Skip to main content
NetApp Knowledge Base

Cannot Enable AES Encryption With Error KRB5 KDC UNREACH in ONTAP 9

  1. Last updated
  2. Save as PDF
Views:
58
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:

Applies to

  • ONTAP 9
  • CIFS/SMB
  • Kerberos
  • AES Encryption

Issue

  • When trying to enable AES Encryption for the vserver, the process fails with error KDC unreachable:
    • ::> vserver cifs security modify -vserver svm01 -advertised-enc-types
      aes-128,aes-256
      Info: In order to disable CIFS AES encryption, the password for the CIFS server
      machine account must be reset. Enter the
      username and password for the CIFS domain "DOMAIN.LOCAL".
      Enter your user ID: administrator
      Enter your password:
      Error: command failed: Password update failed. Reason: Kerberos Error: KDC
      unreachable.
  • SECD logs show failures in communication through port 464 with error (KRB5_KDC_UNREACH):
    • ERROR secd.unexpectedFailure: Unexpected SecD failure in Vserver "svm01".
      Details: Error: CIFS server password change procedure failed
      [ 21 ms] Successfully connected to ip 172.11.111.11w, port 389 using TCP
      [ 38] Successfully connected to ip 172.11.111.11w, port 88 using TCP
      [ 2047] TCP connection to ip 172.11.111.11w, port 464 failed: Operation timed
      out.
      [ 4050] TCP connection to ip 172.11.111.11x, port 464 failed: Operation timed
      out.
      [ 6506] TCP connection to ip 172.11.111.11y, port 464 failed: Operation timed
      out.
      [ 8003] TCP connection to ip 172.11.111.11z, port 464 failed: Operation timed
      out.
      [14084] FAILURE: Kerberos password change for 'SVM01$@DOMAIN.LOCAL.COM' failed
      with Cannot contact any KDC for requested realm (KRB5_KDC_UNREACH)
      [14084] Retry requested, but the retry window (7000 ms) has expired; giving up.

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.