Status: Local Agent is not responding. This may be due to Master or Local Agent being down - after upgrade 8 to 11.5

[kasper123]

We just upgraded our cluster running 8.0.3 that was running on MCS servers to CUCM cluster running 11.5 using Prime Collaboration Deployment (PCD).

Everything else seems to be OK but when I go to Disaster recovery / Backup Device it waits for about 20 seconds and then it says:

Status:  Local Agent is not responding. This may be due to Master or Local Agent being down

This is on both servers.

Does anyone know what could have caused this?

Regards and thank you for your time.

[Jaime Valencia]

Have you already restarted those services?

[kasper123]

Hi Jaime,

Yes, I restarted the services and also both servers but that didn't help.

I found another thread where certificates are pointed out as a cause for this behaviour.

When I see the certificates I do see that some of them have expired. For instance the ipsec and the tomcat certificates on both the publisher and the subscriber but this worked before the upgrade.

[Deepak Rawat · Accepted solution]

You must have changed some information related to the certs during this upgrade that had cause the existing certs to expire. In order to get this working again, you will need to regenerate the IPSec and Tomcat certificates and that will take care of the issue. For this particular issue, IPSec certs are the one that you will need to regenerate but since your Tomcat certs had also been expired it would be good to regenerate them as well.

Refer below on how to regenerate various certs within CM:

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200199-CUCM-Certificate-Regeneration-Renewal-Pr.html#anc12

Regards

Deepak

[Jitender Bhandari · Accepted solution]

Hi

Once you regenerate IPSec cert don't forget to restart DRS services also.

1) Regenerated ipsec.pem certificate on all server.

2) Restarted DRS Master and local on PUB, DRS local on SUB.

JB

[kasper123]

After regenerating the certs I was able to start the services.

Thank you very much!

[kasper123]

Thank you Deepak,

The procedure you sent is for changing CallManager, ipsec, tomcat, TVS and CAPF.

I really see all those are expired on our servers.

If I understood correctly this needs to be done on both servers?

-Will this impact the phones?

-Should I upload some certificates from the publisher on the subscriber and the other way arround? I read somewhere that after regenerating some of the certs have to be uploaded on the other servers to establish trust?

[Deepak Rawat]

Yes, you will need to regenerate the certificates on both the servers. The document I shared lists the impact for all those certificates and also mention the order in which you should regenerate them. There is no need of uploading certs from publisher on to subscriber or vice versa.

Regards

Deepak

[Jaime Valencia]

Actually, it's more likely that he did NOT change something related to the certificates, that's why those old certificates were in the system, if he had changed something (hostname, domain, etc), that would have triggered an automatic certificate regeneration and some of them would have been regenerated with that new info, and would not be expired.

[dsobrinho]

Hi Guys,

Is there some step by step of how can we do this? The documentation is not user friendly.

Something like this:

Problems with backups DRS:
- Check the certificate ipsec and tomcat certificates (if expired go to step 2)



step2: regenerated ipsec and tomcat cert in boths servers Pub and Sub.

Regenerate IPsec
Upon regeneration, the IPsec certificate automatically uploads itself to ipsec-trust.
OS Admin > Security > Certificate Management > Find > Click ipsec certificate > Regenerate

Regenerate Tomcat
Upon regeneration, the Tomcat certificate automatically uploads itself to tomcat-trust.
OS Admin > Security > Certificate Management > Find > Click tomcat certificate > Regenerate

[ahmed]

Hi,

i have problem like that, but i only have single PUB (not cluster), when i did backup on CUCM with IM Presence options checked, i got message due to "local agent not responding". but when i unchek the IM presence options, cucm backup 100% succeed.

i've checked cucm certificates expired about months ago.

what i need to do

Regards,

ahmed

[Jose Gomez]

Hi,

I already have the same issue, do you have any workaround to fix this?

[j.dewiele]

I had no idea the IPSec cert was used internally .... Most of the cert best practices documents don't talk much about it. I know now not to disrespect the IPSec cert.

This was very helpful and fixed my problem.

Thanks,

Joey

[Roger Kallberg]

For more information about what a few of the certificates are used for and how to renew each one of them please have a look at this document that I’ve created.

https://community.cisco.com/t5/collaboration-voice-and-video/cisco-uc-certificates-renewal-guide/ta-p/4077131

[David Vasquez]

DRS quit working on Subscribers after a hard reboot of Publisher.
Once I did the "set cert regen ipsec" from the CLI on the Subscribers and Publisher, then "utils service restart Cisco DRF Master" on Publisher and "utils service restart Cisco DRF Local" on the Subscribers, DRS began to work again. No need to do Tomcat regen unless you are having different issue. BTW, prior to regenerating the IPSEC cert, I attempted to just restart the DRF services and also rebooted the entire cluster one at a time, which did not solve the issue.

Thanks Deepak!