirmed.  
  If either of the above outputs is observed, the issue may require deeper investigation. Please contact the [support team](https://www.manageengine.com/products/desktop-central/request-support.html) for further assistance.
- If the output shows a connection timed out error, there is a connectivity issue between the Connector and the Internal Application. Work through the following causes in order:
  1. **DNS Resolution**  
     The internal application's hostname may be resolving incorrectly on the Connector.  
     **Resolution:** Verify that the hostname resolves to the expected IP address. If the hostname does not resolve or resolves to an incorrect IP address, fix the DNS configuration on the connector.
  2. **Host firewall on the internal application server**  
     The host-level firewall on the internal application may be blocking incoming connections from the Connector.  
     **Resolution:** Update the host firewall rules on the internal application to explicitly allow inbound traffic from the Connector's IP on the application port.
  3. **Network firewall blocking traffic**  
     A network firewall may be blocking traffic between the Connector and the internal application on the application's port.  
     **Resolution:** Open the application's port in the network firewall to allow traffic from the Connector to the Internal Application.
  4. **Service/server not running or unreachable on the expected port**  
     The internal application's server may be down, or the connector service may not be running or listening on the expected port. Run the following command to verify:

     ```plaintext
     sudo systemctl status sse-gateway
     ```

     **Resolution:** Verify that the server is up and the application service is active and listening on the correct port.