SMA Error "Unexpected EOF on Connect" -> Cannot add Virtual ESA Hosts

[jaksptr99]

Hi there,

I wanna ask about the Security Management Appliance (SMA) error which we encounter. This is the case below.

SMA

|

|

Main_Group (cluster)

ESA1 (virtual)-ESA2(virtual)-ESA3(physical)-ESA4(physical)

Our system consists of four ESA units. We were just migrating two units from physical ESA to virtual ESA, and the appliance is running well. Note that we use the same network configuration we used previously for the physical ESA.

The problem is when we want to add the new virtual ESAs (ESA1 and ESA2) to the SMA, we keep getting the error message: "Unexpected EOF on Connect".

Is there something missing from our configuration, or is there any additional steps in migration/adding the ESA in the WSA unit?

We are waiting for anyone for help, because we need to implement this as soon as possible.

Any kind of help is appreciated. Please help.

Thank you.

jaksptr

[Robert Sherwin · Accepted solution]

What version of AsyncOS for Email Security is on the ESA(s)?

What version of AsyncOS for Security Management is on the SMA?

There are times if the previous IP has been used on the ESA(s) that the SMA will have initial communications issues when trying to add the ESA and re-establish communication.  If that is the case, I would suggest that you open a support case and allow us to view the appliances from the backend via support tunnel.

Hope that helps!

-Robert

[jaksptr99]

We did solve the case by contacting the TAC, because this is too technical and yet crucial for customer so we opened remote access and case is solved in few hours. Thank you.

[wladimir.gruenemaier]

Such EOF errors are actually normal after an RMA, and may usually resolved by logging via Command Line Interface into the SMA, and delete all old host keys by running the commands ‚logconfig‘ and ‚hostkeyconfig‘.

If the EOF errors then still persist, it might be that the new ESA blacklisted the SMA from SSH connections though it’s IP blocking service. This service cannot be restarted at the CLI or GUI level, but TAC could restart the relevant blocking process manually. Alternatively, you might consider performing a reboot of the affected ESA, as this will as well clear the blocklist accordingly. 

[wladimir.gruenemaier]

:-)

[Mathew Huynh]

Hello Jaksptr,

Just building on Robert's response as well.

Could you attempt to do a telnet test from your SMA's IP to your ESA's linked IP's on port 22 and do the same from ESA to SMA to see the response.

Typically Unexpected EOF would indicate something caused a connection termination.

Thanks,

Matthew