Upload to SNTC Portal Complete?

[Matthew Lounsbury]

I originally installed the PSS Collector via the OVA PSS-CSPCServer-2.6.0.1-OVF10.ova.  I generated a new CSP-C entitlement in the SNTC Portal, and applied it to that collector.  After doing some reading of other threads around here, and doing a search, I found there was a SNTC Collector with an OVA of SNTC-CSPC2.6.1-RC1-OVF10.ova.  I decided to shut down my existing collector and redeploy the new SNTC Collector.  I did not generate a new CSP-C entitlement, and uploaded the existing one I had.  I received an error during the process that said:

Entitlement update done locally, but failed on tail-end gateway. No response from connectivity tail-end gateway. CSPC not run without connectivity tail-end gateway.

I found this post: https://supportforums.cisco.com/discussion/12703286/error-tail-end-gateway-during-entitlement-file-load

It let me log into the application and I was able to add devices to the inventory.  I then did a collection and had it upload.  I did not see any errors in the log, but I'm not seeing anything on the portal yet.  I did this after 3 or 4pm EST yesterday, and I know it could take some time for it to show up in the portal.  Is it possible to see if you can see the upload completed and that there is processing going on with the file?  If not, I can remove the license, delete the existing entitlement from the portal and then generate a new one and upload it to the collector (if that is the process I should take).

Would anyone be able to assist?

[Matthew Lounsbury]

Lynden,

Apologies for taking so long to get back to you.  I have been trying some things on my side to see if I could determine what exactly is happening.  

I have attempted to gather packets using tcpdump in the Collector CLI itself, using a Windows host running WireShark connected to the same vSwitch in VMware with the switch in promiscuous mode, and from our sniffers on the network.  It seems like any time I run the upload job, it looks like it is doing something in the GUI, but in reality, nothing is happening.  I even ran a collection job and I did not see any attempt to connect to the Cisco server to upload the information.  I even tried rebooting the server to see if that would cause it to reach out to the Cisco servers, and that did not fix it either.

With that being said, I decided to install another collector on a different VMware environment and generated a new entitlement for it.  I went through the process and configured the network portion of the collector, and rebooted it like the instructions said.  When it came back up, I went into the CLI and started another tcpdump.  I went to the Collector's GUI, logged in, and was asked to upload the entitlement.  I selected the new entitlement zip file, and watched the packet capture.  The GUI showed the error "Entitlement update done locally, but failed on tail-end gateway" and on the packet capture I could see that it attempted to make a direct connection to the Cisco servers, but I see no communication with our proxy server.  I would expect that if the Collector needed to talk with the proxy to provide username/password, that I would see the IP address for the proxy in the tcpdump.  As it stands, the IP for the proxy does not show anywhere in the tcpdump.

I am not sure how many other people that are using the Collector and have a proxy server that requires authentication like ours does, but from what I can see, the Collector does not communicate with the proxy at all in the way that I would expect it to, nor does it appear to be consistent with even attempting a connection to the Cisco server.

[Matthew Lounsbury]

Hey Lynden,

Any thoughts or ideas here?

Thanks.

-Matt

[Lynden Price]

Hi Matt,

We do sometimes have issues with the built in proxy function. Is there any way you could temporarily bypass the proxy for a test? I'd like to eliminate it as a variable.

Thanks,

Lynden