# Redfish iLO check plugin fails: Tunnel connection failed: 403 forbidden

**URL:** <https://community.icinga.com/t/redfish-ilo-check-plugin-fails-tunnel-connection-failed-403-forbidden/9337>\
**Category:** Icinga 2\
**Created:** [March 1, 2022, 9:51am UTC](https://community.icinga.com/t/redfish-ilo-check-plugin-fails-tunnel-connection-failed-403-forbidden/9337 "2022-03-01T09:51:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lobr](https://community.icinga.com/letter_avatar_proxy/v4/letter/l/439d5e/32.png) [@lobr](https://community.icinga.com/u/lobr)\
**Post date:** [March 1, 2022, 9:51am UTC](https://community.icinga.com/t/redfish-ilo-check-plugin-fails-tunnel-connection-failed-403-forbidden/9337/1 "2022-03-01T09:51:55Z")

</div>

Hello,

i implemented the check\_redfish plugin ([https://github.com/bb-Ricardo/check\_redfish](https://github.com/bb-Ricardo/check_redfish)) into my Icinga2 system (latest version), due to issues with checking the newest HPE iLO 5 systems with the “check\_ilo2\_health” plugin ([https://exchange.nagios.org/directory/Plugins/Hardware/Server-Hardware/HP-(Compaq)/check\_ilo2\_health/details](https://exchange.nagios.org/directory/Plugins/Hardware/Server-Hardware/HP-(Compaq)/check_ilo2_health/details)).

On icingaweb2 the plugin output is the following:

```auto
2022-02-28 17:40:57,​027 - DEBUG: Proxy HTTPS connection to 10.116.246.168 through cloud-revproxy.localdomain:8080
2022-02-28 17:40:57,​028 - DEBUG: HTTP REQUEST: GET
	PATH: /redfish/v1/
	BODY: None
2022-02-28 17:40:57,​028 - INFO: Attempt 1 of /redfish/v1/
2022-02-28 17:40:57,​063 - INFO: Retrying /redfish/v1/ [Tunnel connection failed: 403 Forbidden]
2022-02-28 17:40:58,​065 - DEBUG: Proxy HTTPS connection to 10.116.246.168 through cloud-revproxy.localdomain:8080
2022-02-28 17:40:58,​065 - DEBUG: HTTP REQUEST: GET
	PATH: /redfish/v1/
	BODY: None
2022-02-28 17:40:58,​065 - INFO: Attempt 2 of /redfish/v1/
2022-02-28 17:40:58,​083 - INFO: Retrying /redfish/v1/ [Tunnel connection failed: 403 Forbidden]
2022-02-28 17:40:59,​089 - DEBUG: Proxy HTTPS connection to 10.116.246.168 through cloud-revproxy.localdomain:8080
2022-02-28 17:40:59,​090 - DEBUG: HTTP REQUEST: GET
	PATH: /redfish/v1/
	BODY: None
2022-02-28 17:40:59,​090 - INFO: Attempt 3 of /redfish/v1/
2022-02-28 17:40:59,​245 - INFO: Retrying /redfish/v1/ [Tunnel connection failed: 403 Forbidden]
2022-02-28 17:41:00,​252 - DEBUG: Proxy HTTPS connection to 10.116.246.168 through cloud-revproxy.localdomain:8080
2022-02-28 17:41:00,​252 - DEBUG: HTTP REQUEST: GET
	PATH: /redfish/v1/
	BODY: None
2022-02-28 17:41:00,​252 - INFO: Attempt 4 of /redfish/v1/
2022-02-28 17:41:00,​267 - INFO: Retrying /redfish/v1/ [Tunnel connection failed: 403 Forbidden]
2022-02-28 17:41:01,​272 - DEBUG: Proxy HTTPS connection to 10.116.246.168 through cloud-revproxy.localdomain:8080
[CRITICAL]: Unable to connect to Host '10.116.246.168', max retries exhausted.

```

Service check and check commands have been copied from here:  
[https://github.com/bb-Ricardo/check\_redfish/blob/master/contrib/icinga2\_check\_redfish\_command.conf](https://github.com/bb-Ricardo/check_redfish/blob/master/contrib/icinga2_check_redfish_command.conf)  
[https://github.com/bb-Ricardo/check\_redfish/blob/master/contrib/icinga2\_hw\_service\_checks\_example.conf](https://github.com/bb-Ricardo/check_redfish/blob/master/contrib/icinga2_hw_service_checks_example.conf)

I tried to implement this code line in the python script, but it did not solve the issue:  
`os.environ['no_proxy'] = "*"`

It is very interesting that the queries do work when they get executed on the CLI (but not on icingaweb2):

`root@icinga2:/usr/lib64/nagios/plugins/check_mk>>/usr/lib64/nagios/plugins/check_redfish/check_redfish.py -H 10.116.246.168 -u USERNAME-p PW--power [OK]: Chassi 1 : All power supplies (2) are in good condition [OK]: Chassi enclosurechassis : All power supplies (2) are in good condition|'ps_1.1'=355 'ps_1.2'=355 'ps_enclosurechassis.1'=355 'ps_enclosurechassis.2'=355`

The feedback from the developer of the plugin is the following:

> Then your icinga environment must contain proxy settings.  
> Change to the icinga user and run `env` or your icinga config contains theses settings.

But even if on the http\_proxy and https\_proxy env variable gets unset, the result of the checks stay the same

```auto
-bash-4.2$ env | grep proxy
ftp_proxy=http://cloud-revproxy:8080
no_proxy=.localdomain,localhost,127.0.0.1

```

Do you have any assumptions what might cause this?

---

<div class="post-metadata">

**Author:** ![lobr](https://community.icinga.com/letter_avatar_proxy/v4/letter/l/439d5e/32.png) [@lobr](https://community.icinga.com/u/lobr)\
**Post date:** [March 24, 2022, 2:52pm UTC](https://community.icinga.com/t/redfish-ilo-check-plugin-fails-tunnel-connection-failed-403-forbidden/9337/2 "2022-03-24T14:52:45Z")

</div>

Is there anyone that could help?

Is there a way to store the no\_proxy variable in the check?

---

<div class="post-metadata">

**Author:** ![lobr](https://community.icinga.com/letter_avatar_proxy/v4/letter/l/439d5e/32.png) [@lobr](https://community.icinga.com/u/lobr)\
**Post date:** [March 25, 2022, 11:49am UTC](https://community.icinga.com/t/redfish-ilo-check-plugin-fails-tunnel-connection-failed-403-forbidden/9337/3 "2022-03-25T11:49:28Z")

</div>

If have found the solution.  
Just set e.g.  
`NO_PROXY="10.116.246.168,localhost,127.0.0.1,localaddress,.localdomain.com"`  
in` sysconfig/icinga2` on your icinga2 client.