Problem connecting with Powershell

[jregel82]

I'm trying to connect to our Nimble array using connect-nsgroup and I'm getting a certificate error/403 forbidden:

PS C:\Program Files\Nimble Storage\bin> Connect-NSGroup -group 1.2.3.4

cmdlet Connect-NSGroup at command pipeline position 1
Supply values for the following parameters:
credential
Get-Certificate : Failed to get website certificate. The error was 'Exception calling "GetResponse" with "0" argument(s): "The
remote server returned an error: (403) Forbidden."'.
At C:\windows\system32\windowspowershell\v1.0\Modules\NimblePowerShellToolKit\NimblePowerShellToolKit.psm1:867 char:13
+     $cert = Get-Certificate -Uri $url -TrustAllCertificates
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-Certificate

Exception calling "DownloadString" with "1" argument(s): "The remote server returned an error: (403) Forbidden."
Exception calling "DownloadString" with "1" argument(s): "The remote server returned an error: (403) Forbidden."
At C:\windows\system32\windowspowershell\v1.0\Modules\NimblePowerShellToolKit\NimblePowerShellToolKit.psm1:839 char:9
+         $response = $webClient.DownloadString($url) | ConvertFrom-Jso ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

Any ideas? Do I need a valid cert on the Nimble?

Thanks

[Chris_Lionetti]

Unfortunately there are a number of reasons that this could happen.

I have given a few steps below, and many of these steps are just to isolate the problem, and not long-term solutions on their own.

1. 1. Disable the firewall on the server that you are running the PowerShell commands from. Temporary. We will re-enable it later, we just need to know that this ISNT the problem.
2. Ensure that you are not going through a gateway or proxy that is preventing specific ports. i.e. Some gateways or proxies will prevent port 443, which prevent SSL from initiating from one side. This could also be enabled at the switch via ACLs.
3. Create a new user with a with a new password. Note that the username and password are both case sensitive. This should be a local account on the array, and not a domain account.
4. The IP address you are trying to communicate with needs to have Management Traffic Enabled, i.e. Cant be iSCSI access only.

If item 1 or 2 fix it, we can work on setting up rules to allow unrestricted access between these endpoints but still allow the firewall to be enforce for all other address.

If item 3 fixes it, we can look at the username and how it is formatted, is it a domain name account, is it a group account?

If you can give these a shot, and let me know I can go farther with this.

Note also, what is the command you are using; i.e.

   connect-nsgroup -group 1.2.3.4 -cred $(get-credential)

Note, so that we are not troubleshooting a complete script, lets focus just on getting the above command to work, then we can go for more.