ONTAP Discussions

7MTT CIFS precheck always fails (error 343)

thokelly
11,223 Views

Hello,

 

the error message is:

"The HTTP port of the 7-Mode Transition Tool server is blocked by the firewall or HTTP port is not opened for target SVM data LIFs.

Therefore, 7-Mode Transition Tool cannot transition 7-Mode local users and groups configurations to the following SVMs."

 

but all windows firewall ports are open. Even disabled the firewall completely.

 

Changed the 7MTT http port to 8089 and https port to 8444 because "On Command " is running also on this server.

Even when I stop all DFM services the error occurs.

 

 

transition tool conf:

...

################################################################################
#             7-Mode Transition tool server HTTP/HTTPS configurations          #
################################################################################

# HTTP inbound port number of server.
# Default value is 8088
tool.http.port = 8089

# HTTPS inbound port number of server.
# Default value is 8443
tool.https.port = 8444

...

 

 

Any ideas?

 

 

1 ACCEPTED SOLUTION

thokelly
10,941 Views

Hi matt,

 

 

disabling TCP offload did not work.

 

We decided to exclude "CIFS local users and groups" from migration to SVMs, since local users are only administrators.

The PreChecks then runs OK (if you ignore the Snaplock Prechecks...).

 

Starting baseline then brings another error ("snapmirror subsystem not ready"), but this will be a new thread...

 

 

Thanky for your help so far.

 

/Tom

 

View solution in original post

14 REPLIES 14

mbeattie
11,144 Views

Hi,

 

There is a related KB on this:

 

https://kb.netapp.com/support/s/article/ka31A000000112KQAQ/7mtt-how-to-resolve-a-firewall-issue-when-transitioning-cifs-local-users-and-group-configur...

 

When you say you've disabled the firewall is that off for all profiles?

 

 

C:\>netsh advfirewall show allprofiles | find /i "Settings"
Domain Profile Settings:
Private Profile Settings:
Public Profile Settings:

C:\>netsh advfirewall show allprofiles | find /i "State"
State                                 OFF
State                                 OFF
State                                 OFF

 

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

mbeattie
11,136 Views

Hi,

 

What's the firewall policies for the vservers data LIFS?

 

cluster1::> network interface show -vserver vserver1 -fields firewall-policy, role
vserver  lif                role firewall-policy
-------- ------------------ ---- ---------------
vserver1 vserver1_cifs_lif1 data 7mtt_migration
vserver1 vserver1_mgmt_lif1 data mgmt
2 entries were displayed.

 

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly
11,121 Views

Hi,

 

the firewall policy for the LIFs is "mgmt", and "mgmt" is

 

        mgmt
                     dns        0.0.0.0/0
                     http       0.0.0.0/0
                     https      0.0.0.0/0
                     ndmp       0.0.0.0/0
                     ndmps      0.0.0.0/0
                     ntp        0.0.0.0/0
                     snmp       0.0.0.0/0
                     ssh        0.0.0.0/0

 

 

but anyway firewalls are disabled

 

cluster::> firewall show
  (system services firewall show)
Node           Enabled Logging
-------------- ------- -------
node-01        false   false
node-02        false   false

 

 

 

thokelly
11,120 Views

Hi,

 

yes, it was 'off' for all profiles.

 

 

mbeattie
11,097 Views

Hi,

 

I had a look for 7MTT error 343...another KB referencing firewalls:

 

https://kb.netapp.com/support/s/article/ka11A0000001BqRQAU/7mtt-error-code-343-reason-network-error-occurred-timeout-was-reached-connect-timed-out

 

But this one refers settings for the network adapter on the host that 7MTT is installed on:

 

https://kb.netapp.com/support/s/article/ka11A0000001L5uQAE/internal-migration-issues-with-7mtt

 

Can you post any additional logs?

 

/Matt

 

 

 

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly
10,940 Views

Hi Matt,

 

this is a dead link

 

https://kb.netapp.com/support/s/article/ka11A0000001L5uQAE/internal-migration-issues-with-7mtt

 

"KB article Not found. Please check the URL or KB number and try again. "

 

 

/Tom

 

mbeattie
10,924 Views

Hi Tom

 

Heres the external link: https://kb.netapp.com/support/s/article/ka11A0000001L5u/internal-migration-issues-with-7mtt

Just incase you still can't access it the KB references error 343 as:

 

Cause: Network checksum errors


Solution: Perform the following actions on the host using 7MTT:

 

  • Right-click Computer and click Manage.
  • Open Device manager.
  • Click Device Manager.
  • Expand Network adapters.
  • Right-click your network adapter.
  • Click Properties.
  • Click the Advanced tab.
  • Locate and select IP Checksum Offload. Change the value on the right to Disabled.
  • Locate TCP Checksum offload (IPvX).
  • Set the value on the right to Disabled.

I can't be certain this is the issue in your environment but it's one process to eliminate in troubleshooting the issue.

If the error persists can you please post the logs. Thanks

 

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

thokelly
10,942 Views

Hi matt,

 

 

disabling TCP offload did not work.

 

We decided to exclude "CIFS local users and groups" from migration to SVMs, since local users are only administrators.

The PreChecks then runs OK (if you ignore the Snaplock Prechecks...).

 

Starting baseline then brings another error ("snapmirror subsystem not ready"), but this will be a new thread...

 

 

Thanky for your help so far.

 

/Tom

 

bharatja
9,126 Views

Hi Matt,

 

We are using 7MTT version 3.3 and we have the same problem. I have gone through the troubleshooting steps which you have mentioned here but still issue wasn't resolved. So could you please help us here.

 

 

mbeattie
9,118 Views

Hi,

 

Have you reviewed this KB or do you have an open case?

 

https://kb.netapp.com/app/answers/answer_view/a_id/1017981

 

"Create a rule in the Windows firewall to allow incoming connections for any protocol on port 8088"

 

/Matt

If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.

bharatja
9,114 Views

Hi Matt,

 

firewall policy is diabled on my 7MTT server.  I have logged a case with support and waiting for the resolution.

 

 

Regards,

Bharat

ousturali
8,709 Views

Hi to all

 

it is a little bit late, but i was dealing with the same error for a long time ,with 7mtt 3.3.2 version

 

But strangely, your advice helped me

 

Thanks a lot,

 

 

franky4u
8,324 Views

I had the same issue and did a lot of troublshooting. The solution is to open in the Firewall Port http (8088) not for data LIfs, but for Management LIFs. So open e0M from node1 and node2

Emile-Bodin
11,042 Views

Collect the log bundle from 7-MTT, in the log bundle you will have your projects and the folder "PRECHECK". Check the log files in there and look for the error entry this will tell you more in WHY it fails.

 

Im my experiance, in most cases it is related to still running "import" jobs on the destination cluster which prevents the precheck from completing.

 

Anyway, if you need a analysis open a CASE so tech support can go over the 7-mtt log bundle.

 

- Emile

Public