CIRA connections to Cloud Hosted MeshCentral docker

[b8two]

Hi All,

I'm trying to resolve why most machines on my meshcentral instance that are Activated with ACM or CCM but do not have a connection for HW Connect or IntelAMT tab on Meshcentral.

Server Status indicates 12 currently connected but I don't have 12 devices indicated with CIRA in "My Devices", only 3 Indicating CIRA but could potentially be 90+.

The networking configuration is along the lines of this diagram due to company requirements.

config.json; - cut version

  "settings": {
    "cert": "meshcentralweb.example.com",
    "certUrl": "https://meshcentralweb.example.com:443"
    "WANonly": true,
    "port": 443,
    "aliasPort": 8443,
    "redirPort": 80,
    "TLSOffload": true,
    "mpsPort": 4433,
    "mpsAliasHost": "iamtmps.example.com",
    "_mpsTlsOffload": false,
    "_mpsHighSecurity": true,
    "compression": true,
    "agentwscompression": true,
    "WebRTC": "true",

Using meshagent console:

> amtconfig
06:01:12, LMS tunnel start.
06:01:13, Checking Intel AMT state...
06:01:20, Intel AMT connected.
06:01:34, Done.
06:01:34, LMS tunnel closed.

Using the mesh central server tracing example
My Server Tracing,(mps,amt)

Checking Intel AMT state...
Attempt Initial Contact, CIRA-LMS
LMS-Connect,TLS,admin
Initial Contact Response, 408
Attempt Initial Contact,CIRA-LMS
LMS-Connect,NoTLS,admin
Initial Contact Response, 200
Intel AMT connected.
Create new MPS server invalid response.
Remove device

OR

Intel® AMT | Activated ACM, v11.8.50, TLS

Using meshagent console:

> amtconfig
06:01:12, LMS tunnel start.
06:01:13, Checking Intel AMT state...
06:01:20, Intel AMT connected.
06:01:34, Done.
06:01:34, LMS tunnel closed.

Using the mesh central server tracing example
My Server Tracing,(mps,amt)

Checking Intel AMT state...
Attempt Initial Contact, CIRA-LMS
LMS-Connect,TLS,admin
Initial Contact Response, 408
Attempt Initial Contact,CIRA-LMS
LMS-Connect,NoTLS,admin
Initial Contact Response, 200
Intel AMT connected.
Done.
Stop Management,
Remove device

From the remote iAMT Machine desktop browser I get the expected output using port 4433

MeshCentral MPS server.
Intel® AMT computers should connect here.

The Certificate indicates along the lines of;

Issued to:  **iamtmps.example.com**
Issued by **MeshCetnralRoot-XXXXXa**
Valid unitl end of 2049

What I have been seeing is some AMT connections that do work are not correctly associated with the MeshAngent of the same device.
for example I have one entry indicating;
Activated ACM, v14.1.53, TLS
but the IntelAMT connection
v11.8.50 activated in Client Control Mode (CCM)
How are the two linked? Could this be related to the System ID not being unique?
Majority of the iAMT connections I have are from 4 machine models (two different vendors) ID: "03000200-0400-0500-0006-000700080009"

I found a way to update the UUID but no overall change has been observed.

[si458]

from what im aware the intel amt Identifier is based of the motherboard Identifier (from my discovery)
as ive recently added in a Identifier field into my web ui so i could find out what meshcentral thinks the Identifier is
(not pushed to repo yet as only added for my testing but might be nice for others to see!)

as for your devices, you see from one of your responses Create new MPS server invalid response.
basically the meshcentral AMT code thats adds things into the devices AMT couldnt create the mps server because it was invalid
so something is wrong with either your meshcentral config OR the amt devices themselves

what is iamtmps.example.com ?
is this another device which forwards the ports to meshcentral (reverse proxy, firewall) ?
is this just a DNS name which points to the meshcentral machine (so direct access) ?