Failed to join the cluster. Error was: 'Unexpected EOF on connect'

[Licences Manager]

Hello All

I need to create an Ironport ESA Cluster.

I have two Virtual Appliance.

A-

Product: Cisco C300V Email Security Virtual Appliance
Model: C300V
Version: 9.7.0-125
Build Date: 2015-10-15

and

B-

Product: Cisco C300V Email Security Virtual Appliance
Model: C300V
Version: 9.7.0-125
Build Date: 2015-10-15
Install Date: 2016-05-27 21:25:01

But when I create an cluster on the A and I try to B joins It, that fail.

I try the inverse and same error

I indicated the fingerprint by prejoins for the two tests.

I never seen this error with physical device...

thanks for your Help

Regards, 

Lionel D.

[Ravi Singh]

The EOF notation in the error indicates that the appliance(s) are having issues with reading the end of file/configuration.  Restart the appliances Re-configure the cluster on mail1, and then join mail2 into the cluster.  I would suggest using only IP address, and also be sure that you are using only 22/SSH.  When the prompt for "would you like to start CCS/2222" appears, be sure to select no.

Once mail2 is in cluster - run 'clustercheck' from the CLI to assure health and connectivity.

Also - assure that you have PTR records in place for all cluster members:

DNS and Hostname Resolution

DNS is required to connect a machine to the cluster.  Cluster communication is normally initiated using the DNS hostnames of the machines (not the hostname of an interface on the machine).  A machine with an unresolvable hostname would be unable to actually communicate with any other machines in the cluster, even though it is technically part of the cluster.

Your DNS must be configured to have the hostname point to the correct IP interface on the appliance that has SSH or CCS enabled. This is very important.  If DNS points to another IP address that does not have SSH or CCS enabled it will not find the host.  Note that centralized management uses the "main hostname," as set with the sethostname command, not the per-interface hostname.

If you use an IP address to connect to another machine in the cluster, the machine you connect to must be able to make a reverse look up of the connecting IP address.  If the reverse look up times out because the IP address isn't in the DNS, the machine cannot connect to the cluster.

For best practices, and full review of cluster setup --- please see Ch. 38 in the 8.5.5 guide: http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-5-5/ESA_8-5-5_User_Guide.pdf

[Licences Manager · Accepted solution]

Thanks for your answer

I restart mail2, because these tries to joins the cluster goes to a Ban for all users for the ironport !!

after restart I can login again.

Regards,

Lionel D.

[Libin Varghese]

Hi Lionel,

After researching on this error it seems that we are hitting an internal bug. Please perform a soft reboot on the destination ESA for which you are trying to connect.

To reboot the appliance, you can follow below commands:

ESA> suspendlistener

Enter the number of seconds to wait before abruptly closing connections.

[30]>

ESA> reboot

Enter the number of seconds to wait before forcibly closing connections.

[30]>

An alternative to this would be enable a remote access to the appliance so that TAC can review and restart a service on the appliance. A reboot does this automatically, however can be done manually through a secure tunnel access as well.

Thanks

Libin Varghese

[Licences Manager]

Thanks, 

 I can't connect so I have to force restart via CTRL Alt Supp

and after connexions are Ok, Gui or SSH ok !

Lionel D.

[Libin Varghese]

Lionel,

Glad to hear that. Thank you for the update.

- Libin V

[Jens Roesen]

Kind of sounds like you hit CSCux58294:

Symptom:
GUI or SSH access to the ESA fails immediately and cluster connections fail to establish.

Regards

Jens