Symptoms You have confirmed that EFM is running, and you can open a broker connection using port 8080 or 8443 from the EFM server. However, from an external broker, not hosted on the same machine, the connection is refused. Diagnosis Is this is your first external broker then probably EFM server is not listening for connection requests on outside interfaces. From a remote destination you can try to telnet to either 8080 (http) or 8443 (https) ports: if the connection is refused, this is likely your problem. It might also be a firewall or access-list problem, but then this is a network issue, not an EFM issue. Solution By default ans starting with EFM 1.6 the EFM broker only listens to the local, loopack interface (127.0.0.1). To confirm this is the case, check the configuration file:   efm-server:~ $ grep "host" /opt/cisco/kinetic/efm_server/server.json "host": "127.0.0.1",   The "host" option tells EFM on which interface it should be listening for incoming connections. 127.0.0.1, called the loopback address, will only permit connection originated by EFM server itself to be successful. Should you want to open this up to the outside world, edit the file and replace 127.0.0.1 (loopback) by 0.0.0.0 (all interfaces):   efm-server:~ $ vi /opt/cisco/kinetic/efm_server/server.json   You need to restart the EFM server for this change to take effect:   efm-server:~ $ sudo systemctl restart efm-server ... View more

Symptoms EFM broker connection to upstream EFM server is failing. You have confirmed that the IP connectivity to the destination port number (tcp/443 by default) is open, yet the connection does not establish from the EFM broker to the EFM server. You have verified that both the broker and the server have their time synchronized. Diagnosis Upon log inspection you can see a message "Verification of certificate failed" and "X509 verification result: certificate has expired and depth 0". It might be that when the certificate was created your system time was not correct. Solution Log in to EFM server as user "efm", and enter the directory where the EFM server SSL certificate is stored:   cd /etc/cisco/kinetic/ssl/efm-server   Before generating new certificates, makes sure this is indeed the issue. Check your current certificate expiration date with: openssl x509 -in selfsigned.cert -text | grep Not   First we need to generate a new server key, remember the passphrase used to encrypt that key: openssl genrsa -des3 -out server.pass.key 2048   Remove the passphrase from that key: openssl rsa -in server.pass.key -out selfsigned.key   Create a Certificate Signing Request: openssl req -new -key selfsigned.key -out selfsigned.csr   Generate a new certificate using the CSR and key: openssl x509 -req -sha256 -days 365 -in selfsigned.csr -signkey selfsigned.key -out selfsigned.cert   Check if your key is valid: openssl rsa -in selfsigned.key -check   Check if your certificate is valid (pay attention to dates): openssl x509 -in selfsigned.cert -text   You may need to restart EFM server and broker to wipe out any remains of a previous cached certificate.   ... View more

The purpose of this article is to sort out and clarify how licenses are effectively working in Cisco Kinetic Edge & Fog Processing Module (EFM). It does not address ordering licenses, prices, or anything related to the Cisco Kinetic Cloud (GMM and DCM).    Type of License   There is fundamentally only one license in Cisco EFM, but it can activate two separate features: the EFM broker (the logic engine that runs the data flow amongst other things), and   the visualizations (DGLux5). Initial license: during the EFM installation process, the installer package will automatically create a license for the EFM broker. This means that a new license will never need to be generated again unless the graphical data flow editor is being used.   Since there is only one license, if you ever want to start using the data visualisation, you'll be offered an option to request a trial version. If your instance has internet access it is granted immediately using an on-line activation process. However now the entire license will now be 180-days. After 180-days your license will expire and you won't have a broker, you won't have a data flow editor, and you won't have visualizations.    Workaround 1: Use separate users for EFM broker and visualization During the installation, install only the broker as one user, and the visualization as another user. This way you have separate licenses per user, and expiration of one will not affect others. This is described in: https://www.cisco.com/c/dam/en/us/td/docs/cloud-systems-management/cisco-edge-fog-fabric/1_2_0/Kinetic-EFM-1-2-0_Install_EFM_DGLux5.pdf Workaround 2: Reinstall EFM. This very effective approach will wipe all of your installation, including tokens, data flow, etc... unless you backup them manually. Since the WebUI is not working this is quite a long process that is not recommended if all you want is a new working license. However if you do re-install make sure you separate EFM broker and visualization components on two users as see before. Workaround 3: Regenerate License Remove the user's ~/.dglogik directory, and perform an in-place upgrade of EFM. You will essentially reinstall the same version of EFM, but the installer will generate a new EFM broker license. You'll get access to the data flow editor, and none of your data will be lost.   ... View more