Solved: 7MTT CIFS precheck always fails (error 343)

thokelly · ‎2017-09-12

Hello,

the error message is:

"The HTTP port of the 7-Mode Transition Tool server is blocked by the firewall or HTTP port is not opened for target SVM data LIFs.

Therefore, 7-Mode Transition Tool cannot transition 7-Mode local users and groups configurations to the following SVMs."

but all windows firewall ports are open. Even disabled the firewall completely.

Changed the 7MTT http port to 8089 and https port to 8444 because "On Command " is running also on this server.

Even when I stop all DFM services the error occurs.

transition tool conf:

...

################################################################################
# 7-Mode Transition tool server HTTP/HTTPS configurations #
################################################################################

# HTTP inbound port number of server.
# Default value is 8088
tool.http.port = 8089

# HTTPS inbound port number of server.
# Default value is 8443
tool.https.port = 8444

...

Any ideas?

thokelly · ‎2017-09-14

Hi matt,

disabling TCP offload did not work.

We decided to exclude "CIFS local users and groups" from migration to SVMs, since local users are only administrators.

The PreChecks then runs OK (if you ignore the Snaplock Prechecks...).

Starting baseline then brings another error ("snapmirror subsystem not ready"), but this will be a new thread...

Thanky for your help so far.

/Tom

View solution in original post

mbeattie · ‎2017-09-13

Hi,

There is a related KB on this:

https://kb.netapp.com/support/s/article/ka31A000000112KQAQ/7mtt-how-to-resolve-a-firewall-issue-when-transitioning-cifs-local-users-and-group-configur...

When you say you've disabled the firewall is that off for all profiles?

C:\>netsh advfirewall show allprofiles | find /i "Settings"
Domain Profile Settings:
Private Profile Settings:
Public Profile Settings:

C:\>netsh advfirewall show allprofiles | find /i "State"
State                                 OFF
State                                 OFF
State                                 OFF

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

mbeattie · ‎2017-09-13

Hi,

What's the firewall policies for the vservers data LIFS?

cluster1::> network interface show -vserver vserver1 -fields firewall-policy, role
vserver  lif                role firewall-policy
-------- ------------------ ---- ---------------
vserver1 vserver1_cifs_lif1 data 7mtt_migration
vserver1 vserver1_mgmt_lif1 data mgmt
2 entries were displayed.

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly · ‎2017-09-13

Hi,

the firewall policy for the LIFs is "mgmt", and "mgmt" is

        mgmt
                     dns        0.0.0.0/0
                     http       0.0.0.0/0
                     https      0.0.0.0/0
                     ndmp       0.0.0.0/0
                     ndmps      0.0.0.0/0
                     ntp        0.0.0.0/0
                     snmp       0.0.0.0/0
                     ssh        0.0.0.0/0

but anyway firewalls are disabled

cluster::> firewall show
(system services firewall show)
Node           Enabled Logging
-------------- ------- -------
node-01    false   false
node-02        false   false

thokelly · ‎2017-09-13

Hi,

yes, it was 'off' for all profiles.

mbeattie · ‎2017-09-13

Hi,

I had a look for 7MTT error 343...another KB referencing firewalls:

https://kb.netapp.com/support/s/article/ka11A0000001BqRQAU/7mtt-error-code-343-reason-network-error-occurred-timeout-was-reached-connect-timed-out

But this one refers settings for the network adapter on the host that 7MTT is installed on:

https://kb.netapp.com/support/s/article/ka11A0000001L5uQAE/internal-migration-issues-with-7mtt

Can you post any additional logs?

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly · ‎2017-09-13

Hi Matt,

this is a dead link

https://kb.netapp.com/support/s/article/ka11A0000001L5uQAE/internal-migration-issues-with-7mtt

"KB article Not found. Please check the URL or KB number and try again. "

/Tom

mbeattie · ‎2017-09-14

Hi Tom

Heres the external link: https://kb.netapp.com/support/s/article/ka11A0000001L5u/internal-migration-issues-with-7mtt

Just incase you still can't access it the KB references error 343 as:

Cause: Network checksum errors

Solution: Perform the following actions on the host using 7MTT:

Right-click Computer and click Manage.
Open Device manager.
Click Device Manager.
Expand Network adapters.
Right-click your network adapter.
Click Properties.
Click the Advanced tab.
Locate and select IP Checksum Offload. Change the value on the right to Disabled.
Locate TCP Checksum offload (IPvX).
Set the value on the right to Disabled.

I can't be certain this is the issue in your environment but it's one process to eliminate in troubleshooting the issue.

If the error persists can you please post the logs. Thanks

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly · ‎2017-09-14

Hi matt,

disabling TCP offload did not work.

We decided to exclude "CIFS local users and groups" from migration to SVMs, since local users are only administrators.

The PreChecks then runs OK (if you ignore the Snaplock Prechecks...).

Starting baseline then brings another error ("snapmirror subsystem not ready"), but this will be a new thread...

Thanky for your help so far.

/Tom

bharatja · ‎2018-08-08

Hi Matt,

We are using 7MTT version 3.3 and we have the same problem. I have gone through the troubleshooting steps which you have mentioned here but still issue wasn't resolved. So could you please help us here.

mbeattie · ‎2018-08-08

Hi,

Have you reviewed this KB or do you have an open case?

https://kb.netapp.com/app/answers/answer_view/a_id/1017981

"Create a rule in the Windows firewall to allow incoming connections for any protocol on port 8088"

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

bharatja · ‎2018-08-08

Hi Matt,

firewall policy is diabled on my 7MTT server. I have logged a case with support and waiting for the resolution.

Regards,

Bharat

ousturali · ‎2020-05-17

Hi to all

it is a little bit late, but i was dealing with the same error for a long time ,with 7mtt 3.3.2 version

But strangely, your advice helped me

Thanks a lot,

franky4u · ‎2020-06-30

I had the same issue and did a lot of troublshooting. The solution is to open in the Firewall Port http (8088) not for data LIfs, but for Management LIFs. So open e0M from node1 and node2

Emile-Bodin · ‎2017-09-13

Collect the log bundle from 7-MTT, in the log bundle you will have your projects and the folder "PRECHECK". Check the log files in there and look for the error entry this will tell you more in WHY it fails.

Im my experiance, in most cases it is related to still running "import" jobs on the destination cluster which prevents the precheck from completing.

Anyway, if you need a analysis open a CASE so tech support can go over the 7-mtt log bundle.

- Emile