Trust Issues in HP SIM 4.1

[Gabriel Aguilo]

hello everyone;

I recently upgraded from HP SIM 4.0 to HP SIM 4.1.

I did a completely new install of HP SIM, and proceeded to setup eveything up again.

However, I now have various "Security trust issues" with about 75% of my servers, while the other 25% are displayed correctly.

I have tried to troubleshoot this many times, and have followed many of the anwsers displayed on this forum; Here is my progress so far;

1. I have enabled "Trust by Certificate", in the Systems management homepage of the problematic server, and imported the certificate from my CMS. (using "Get cert"). Even using "Trust all" of "Trust by Name" did not work.

2. I have imported the servers security certificate into my CMS. I enabled "Require Trusted certificates". I have tested this working on some servers, but the blue "i" still appears.

3. I have ran the Software polling task and Identify tasks after every change.

4. I have made sure all the VCA agents and PSP are up to date. If logging onto the Systems Management homepage locally onto the problem server, and opening the VCA agent, I can connect to the VCRM on the CMS server, and choose the correct PSP to reference.

The only thing that I have found that differentiates between the servers that are displayed correctly on those that appear with the trust issue, is that the working servers have the WBEM protocol displaying as installed and the others only the SNMP protocol.

Now as I understand it, this shouldnt matter when it comes to the software status of a server + the trust issues that I am having.

Does anyone have any ideas?

Thanks in advance,

Gabriel

[Rob Buxton]

Gabriel,
Not sure if I'm reading this right but...
On a Server that is not working you need to import the HPSIM Server Certificate.

From the System Management Homepage of one of the Servers not working go to the Settings Tab, then Options and then check the Trust Settings and which Servers are listed as having certificates loaded. Your new HPSIM Server should be amongst them.
Try deleting and reimporting.
You can also check the SNMP settings from the Settings tab, you should have suitable Read Only and Read Write Community names

[Gabriel Aguilo]

Thanks for the reply Rob.

I have gone into the Systems management homepage and deleted and re-imported the HP SIM server certificate. I used "Get Cert" and I also tried to cut and paste the certificate information in.

Neither worked.

The SNMP settings are definitely correct.

HP tech support are stumped as well. I think we might have to move HP SIM onto a new server.

[Matt Mascarich]

Gabriel, I am having the same/similiar problem. I also have a case open with HP and I am waiting to hear back... With my situation all my servers are Windows 2003 or 2000. All servers that are either domain controllers or member servers the security trusts work great. It is only with servers that do not participate in the domain that I have security trust issues. HP says it should not matter but I feel like I am going crazy comparing settings

[Gabriel Aguilo]

I know what you mean, it is infuriating!

However, servers that are on my same domain, and even servers that are on a different subnet / domain appear OK.

However some just dont want to work! the only thing I think is that the VCA agents (even though I have reinstalled the numerous times) are rejecting all attempts to be accessed remotely - i.e via a browser window with HP SIM

I say this because, I started to see if any of the configuration changes in the HTTP server settings on the System Management homepage had any effect, and if you enable "anonymous login", you can the access it directly via HP SIM. It still appears with the Blue "i", but at least the changes are being made and picked up.

Trust all / Trust by Name / Trust by certificate still does not work.

Ive run out of ideas.

Hopefully HP will get back to me with an anwser.

[Gabriel Aguilo]

I finally figured out what was going wrong!

The servers which could not work were those that had an underscore "_" in their name.

As soon as I stopped going through a proxy, I was able to access the rest of the servers OK.

Thanks for replying

[Gabriel Aguilo]

I finally figured out what was going wrong!

The servers which could not work were those that had an underscore "_" in their name.

As soon as I stopped going through a proxy, I was able to access the rest of the servers OK.

Thanks for replying