I'll try to help out, I'm not that good in networking. I spoke to one of my co-worker about it. He mentioned something about expired x509 cert, could you check by running #show vlt 1 vlt-port-detail to see if it sheds any light to the issue.
o show vlt 1 Domain ID : 1 Unit ID : 1 Role : Version : 2.3 Local System MAC address : 0c:29:ef:ef:a0:00 Role priority : 32768 VLT MAC address : 00:00:00:00:06:06 IP address : fda5:74c8:b79e:1::1 Delay-Restore timer : 90 seconds Peer-Routing : Enabled Peer-Routing-Timeout timer : 0 seconds VLTi Link Status port-channel1000 : up
VLT Peer Unit ID System MAC Address Status IP Address Version ---------------------------------------------------------------------------------- 2 0c:29:ef:ef:4e:00 up fda5:74c8:b79e:1::2 RACK6-TOR2(conf-vlt-1)# do show running-configuration vlt ! vlt-domain 1 backup destination 172.29.2.61 discovery-interface ethernet1/1/49-1/1/50 vlt-mac 00:00:00:00:06:06
Using ssh to each switch and clear NTP time back and set the clock date per the instructions below:
Commands: (Note: You will need to connect to each Front End switch rabbit.rack, hare.rack Back End switche fox.rack, hound.rack) # ssh
# configure terminal
# no ntp server 192.168.219.254
# exit
# clock set 01:00:00 2021-07-01
# show clock
Example:
fox# configure terminal
fox(config)# no ntp server 192.168.219.254
fox(config)# exit
fox# clock set 01:00:00 2021-07-01
fox# show clock
2021-07-01T01:00:01.74+00:00
Run the SC procedure from solve to renew the switch certificates.
Commands: # service-console run Check_Switch_Certificates
# service-console run Renew_Switch_Certificates
Note: during the run of service-console the health check for NTP will still pass as it will not detect the previous config change of disabling NTP. Output will look like below
Example: (Note: output is truncated)
...
NTP is configured on the switch fox.rack
NTP is configured on the switch hound.rack
NTP is configured on the switch rabbit.rack
NTP is configured on the switch hare.rack
...
Once the switch certificates are updated on all switches revert the ntp configuration previously made on both FE and BE switches and verify time is set back to current
Commands:(You will need to connect to each Front End switch rabbit.rack, hare.rack Back End switch fox.rack, hound.rack) # ssh
# configure terminal
# ntp server 192.168.219.254
# exit
# show ntp status
# show clock
Example:
ssh fox.rack
fox configure terminal
fox(config)# ntp server 192.168.219.254
fox(config)# exit
fox# show ntp status
associd=0 status=0618 leap_none, sync_ntp, 1 event, no_sys_peer,
system peer: 192.168.219.254:123
system peer mode: client
leap indicator: 00
stratum: 5
log2 precision: -22
root delay: 3.480
root dispersion: 966.568
reference ID: 192.168.219.254
reference time: e4a1a404.c24ca800 Tue, Jul 20 2021 19:35:32.758
system jitter: 0.000000
clock jitter: 1.401
clock wander: 0.000
broadcast delay: -50.000
symm. auth. delay: 0.000
fox# show clock
2021-07-20T19:35:53.14+00:00
Having th same issue of certificate expired, I've upgraded to the version 10.5.6.2 and reintegrate the two switchs (OS10) with (VLT) interconnected with a Cisco Nexus 7K (VPC)
Now I'm facing a strange issue when testing HA, which is when I shut the ports connected to the ESXI (Uplinks) on primary switch same ports on the other switch go down and no
there is no 10.5.6.2 version, it might be typo. Could you please double check? Also you should have upgraded 10.5.0.4 >> 10.5.0.9 > 10.5.2.6 in that order, can you confirm this is how you did?
DELL-Joey C
Moderator
•
4.1K Posts
0
August 22nd, 2021 19:00
Hi,
I'll try to help out, I'm not that good in networking. I spoke to one of my co-worker about it. He mentioned something about expired x509 cert, could you check by running #show vlt 1 vlt-port-detail to see if it sheds any light to the issue.
ANetops
1 Rookie
•
18 Posts
0
August 23rd, 2021 03:00
Hi Joey,
Thanks for responding.
i donit see any vlt port details.
show vlt 1 vlt-port-detail
% Error: VLT port not found
i don't see any cert installed on that.
show crypto ca-certs
--------------------------------------
| Locally installed certificates |
DELL-Marco B
Moderator
•
4K Posts
0
August 23rd, 2021 03:00
Hello,
that's strange it seems that there is no VLT configured. Can you configure a VLT domain and define interfaces?
Thanks
Marco
ANetops
1 Rookie
•
18 Posts
0
August 23rd, 2021 06:00
Hi Marco,
Configuration is there.
o show vlt 1
Domain ID : 1
Unit ID : 1
Role :
Version : 2.3
Local System MAC address : 0c:29:ef:ef:a0:00
Role priority : 32768
VLT MAC address : 00:00:00:00:06:06
IP address : fda5:74c8:b79e:1::1
Delay-Restore timer : 90 seconds
Peer-Routing : Enabled
Peer-Routing-Timeout timer : 0 seconds
VLTi Link Status
port-channel1000 : up
VLT Peer Unit ID System MAC Address Status IP Address Version
----------------------------------------------------------------------------------
2 0c:29:ef:ef:4e:00 up fda5:74c8:b79e:1::2
RACK6-TOR2(conf-vlt-1)# do show running-configuration vlt
!
vlt-domain 1
backup destination 172.29.2.61
discovery-interface ethernet1/1/49-1/1/50
vlt-mac 00:00:00:00:06:06
but for some reason, vlt role is not showing.
DELL-Marco B
Moderator
•
4K Posts
0
August 23rd, 2021 07:00
Hello,
please try this:
# ssh
# configure terminal
# no ntp server 192.168.219.254
# exit
# clock set 01:00:00 2021-07-01
# show clock
Example:
# service-console run Check_Switch_Certificates
# service-console run Renew_Switch_Certificates
Note: during the run of service-console the health check for NTP will still pass as it will not detect the previous config change of disabling NTP. Output will look like below
Example: (Note: output is truncated)
# ssh
# configure terminal
# ntp server 192.168.219.254
# exit
# show ntp status
# show clock
Example:
Reybeast2
130 Posts
0
August 23rd, 2021 08:00
can you try shutting down the vlt interfaces (49 and 50) on one switch, wait 10 seconds and bring it back up?
#Iwork4dell.
ANetops
1 Rookie
•
18 Posts
0
August 23rd, 2021 11:00
Hi Marco,
Thanks for the details.
its because of expired cert.
is service console separate software that we need to install to renew this?
Regards
Ashraff S
DELL-Chris H
Moderator
•
9.7K Posts
0
August 23rd, 2021 13:00
ANetops,
It looks like he is referring to the ECS service console, as seen here.
You can find the installation steps for the console here.
Let us know how it goes.
medred
1 Rookie
•
3 Posts
0
August 28th, 2021 03:00
Dears,
Having th same issue of certificate expired, I've upgraded to the version 10.5.6.2 and reintegrate the two switchs (OS10) with (VLT) interconnected with a Cisco Nexus 7K (VPC)
Now I'm facing a strange issue when testing HA, which is when I shut the ports connected to the ESXI (Uplinks) on primary switch same ports on the other switch go down and no
Could you please advice
Thanks,
DELL-Young E
Moderator
•
5.4K Posts
0
August 29th, 2021 22:00
Hi,