SyncIQ policies fail "No node on source cluster was able to connect to target cluster"
Summary: SyncIQ policies fail with error "No node on source cluster was able to connect to target cluster" on OneFS 9.1+. This is due to the "encryption required" flag being automatically set to "yes." ...
Symptoms
SyncIQ source or target cluster was recently upgraded to OneFS 9.1.0 or later.
All policies fail with error: No node on source cluster was able to connect to target cluster.
The SyncIQ log /var/log/isi_migrate.log shows "attempting to run an unencrypted" message:
2021-01-27T18:41:05Z <3.3> btestin-1(id1) isi_migrate[33253]: secondary: Source 1XX.1XX.1.69 is attempting to run an unencrypted sync while the global required flag is set.
2021-01-27T18:41:36Z <3.3> btestin-1(id1) last message repeated 5 times
2021-01-27T19:05:27Z <3.3> btestin-1(id1) isi_migrate[33253]: secondary: Source 1XX.1XX.1.69 is attempting to run an unencrypted sync while the global required flag is set.
Cause
In OneFS 9.1 and later, SyncIQ sets the encryption required flag to yes by default:
# isi sync settings view
Service: on
Source Subnet: -
Source Pool: -
Force Interface: No
Restrict Target Network: No
Tw Chkpt Interval: -
Report Max Age: 1Y
Report Max Count: 2000
RPO Alerts: Yes
Max Concurrent Jobs: 32
Bandwidth Reservation Reserve Percentage: 1
Bandwidth Reservation Reserve Absolute: -
Encryption Required: Yes
Cluster Certificate ID:
OCSP Issuer Certificate ID:
OCSP Address:
Encryption Cipher List:
Renegotiation Period: 8H
Service History Max Age: 1Y
Service History Max Count: 2000
Use Workers Per Node: No
Resolution
There are two options to address this issue.
-
Configure policies to use encryption. See KB article 21507: Isilon OneFS: How to configure SyncIQ policies to use SSL encryption
-
Change the encryption required flag in SyncIQ.
isi sync settings modify --encryption-required=false
btestin-1# isi sync settings view
Service: on
Source Subnet: -
Source Pool: -
Force Interface: No
Restrict Target Network: No
Tw Chkpt Interval: -
Report Max Age: 1Y
Report Max Count: 2000
RPO Alerts: Yes
Max Concurrent Jobs: 16
Bandwidth Reservation Reserve Percentage: 1
Bandwidth Reservation Reserve Absolute: -
Encryption Required: No
Cluster Certificate ID:
OCSP Issuer Certificate ID:
OCSP Address:
Encryption Cipher List:
Renegotiation Period: 8H
Service History Max Age: 1Y
Service History Max Count: 2000
Use Workers Per Node: No