Cannot register client - Registration operation failed

It looks like related to the certificate issue. Please enable the debug of avagent and run registration again. Then we will see what caused failure in the debugged log.

--Beta

Even though you have RETIRED the server, it is still up and running, and so is the Avamar program on the server.

I get this a lot.

Because Avamar is still running the client is trying to talk to the Avamar master node.

Simply power off the server, or un-install Avamar from it so it will quit talking.

Tips on this

if you look at the daily phone home report you might see

Warn Client Reconnect Error - Hostname mismatch

you can log into the utility node and run the command

grep errno=\"101\" /usr/local/avamar/var/mc/server_log/mcserver.log.#  (where # is 0 or 1 - look in the dir for the files you would want to check)

this will give you a list of servers trying to connect that are NOT registered.

I then verify that I should not be backing them up (they are normally retired servers)  and in un-install Avamar and the errors go away.

Some times it is because they cloned a server that had Avamar installed, and the new one has not been registered yet.

Thank you both for the replies.

It seems that Avamar 7.3 client needs more TCP ports available in order to communicate with the avamar server.

I removed the client completely from the avamar server, opened the required ports and i was able to register the client.

Hi lothargr,

What are the additional required ports as we have opened all the ports from the product security guide. Are there any which are not documented?

We are facing the same issue at another customer site and are unable to register and clients. Please help us with this issue.

Thanks

Kamal

Dear Kamalt,

From my experience the required ports are the following:

TCP 28001, 30001, 30003

This time i have a problem with a different client registration and although i have opened the required ports i get the following messages:

2017-09-06 14:41:53 avagent Info <5702>: Command Line: /usr/local/avamarclient/bin/avagent.bin --quiet --init --daemon=false --listenport=28009 --bindir="/usr/local/avamarclient/bin" --vardir="/usr/local/avamarclient/var" --sysdir="/usr/local/avamarclient/etc" --logfile="/usr/local/avamarclient/var/avagent.log" --logtimeformat=default --logtimezone=default --mcsaddr="10.51.248.244" --listenport=28009 --dpndomain="clients"

2017-09-06 14:41:53 avagent Info <5703>: Parsed Flags: /usr/local/avamarclient/bin/avagent.bin --quiet --initialize --service=false --acport=28009 --bindir=/usr/local/avamarclient/bin --vardir=/usr/local/avamarclient/var --sysdir=/usr/local/avamarclient/etc --logfile=/usr/local/avamarclient/var/avagent.log --logtimeformat=default --logtimezone=default --mcsaddr=10.51.248.244 --acport=28009 --dpndomain=clients

2017-09-06 14:41:53 avagent Info <42249>: Checking for stale certificate lock

2017-09-06 14:41:53 avagent Info <18918>: Registration: Processing secure registration with the MCS.

2017-09-06 14:41:53 avagent Info <18921>: Registration: Requesting root CA from the MCS.

2017-09-06 14:41:53 avagent Info <18926>: Registration: Saving root CA.

2017-09-06 14:41:53 avagent Info <18928>: Registration: Creating certificate signing request.

2017-09-06 14:41:54 avagent Info <18930>: Registration: Sending the certificate signing request to the MCS.

2017-09-06 14:41:54 avagent Error <41041>: Certificate could not be verified.

2017-09-06 14:41:54 avagent Error <5365>: Cannot connect to 10.51.248.244:30003.

2017-09-06 14:41:54 avagent Info <5059>: unable to connect, sleep(10) then retrying

2017-09-06 14:42:04 avagent Error <41041>: Certificate could not be verified.

2017-09-06 14:42:04 avagent Error <5365>: Cannot connect to 10.51.248.244:30003.

2017-09-06 14:42:04 avagent Info <5059>: unable to connect, sleep(10) then retrying

2017-09-06 14:42:14 avagent Error <41041>: Certificate could not be verified.

2017-09-06 14:42:14 avagent Error <5365>: Cannot connect to 10.51.248.244:30003.

2017-09-06 14:42:14 avagent Error <18931>: Registration: Unable to send the certificate signing request to the MC.

2017-09-06 14:42:14 avagent Info <18936>: Unable to securely register with the MCS (10.51.248.244)

2017-09-06 14:42:14 avagent Error <7530>: Unable to register, no response from Administrator 10.51.248.244:28001

Communication through ports 28001, 30001 and 30003 is tested and works ok.

Any Ideas??

After enabling debug logging, the issue seems to be related to the avamar server certificate.

The server is behind NAT.

2017/09/07-12:52:04.08095 [avagent]  sslcertificate::verify_certificate_ip CN Name='Avamar Server RSA TLS'

2017/09/07-12:52:04.08096 [avagent]  sslcertificate::verify_cnname Performing CN Name validation for Avamar Server RSA TLS

2017/09/07-12:52:04.08267 [avagent]  sslcertificate::verify_certificate_ip CN Name='XXXXXXXXXXXXXXXX'

2017/09/07-12:52:04.08269 [avagent]  sslcertificate::verify_cnname Performing CN Name validation for avmserver02.lhbronet.local

2017/09/07-12:52:04.08378 [avagent]  sslcertificate::verify_certificate_ip CN Name field did not match Hostname - Checking SA Names

2017/09/07-12:52:04.08380 [avagent]  sslcertificate::verify_certificate_ip rawIPAddrLen = 4

2017/09/07-12:52:04.08381 [avagent]  sslcertificate::verify_certificate_ip Comparing 172.16.40.11 with 10.51.248.244

2017-09-07 15:52:04 avagent Error <41041>: Certificate could not be verified.

Is there any workaround?

* I have already added a NAT entry using the nodedb command..

https://emcservice--c.na55.visual.force.com/apex/KB_BreakFix_clone?id=kA2j0000000RGcr

It is related to a new feature -- Session Security Feature - which comes with v7.3. The above KB is to disable it. Then you should be able to register the client. If you cannot access it, please contact EMC support.

Dear Zhou,

thank you for your reply but the link does not seem to work, can you please check it or tell me the KB article number?

Hello,

I had the same issue and this helped me.

https://emcservice.force.com/CustomersPartners/kA2j0000000kB3pCAE

Thank you very much Zhou..

Can't see any resolution notes