For those running DNAC version 1.2.6 in a cluster I want to share some valuable information on using a centos server to perform backups:
If you are using a linux repo to perform backups without assurance data you may see these errors in /var/log/secure:
Connection closed by <DNACIP> port $$$$ [preauth]
sshd: Failed password for dnac from <DNACIP>
unix_chkpwd: password check failed for user (dnac)
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<DNACIP> user=dnac
After testing several changes to pam.d config files such as system-auth and password-auth I realized that nothing on the server side was fixing the issue. I also saw this error:
sshd: Did not receive identification string from <DNACIP> port $$$$
That error led me to notice that I was performing all of my admin work using the GUI via the DNAC VIP ip address. Backups always failed when attempting to use DNAC via the VIP. I then proceeded to hand-jam the repo config into each server by accessing each server via the GUI by its IP address for node 1, node 2, node 3. Then I accessed DNAC from the command line to determine who the leader was using this command:
etcdctl member list
Once the master node was identified and I hand-jammed the repo config on each server, I kicked off the backup directly from the master, and everything worked perfectly. Hopefully this will save some of you out there the headache I went through.
