Runbook · Most common issue #1

eHawk connectivity and remote access failures

Remote access

Symptom

Cannot open a remote session to the crane: VPN not established, eHawk terminal shows offline in the portal, or the on-site Juniper / Cisco router is unreachable.

Investigate

Is the eHawk terminal (site VPN router) online in ehawk.lh.internal → Sites? Offline → site uplink or router problem. Online but session fails → your side (VPN client, MFA, approval).

Fix

# from your laptop — is the central VPN up?
ping ehawk-gw.lh.internal
# on site (service port 12) — is the router alive?
ping 192.168.30.1
# Juniper SRX console:
show security ike security-associations
show security ipsec security-associations
# Cisco ISR console:
show crypto isakmp sa
show crypto ipsec sa

The eHawk terminal dials out to the jump host over the customer's internet uplink. No IKE/IPsec SA on the router means the tunnel never came up — usually uplink, DNS or the customer firewall blocking UDP 500/4500.

Steps

Your VPN first. Connect the corporate VPN client, then open ehawk.lh.internal. MFA prompt missing → account issue, contact IT.
Terminal offline in the portal. Check the site's last-contact time. Recently offline → customer internet or power in the e-house. Ask the customer to confirm WAN link lights on the eHawk router.
Router reachable on site but no tunnel. Console into the Juniper SRX / Cisco ISR (credentials Vault → lh/crane/ehawk-router) and check IKE/IPsec SAs. No SA → verify DNS resolves ehawk-gw.lh.internal and that UDP 500/4500 outbound is allowed by the customer firewall.
Tunnel up, session fails. OT targets need approval — check the request is not pending with OT security. Maxedge target: the VM may be down, see host runbook.
Workaround. Someone on site can connect a laptop to service port 12 and follow the guides locally.

Not resolved? Escalate to Product Engineering with docker ps -a, the relevant docker logs and the unit's Masterdata link.