Forum Discussion

Luca_55898's avatar
Luca_55898
Icon for Nimbostratus rankNimbostratus
Sep 26, 2012

gtm_add failing

I have a new GTM that i want to add use with my existing GTM.

 

I have configured the new GTM with a management IP, and provisioned the GTM section. From the doco I have read I now need to run the gtm_add script on the new GTM.

 

So i run it and i get this:

 

[root@gtm02:Active] config gtm_add 192.168.26.15

 

WARNING: Running this script will wipe out the current configuration

 

files (bigip_gtm.conf, named.conf and named zone files) on the BIG-IP GTM

 

Controller on which this script is run. The configuration will be

 

replaced with the configuration of the remote BIG-IP GTM Controller

 

in the specified sync group

 

The local BIG-IP GTM MUST already be added in the configuration of the

 

other GTM.

 

 

Are you absolutely sure you want to do this? [y/n] yes

 

 

==> Running 'bigstart shutdown gtmd' on the local system

 

==> Running 'bigstart shutdown zrd' on the local system

 

==> Running 'bigstart shutdown named' on the local system

 

Retrieving remote and installing local BIG-IP's SSL certs ...

 

Enter root password if prompted

 

Password:

 

Rekeying Master Key...

 

Verifying iQuery connection to 192.168.26.15. This may take up to 30 seconds

 

iQuery connection to 192.168.26.15 failed.

 

Is big3d running?

 

Is tcp port 4353 access allowed?

 

 

Restarting gtmd

 

Restarting named

 

Restarting zrd

 

 

So a few quesitons

 

1) What interface should i use to connect the two GTMs on? Is the management interface OK or should i se the self IP?

 

2) The gtm_add scirpt says 'The local BIG-IP GTM MUST already be added in the configuration of the

 

other GTM' How do I do that? This could be why it is failling down im thinking....

 

I have added each GTM into the servers section on both guys, and also created the data centers

 

I cal telnet on port 4353 between both GTMs and also SSH between both

 

 

Actually - the gtm log shows this:

 

Sep 26 17:41:18 gtm01 iqmgmt_ssl_connect: SSL error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

 

Sep 26 17:41:18 gtm01 err gtmd[6206]: 011ae0fa:3: iqmgmt_ssl_connect: SSL error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (3361

 

thanks,

 

config
design

7 Replies

Sort By
  • Bhanu_9561's avatar
    Bhanu_9561
    Icon for Cirrus rankCirrus
    Sep 26, 2012
    Looks like you do not have access to port 4353.

     

     

    It is always better to establish the iQuery connection on the TMM interfaces rather than the management interface.

     

    Typically the management interfaces live on a separate zone in which case might not have 4353 port access.

     

     

    My next option would be give 4353 and 22 port access to one of the Selp IP. Change the port lockdown setting on the BIG-IP as well to accept 22 and 4353.

     

     

    If gtm_add still doesnt work try this:

     

     

     

    As at this point the key exchange might have been performed remove the entry for the host in the known_hosts file. This will be the IP address against which you have unsuccessfully run the gtm_add command against.

     

    Log in to the appropriate BIG-IP GTM command line:

     

    vi /root/.ssh/known_hosts, search for and remove existing entry for (to run gtm_addl)

     

    Only remove entries containing address of the GTM (GTM against which you performed the gtm_add).

     

     

     

    Make sure that only the server.crt exists in the /config/httpd/conf/ssl.crt folder on the GTM against which you are performing the gtm_add against.

     

  • psavalam_195881's avatar
    psavalam_195881
    Icon for Nimbostratus rankNimbostratus
    May 05, 2015

    This may work, you might have to renew the device certificate and give the name other than the default localonly.localhost cert. Altough the internal root cert is same , this resolved issues with the

     

    Sep 26 17:41:18 gtm01 iqmgmt_ssl_connect: SSL error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Sep 26 17:41:18 gtm01 err gtmd[6206]: 011ae0fa:3: iqmgmt_ssl_connect: SSL error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (3361

     

    This must be followed by the "bigip_add " to ensure iquery comm. and also the check if 4353 is responding.

     

    Another check is to find the group-names are same on these GTMs

     

    • brad_11480's avatar
      brad_11480
      Icon for Nimbostratus rankNimbostratus
      Apr 25, 2017

      having the same message... my device certificates are issued by our internal PKI -- and are not self-signed.

       

      communication is likely there as it does return that message.... and when i do a iqdump it shows it is trying to open the session.

       

      how do i correct the certificate verify problem?

       

    • David__Pasch_24's avatar
      David__Pasch_24
      Icon for Nimbostratus rankNimbostratus
      Apr 26, 2017

      Try installing your SSL cert as a bundle with the full chain to the CA Root Cert.

       

    • brad_11480's avatar
      brad_11480
      Icon for Nimbostratus rankNimbostratus
      May 01, 2017

      Bingo. Yes had to go futz it so the cert and its entire chain is provided. Appreciate the help.

       

  • David__Pasch's avatar
    David__Pasch
    Icon for Altostratus rankAltostratus
    May 01, 2017

    When using an a CA for the SSL certs used in iQuery, bundle the certificates so that the full chain to the CA is valid.