SSRS Report Not Accessible Outside Server: This is common issue which we face when we try to browse the web portal and web server URL was unreachable. You can see this below screenshot for your reference, now this error can be in different ways like host/Ip/server name unreachable.
Issue Description?
Note: In my case the SSRS Server is hosted in NODE 1 and when I try to browse from NODE 2 it gives me this above error message. The SSRS hosted machine (NODE 1) is working fine because it works locally and SSRS Report Not Accessible Outside Server because it is remote.
SSRS Report Not Accessible Outside Server
Before we troubleshoot this “SSRS Report Not Accessible Outside Server” issue, make sure the URLs are accessible with in the server (locally) if by any chance it is not accessible locally then you there is something wrong in the SSRS configuration.
In my case you can see that the SSRS URLs are accessible with in the VM where SSRS is installed and also, I have cross checked the port is open or not for the VM.
The SSRS URL I am accessing is in the SSRS VM itself and all the ports are open, you can see this in above image.
CAUTION! This is NODE1 (SSRS Server Machine/VM), IP is (192.168.2.115), server machine name is "sqlserver" and FQDN is "sqlserver.vickey.lab" where vickey.lab is the domain. The URL is "http://sqlserver/ReportsONVM/"
Troubleshoot 1?
Assuming that you are in the nob-working VM. The simple fix is to browse the URLs with IP/Server name/FQDN and most of case it will work, you can see the below screenshot on 3 different URL’s I am browsing.
Step 1: No matter what the URL is (http://sqlserver/ReportsONVM/), you have to change the middle part in the URL. In my case its “sqlserver” and I will change it to the IP of the SSRS server.
http://192.168.2.115/ReportsONVM/
Step 2: URL is (http://sqlserver/ReportsONVM/), you have to change the middle part in the URL. In my case its “sqlserver” and I will change it to the FQDN of the server to check whether the “Access SSRS Site Remotely?”
http://sqlserver.vickey.lab/ReportsONVM/
We tried all the possible way to browse the URL and it did not work out, now we will implement some action plan to isolate the issue.
Troubleshoot 2?
Step 1: Go to your VM (NODE 2) where you are not able to access the URL, the first things we have to check whether you are able to ping the IP of SSRS server VM? If yes, please cross check by pinging and also pinging fully qualified domain name (FQDN) and server name.
Please find the below query for command prompt and make sure you run and check one-by-one!
Ping 192.162.2.115
Ping sqlserver
Ping sqlserver.vickey.lab
If you get response back from SSRS server VM then we are good and there is no connectivity issue between the VM’s, now we can move to next step. If there is some problem, please check with your IT team or go to 2nd step.
Troubleshoot 3?
Sometime due to group policy we will not be able to access the URLs, but we can ping the VM as shown in above steps. Now to make the ping works or VM’s accessible to each other we will manually add it, and this process is called “HOST FILE ENTRY“
Browser the host file entry path by going to your non-accessible URL machine/VM location: “C:\Windows\system32\drivers\etc” and you will find file with name “hosts”. Please open with Administrator rights.
Please find the below FORMAT on how to add the host file entry, please change the values (Server name, FQDN & IP Address)
192.168.2.115 http://192.168.2.115/ReportsONVM/
192.168.2.115 http://sqlserver.vickey.lab/ReportsONVM/
192.168.2.115 http://sqlserver/ReportsONVM/Once done please save the file and re-start the SSRS server and browser the URL again to check the behavior. You can find the below format image below:
If you had done with all the changes and setting shown above, please re-start the SSRS server and check the behavior. If the issue still persists, please go the next troubleshooting step:
Troubleshoot 4?
Now we will collect some Fiddler traces and check what is happening in the backend to isolate the issue, please don’t panic with the traces, I will show you in simple and very easy way to isolate the issue.
Now if you don’t have fiddler tool installed in your machine, please find the link to download and capture the traces: https://kingfishertechtips.in/capture-fiddler-trace-for-debugging-issue/ Once you have the traces you will find the error details related to the SSRS URL and you can have a look on this below image and check accordingly.
If you see in the below image when I try to browse the URL, the error is captured, and it is highlighted in yellow mark and in the right-hand side under “Headers” section you can find the URL (http://sqlserver/ReportsONVM/) details and below that we have one more “Headers” and we can see that the Transport Connection is “Closed” It means the SSRS Server machine (NODE 1) refuse to accept the connection.
If you need more details about the issue and complete error details, you can just click on “RAW” on the bottom page and you can see the exact error message.
Now once we confirm the problem that the SSRS VM is refusing the connection we will try to resolve in different ways (firewall or azure network for azure VM). Before that we will cross check about the port blockage using some PowerShell command:
Troubleshoot 5?
To cross check about the port blockage, I will run this below PowerShell command to check the port is open or not for the SSRS Server. Note: I am running this command from my NODE 2 server, from where the URLs are not accessible. Make sure to change the IP of the SSRS Server Machine/VM, here 192.168.2.115 is my SSRS server machine IP.
Test-NetConnection -ComputerName 192.168.2.115 -Port 80
As you see the connection for the server (sqlserver/192.168.2.115/sqlserver.vickey.lab) is completely closed and now we have only one option to enable it using firewall.
Note: In my case I am using on-prem VM so I can enable it from Windows firewall but if you have Azure firewall setup for your Azure VMs then you must make sure that allow inbound and outbound port is enabled. Follow the next troubleshooting step to enable firewall for windows.
Troubleshoot 6?
Now to enable the port for incoming request we have to go back to SSRS server machine (NODE 1). From here we will make changes to the SSRS machine firewall (NODE1).
Step 1: Please search for “Firewall” and click on the first result from the top.
Step 2: Click on “Advanced Settings” and go to next step.
Step 3: First click on “Inbound Rules” and then right click on the Inbound Rules, hit New Rule.
Step 4: Select the Port Rule and go to next step.
Step 5: Give the port number “80” and click on next.
Step 6: Leave everything to default and click on next.
Step 7: Give any friendly name and hit apply/ok!
Step 8: As you can see that it has successfully added and automatically allowed in the Inbound Rules. Please perform the same for Outbound Rules as well!
Note: The Inbound Rules & Outbound Rules must also be performed outside the server VMs, in my case I was not able to access it from NODE 2 so I have added this rules in my NODE 2 machine as well!
I hope this might have solved your problem, for me once I performed this action, I was able to access the SSRS URLs and you can find the proof in this below screenshot.
If still the issue persists “SSRS Report Not Accessible Outside Server” then please check further with your network team. if not then please check the last step shared by me on Troubleshooting 7?
Troubleshooting 7?
If there is IIS server involved, then you have to check few things and enable some setting by using some PowerShell command. You can check this last TSG if none of the above steps worked?
Step 1: Run this command “netstat -aon” in cmd prompt with admin privileges and if you were unable to find any IP like 0.0.0.0:80, then we have to add it manually. In my case there is no IIS server involved so I am able to see.
Step 2: If it is not listed then add it from 3rd step below. (This happens because IIS is not listened to the port that we are looking for, so we executed the below command in CMD prompt.)
Step 3: If you run this “netsh http add iplisten ipaddress=0.0.0.0” in your CMD then local ip traffic will be routed here 0.0.0.0:80. Click here!
Note: A server can use the IP address 0.0.0.0 to mean that it can accept connections from any other IP address. This is called binding to all network interfaces. A client device, such as a PC, may have a 0.0.0.0 address when it is not connected to a network or when it is offline. Hope “SSRS Report Not Accessible Outside Server” is resolved by above steps”.
Troubleshooting 8?
The final step is to collect network traces and check what is happening under the hood, in my case I collected Wireshark traces from the source to destination port and found that the port was still blocked even after enabling from firewall and adding the port.
If you see in the below image, I have filtered it out based on protocol and port which SSRS/PBIRS is listening.
Now I have also added the source and destination IP, and you can see that there is no proper handshake between the servers. The request is sent back-to-back but the destination server is not able to acknowledge and send back the request.
If you further investigate on this under transmitting protocol you can clear view of the packets where SYN-ACK is absent.
Now here could be multiple reasons why this is being blocked and it is now purely related to network or AD level problem. What I want to convey here is that when any kind of high-level group policy or any kind of azure firewall rule or any other similar tool is implemented than this will override all the low-level permissions.
In my case I have disabled the port 80 from domain group policy and when I enable that I will be able to access the port 80 and I have made separate article on how to enable port using group policy, you can click on this article for more info.
Also, I will put one screenshot on how this looks from domain controller group policy, enable port 80 for inbound and out bound and this will work.
