Suggestions for troubleshooting new installation.

[Ian5]

Hi all, I'm working with a customer setup where we have iLOs on 172.19.234.64/26 and a new OneView server on 172.19.97.90/26 with a Check Point firewall in between. Routing all seems to work, I can ping the iLOs from the OneView server and a Windows machine on the same subnet as the OneView server can connect to the iLOs from a browser, but OneView is unable to add the servers (the dreaded big red box).

The Check Points are set with an Any-Any rule and we can see traffic apart from a couple of dropped packets where the CP is complaining about of of sequence packets (first packet isn't a SYN).

Should this configuration work?

TIA

Ian

[Ian5]

More information. The networking side appears to be configured correctly as one of the servers added successfuly. The iLOs are on 172.19.234.101 - 114 with a 26 bit mask. 113 worked (an Apollo 4200). I then removed it from OneView, moved it to 114 and added it back in successfully. I moved one of the other iLOs to 113 and it fails the same as before. 

This suggests to me that the problem is on the iLO side. I can see two entries in the iLO Event Log for an XML login and an XML logout. OneView is 8.30.00-0478357. The firmware on the iLO that works is 2.72 Sep 04 2022 and on the ones that don't 2.81 Mar 07 2023. Do the iLOs need some special config? The account that I am using to add them into OneView is the Administrator account.

Anyone any ideas what to try next?

[sfrench-quilter]

Hi Ian,

Sounds like a tricky problem with a number of variables.

Given that a known good device using the 172.19.234.113/26 IP was able to be added to OneView, but another using the same IP was not, it hopefully rules out any firewalling woopsies - that said some firewalls may be set to application aware or locked down to certain mac changes.. it seems unlikely as you point to two iLO5 versions?

This leads me to think that there may be a misconfiguration on the target iLO that you are unable to join to OneView.
Can you ping 172.19.234.113 from OneView on the device you cannot add?

I know you say that the networking is configured correctly, but the first things to check would be the subnet mask and gateway address of iLO. If you are sure this is correct, and you can ping it from OneView then it does sound like an unusual issue.

For the sake of progressing with this issue, you could downgrade or upgrade iLO so both versions match and re-test - I'm not aware of any bugs/faults that would cause an issue but thats all I can think of that might help.

Other thoughts: are you using self signed SSL certs? Have you set any specific cipher suite requirements?
Are you adding to OneView using IP address or via DNS name? is the DNS configured properly?

Good luck

[Sunitha_Mod]

Hello @Ian5,

Let us know if you were able to resolve the issue.

If you have no further queries and you are satisfied with the answer then kindly mark the topic as Solved so that it is helpful for all community members.

[Ian5 · Accepted solution]

I got it working finally by doing a factory reset of the iLOs. Post reset I changed the configuration to be exactly the way it was originally and then removed it and readded which worked. Bizarre. Nothing to do with the network. For anyone fighting with a similar issue OneView will generate a different error message depending what you do, which is useful for checking it is actually talking to the iLO. 

If there is nothing listening at the far end (or there is a network issue) then you get an unable to establish trusted communication error:

If you put in bad credentials then you get:

If OneView is talking to the iLO but fails for some other reason you get:

These are useful in then working out next steps. 

I also installed iLO Amplifier and that worked without all this palaver. I do prefer OneView though.

[Sunitha_Mod]

Hello @Ian5,

Excellent! 

We are extremely glad to know you were able to find the solution and we appreciate you for keeping us updated.