Avaya Site Administration Connection Error 1

[CChambleeJr]

I'm using Avaya Site Administration version 6.0.07. I have a duplicated pair of HP servers running CM 6.0.1. Before I performed a server interchange, I could SAT and SSH into the active server using PuTTY with no issues. I could also access the active server using Avaya Site Administration. However, after performing an interchange, I can no longer connect to the active server via ASA. I can connect with PuTTY just fine, although I did initially get a pop-up regarding the RSA fingerprint, where I had to confirm the new RSA fingerprint/key. That being the case, is there something in ASA that needs to be reset/configured in order to allow it to connect to the duplicated IP address now that the other server is the active one? Seems like this has got to be a fingerprint/key issue with SSH.


===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[wpetilli]

This happened to me in a remote site during a WAN fracture, but eventually worked. I'm sure you've tried completely closing out ASA.. maybe even flush your dns cache. If the server is healthy there shouldn't be any reason why you couldn't access.

 

[CChambleeJr]

Yes, I've shut it down completely, even rebooted my Windows machine. I also tried creating a new voice system profile, with a total of five "connections" defined. It just won't connect to the servers with the "A" server active. If I interchange back to the "B" server as active, then ASA connects just fine. Since PuTTY will connect fine to either one as active, It's got to have something to do with the SSH fingerprint. I've searched the registry but can't find anything in it that looks to be able to "clear" the keys.

===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[wpetilli]

Yea, because essentially isn't ASA just SSH. That's odd.. what about uninstalling ASA altogether and re-installing. The main concern is the servers are in good health

 

[montyzummer]

If the B server is active log on to A and restart CM either by the web interface or from linux shell , if you log onto A server via shell and type statapp do you see all processes up and running??

APSS (SME)
ACSS (SME)
ACIS (UC)

 

[CChambleeJr]

Did that, MontyZ, and all of the services did come back up. Did another interchange, ASA still won't connect to the "A" server when it's the active server. PuTTY connects just fine, in fact, I can open multiple sessions to the same server. I even tried to ASA to the actual IP address of the "A" server (instead of the virtual IP), still no-go. Interchanged back to "B" active, now ASA connects OK. I'm really baffled with this issue. About to try ASA 6.0 SP2 (just released a few months ago) to see if it helps.


===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[montyzummer]

have you tried statapp or systat -p from linux shell to see if everything is coming back up , other thing to check is from webadmin / server access is 5023 allowed this may have switched itself off , as putty will connect on port 22.

APSS (SME)
ACSS (SME)
ACIS (UC)

 

[CChambleeJr]

Actually, I'm connecting with PuTTY on port 5022/SSH, same as my connection properties in ASA. Also tried the built-in Emulation terminal in ASA, same problem.

I have seen references to removing the "known_hosts" file (that contains the known SSH key fingerprints) to restore connectivity issues, but I have not been able to find that file on the CM server. Not sure it would even help. At this point, I'm open to all suggestions.

===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[kyle555]

Its the known_hosts file in the ssh directory of your ASA. Its part of application data and tends to persist across a reinstall. Just update your ASA - or test everything with telnet and it will work fine. When you upgrade a virtual machine or perform a CM interchange, the keys change and ssh has a security mechanism to say "hey, the key that IP a.b.c.d is presenting is different! this might be a different server than the one you think you're logging into!".

The first releases of ASA 6.0 had a problem and wouldn't reconnect to that. Saw it with a guy configuring a lab system the same as production (same IPs) and he used the same ASA to connect to the 2 systems with the same IPs and had the exact same problem.

 

[CChambleeJr]

Thanks guys, this new ASA SP may be the ticket. Working on installing it now.

===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[4merAvaya]

Log into the standby server using Internet Explorer. Go to the section 'Secutity' and open up System Access. Print that page.

Now log into the active server and go to the same page. Make sure the setting match the ones from the standby server. Either Telnet or SAT is not enabled.

Add the features that are missing and click 'Submit'.

Kevin

 

[Stinney]

Check out this:

http://theavayaengineer.wordpress.com/2012/08/22/ssh-sftp-fingerprint-error/

Could be the known hosts issue that kyle555 mentioned.

- Stinney
"Scire ubi aliquid invenire possis, ea demum maxima pars eruditionis est"

"To know where to find anything is, after all, the greatest part of education"

 

[kyle555]

Basically, yeah, but that link refers to how to solve it on a linux server. ASA has its known hosts in something like c:\users\you\application data\avaya\site administration or something and the older releases of 6.0 don't deal well with things changing.

 

[CChambleeJr]

Correct Kyle555. Upgrading to ASA 6.0 SP11 (June 2014) resolved my issue. When I made the initial connection, I received a pop-up, asking me if I wanted to add the current fingerprint to it's known_hosts file. After confirming yes, I was able to connect to the SAT port on either active server. And by the way, ASA's known_hosts file is at:

c:\users\<username>\AppData\Roaming\Avaya\Site Administration\user\known_hosts

Thanks for all the tips and help, guys. Mark this one as resolved!


===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[CChambleeJr]

Clarification... ASA 6.0.07 SP11.01 utilizes the "known_hosts" file, as noted above. The previous version I was using (6.0.007) doesn't use this known_hosts file, as it wasn't there before the SP11 patch was applied.

===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[wpetilli]

Would uninstalling the program wipe out those directories so if you reinstalled you can start fresh? I know that's not the most convenient thing, but curious.

Another ASA issue I've had happen is it just completely hangs... like if you are entering commands too fast. In task manager I had to right click the process and go to set affinity and uncheck all the cpu's except 1.

 

[CChambleeJr]

Yes, I had issues with ASA hanging up, as well, especially when populating larger forms quickly. Really frustrating. That's why I use PuTTY now for my day-to-day changes and adds, and only use ASA for doing reports.


===
Chuck Chamblee
ACSS (CM) | CTP | A+

 

[wpetilli]

Just unflag the multiple cpu's and that fixes the issue.

 

[Stinney]

There is a program that will fix the multi-cpu issue: imagecfg.exe

Google for it and download it. Then follow these instructions:


Copy imagecfg.exe to C:

Navigate to directory with file you want to set affinity on

ie: cd \Program Files\Avaya\Site Administration\bin

Execute the following command:

c:\imagecfg -a 0x1 [executable file name]

ie: c:\imagecfg -a 0x1 asa.exe


- Stinney
"Scire ubi aliquid invenire possis, ea demum maxima pars eruditionis est"

"To know where to find anything is, after all, the greatest part of education"

 

[CChambleeJr]

WPETILLI,
What's the deal with this "unflag the multiple CPUs" option? Is this part of the ASA configuration? Where?

===
Chuck Chamblee
ACSS (CM) | CTP | A+