Skip to main content
NetApp Knowledge Base

Troubleshooting: Cloud Volumes ONTAP HA: Mediator Security Group

  1. Last updated
  2. Save as PDF
Views:
1,158
Visibility:
Public
Votes:
0
Category:
netapp_console
Specialty:
ds_cvo
Last Updated:

Applies to

HA Cloud Volumes ONTAP

Issue

  • Security Group issues: A common problem in mediator issues is when customer modifies Security Groups (SG), which are created by default in AWS by OnCommand Cloud Manager.
  • When adding external route table, following error occurs:

An error occurred while saving route tables: Failed to create external route table "rtb-6dfa8106".
The system encountered a timeout waiting for the mediator to complete the operation

  1. Check mediator status first in AWS console and OCCM.

The mediator status is up in OCCM:

Cloud Volumes ONTAP HA: Mediator Security Group

  1. Check statusf or mailbox disks of mediator. In following example, it is up/up.

mynodename::> set -privilege advanced
mynodename::*> storage iscsi-initiator show
                                                                    Status
Node Type Label    Target Portal      Target Name                      Admin/Op
---- ---- -------- ------------------ -------------------------------- --------
mynodename-01
  mailbox
       mediator 172.30.0.50        iqn.2012-05.local:mailbox.target.R6cXd
                                                                      up/up
  partner
       partner  172.30.4.19:65200  iqn.2012-06.com.bsdctl:target0     up/up
mynodename-02
  mailbox
       mediator 172.30.0.50        iqn.2012-05.local:mailbox.target.R6cXd
                                                                      up/up
  partner
       partner  172.30.14.225:65200
                                   iqn.2012-06.com.bsdctl:target0     up/up
4 entries were displayed.

Cause

  • The timeout is indicative that mediator's internal HTTP API cannot be reached from Cloud Volumes ONTAP node(s)
  • OCCM mediator status of up indicates mediator is up and OCCM can communicate with the mediator via its external API (port 3000)
  • Mailbox status of up/up indicates ONTAP can communicate with the iSCSI target on the mediator via the internal iSCSI port (3260)
ONTAP normally communicates with mediator internal API using port 3080.

Solution

Corrective Action

  • Default internal mediator security group allows communication on all ports between ONTAP nodes and mediator
  • If a custom internal security group is used, ports 3080 and 3260 should be open for incoming traffic to mediator

Note: For external security group: communication between OCCM and the mediator and the mediator to the AWS endpoint(s), port 3000 should be open for incoming traffic to the mediator. Port 22 and ICMP protocol can be opened for troubleshooting via ssh and ping.

Additional Information

additionalInformation_text

Internal Notes

internalNotes_text

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.