Can't access KVM after updating firmware to 3.0(3a)

[carolinahusker]

I can't launch KVM on a UCS c240 m3. I've tried multiple different browsers and multiple different computers.

After launching KVM Java loads and gives me the following error:

<?xml version="1.0" encoding="UTF-8"?>
<jnlp codebase="https://<ip address here>:443/*" spec="1.0+">
<information>
<title>Cisco Virtual KVM Console</title>
<vendor>Cisco Systems Inc.</vendor>
<icon href="https://<ip address here>:443/images/logo.gif" kind="splash"/>
<shortcut online="true"/>
</information>
<application-desc main-class="com.avocent.nuova.kvm.Main">
<argument>title=<ip address here> - KVM Console</argument>
<argument>ip=<ip address here></argument>
<argument>vmprivilege=true</argument>
<argument>helpurl=https://<ip address here>:443/help/content/kvm_vm_help.html</argument>
<argument>user=2044897763</argument>
<argument>passwd=1967513926</argument>
<argument>kmport=2068</argument>
<argument>vport=2068</argument>
<argument>apcp=1</argument>
<argument>power=1</argument>
<argument>nextboot=1</argument>
<argument>vm=1</argument>
<argument>chat=1</argument>
<argument>statusbar=ip,un,fr,bw,kp,enc</argument>
<argument>tempunpw=1</argument>
<argument>version=2</argument>
<argument>aimpresent=1</argument>
<argument>export=1</argument>
<argument>custom=2</argument>
<argument>language=en</argument>
<argument>-Xmx512M</argument>
<argument>-Xms256M</argument>
<argument>dvr=2</argument>
</application-desc>
<security>
<all-permissions/>
</security>
<update check="always" policy="always" />
<resources>
<j2se version="1.6.0_14+" href="http://java.sun.com/products/autodl/j2se" initial-heap-size="256M" max-heap-size="512M"/>
<jar href="https://<ip address here>:443/software/avctNuova.jar" download="eager" main="true" />
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Windows" arch="x86">
<nativelib href="https://<ip address here>:443/software/avctKVMIOWin32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMWin32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Windows" arch="amd64">
<nativelib href="https://<ip address here>:443/software/avctKVMIOWin64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMWin64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Windows" arch="x86_64">
<nativelib href="https://<ip address here>:443/software/avctKVMIOWin64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMWin64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="x86">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="i386">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="i586">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="i686">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux32.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="amd64">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Linux" arch="x86_64">
<nativelib href="https://<ip address here>:443/software/avctKVMIOLinux64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMLinux64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
<resources os="Mac\ OS\ X" arch="x86_64">
<nativelib href="https://<ip address here>:443/software/avctKVMIOMac64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
<nativelib href="https://<ip address here>:443/software/avctVMMac64.jar" download="eager"/>
<property name="jnlp.packEnabled" value="true"/>
</resources>
</jnlp>

[Evan Mickel]

This issue appears to relate specifically to Java, the version you are running (1.6) is quite old, I would recommend a Java update to Java 8.  I am currently running 1.8u131 and am seeing no issues reaching the KVM of servers at 3.0(3e).

There are certain Java deficiencies within the 3.0(3a) code train, I would recommend reviewing the release notes:

https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/release/notes/b_UCS_C-Series_Release_Notes_3_0_3.html

In previous versions we listed which Java code was supported at least within the UCSM release notes, this does not appear to be the case in the CIMC release notes, and will not be the case in UCSM release notes going forward as the Java based UI is deprecated.  My suggestion however stands, update Java into the 8 code train (avoiding any effected versions listed in the release notes) and you should be good to go.

Thanks!

[carolinahusker · Accepted solution]

I installed the older version so that I could update firmware from 1.5. I also tried from another computer with Java 8 151 and I received the same error message. However, when I tried from another computer with Java 8 121 it worked.

[Michael Holloway]

Adding workarounds to this thread as this topic ranks high on search engines currently.

Starting with Java 8 151, some of the UCS  (such as C210 M2) won't connect via the CIMC java KVM, due to Java TLS/SSL and cipher/algorithm security changes. Reverting to Java 8 144, or older, is one workaround (perhaps in a VM).

After watching CIMC TLS/SSL connection logs, I found that I was also able to connect to the KVM from MacOS firefox running 7/2018 Java 8 (build 1.8.0_181-b13) after removing the restriction to using SSLv3 and allowing SSL_RSA_WITH_3DES_EDE_CBC_SHA:

sudo vi /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/java.security

#jdk.tls.disabledAlgorithms=MD5, SSLv3, RC4, MD5withRSA, DH keySize < 1024, \
#    EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC

jdk.tls.disabledAlgorithms=MD5, RC4, MD5withRSA, DH keySize < 1024, \
    EC keySize < 224, DES40_CBC, RC4_40