IronPort cluster limit

[tsilveruits]

Is there a limit on the number of nodes that can be in a cluster (X1070 or C300)? I'm running into errors when joining new nodes to our cluster. By removing a node, I was able to add a new node. There are 20 members currently. The error is, 

Joining cluster group Main_Group.
Traceback (most recent call last):
File "/usr/build/iproot/ap/ipoe/ipoe/bootstrap.py", line 55, in <module>
File "/data/lib/python2.6_9_amd64_nothr/runpy.py", line 128, in _run_module_as_main
"__main__", fname, loader, pkg_name)
File "/data/lib/python2.6_9_amd64_nothr/runpy.py", line 34, in _run_code
exec code in run_globals
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 45081, in <module>
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 32408, in main
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 925, in command_loop
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 41211, in do_command
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 41461, in main_input_run
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 41224, in run_func
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 2198, in clusterconfig
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 3950, in _clusterjoin_internal
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 41937, in cluster_ssh_related_command
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/cli.py", line 41955, in ssh_interactive_command
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/shared/SSH.py", line 24, in do_ssh_related_command
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/shared/UI.py", line 29, in call
File "build/bdist.freebsd-9.2-RELEASE-amd64/egg/command_client.py", line 242, in call
ssh.connection.channel.Channel_Closed_Error

[Mathew Huynh · Accepted solution]

Hey Tim,

Yes you are correct, there is a limit on the amount of devices within the cluster.

Limit is 20:

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117921-technote-esa-00.html

There is a bugID for this to have the ESA send out a meaningful error rather than a traceback:

https://tools.cisco.com/bugsearch/bug/CSCuw43965

And an enhancement to add the documentation into the user guide:

https://tools.cisco.com/bugsearch/bug/CSCux41633

I hope this helps.

Merry Christmas.

- Matthew

[B. BELHADJ]

Hi Mathew,

I have the same error when joining a vESA 9.7.0 (trial version) to another vESA 9.7.0 (trial version) in my lab environment.

That's limitation with the trial versions?

Best regards.

[Mathew Huynh]

Hello Abdollah,

All ESAs (Physical or Virtual) will have a 20 system limit.

However if you're getting this error despite there is no where close to 20 systems in a cluster, then i would advise you to ensure that the cluster port (22 or 2222) between all systems are opened and each of them can communicate to each other on the specified port (use the telnet function to test).

if all is well, the last thing to ensure is the IP/hostname that you're using to communicate together has DNS records.

IE: IP addresses needs a PTR record added to allow cluster comms

hostnames needs an A record published

Regards,

matthew

[B. BELHADJ]

Hello Mathew,

Thank you so much for your quick reply.

I have the ssh and CCS opened, but I will re-check all that and tell you about the result.

Best regards.

[B. BELHADJ]

Hello Mathew,

I configured the vESAs in the cluster. The issue was at the DNS level. Yes as you explained the two vESAs must have their host names in the DNS system with the A and PTR records. The name must not be the per interface host name, it must be set with the sethostname command.

Thank you so much again.

[Mathew Huynh]

Hey Abdollah

Happy to help and glad to see that my assistance has helped resolve your issue.

Thanks,

Matthew

[tsilveruits]

Thank you, Matthew. I wasn't able to find that information on my own. Much appreciated.