Okta Advanced Server Access Fails Externally via a Bastion Host

An error occurs when accessing an Okta Advanced Server Access (ASA) managed server externally via a bastion host without a Virtual Private Network (VPN) connection. Resolve this issue by ensuring the bastion server hostname is resolvable via public Domain Name System (DNS) or by adding an entry in the hosts file pointing the bastion to an external Internet Protocol (IP) address. When attempting to access the ASA-managed server via a bastion host, the following error occurs:

dial tcp: lookup my-bastion: no such host

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Bastion server
• ASA URL handler

The error occurs when accessing the server from the Internet without a VPN connection.

How is external access to an ASA-managed server via a bastion host resolved?

Ensure the bastion server hostname is resolvable via public DNS, or add an entry in the local hosts file that points the bastion to an external Internet Protocol (IP) address.

• Ensure that the bastion server hostname is resolvable via public DNS.
• Add an entry in the /etc/hosts file that points the bastion to an appropriate external IP address.

Review the following example of the /etc/hosts file content to verify the correct format for the bastion host entry.

[~]$ more /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1       localhost
1.1.1.204     my-bastion.<domain>.com my-bastion

Review the following example of an ASA URL handler to verify the correct format for the connection string.

scaleft://<my account>@app.scaleft.com/t/<my project>/a/server.domain.com/rdp?via=my-bastion