Remote swlist fail/success on multi-homed host

[Alan Shearer_1]

Hi,

I'm tying down permissions (swacl) so that only the root user from a central system can run remote swlist etc. commands.

swlist -l bundle @ remotehost

I have two central servers I'm testing this from. One server works fine when the permissions are changed. The other does not. With further tests the permission granting/removing is working exactly as I require.

The issue is when running it from the multi-homed server. It is connected to two subnets:

Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
lan1 1500 192.11.16.0 192.11.16.22 32774 0 301669 0 0
lan0 1500 192.11.15.0 192.11.15.22 3693830 0 7649878 0 0
lo0 4136 127.0.0.0 127.0.0.1 72859 0 72859 0 0

Destination Gateway Flags Refs Interface Pmtu
127.0.0.1 127.0.0.1 UH 0 lo0 4136
192.11.16.22 192.11.16.22 UH 0 lan1 4136
192.11.15.22 192.11.15.22 UH 0 lan0 4136
192.11.16.0 192.11.16.22 U 2 lan1 1500
192.11.15.0 192.11.15.22 U 2 lan0 1500
127.0.0.0 127.0.0.1 U 0 lo0 0
default 192.11.15.1 UG 0 lan0 0

Both servers work all the time to hosts on the x.x.15.x LAN, whereas only the single NIC server will work to hosts on the x.x.16.x LAN (even though it is not directly connected to that LAN). On the multi-homed host the command will always return an error saying you don't have the required permissions, yet I know they are set correctly. If I take down lan1 on the MH system, the command will work fine. So I'm now stuck at the point thinking there is some issue with the multi-homed setup of this host, routing etc..

Any suggestions?

Thanks

[Bob E Campbell · Accepted solution]

I figured swacls would be involved...

First check /var/adm/sw/swagentd.log and verify what system SD believes is trying to connect. If you forgot an alias add that in. If the host is one already included in your swacl try adding the explicit set of IPs being used as well.

[Tim Nelson]

the hostname will always resolve the the first one listed in /etc/hosts

can you create the acl using an IP address for the other lan ?

If not switch the two around in the host file, or lock in the lan you intend to use.

Multihomed hosts have these problems. You may not be able to have it both ways.

[Alan Shearer_1]

Tim/Bob cheers for the input.

I removed all entries from hosts. Both addresses could be resolved using DNS.

I now have swacl entries for both addresses of the central server on the client and it works fine.

So, even though the client on one subnet, can contact the central server on either of its subnet addresses - if the system is available on the local subnet it insists on using that (as demonstrated by me downing the 2nd LAN on the central server and it then working ok without additional swacl entries).

I guess the ip_strong_es_model variable may be at the bottom of all this.