PowerVault ME5: Alert - SupportAssist is not yet authenticated with the Dell backend

PowerVault administrators may see the following Health Alert displayed in PowerVault Manager or when using the command-line interface (CLI) command: show alerts
 

Description: SupportAssist is not yet authenticated with the Dell backend. 

Recommended Action: - Run SupportAssist authentication with a new access key and associated PIN.

Administrators may also observe the following event in Event History: Event 362 Scheduler: SupportAssist is not registered with the Dell backend. Check alerts for guidance. (task: CHKeepAlive, task type: CHKeepAlive)

# show events 
2023-01-14 12:21:02 [362]  #A265:  ME5012 Array SN#00XXXXXXXXXX Controller A INFORMATIONAL Scheduler: SupportAssist is not registered with the Dell backend. Check alerts for guidance. (task: CHKeepAlive, task type: CHKeepAlive)

To resolve this message either complete the registration to enable SupportAssist using an access key and PIN or disable SupportAssist. Dell Technologies recommends enabling SupportAssist.
 

• Overview of the steps to configure SupportAssist and use Dells CloudIQ service 
• Firewall configuration
• Enabling SupportAssist using PowerVault Manager to use a direct connection  
• Enabling SupportAssist using PowerVault CLI to use a direct connection
• How to disable SupportAssist 
• Contacting Dell technical support for assistance

Overview of the steps to configure SupportAssist and use Dells CloudIQ service.

1. Register an enterprise support business account for your company. Your company must be the owner of the PowerVault ME5 asset. See How to Register for Access to Dell Technologies Online Support or Upgrade an Existing Account. A Dell support business account is required to use the Dell CloudIQ service.
 

2. PowerVault ME5 systems shipped by Dell from April 02,2023 do not need to take this step, the access key is now factory enabled. However, if your PowerVault ME5 system shipped prior to April 2023 you must log in to dell.com/support. Use your support business account and generate an access key and PIN using the PowerVault ME5 service tag. The access key and PIN is only used to enable connectivity one time. See PowerVault ME5: How to generate an Access Key and Pin to enable SupportAssist

3. SupportAssist can be configured to send telemetry data via a direct connection, or it can integrate with Dell Secure Connect Gateway - Virtual Edition (SCG/VE). Follow the instructions further down to configure a direct connection. If your organisation uses Secure Connect Gateway - Virtual Edition follow the instructions outlined in PowerVault ME5: How to configure SupportAssist to Connect via Gateway Server

4. Once SupportAssist is enabled and sending telemetry data, wait a few hours, log in to https://cloudiq.dell.com using your support business account and onboard the PowerVault ME5. See CloudIQ: General procedures to onboard PowerVault ME Series arrays to CloudIQ

 

Firewall configuration

Firewall requirements

• A direct connection opens am outgoing secure connection (TLS) on port 443 to the listed Dell endpoints. 
• The PowerVault ME5 must be configured to use a DNS server.

Protocol	Port	Endpoint
TCP	443	esrs3-core.emc.com
		esrs3-coredr.emc.com

Note: A gateway connection opens a secure connection (TLS) to a Secure Connect Gateway (SCG/VE) appliance management address on port 9443. 
 

Warning about using SSL decryption

To ensure connection integrity, proxy servers and devices external to your demilitarized zone (DMZ) must not perform any method of SSL decryption on outbound or inbound traffic for the Dell secure remote servers.
SSL decryption that is performed on outbound communication causes a loss of connectivity to the backend. SSL decryption includes decryption by your firewall, proxies, web traffic filtering appliances or cloud services, web traffic shaping or load balancing, certificate verification, certificate proxy, or Intrusion Detection Services (IDS). In case the SSL decryption is enabled on the proxy servers and other devices, ensure that esrs3-core.emc.com and esrs3-coredr.emc.com are added to the SSL decryption exclusion list on the proxy servers and devices.

 

Enabling SupportAssist using PowerVault Manager to use a direct connection 

1. Ensure that the controller management ports are configured and connected to the management LAN. In PowerVault manager, go to the Network panel (Settings > Network) to configure IPv4 network-port settings. The management network IPs used must be configured on an IP subnet that can reach the company proxy server or Internet gateway.

2. Both controller modules must be configured to resolve DNS names. In PowerVault manager, go to the Network panel (Settings > Network) to configure DNS servers and local search domain. 

3. On systems shipped prior to April 2023, log in to dell.com/support and generate an access key and PIN using the PowerVault ME5 enclosure 0 service tag. See PowerVault ME5: How to generate an Access Key and Pin to enable SupportAssist. If you encounter problems generating an access key contact Dell technical support for assistance.

4. If you did not enable SupportAssist during the guided setup, you can enable it from the Maintenance > Support panel in PowerVault Manager.

Steps

1. Go to Maintenance > Support.
2. Select the Enable SupportAssist check box and Enable CloudIQ if you want to use the service.
   The SupportAssist agreement is displayed.
3. Read through the agreement, then acknowledge it by selecting I accept this agreement and clicking ACCEPT AND CONTINUE.
4. In the Connection Information panel, select your connectivity options:
   • Connection Type Select whether to connect directly or through a gateway.
   • Proxy Details. If applicable, select Use a Proxy Server and then enter the server settings.
   • Access key and PIN. Systems that ship since April 2023, skip this step. Otherwise enter the information requested. If you do not have the access key or PIN, click on request a new Access Key, and PIN and follow the prompts to have new key information emailed to you.    
5. Click Test and Enable Connectivity.
   Test results are displayed, you can either go back and re-enter information, or click Continue to proceed.
6. In the Contact Information panel, enter the primary contact information and select the preferred contact settings. You can also enter information for a secondary contact
7. Click Apply changes, and click OK on the confirmation prompt.

5. Wait an hour after first enabling SupportAssist to use the CloudIQ service. For more information see CloudIQ: General procedures to onboard PowerVault ME Series arrays to CloudIQ

 

Enabling SupportAssist using PowerVault CLI to use a direct connection

• Before you begin generate the access key and PIN using the enclosure 0 service tag from your ME5. For guidance see PowerVault ME5: How to generate an Access Key and Pin to enable SupportAssist
• The controller modules management ports must be configured and connected to the management LAN.
• The controller modules must be configured to use DNS servers.
• Using a terminal application such as PuTTY open an SSH session to the management interface of either controller module. 
• Use the following commands substituting the correct values for the access key and PIN:

# set support-assist enabled 
To use SupportAssist you must run "show support-assist eula" and read the EULA.
Do you accept the EULA? (y/n) y

# set support-assist-authentication access-key <ABCD1234> pin <1234>

• A successful direct connection network connection test looks like this. There is a successful connection to at least one endpoint. 

# check support-assist-connection mode direct
SupportAssist Connection
------------------------
Connection State: Connected

  Endpoint
  --------
  Mode: direct
  Endpoint: https://esrs3-core.emc.com
  Status: success
  HTTP Status: 200
  Message: OK
  Status Detail: Success
  Proxy Type: none

  Endpoint
  --------
  Mode: direct
  Endpoint: https://esrs3-coredr.emc.com
  Status: success
  HTTP Status: 200
  Message: OK
  Status Detail: Success
  Proxy Type: none


Success: Command completed successfully. 

For troubleshooting guidance see PowerVault ME5: How to use CLI to troubleshoot SupportAssist connectivity

 

How to disable SupportAssist 

1. In PowerVault Manager, navigate to Maintenance > Support.

2. On the SupportAssist tab, select or clear the Enable SupportAssist checkbox.

3. Click Apply Changes, and click OK at the confirmation prompt.


 

Contacting Dell technical support for assistance.

If you require assistance from Dell technical support to resolve getting SupportAssist, or CloudIQ enabled.
 
1. Gather the support bundle from the PowerVault ME5. See PowerVault ME5: How to collect PowerVault support logs

2. If possible, save the text output from the SSH session showing the CLI output. See PowerVault ME5: How to use CLI to troubleshoot SupportAssist connectivity

3. Contact Dell technical support.