DataONTAP powershell cannot connect to a cluster

[BenCoughtry]

Hi all, I'm having trouble connecting to 1 CDOT cluster but can connect to others from same server with matching hardware and OnTap versions. Below is what I've checked already.  I CAN reach onbox system manager OK as well as SSH to the cluster mgmt LIF, but powershell connections and thus WFA connections fail.  Details:

Error:

PS C:\Windows\system32> Connect-NcController san2001c-cluster.eci.cloud -Credential admin
Connect-NcController : Object reference not set to an instance of an object.
At line:1 char:1
+ Connect-NcController san2001c-cluster.eci.cloud -Credential admin
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidResult: (san2001c-cluster.eci.cloud:NcController) [Connect-NcController], NullRef
erenceException
+ FullyQualifiedErrorId : HttpConnectionFailed,DataONTAP.C.PowerShell.SDK.ConnectNcController

PS C:\Windows\system32> Connect-NcController san2001c-cluster.eci.cloud -Credential admin -https
Connect-NcController : API invoke failed.
At line:1 char:1
+ Connect-NcController san2001c-cluster.eci.cloud -Credential admin -https
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidResult: (san2001c-cluster.eci.cloud:NcController) [Connect-NcController], NaExcep
tion
+ FullyQualifiedErrorId : HttpConnectionFailed,DataONTAP.C.PowerShell.SDK.ConnectNcController

Things I've tried:

• Connect to another cluster also running ontap 9.1from same powershell server -> connect OK
• Connect to affected cluster using systemscope credentials -> same error as above on affected cluster but OK on other 9.1 clusters
• Compared configuration of the following match for both affected cluster and working cluster (both clusters run ontap 9.1:
  
  • vserver services web show
  • web access show
  • security ssh show
  • security ssl show
  • firewall policy show
  • security certificate show
• There are NO firewalls between the powershell server and affected cluster
• I've tried powershell connections from other Windows servers running different Windows OS, powershell and DataONTAP plugin versions -> same error

Other information:

-DataONTAP plugin version 4.1.0

-Powershell version 4.0

-.NET v 3.5 and 4.5 feature are installed

Any suggestions would be appreciated.  Thanks!

[JGPSHNTAP]

^^

The connection needs API access to the cluster

security login show  

You need to have API access

Also, i've seen those really wierd errors once in a while

[BenCoughtry]

Do I not already have this?

san2001c-cluster::*> sec login show
(security login show)

Vserver: san2001c-cluster
Authentication Acct Is-Nsswitch
User/Group Name Application Method Role Name Locked Group
---------------- ----------- --------- ---------------- ------ -----------
admin console password admin no no
admin http password admin no no
admin ontapi password admin no no
admin service-processor password admin no no

admin ssh password admin no no

[JGPSHNTAP]

Yes, looks good.

And you are connecting to the other cluster successfully from the same computer?

[BenCoughtry]

Correct 🙂  Just this 1 cluster is problematic, others work just fine and are running same OnTap versions, and apparently same configuration, as far as I can tell.

[BenCoughtry · Accepted solution]

Support had me changed "system services web modify -http-enabled true" even though other working clusters had that set to false, and that fixed the issue.  Confirmed self-signed certificates are still valid so unclear why this fixed it but powershell login works OK now.