Upload processing stopped after upgrade to 2.8.1

[jvujcich]

After upgrading our SNTC collector from 2.7.4 to 2.8.1 the upload fails with the message:

"Sheduled upload failed with connectivity exception occurred while processing the request. the exception is :: https transport mode has failed peer not authenticated".

I checked the time sync and the shedule. The discovery was successfull. What else could be wrong? Do I have to re-register the collector?

[jofrumki]

The error message "https transport mode has failed peer not authenticated" indicates that the expected certificate chain is being disrupted during the SSL connection by a SSL intercept app on your network. Please be sure to whitelist the SNTC portal IP 72.163.7.113:443 (concsoweb-prd.cisco.com) and test your upload again.

[jvujcich]

Hi There,

Thanks for the quick reply.

I don't see how an upgrade from 2.7.4 to 2.8.1 would have changed that.

However, I'll get the proxy engineer to check that IP 72.163.7.113:443 (concsoweb-prd.cisco.com) is still whitelisted.

[jofrumki]

In the meantime, can you please share the Customer name and CSPC Appliance ID in a private message?
Appliance ID = CSPC GUI, Administration-->Server Properties-->Registration Certificate Properties, CSP00090XXXXX

[jvujcich]

The Proxy enginner and I had a look, and the 72.163.7.113:443 (concsoweb-prd.cisco.com) was white listed correctly.

Then, all of a sudden it started to upload succesfully.

He swears he didn't change anything.

So now it's all good, But I don't know why.

I'll check again after the weeked - When it's sheduled to do a discovery/upload again.

Thanks for your assitance.

Cheers.

[jofrumki]

That's great to hear, please let us know if this comes up again.

[jvujcich]

Hi, It has again failed it's sheduled upload over the weekend. A manual upload fails too - I'm getting that same error. The proxy guy says it is connecting to your cloud though.

[jofrumki]

In a private message please provide me the output of the following command while logged in as root;

openssl s_client -connect concsoweb-prd.cisco.com:443

Also, please provide the log file from this location;

/opt/ConcsoTgw/tail-end-gateway-decoupled/bin/CONN_TEG_LOGS/tail-end-gateway.log

[jofrumki · Accepted solution]

Based on your private message you have been affected by bug CSCvo43779. Please see the proposed workaround for steps to resolve this issue.

[jvujcich]

Hi There,

I have applied those workarounds  but they havn't resolved the issue.

The proxy guy says that it's still attempting a nettools connection.

Also, after restarting the collector, some of those workarounds are undone?!

It might be time for a Web-Ex session. What do you think?

[jofrumki]

Please see the updated workaround;

From root run the following commands in order;

sed -i ':a;N;$!ba;s/file/#file/1' /opt/ConcsoTgw/tail-end-gateway-decoupled/bin/run.sh

sed -i 's/nettools-upload.cisco.com/72.163.7.113/g' /opt/ConcsoTgw/tail-end-gateway-decoupled/conf/csof_config.xml

service concsotgw restart

[jvujcich]

Hi there,

Well, The Collector reports a successfull upload, however, it does not appear in the portal, And i have waited a day.

It might be to do with when i reloaded the entitlement. I see that my Appliance ID has changed when i did that.

It seems to be listed correctly within "All Collectors" on the portal.

On the collector, I checked the upload shedule has "upload to remote server" etc.

Anything you could check on your side?

[jofrumki]

Can you provide the Appliance ID for the new entitlement please?

[jvujcich]

Sure, it's CSP0009039650

[jofrumki]

I can see an upload was processed on 3-11 and 3-12. Can you confirm you see these in your portal now?