IBM License Metric Tool (ILMT)

That 'Read timed out' seems to be self-explanatory....
Did you try any connection tests on that port (from ILMT server side) or just verified that ports are opened on firewall ?

I'd start with verifying TCP connection between ILMT & SQLServer:
curl -v telnet://<SQLServer>:1433

If the above works you could try the JDBC connection test using SetupDatabase script:
..\LMT\wlp\usr\servers\server1\bin\SetupDatabase.bat -verbose

Upon 'Specify the database host...' please fill in the SQLServer with Bigfix's database.
(On 'Do you want to save a new database connection setup' make sure to answer 'n' not to screw up the current temadb connection setup) .

Oktawian –

We attempted the curl-v telnet command with success.

We also attempted the SetupDatabase.bat – verbose command with the same results:

Prelogin error: host bigfix.xxx.xxx.xxx port 1433 Error reading prelogin response: Read timed out

We reached out to our network folks, and they adjusted the policy and now we are getting the below error message:

Prelogin error: host bigfix.xxxx.xxx.xxx port 1433 Error reading prelogin response: Connection reset

Talked with the database resource; per their logs, we are not making it to the SQL server.

Then talked with the network folks and they are inspecting the packets for both “mssql-db-base” and “ssl”; basically, deep packet filtering.

Which means they are inspecting the packets are to be mssql and encrypted.

I did find the below article that states:

Starting from application 9.2.32, (we are at 9.2.36.1) connection between the BigFix server and the MS SQL Server database is encrypted by default and no additional steps are needed.

Enabling encrypted connection to the BigFix database

If the connection is transmitting sql packets and encrypted between ILMT and Bigfix, would this not meet the requirement of SSL encryption between these two?

Looking for guidance on next steps for this, please.

Indeed, this 'Connection reset' would imply breaking below application layer (TCP/TLS related).
It looks like that this SQL server instance only allows encrypted connections.

Unfortunately, as of now, encrypted connection between ILMT and SQL server instance where BigFix database is located (through datasource) is not supported...
You are encouraged to open an idea (former RFE) for introducing support for this feature: https://integration-development.ideas.ibm.com/?project=ILMT


'If the connection is transmitting sql packets and encrypted between ILMT and Bigfix, would this not meet the requirement of SSL encryption between these two?'
Well, not quite.
Connection between ILMT Server and Bigfix Server is encrypted but it uses some Bigfix proprietary encryption scheme not TLS per se.

Oktawian -

Quick question/clarification.

Above you mention “Unfortunately, as of now, encrypted connection between ILMT and SQL server instance where BigFix database is located (through datasource) is not supported...”

Are we incorrectly interpreting/understanding the Enabling encrypted connection to the BigFix database section under Security of the ILMT documentation then?

It seems that the documentation is advising that encryption to the Bigfix database can be accomplished.

You can enable encrypted connection with the MS SQL Server that is used as the BigFix database. In this case, both the BigFix server and the License Metric Tool server trust any certificate that is presented by the MS SQL Server that is used as the BigFix database.

It just requires configuring the MS SQL server to force encrypted connections.

Which MS SQL server though… ILMT or Bigfix SQL Server?? (documentation does not specify as ILMT can also use a SQL server).

Procedure:

To encrypt the connection to the BigFix database, configure the MS SQL Server to force encrypted connections. For more information, see: Enable encrypted connections to the Database Engine.”

And that the ILMT connection between the BigFix server and the MS SQL Server database is encrypted by default. 

Which MS SQL server… ILMT or Bigfix SQL Server?? (documentation does not specify).

About this task:

Starting from application update 9.2.32, connection between the BigFix server and the MS SQL Server database is encrypted by default, and no additional steps are needed.

Our environment is being more granular around security controls.

The IBM documentation appears to be advertising we can enable encrypted connection to the BigFix SQL database from ILMT.

We are wanting to take advantage of this security feature.

Any guidance and/or assistance in understanding this process would be greatly appreciated.

Thank you for your time on this.

You are right...
That documentation section is quite misleading.
I've already opened a dedicated task to correct that part.

However, here is a summary:
You can enable encrypted traffic for following connections:

• between BigFix server and SQL server instance where BigFix database (BFEnterprise) is located,
• between ILMT server and SQL server instance where ILMT database (temadb) is located,
   

Encrypted connection between ILMT server and SQL server instance where BigFix database is located (setup through datasource) is not yet supported.