This is me troubleshooting connectivity to F5 Distributed Cloud (XC) NGINX One Agent from our internal NGINX+ instances. NGINX-AGENT Config File cat /etc/nginx-agent/nginx-agent.conf NGINX-AGENT Status sudo systemctl status nginx-agent NGINX-AGENT Log File Start of log sudo head -n 50 /var/log/nginx-agent/agent.log End of log sudo tail -n 50 /var/log/nginx-agent/agent.log ERROR logs time=2026-04-09T14:19:11.240Z level=ERROR msg="Unable to update data plane health" error="command service client not connected yet" correlation_id=142e437b-341f-11f1-aeca-506b8d721489 server_type=command time=2026-04-09T14:19:11.999Z level=ERROR msg="Failed to create connection" error="rpc error: code = Unavailable desc = connection error: desc = \"transport: authentication handshake failed: credentials: cannot check peer: missing selected ALPN property. If you upgraded from a grpc-go version earlier than 1.67, your TLS connections may have stopped working due to ALPN enforcement. For more details, see: https://github.com/grpc/grpc-go/issues/434\"" correlation_id=11334b61-341f-11f1-aeca-506b8d721489 server_type=command POTENTIAL ISSUE -- Connecting through a proxy or load balancer that strips or doesn't support ALPN ** reach out to SECURITY team and validate they don't have a setting to strip out ALPN or http2 at the proxy Check version of grpc-go sudo dnf info python3-grpcio Not root, Subscription Management repositories not updated nginx agent repo 17 kB/s | 12 kB 00:00 EPEL_9 28 MB/s | 25 MB 00:00 infratools_ansible 320 kB/s | 155 kB 00:00 Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs) 21 MB/s | 86 MB 00:04 Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs) 24 MB/s | 109 MB 00:04 Available Packages Name : python3-grpcio Version : 1.46.7 Release : 10.el9 Architecture : x86_64 Size : 2.0 M Source : grpc-1.46.7-10.el9.src.rpm Repository : ALLYBANK_EPEL_9_epel_9_repo Summary : Python language bindings for gRPC URL : https://www.grpc.io License : Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT Description : Python language bindings for gRPC (HTTP/2-based RPC framework).TEMP Workaround to test Set Variable: GRPC_ENFORCE_ALPN_ENABLED=false on the client side Rollback: unset GRPC_ENFORCE_ALPN_ENABLED ADD Additional DEBUG GRPC_GO_LOG_VERBOSITY_LEVEL=99 GRPC_GO_LOG_SEVERITY_LEVEL=info Rollback unset GRPC_GO_LOG_VERBOSITY_LEVEL=99 unset GRPC_GO_LOG_SEVERITY_LEVEL=info NGINX-AGENT Restart sudo systemctl restart nginx-agent GET TCPDUMP of ALPN http2 sudo tcpdump -i any -nn -vv -s0 port 443 -A -w /home/user/nginx-agent-alpn-http2-20260415_1014.pcap ..

Here are the steps to building a Debian Virtual Machine on Nutanix

We have an agent we are using on our RHEL build and the agent can communicate via IPv4 or IPv6 but we do not have IPv6 established in our network so I want to disable IPv6 since the agent keeps defaulting to IPv6 and failing. So what do you do? Verify IPv6# Show IPv6 addresses on all interfaces ip a | grep inet6 # Check that no IPv6 addresses remain on the interface ip -6 addr show dev ens224 # The output should be empty (no IPv6 addresses listed) # Confirm the setting stuck nmcli connection show "ens224" | grep ipv6.method # Should show: ipv6.method: disabled # Show IPv6 method for all connections (interfaces) nmcli -f NAME,IPV6.METHOD connection show # Or check sysctl for all interfaces sysctl -a 2>/dev/null | grep disable_ipv6If the command returns no output, IPv6 is successfully disabled Disable IPv6 on a Specific Interface# Disable IPv6 on the ens224 interface sudo nmcli connection modify "ens224" ipv6.method disabled # Apply the change sudo nmcli connection up "ens224"Disable IPv6 on Multiple Interfaces# Disable IPv6 on a list of connections for conn in "ens224" "ens256" "virbr0"; do sudo nmcli connection modify "$conn" ipv6.method disabled sudo nmcli connection up "$conn" echo "IPv6 disabled on $conn" doneEdit the GRUB configurationsudo vi /etc/default/grubAdd ipv6.disable=1 to the GRUB_CMDLINE_LINUX line inside the quotes.GRUB_CMDLINE_LINUX="... ipv6.disable=1"Regenerate the GRUB configuration:For BIOS-based systems:sudo grub2-mkconfig -o /boot/grub2/grub.cfgFor UEFI-based systems:sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfgTo identify if RHEL is running in UEFI or Legacy (BIOS) mode, check for the presence of the /sys/firmware/efi directory. If the directory exists, the system is booted in UEFI mode. If it does not exist, it is using Legacy BIOS. Check for UEFI Directory: Run ls /sys/firmware/efi. If it lists files (like config_table or vars), it is UEFI. Check via Command Line (Alternative): Run [ -d /sys/firmware/efi ] && echo "UEFI" || echo "Legacy". Check via dmesg: Run dmesg | grep -i "EFI" to look for EFI-related boot messages. Check via dmidecode: Run sudo dmidecode -t bios and look for "UEFI is supported" or BIOS characteristics. UEFI: Uses /sys/firmware/efi and typically GPT partitions. Legacy: Lacks the EFI directory and typically uses MBR partitions Reboot the system:sudo rebootSUMMARYSelectively disabling IPv6 per interface is the right way to handle IPv4-only network segments on RHEL. Use nmcli connection modify with ipv6.method disabled and you get clean, persistent, per-interface control. Stay away from kernel-level global disabling unless you have a very specific reason and fully understand the consequences.