Ironport c160 cluster problems

Hi!
I have two Ironport C160 in cluster mode, tonight one of them has stopped working, and I can not access this on, but it responds to ping.
In the system log I found only the following line:
Mon Mar 12 15:30:39 2012 Warning: Error connecting to cluster machine xxxxx (Serial#: xxxxxx-xxxxxx) at IP xx.xxx.xxx.x - Operation timed out - Timeout connecting to remotehost cluster
Mon Mar 12 15:31:09 2012 Info: Attempting to connect via IPxxxxx toxxxxxxxx port 22 (Explicitly configured)
My version is:6.5.3-007
What I can log to find the cause of the problem?
How I can find out what the problem?
How can you solve?
Thank you very much

Well, "queuereset" is not a valid command, what you mean is "resetqueue", which I would strongly not recomment to use without having a very good reason.Because this command removes all messages from the workqueue, delivery queues, and quarantines. There are usually less destructive ways to fix a cluster problem.
BTW, version 5.5 has long been gone, so we won't need to reference any bugs from there any more.
Regards,
Andreas

Similar Messages

Ironport C160 Device Troubleshooting

My apologies if I am posting this in the wrong place but there does not appear to be a place for Ironport devices.
We have two Ironport C160 appliances configured as a cluster that have been running without issue for several months. In the past month and a bit one of the units has hung/failed/become unresponsive. I'm wondering if there is a standard process people who support these devices follow to troubleshoot problems like this? I couldn't find anything of much use in the documentation I have available so any advice relating to what I should be checking would be appreciated. Are there log files to look at? Is there anything I can do other than a hard reset to get this machine back and once its back is there something I should be doing to make sure its working properly?
Any assistance or direction you can provide would be great.
Thanks

Mitch,
it looks like your user account only has guest level access, while you need customer level access. I can only suggest to follow the FAQ's recommendation:
If you are a Cisco IronPort customer and facing issues accessing these
communities, please contact Cisco IronPort Customer support for
assistance. The contact information can be found here: Cisco IronPort Support Contacts
hth
Herbert

Ironport C160 Firmware upgrade issue

Hi All ,
i have C160 appliance when i tried to upgrade the OS with available it was failed . you can see the below captures .
Upgrades available.
1. AsyncOS 7.1.5 build 101 upgrade For Email, 2012-02-03
[1]> 1
Performing an upgrade may require a reboot of the system after the upgrade is
applied. You may log in again after this is done. Do you wish to proceed with
the upgrade? [Y]> y
IronPort Email Security Appliance(tm) Upgrade
Finding partitions... done.
Setting next boot partition to current partition as a precaution... done.
Erasing new boot partition... done.
Installing application... done.
Installing CASE... 35% 12:04 ETA./data/third_party/case/libexec/uridb-20110317_102448/uridb_1: Premature end of gzip compressed data: Input/output error
tar: Error exit delayed from previous errors.
The system upgrade failed due to a connection timeout. This could be the result
of a network interruption or a more serious error. If this problem persists,
please contact customer support.
(Machine mailrelay01.bahrainedb.com) [Disconnected]>
====================================================================== 192.168.111.4 ==========================
AsyncOS 7.1 for IronPort C160 build 020
Welcome to the IronPort C160 Messaging Gateway(tm) Appliance
(Machine mailrelay01.bahrainedb.com) [Disconnected]> upgrade
Would you like to save the current configuration to the configuration directory
before upgrading? [Y]>
Do you want to include passwords? Please be aware that a configuration without
passwords will fail when reloaded with loadconfig. [N]> y
Email a copy? [N]>
Upgrades available.
1. AsyncOS 7.1.5 build 101 upgrade For Email, 2012-02-03
[1]> 1
Performing an upgrade may require a reboot of the system after the upgrade is
applied. You may log in again after this is done. Do you wish to proceed with
the upgrade? [Y]> y
Removing stale lock file
IronPort Email Security Appliance(tm) Upgrade
Finding partitions... done.
Setting next boot partition to current partition as a precaution... done.
Erasing new boot partition... done.
Installing application... 87% 02:41 ETAdata/release/phoebe-7-1-5-101/lib/pycbox/ironport_debug.db: Premature end of gzip compressed data: Input/output error
tar: Error exit delayed from previous errors.
The system upgrade failed due to a connection timeout. This could be the result
of a network interruption or a more serious error. If this problem persists,
please contact customer support.
(Machine mailrelay01.bahrainedb.com) [Disconnected]>
(Machine mailrelay01.bahrainedb.com) [Disconnected]>
(Machine mailrelay01.bahrainedb.com) [Disconnected]>
Can you please advice

Asiam -
More than likely - there is something on the network that is distrupting the download and recompression of the upgrade package.
If you can - please contact the TAC, open a support case, and also open a tunnel for the appliance. If permissiable, just let us know if it is OK to attempt the upgrade while we are connected through tunnel as well.
Instructions on how to open remote access to ESA:
>techsupport tunnel cisco2013
## Please make sure you use the command above, from its CLI (command line interface), when opening the remote access.
Article #1541: What are Techsupport Tunnels? Link: http://tools.cisco.com/squish/b4b51
*** If you choose a different password, please notify me of the password you issued. ***
*** Also, please verify the S/N on the appliance the tunnel was initiated against. ***
You can either generate a support case directly from the appliance, or dial into the following:
Cisco Customer Interaction: 1-800-553-2447 / Outside US
-Robert

What is the latest available AsyncOS Version for the IronPort C160

Hello @ all,
i try to figure out if there is a AsyncOS 8.x update for the Cisco IronPort C160 available.
My Cisco C160 cluster is running the 7.6.0-357 AsyncOS version.
Greetings Robert

8.0.1-023 is still the latest GA release. If you are on that release, you won't see any of the FCS releases.
Q: Are there any other releases available for AsyncOS?
A: Yes, FCS candidates are available for provisioning, but you must open a support case and request to be added to the FCS provisioning group. Please see our other CSC blog posts for recent FCS release information.
I'll shoot you a DM and work with you to get your SN and info, if you are wanting to get 8.5.6-073?
I hope this helps!
-Robert
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

Ironport C160-Best practice config for my 2 listeners?

I am trialling an Ironport C160.
I want it to scan inbound and outbound mail. I have configured a public inbound listener for mail from the internet. It is configured to accept all my domains, and forward them to my exchange server. It does LDAP lookups for recpients to ensure they are valid. It uses the Data1 interface on the ip address of the Ironport and also has the hostname ironport.mydomain.com.
What is the recommended way to configure the private outbound listener? I just want it to do simple av scanning, then pass it on to my ASA.
Should I configure a new interface o Data2, and use port 25? If so, what would the hostname be?
Or use the same interface and use port 24 instead?
What are the pros and cons of each setup?

Please note that you can add your Exchange server IP address into RELAYLIST or any sender group with RELAYED mail flow policy or mail flow policy with 'Relay' connection behavior. Add IronPort listener iP as smart host on Exchange server. All emails from Exchange server will then be treated as outgoing emails and envelope recipient address will not be checked against LDAP.
Most of my customers simply use one listener for both incoming and outgoing emails. You can choose to have multiple listeners for incoming (e.g. Different domains want to have their own MX IP addresses, sender groups for whitelist, greylist, blacklist domain/IP ranges) and outgoing emails (e.g. Not adding 'Received' header for outgoing listener for security reason).
Please note that there is a restriction that you cannot configure IP addresses on same network range on different physical interfaces on IronPort.
You can also configure multiple IP interfaces or interface groups on IronPort such that you can deliver emails for different domains, normal or urgent, management or marketing or other emails by different IP addresses or IP range.

Cisco Ironport c160 licence upgrade

hi all,
What i need to do to upgrade expired license for ironport c160,
Where can I read about product number for this type of license?

Hi Mihail,
I am not sure if I understand the question.
If you have expired keys you should renew them. I would recommend contacting your Cisco Account Team and/or Reseller. If you are in process of renewing the keys, you could open a support ticket with our licensing team so they can evaluate the situation and assist you further.
You can find information about the keys your appliance has via Web UI and CLI.
In the Web UI, please go to:
System Administration > Feature Keys > Feature Keys.
Via CLI, please run:
> featurekey list
I hope this helps.
Regards,
Valter

SPF is not supported SCVMM cluster problems, when repairing ?

SPF is not supported SCVMM cluster problems, when repairing ?

See:
*http://forums.sdn.sap.com/thread.jspa?threadID=2056183&tstart=45#10718101

Configuring Listener on IronPort C160

Hi,
We are currently in the process of configuring IronPort C160 system. The email appliance is going to be set up in the DMZ. We already have a listener for Incoming Mail and has the IP address in the DMZ network. We have also configured SMTP routes fto accept mails for our domains(Receiving domains) and forward it. However, I am not sure do we need a listerner for the outbound mail. Also we have routes for incoming mail that specify the destination host. Do we need to have something for emails going outbound ?
can somebody please help?

Hi,
So I am not sure if I am following all of your throught process here as there are several questions.
As far as do you need an outbound listener? Multiple listeners (inbound and outbound) are not required but in some cases they make sense. WIth a DMZ configuration it may make sense to do this depending on your network layout. Based on some of the other statements and comments in your post I would think you probably would want a seperate listener for inbound and outbound.
I may need some clarification on your network configuation to give you an accurate answer on the remaining questions. For outbound you can utilize smtproutes if you want to force traffic to a speicifc host or IP ( bypass DNS). Typically outbound traffic is routed through the relaylist sendergroup in the HAT from there the appliance simply looks up the recipient domain via DNS to get the MX record for recipient domain. If you need to relay to another host prior to sending the messages out to the rest of the world then you would probably want to set up an smtproute to point to that host.
It may be easier to not think of the appliance as having inbound or outbound. In reality the appliance does not really know or care about inbound or outbound it simply processes the messages and routes them based on DNS or specified routes through something like smtproutes.
Not sure I fully answered your question , but hopefully that helped a bit. If you can provide a bit more detail I think I can help clarify things for you.
Christopher C Smith
CSE
Cisco IronPort Customer Support

Degraded RAID on IronPort C160

Our IronPort C160 has a degraded RAID. How do I identify the bad hard drive and if I replace it will the RAID rebuild itself? Opening a TAC case is not an option.
Thanks,

Unfortunatley - the hard drives in the C160 appliance are not hot swappable. You would need to open a support case through TAC, and have the appliance RMA'd - if it is still under contract. Starting with the C170 - the drives are hot swappable.
Hope this helps!
-Robert
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

Leopard - QMaster and Virtual Cluster problem

Hi guys,
Up until yesterday I had my MacPro Octo running under 10.4 where I did succesfully set up a Virtual Cluster using 4 instances for Compressor. It worked as a charm and my MacPro was doing it's job perfectly.
Today, I made a bootable backup of my 10.4 install and installed 10.5 using the erase and install options ( clean install ). I installed all my software again and tryed setting up my Virtual Cluster again, using the same settings I had under 10.4. Sadly I can't seem to get it working.
In the QMaster Preferences pane, I have the QuickCluster with Services option checked. For the compressor entry in the Services I have the Share Option checked and used 4 isntances for the selected service. The Quickcluster received a descent name and the option to include unmanaged services from other computers is checked.
I have the default options set in the Advanced tab, ( nothing checked except log service activity to log file and Show QMaster service status in the Menu Bar). I then started the Cluster using the Start Sharing button.
Now I open u Compressor and add a file to process ( QT encode to iPod ), but when I hit the Submit button, my Virtual Cluster doesn't show up in the Cluster Dropdown. If I now leave the Compressor GUI open for 5 minutes, it will eventually show up in the list, and I can pick it. Sadly, picking it from the list at this point and hitting the Submit button makes Compressor Hang.
I checked my logs, but the only thing concerning Compressor I could find is this :
4/12/07 20:12:35 Compressor[242] Could not find image named 'MPEG1-Output'.
4/12/07 20:12:35 Compressor[242] Could not find image named 'MPEG1-Output'.
4/12/07 20:12:35 Compressor[242] Could not find image named 'MPEG1-Output'.
4/12/07 20:12:41 Batch Monitor[190] * CDOClient::connect2: CException [NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218488391.647220 218488361.647369) 1'], server [tcp://10.0.1.199:49167]
4/12/07 20:12:41 Batch Monitor[190] exception caught in -[ClusterStatus getNewStatusFromController:withOptions:withQueryList:]: NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218488391.647220 218488361.647369) 1'
4/12/07 20:17:55 Batch Monitor[190] * CDOClient::connect2: CException [NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218488705.075513 218488675.075652) 1'], server [tcp://10.0.1.199:49167]
I tried Stopping and then Restart Sharing and I noticed the follwoing entries in my log :
4/12/07 20:23:26 compressord[210] can't refresh cache from file "/Library/Application Support/Apple Qmaster/qmasterservices.plist"
4/12/07 20:23:26 compressord[211] can't refresh cache from file "/Library/Application Support/Apple Qmaster/qmasterservices.plist"
4/12/07 20:23:26 compressord[213] can't refresh cache from file "/Library/Application Support/Apple Qmaster/qmasterservices.plist"
4/12/07 20:23:26 qmasterca[269] can't refresh cache from file "/Library/Application Support/Apple Qmaster/qmasterservices.plist"
4/12/07 20:23:26 qmasterqd[199] can't refresh cache from file "/Library/Application Support/Apple Qmaster/qmasterservices.plist"
4/12/07 20:23:27 QmasterStatusMenu[178] * CDOClient::connect2: CException [NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218489009.603992 218489007.604126) 1'], server [tcp://10.0.1.199:49407]
4/12/07 20:23:27 Batch Monitor[190] * CDOClient::connect2: CException [NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218489037.738080 218489007.738169) 1'], server [tcp://10.0.1.199:49407]
4/12/07 20:23:27 Batch Monitor[190] exception caught in -[ClusterStatus getNewStatusFromController:withOptions:withQueryList:]: NSException raised by 'NSPortTimeoutException', reason = '[NSPortCoder sendBeforeTime:sendReplyPort:] timed out (218489037.738080 218489007.738169) 1'
Batch Monitor immediately detects the cluster being active again, but Compressor doesnt, leaving me only This Computer available in the Cluster drop down when submitting a batch.
In my Activity Monitor, I notice that CompressorTranscoder is not responing ( the 4 CompressorTranscoderX processes are fine ) and the ContentAgent proces isn't responding neither.
Does anyone have any clue on what I could check next or how I could fix my problems ?
Thanks a lot in advance,
Stefaan

Bah, this is crazy, today it doesn't work anymore. Yesterday my cluster was showing up in the Dropdown window, and I could submit a batch to it, and it got processed over my virtual cluster.
Today, after finishing the second part of my movie, I tried it again. I didn't change anything to my settings, my machine hasn't even rebooted (just recovered from sleep mode) and my cluster isn't showing up at all anymore. Even the Qmaster menu doesn't show it
Guess, I'll have to wait out until it appears again, or try a few things out

August Patch Cluster Problems

Has anyone had the following issue after installing the latest Patch Cluster?
After a reboot I get
couldn't set locale correctly
To correct this I have to edit /etc/default/init
and remove
LC_COLLATE=en_GB.ISO8859-1
LC_CTYPE=en_GB.ISO8859-1
LC_MESSAGES=C
LC_MONETARY=en_GB.ISO8859-1
LC_NUMERIC=en_GB.ISO8859-1
LC_TIME=en_GB.ISO8859-1
If I then create a flash archive and use this flash archive the jumpstart process then puts the locale info back and the problem appears again.
It's not critical as I don't need to be on the latest Patch Cluster but would wondered if I'm the only one having issues?

If you open the directory in CDE's file manager, right click on the zipped file and select unzip. The cluster will be unzipped to a directory structure called x86_recommended or something of the sort. Change to that directory to run the patch cluster install script. The patch script is looking for that directory structure.
Lee

NVGRE Gateway Cluster Problem

Hello
We have following setup:
Management Hyper-V hosts running WAP, SPF and SCVMM 2012 R2 components
Gateway Hyper-V host: single node gateway hyper-v host, configured as a single node cluster to be able to join extra hardware in the future
this Hyper-V host runs 2 Windows Server Gateway VMs,configured as a failover cluster.
The following script is used to deploy these windows server gateway VMs as a high available NVGRE gateway service:
http://www.hyper-v.nu/archives/mscholman/2015/01/hyper-v-nvgre-gateway-toolkit/
two tenant Hyper-V hosts running VMs which are using network virtualization
The setup is completed successfully and when creating a tenant in WAP and creating VM network for this tenant using NAT, the VMs of this tenant are accessible and can access Internet using the HA Gateway cluster.
The Gateway Hyper-V host and NVGRE Gateway VMs are running in a DMZ zone, in a DMZ Active Directory Domain.
Management and Tenant Hyper-V hosts, incl all Management VMs, are running in a dedicated internal Active Directory domain.
Problems start when we failover the Windows Server Gateway service to the other VM node of the NVGRE Gateway cluster. We see in the lookup records on the Gateway Hyper-V host that the MAC address of the gateway record for tenants is updated with the new
MAC address of the VM node running the gateway service.
But in SCVMM, apparently, this record is not updated. The tenant hosts still use the old MAC address of the other Gateway VM node.
When looking in the SCVMM database, we can also see that in the VMNetworkGateway table that the record representing the gateway of the tenant, still points to the MAC address of the PA network adapter of the other node of the NVGRE Gateway cluster, not to the
new node on which the gateway service is running after initiating a failover.
On the tenant hyper-v hosts, the lookup record for the gateway also points to the old node as well.
When manually changing the record in the VMNetworkGateway table to the new MAC address, and refreshing the tenant hosts in SCVMM, all starts working again and the tenant VMs can access the gateway again.
Anybody else facing this issue? Or is running a NVGRE Gateway cluster on a single Hyper-V node not supported?
To be complete, the deployed VMs running the gateway service are not configured as HA VMs.
Regards
Stijn

If i understand your post correctly you have a single Hyper-V Host running 2 GW VM's. I think the problem is that when you deploy a HA VM Gateway Cluster it wants to create a Cluster Resource (PA IP Address) on the Hyper-V host as well. So when you run 2
hyper-v hosts and 2 gw vm's and you move the active role to another host it will move the Provider Address to the other Hyper-V host as well. I believe this is by design. You should ask yourself also the question why running 2 vm's in a cluster on the same
node ;-)
I would recommend to use 2 node Hyper-V Host Cluster (This is needed for the HA PA Address, And not necessary for your GW VM's )
Then run the deployment toolkit again. Now when that's done again, take a close look on how the Active node on the Hyper-V host has the corresponding PA assiogned on that Hyper-V host. Then do a failover, refresh the cluster manager and take notice
of the PA address that has moved along to the other Hyper-V host that is the active one. It is diffuclt to explain, in a couple of sentences but i hope you have the opportunity to build the 2nd Hyper-V host aswell and create a cluste.
Side note: if you want to keep the excising VM Gateway cluster. remove all gateways from VM Networks and remove the Gateway service from VMM. Then provision the second Hyper-V Host, Configure Cluster, Live migrate 1 GW VM node to it. Reconfigure
Shared VHDX for quorum and csv and then add back the network service again. Don't try to leave it as a network service in VMM and move the VM to another node. It will not work when failover.
Best regards, Mark Scholman. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Cluster Problems??

Hi All,
Need some help we have a SAP 4.6C install on a Microsoft cluster with a MSQL database one node in the
Cluster is corrupt and needs to be rebuilt my question to you all is can one node of the cluster be built
Or will both nodes have to be rebuilt.
If so where can I find the documentation to do this can it result in any other problems.
Thanks
John

Hello - The nature of MSCS is failover. Thus one node failure = one node recovery. MSCS documentation would suffice here.
Regards.

BorderManager Cluster problems

I have set up a 2 node NW 6.5 SP8 cluster to run BorderManager 3.9 SP2. I don't have a 'Split Brain Detector' (SBD) partition; the servers only monitor each other through the LAN heartbeat signal that is being sent by the master and replies by the slave. This has worked well from a high availability perspective but I keep running into a situation where both nodes will go 'active'.
Usually, I have Node 0 set as both the cluster master and the host of the NBM proxy resource. Node 1 is then in standby - ready to load the proxy service and assume the proxy IP address if node 0 dies. At some point (the time is variable in days 2 - 5 and doesn't seem to be related to network load) Node 0 will think that Node 1 has failed and will show that on the Cmon console. Shortly afterwards Node 1 will think that Node 0 has failed and bind the proxy IP and cluster master IP and load the proxy. At this time I have two servers; both with the same Cluster Master IP bound and the proxy IP bound and proxy.nlm loaded!
I can access Node 0 through rconj and it appears to be working fine. If I do a 'display secondary ipaddress' I can see it has both the proxy IP and Cluster Master IP bound to it. The same thing is the case for Node 1. I unload the proxy on Node 0 and reset the server. When it comes back up, it joins the cluster just fine and there doesn't appear to be any other problem.
Has anyone else seen this behavior? (Craig???)
thanks,
Dan

In article <[email protected]>, Dchuntdnc wrote:
> but I keep running into a situation where
> both nodes will go 'active'.
I've got one of those situations too, at a client.
>
> Usually, I have Node 0 set as both the cluster master and the host of
> the NBM proxy resource. Node 1 is then in standby - ready to load the
> proxy service and assume the proxy IP address if node 0 dies. At some
> point (the time is variable in days 2 - 5 and doesn't seem to be related
> to network load) Node 0 will think that Node 1 has failed and will show
> that on the Cmon console.
This sounds familiar, except for me it happens within hours.
> Shortly afterwards Node 1 will think that
> Node 0 has failed and bind the proxy IP and cluster master IP and load
> the proxy. At this time I have two servers; both with the same Cluster
> Master IP bound and the proxy IP bound and proxy.nlm loaded!
Yep. Gets annoying, to say the least!
>
> I can access Node 0 through rconj and it appears to be working fine.
> If I do a 'display secondary ipaddress' I can see it has both the proxy
> IP and Cluster Master IP bound to it. The same thing is the case for
> Node 1. I unload the proxy on Node 0 and reset the server. When it
> comes back up, it joins the cluster just fine and there doesn't appear
> to be any other problem.
Yep.
>
> Has anyone else seen this behavior? (Craig???)
I have definitely fought this issue, but only on one (of many) BM cluster.
Both nodes of the cluster are on old servers, and when the proxy is
active, it is exceptionally busy. (More than 2000 users, and plenty of LAN
bandwidth). I was on site at the client working on this (and a lot of
other projects) and I never was able to get to the bottom of it. The fact
that the server was so busy (24x7) made it hard to experiment on. My hope
at this point is to get decent newer hardware in there to replace the
7-year old nodes.
This happened when one server was BM 3.8 and the other BM 3.9, but it
continued to happen when I upgraded both to 3.9sp2. It also happened even
though I moved the heartbeat to dedicated nics with a crossover cable.
I'm thinking that something causes the LAN drivers to hiccup long enough
for the server to stop responding to heartbeat - but the proxy seems to
work continuously without showing a 30-second pause anywhere.
For the time being, I've left the oldest node not loading cluster
services. It's a manual failover at this time, but that's better than
nothing. (And the primary node is quite stable anyway, for months and
months at a time).
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***

Patchin portal cluster problem

I am trying to run, Portal patch 13 on a WAS cluster.
t
The problem I am getting is that the patch installation asks for a "username and password" for administrator
When I enter the details I get an error.
My question is that if it is in safe modde, how is the install checking these details. I cannot log into the visual admin when the cluster is in safe mode.
Anybode else have this problem.
Thanks

I think I just figured out how to use the sage mode. It basically just limits the cluster to 1 server and 1 dispatcher. Youre right, the same result can be achieved with the config tool
Thanks

Ironport c160 cluster problems

Similar Messages

Maybe you are looking for