3PAR File Persona Configuration

[rianui]

Hello gurus,

I am setting up 3PAR file persona but I have gotten into some road blocks. I have done the following.

1. Configured the array

2. Configured the LDAP and tested connectivity successfully from the GUI. However the cli response is different, "3PAR cli% showfs -ldap
LDAP configuration does not exist for File Services."

3. I configured the time on the array and AD to a dirrerence of seconds (the 3PAR array does not pick time from the NTP server)

4. I set the network configuration as expected,

"3PAR cli% shownet
IP Address Netmask/PrefixLen Nodes Active Speed Duplex AutoNeg Status
172.16.x.x 255.255.254.0 01 0 1000 Full Yes Active

Default IPv4 route : 172.16.x.x
Default IPv6 route : None
NTP server : 172.16.x.x
DNS server : 172.16.x.x"

However when I try to add the unit to the AD I get the follwing error;

3PAR cli% setfs ad hpe3par domain.com
Please enter hpe3par's password:
Failed to join domain domain.com . Reason: Node [node1fs] cannot resolve domain.com [domain.com: Temporary failure in name resolution] ". Please check / correct FSN DNS configuration.

3PAR cli% setfs ad hpe3par domain.com
Please enter hpe3par's password:
Node [node1fs] had already joined the domain [DOMAIN.COM] Error trying to CREATE AD configuration on node [node0fs]auth_lsaclient_LsaAdJoinDomain status:121 reason:No Message for status code.

The first error points to the DNS but the I set the DNS IP address on the array.

What could I be missing?

Rianui

[sbhat09]

Hello @rianui,

Looks like the LDAP services you configured, is not available/applicable for file persona. I am looking for more details and will get back to you.

Regards,
Srinivas Bhat

If you feel this was helpful please click the KUDOS! thumb below!

[ASHPE]

Hello Rianui,

LDAP can be used to authenticate users on both the Inserv and File Persona nodes and  it appears you have configured it for the Inserv nodes,  not the FP nodes.  That is why the "showfs -ldap" command returns the message about LDAP not being configured.

FP uses three methods to authenticate users: as mentioned LDAP is one, Active Directory and Local Users are the other two. By joining the domain, you will be using AD to authenticate. Without knowing the 3PAR OS and FP versions it is hard to say why the node(s) are joining the domain.  As you noted, a time difference of five minutes or greater between the FP node(s) and AD domain controller is one possibility. 

I would recommend logging a case with the Support Center and work with an FP resource to determine why the node(s) are not  joining the domain. If you want to use LDAP to authenticate, they can help you with that or you can reference the FP Users Guide to configure LDAP

Regards,

Andy String