Cisco WAAS Troubleshooting Guide for Release 4.1.3 and Later -- Troubleshooting the MAPI AO - Revision history

Mkorenba at 02:02, 24 April 2013

2013-04-24T02:02:58Z

← Older revision		Revision as of 02:02, 24 April 2013
Line 579:		Line 579:
	=== Common Problems ===		=== Common Problems ===

-	~~'''Three well known~~ reasons ~~the Core fails key retrieval during Outlook client connection,~~ which results in eMAPI connection Hand-off to Generic AO (TG).~~'''~~	+	Below are some common reasons which results in eMAPI connection Hand-off to Generic AO (TG).

	<br>		<br>
Line 604:		Line 604:
	<br>		<br>

-	==== Problem 2: There is a time skew between the Core WAE and the KDC it attempts to retrieve the key from<br> ====	+	==== Problem 2: There is a time skew between the Core WAE and the KDC it attempts to retrieve the key from<br> ====

	'''Output from sr-errolog on Core WAE'''<br>		'''Output from sr-errolog on Core WAE'''<br>
Line 624:		Line 624:
	[SRKeyRetriever.cpp:267]'''		[SRKeyRetriever.cpp:267]'''
	10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]		10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]
-	</pre>	+	</pre>
-		+
	==== <br> Resolution 2: Use ntpdate on all WAEs (especially the Core) to sync the clock with the KDC. Then point to the enterprise NTP server (prefereably the same as the KDC). ====		==== <br> Resolution 2: Use ntpdate on all WAEs (especially the Core) to sync the clock with the KDC. Then point to the enterprise NTP server (prefereably the same as the KDC). ====

Line 640:		Line 639:


-	</pre>	+	</pre>
-		+
	==== <br> Resolution 3: If your Core WAE services multiple Exchange servers in different domains you must configure an Encryption service Identity for each domain the Exchange servers reside in. ====		==== <br> Resolution 3: If your Core WAE services multiple Exchange servers in different domains you must configure an Encryption service Identity for each domain the Exchange servers reside in. ====

Line 648:		Line 646:
	<br>		<br>

-	==== Problem: If WANSecure fails your connections can drop to TG  ====	+	==== Problem 4: If WANSecure fails your connections can drop to TG  ====

	eMAPI connections can be handed over to Generic AO because WAN secure plumb failed. WAN Secure plumb failed because cert verify failed. Peer cert verify will failed because the default self-signed peer cert is being used or the cert has legitimately failed OCSP check.		eMAPI connections can be handed over to Generic AO because WAN secure plumb failed. WAN Secure plumb failed because cert verify failed. Peer cert verify will failed because the default self-signed peer cert is being used or the cert has legitimately failed OCSP check.
Line 701:		Line 699:
	10/08/2012 20:04:34.430(Local)(5939 4.0) ERRO (430055) openssl errors: error:14090086: SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1244:		10/08/2012 20:04:34.430(Local)(5939 4.0) ERRO (430055) openssl errors: error:14090086: SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1244:
	[open_ssl.cpp:1220]</pre>		[open_ssl.cpp:1220]</pre>
-	==== Resolution: Remove peer cert verify configuration from both WAEs and restart the encrytpion service on the Core WAE(s). ====	+	==== Resolution 4: Remove peer cert verify configuration from both WAEs and restart the encrytpion service on the Core WAE(s). ====
	<pre>pdi-7541-dc(config)#crypto ssl services host-service peering		<pre>pdi-7541-dc(config)#crypto ssl services host-service peering

Line 709:		Line 707:

	pdi-7541-dc(config)#windows-domain encryption-service enable</pre>		pdi-7541-dc(config)#windows-domain encryption-service enable</pre>
-	==== <br>Problem: If NTLM is used by the Outlook client the connection will be pushed down to Generic AO. ====	+	==== <br>Problem 5: If NTLM is used by the Outlook client the connection will be pushed down to Generic AO. ====

	<br>You will see the following in the mapiao-errorlog on the client side WAE:		<br>You will see the following in the mapiao-errorlog on the client side WAE:
Line 721:		Line 719:
	<br>		<br>

-	==== Resolution: The customer must enable / require Kerberos authentication in their Exchange environment. NTLM is NOT supported (as of 5.1) ====	+	==== Resolution 5: The customer must enable / require Kerberos authentication in their Exchange environment. NTLM is NOT supported (as of 5.1) ====

	Be aware there is a Microsoft tech brief that calls out a fall back to NTLM when a CAS is used.		Be aware there is a Microsoft tech brief that calls out a fall back to NTLM when a CAS is used.
Line 733:		Line 731:
	In Exchange 2010 RTM, there is no fix for this! Kerberos in the above scenario will never function pre-Exchange 2010-SP1.		In Exchange 2010 RTM, there is no fix for this! Kerberos in the above scenario will never function pre-Exchange 2010-SP1.

-	In SP1, Kerberos can be enabled in these environments, but it's a manual process. See the article here: http://technet.microsoft.com/en-us/library/ff808313.aspx	+	In SP1, Kerberos can be enabled in these environments, but it's a manual process. See the article here: http://technet.microsoft.com/en-us/library/ff808313.aspx
-		+
-		+

	== MAPI AO Logging ==		== MAPI AO Logging ==

Mkorenba at 01:58, 24 April 2013

2013-04-24T01:58:10Z

← Older revision		Revision as of 01:58, 24 April 2013
Line 634:		Line 634:
	10/23/2012 18:41:21.918(Local)(3780 1.5) NTCE (918793) initiating key retrieval in progress [SRDataServer.cpp:441]		10/23/2012 18:41:21.918(Local)(3780 1.5) NTCE (918793) initiating key retrieval in progress [SRDataServer.cpp:441]
	10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918790) Initiating key retrieval [SRServer.cpp:271]		10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918790) Initiating key retrieval [SRServer.cpp:271]
-	10/23/2012 18:41:21.918(Local)(3780 1.5) NTCE (918798) Sending ack for result 2, item name /cfg/gl/sr/sr_get_key/pdidc-exchange.cisco.com@cisco.c	+	10/23/2012 18:41:21.918(Local)(3780 1.5) NTCE (918798) Sending ack for result 2, item name /cfg/gl/sr/sr_get_key/pdidc-exchange.cisco.com@cisco.com [SRDataServer.cpp:444]
-	om [SRDataServer.cpp:444]	+	10/23/2012 18:41:21.918(Local)(3780 0.0) ERRO (918813) Failed to find Identity match for domain cisco.com [SRDiIdMgr.cpp:157]
-	~~'''~~10/23/2012 18:41:21.918(Local)(3780 0.0) ERRO (918813) Failed to find Identity match for domain cisco.com [SRDiIdMgr.cpp:157]	+	10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918821) Failed to find identity match for domain [SRKeyMgr.cpp:120]
-	~~''''''~~10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918821) Failed to find identity match for domain [SRKeyMgr.cpp:120]	+	10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918832) Send Key response to the Client for spn: exchangeMDB/pdidc-exchange.cisco.com, # of req's: 1 [SRKeyMgr.cpp:296]
-	~~'''~~10/23/2012 18:41:21.918(Local)(3780 0.0) NTCE (918832) Send Key response to the Client for spn: exchangeMDB/pdidc-exchange.cisco.com, # of req's: 1 [SRKeyMgr.cpp:296]	+


-	</pre>	+	</pre>
		+
	==== <br> Resolution 3: If your Core WAE services multiple Exchange servers in different domains you must configure an Encryption service Identity for each domain the Exchange servers reside in. ====		==== <br> Resolution 3: If your Core WAE services multiple Exchange servers in different domains you must configure an Encryption service Identity for each domain the Exchange servers reside in. ====

Mkorenba at 01:57, 24 April 2013

2013-04-24T01:57:12Z

Mkorenba at 01:54, 24 April 2013

2013-04-24T01:54:00Z

← Older revision		Revision as of 01:54, 24 April 2013
Line 603:		Line 603:

	<br>		<br>
-
-	~~==== ====~~

	'''Output from sr-errolog on Core WAE'''<br>		'''Output from sr-errolog on Core WAE'''<br>
Line 621:		Line 619:
	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511193) session(0x2aaaac0008c0) Failed to Retrieve Key from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com error:1 [SRKeyRetriever.cpp:267]		10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511193) session(0x2aaaac0008c0) Failed to Retrieve Key from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com error:1 [SRKeyRetriever.cpp:267]
	10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]		10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]
-	</pre>	+	</pre>
		+
	==== <br> Resolution 2: Use ntpdate on all WAEs (especially the Core) to sync the clock with the KDC. Then point to the enterprise NTP server (prefereably the same as the KDC). ====		==== <br> Resolution 2: Use ntpdate on all WAEs (especially the Core) to sync the clock with the KDC. Then point to the enterprise NTP server (prefereably the same as the KDC). ====

Mkorenba at 01:51, 24 April 2013

2013-04-24T01:51:15Z

← Older revision		Revision as of 01:51, 24 April 2013
Line 598:		Line 598:
	09/25/2012 18:47:54.147(Local)(9063 0.0) NTCE (147733) SendNextCmd isDuringSend 0, WriteQueue size 1 isDuringClose 0 [SrlibServerTransport.cpp:308]		09/25/2012 18:47:54.147(Local)(9063 0.0) NTCE (147733) SendNextCmd isDuringSend 0, WriteQueue size 1 isDuringClose 0 [SrlibServerTransport.cpp:308]
	09/25/2012 18:47:54.147(Local)(9063 0.1) NTCE (147740) Send Key response to the Client</pre>		09/25/2012 18:47:54.147(Local)(9063 0.1) NTCE (147740) Send Key response to the Client</pre>
-	==== <br> Resolution 1: Consult the ~~attached document to~~ verify the object in AD has the correct permissions. "Replicating Directory Changes" and "Replicating Directory Changes All" must both be set to allow. ====	+	==== <br> Resolution 1: Consult the configuration guide and verify the object in AD has the correct permissions. "Replicating Directory Changes" and "Replicating Directory Changes All" must both be set to allow. ====

-	<br>	+	http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v511/configuration/guide/policy.html#wp1256547
		+
		+	<br>

	==== ====		==== ====

Mkorenba at 01:46, 24 April 2013

2013-04-24T01:46:15Z

← Older revision		Revision as of 01:46, 24 April 2013
Line 484:		Line 484:
	'''<br>This output is from the Core sr-errorlog again and shows successful key retrieval from KDC.<br>'''		'''<br>This output is from the Core sr-errorlog again and shows successful key retrieval from KDC.<br>'''
	<pre>10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673766) Key Not Found in cache, initiating retrieval for spn:exchangeMDB/pdidc-exchange1.pdidc.cisco.com [SRServer.cpp:297]		<pre>10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673766) Key Not Found in cache, initiating retrieval for spn:exchangeMDB/pdidc-exchange1.pdidc.cisco.com [SRServer.cpp:297]
-	10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673811) Queued InitiateKeyRetrieval task [SRServer.cpp:264]10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673819) Key retrieval is in Progress [SRServer.cpp:322]	+	10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673811) Queued InitiateKeyRetrieval task [SRServer.cpp:264]10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673819)
		+	Key retrieval is in Progress [SRServer.cpp:322]
	10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673818) Initiating key retrieval [SRServer.cpp:271]		10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673818) Initiating key retrieval [SRServer.cpp:271]
	10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673827) initiating key retrieval in progress [SRDataServer.cpp:441]		10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673827) initiating key retrieval in progress [SRDataServer.cpp:441]
-	10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673834) Sending ack for result 2, item name /cfg/gl/sr/sr_get_key/pdidc-exchange1.pdidc.cisco.com@pdidc.cisco.com [SRDataServer.cpp:444]	+	10/23/2012 15:46:55.673(Local)(3780 1.2) NTCE (673834) Sending ack for result 2, item name /cfg/gl/sr/sr_get_key/pdidc-exchange1.pdidc.cisco.com@pdidc.cisco.com
		+	[SRDataServer.cpp:444]
	10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673922) Match found for DN: pdidc.cisco.com is ID:MacchineAcctWAAS [SRDiIdMgr.cpp:163]		10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673922) Match found for DN: pdidc.cisco.com is ID:MacchineAcctWAAS [SRDiIdMgr.cpp:163]
	10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673937) Identity MacchineAcctWAAS found in the Map [SRDiIdMgr.cpp:702]		10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673937) Identity MacchineAcctWAAS found in the Map [SRDiIdMgr.cpp:702]
	10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673950) DN Info found for domain pdidc.cisco.com [SRIdentityObject.cpp:168]		10/23/2012 15:46:55.673(Local)(3780 0.0) NTCE (673950) DN Info found for domain pdidc.cisco.com [SRIdentityObject.cpp:168]
-	10/23/2012 15:46:55.674(Local)(3780 0.0) NTCE (674011) DRS_SPN: E3514235-4B06-11D1-AB04-00C04FC2DCD2/e4c83c51-0b59-4647-b45d-780dd2dc3344/PDIDC.CISCO.COM for PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:51]	+	10/23/2012 15:46:55.674(Local)(3780 0.0) NTCE (674011) DRS_SPN: E3514235-4B06-11D1-AB04-00C04FC2DCD2/e4c83c51-0b59-4647-b45d-780dd2dc3344/PDIDC.CISCO.COM for
		+	PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:51]
	10/23/2012 15:46:55.674(Local)(3780 0.0) NTCE (674020) CREATED srkr obj(0x50aa00) for spn (exchangeMDB/pdidc-exchange1.pdidc.cisco.com) [SRKeyMgr.cpp:134]		10/23/2012 15:46:55.674(Local)(3780 0.0) NTCE (674020) CREATED srkr obj(0x50aa00) for spn (exchangeMDB/pdidc-exchange1.pdidc.cisco.com) [SRKeyMgr.cpp:134]
	10/23/2012 15:46:55.674(Local)(3780 1.3) NTCE (674421) Import cred successfull for pn: PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:135]		10/23/2012 15:46:55.674(Local)(3780 1.3) NTCE (674421) Import cred successfull for pn: PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:135]
Line 502:		Line 505:
	10/23/2012 15:46:55.680(Local)(3780 0.1) NTCE (680011) Parsing DRSBIND Response [AppApiDrsBind.cpp:222]		10/23/2012 15:46:55.680(Local)(3780 0.1) NTCE (680011) Parsing DRSBIND Response [AppApiDrsBind.cpp:222]
	10/23/2012 15:46:55.680(Local)(3780 0.1) NTCE (680030) DRSBind Success, Status:00000000 [AppApiDrsBind.cpp:359]		10/23/2012 15:46:55.680(Local)(3780 0.1) NTCE (680030) DRSBind Success, Status:00000000 [AppApiDrsBind.cpp:359]
-	10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685502) session(0x50aa00) Successful in Key Retrieval from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com [SRKeyRetriever.cpp:269]	+	10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685502) session(0x50aa00) Successful in Key Retrieval from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com
-	10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685583) Send Key response to the Client for spn: exchangeMDB/pdidc-exchange1.pdidc.cisco.com, # of req's : 1[SRKeyMgr.cpp:296]	+	[SRKeyRetriever.cpp:269]
		+	10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685583) Send Key response to the Client for spn: exchangeMDB/pdidc-exchange1.pdidc.cisco.com, # of req's : 1
		+	[SRKeyMgr.cpp:296]
	10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685594) Deleting spn: exchangeMDB/pdidc-exchange1.pdidc.cisco.com entry from Pending key request map [SRKeyMgr.cpp:303]		10/23/2012 15:46:55.685(Local)(3780 0.1) NTCE (685594) Deleting spn: exchangeMDB/pdidc-exchange1.pdidc.cisco.com entry from Pending key request map [SRKeyMgr.cpp:303]

	</pre>		</pre>
	<br> '''This output is from the mapiao-errorlog file on the Edge WAE for a successful eMAPI connection'''		<br> '''This output is from the mapiao-errorlog file on the Edge WAE for a successful eMAPI connection'''
-	<pre>'''10/23/2012 17:56:23.080(Local)(8311 0.1) NTCE (80175) (fl=2433) Edge TCP connection initiated (-1409268656), Conn: [14.110.3.117:58352 <=> 14.110.3.99:27744], Flavor: 0 [EdgeTcpConnectionDceRpcLayer.cpp:43]	+	<pre>'''10/23/2012 17:56:23.080(Local)(8311 0.1) NTCE (80175) (fl=2433) Edge TCP connection initiated (-1409268656), Conn: [14.110.3.117:58352 <=> 14.110.3.99:27744],
-	10/23/2012 17:56:23.080(Local)(8311 0.1) NTCE (80199) Edge TCP connection initiated (-1409268656), Conn: [14.110.3.117:58352 <=> 14.110.3.99:27744], Flavor: 0 [EdgeTcpConnectionDceRpcLayer.cpp:48]	+	Flavor: 0 [EdgeTcpConnectionDceRpcLayer.cpp:43]
-	10/23/2012 17:56:23.108(Local)(8311 0.0) NTCE (108825) (fl=2433) Bind Request from client with AGID 0x0, callId 2, to dest-ip 14.110.3.99, AuthLevel: PRIVACY AuthType: SPNEGO AuthCtxId: 0 WsPlumb:1	+	10/23/2012 17:56:23.080(Local)(8311 0.1) NTCE (80199) Edge TCP connection initiated (-1409268656), Conn: [14.110.3.117:58352 <=> 14.110.3.99:27744], Flavor: 0
		+	[EdgeTcpConnectionDceRpcLayer.cpp:48]
		+	10/23/2012 17:56:23.108(Local)(8311 0.0) NTCE (108825) (fl=2433) Bind Request from client with AGID 0x0, callId 2, to dest-ip 14.110.3.99, AuthLevel: PRIVACY
		+	AuthType: SPNEGO AuthCtxId: 0 WsPlumb:1
	[EdgeTcpConnectionDceRpcLayer.cpp:1277]'''		[EdgeTcpConnectionDceRpcLayer.cpp:1277]'''
	10/23/2012 17:56:23.109(Local)(8311 0.0) NTCE (109935) CheckAndDoAoshReplumbing perform replumbing wsPlumbState 1 [Session.cpp:315]		10/23/2012 17:56:23.109(Local)(8311 0.0) NTCE (109935) CheckAndDoAoshReplumbing perform replumbing wsPlumbState 1 [Session.cpp:315]
Line 517:		Line 525:
	10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312687) (fl=2433) Connection multiplexing enabled by server on the connection. [EdgeTcpConnectionDceRpcLayer.cpp:499]		10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312687) (fl=2433) Connection multiplexing enabled by server on the connection. [EdgeTcpConnectionDceRpcLayer.cpp:499]
	10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312700) (fl=2433) Header signing enabled by server on the connection. [EdgeTcpConnectionDceRpcLayer.cpp:510]		10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312700) (fl=2433) Header signing enabled by server on the connection. [EdgeTcpConnectionDceRpcLayer.cpp:510]
-	10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312719) (fl=2433) OnNewConnection - Client IP 14.110.3.117 (0xe6e0375), Serv IP 14.110.3.99 (0xe6e0363), nDstPort=27744, nAssociationGroup=0x11de4,conn_fd=26,	+	10/23/2012 17:56:23.312(Local)(8311 0.1) NTCE (312719) (fl=2433) OnNewConnection - Client IP 14.110.3.117 (0xe6e0375), Serv IP 14.110.3.99 (0xe6e0363), nDstPort=27744,
		+	nAssociationGroup=0x11de4,conn_fd=26,
	bWasConnectionFromReservedPool=0, bIsNewMapiSession=1 [ConnectionReservationManager.cpp:255]		bWasConnectionFromReservedPool=0, bIsNewMapiSession=1 [ConnectionReservationManager.cpp:255]
	'''10/23/2012 17:56:23.366(Local)(8311 0.1) NTCE (366789) (fl=2433) Received security context from core with auth context id: 0 [EdgeTcpConnectionDceRpcLayer.cpp:2912]		'''10/23/2012 17:56:23.366(Local)(8311 0.1) NTCE (366789) (fl=2433) Received security context from core with auth context id: 0 [EdgeTcpConnectionDceRpcLayer.cpp:2912]
	10/23/2012 17:56:23.367(Local)(8311 0.1) NTCE (367157) (fl=2433) Security Layer moved to ESTB state [FlowSecurityLayer.cpp:311]'''		10/23/2012 17:56:23.367(Local)(8311 0.1) NTCE (367157) (fl=2433) Security Layer moved to ESTB state [FlowSecurityLayer.cpp:311]'''
	10/23/2012 17:56:23.368(Local)(8311 0.1) NTCE (368029) (fl=2433) Informational:: Send APC set to WS: asking for Cipher 2 [EdgeTcpConnectionDceRpcLayer.cpp:809]		10/23/2012 17:56:23.368(Local)(8311 0.1) NTCE (368029) (fl=2433) Informational:: Send APC set to WS: asking for Cipher 2 [EdgeTcpConnectionDceRpcLayer.cpp:809]
-	10/23/2012 17:56:23.368(Local)(8311 0.1) NTCE (368041) (fl=2433) Sec-Params [CtxId, AL, AT, ACT, DCT, [Hs, ConnMplx, SecMplx]]:=[0, 6, 9, 18, 18 [1,1,0]] [FlowIOBuffers.cpp:477]	+	10/23/2012 17:56:23.368(Local)(8311 0.1) NTCE (368041) (fl=2433) Sec-Params [CtxId, AL, AT, ACT, DCT, [Hs, ConnMplx, SecMplx]]:=[0, 6, 9, 18, 18 [1,1,0]]
-	10/23/2012 17:56:23.369(Local)(8311 0.0) NTCE (369128) (fl=2433) CEdgeTcpConnectionEmsMdbLayer::ConnectRequestCommon (CallId 2): client version is ProductMajor:14, Product Minor:0, Build Major:6117,	+	[FlowIOBuffers.cpp:477]
		+	10/23/2012 17:56:23.369(Local)(8311 0.0) NTCE (369128) (fl=2433) CEdgeTcpConnectionEmsMdbLayer::ConnectRequestCommon (CallId 2): client version is ProductMajor:14,
		+	Product Minor:0, Build Major:6117,
	Build Minor:5001 Client ip 14.110.3.117 Client port 58352 Dest ip 14.110.3.99 Dest port 27744 [EdgeTcpConnectionEmsMdbLayer.cpp:1522]		Build Minor:5001 Client ip 14.110.3.117 Client port 58352 Dest ip 14.110.3.99 Dest port 27744 [EdgeTcpConnectionEmsMdbLayer.cpp:1522]
	10/23/2012 17:56:23.868(Local)(8311 0.1) ERRO (868390) (fl=2433) ContextHandle.IsNull() [EdgeTcpConnectionEmsMdbLayer.cpp:1612]		10/23/2012 17:56:23.868(Local)(8311 0.1) ERRO (868390) (fl=2433) ContextHandle.IsNull() [EdgeTcpConnectionEmsMdbLayer.cpp:1612]
-	10/23/2012 17:56:23.890(Local)(8311 0.0) NTCE (890891) (fl=2433) CEdgeTcpConnectionEmsMdbLayer::ConnectRequestCommon (CallId 3): client version is ProductMajor:14, Product Minor:0, Build Major:6117,	+	10/23/2012 17:56:23.890(Local)(8311 0.0) NTCE (890891) (fl=2433) CEdgeTcpConnectionEmsMdbLayer::ConnectRequestCommon (CallId 3): client version is ProductMajor:14,
		+	Product Minor:0, Build Major:6117,
	Build Minor:5001 Client ip 14.110.3.117 Client port 58352 Dest ip 14.110.3.99 Dest port 27744 [EdgeTcpConnectionEmsMdbLayer.cpp:1522]		Build Minor:5001 Client ip 14.110.3.117 Client port 58352 Dest ip 14.110.3.99 Dest port 27744 [EdgeTcpConnectionEmsMdbLayer.cpp:1522]
	</pre>		</pre>
Line 563:		Line 575:
	<br>		<br>

-	<br>	+	<br>

	=== Common Problems ===		=== Common Problems ===

Mkorenba at 01:44, 24 April 2013

2013-04-24T01:44:01Z

← Older revision		Revision as of 01:44, 24 April 2013
Line 418:		Line 418:
	==== Step 3- Manually verify the WAE settings that are not checked by the diagnostic command above. ====		==== Step 3- Manually verify the WAE settings that are not checked by the diagnostic command above. ====

-	~~====~~ 1) The above command while it chekcs for the existence of NTP configured, it does not actually verify the times are in sync between the WAE and KDC. It is very important the times are in sync between the Core and KDC for key retrieval to be successful. ~~====~~	+	1) The above command while it chekcs for the existence of NTP configured, it does not actually verify the times are in sync between the WAE and KDC. It is very important the times are in sync between the Core and KDC for key retrieval to be successful.

	If the manual check reveals they are out of sync a simple way to force the clock of the WAE to be in sync would be the ntpdate command ('''ntpdate <KDC ip>'''). Then point the WAEs to the enterprise NTP server.		If the manual check reveals they are out of sync a simple way to force the clock of the WAE to be in sync would be the ntpdate command ('''ntpdate <KDC ip>'''). Then point the WAEs to the enterprise NTP server.
Line 444:		Line 444:
	4) Verify the CMS secure store is open and initialized on all WAEs "show cms secure store"		4) Verify the CMS secure store is open and initialized on all WAEs "show cms secure store"

-	~~<br>~~	+	<br>
-		+
-	<br>	+

	=== <br> Data Analysis ===		=== <br> Data Analysis ===

Mkorenba: /* = */

2013-04-24T01:42:43Z

← Older revision		Revision as of 01:42, 24 April 2013
Line 307:		Line 307:
	4.It give the summary out as Edge device and Core device. Device which can be both edge and core should have EMAPI operational for both edge and core.		4.It give the summary out as Edge device and Core device. Device which can be both edge and core should have EMAPI operational for both edge and core.

-	'''Below is a sample output from an incorrectly configured WAE:~~'''~~	+	'''Below is a sample output from an incorrectly configured WAE:
-	<pre>	+	<pre>Core#accelerator mapi verify encryption-settings
-	Core#accelerator mapi verify encryption-settings [EDGE:]	+	[EDGE:]
-		+	Verifying Mapi Accelerator State
-	Verifying Mapi Accelerator State	+	--------------------------------
-	--------------------------------	+	Status: FAILED
		+	Accelerator Config State Operational State
		+	----------- ------------ -----------------
		+	mapi Disabled Shutdown
		+	>>Mapi Accelerator should be Enabled
		+	>>Mapi Accelerator should be in Running state
		+
		+	Verifying SSL Accelerator State
		+	-------------------------------
		+	Status: FAILED
		+	>>Accelerator Config State Operational State
		+	----------- ------------ -----------------
		+	ssl Disabled Shutdown
		+	>>SSL Accelerator should be Enabled
		+	>>SSL Accelerator should be in Running state
		+
		+	Verifying Wan-secure State
		+	--------------------------
		+	Status: FAILED
		+	>>Accelerator Config State Operational State
		+	----------- ------------ -----------------
		+	wan-secure Disabled Shutdown
		+	>>Wan-secure should be Enabled
		+	>>Wan-secure should be in Running state
		+
		+	Verifying Mapi Wan-secure mode Setting
		+	---------------------------------
		+	Status: FAILED
		+	Accelerator Config Item Mode Value
		+	----------------------- ---- ------
		+	WanSecure Mode User Not Applicable
		+	>>Mapi wan-secure setting should be auto/always
		+	Verifying NTP State
		+	--------------------
	Status: FAILED		Status: FAILED
-	~~Accelerator Config State Operational State~~	+	>>NTP status should be enabled and configured
-	~~----------- ------------ -----------------~~	+
-	~~mapi Disabled Shutdown~~	+
-	~~>>Mapi Accelerator should be Enabled~~	+
-	~~>>Mapi Accelerator should be in Running state~~	+
-		+
-	~~Verifying SSL Accelerator State~~	+
-	~~-------------------------------~~	+
-	~~Status: FAILED~~	+
-	~~>>Accelerator Config State Operational State~~	+
-	~~----------- ------------ -----------------~~	+
-	~~ssl Disabled Shutdown~~	+
-	~~>>SSL Accelerator should be Enabled~~	+
-	~~>>SSL Accelerator should be in Running state~~	+
-		+
-	~~Verifying Wan-secure State~~	+
-	~~--------------------------~~	+
-	~~Status: FAILED~~	+
-	~~>>Accelerator Config State Operational State~~	+
-	~~----------- ------------ -----------------~~	+
-	~~wan-secure Disabled Shutdown~~	+
-	~~>>Wan-secure should be Enabled~~	+
-	~~>>Wan-secure should be in Running state~~	+
-		+
-	~~Verifying Mapi Wan-secure mode Setting</pre>~~	+
-	~~----~~	+
-	~~<pre>~~	+
-	~~Status: FAILED~~	+
-	~~Accelerator Config Item Mode Value~~	+
-	~~----------------------- ---- ------~~	+
-	~~WanSecure Mode User Not Applicable~~	+
-	~~>>Mapi wan-secure setting should be auto/always~~	+
-		+
-	~~Verifying NTP State~~	+
-	~~--------------------~~	+
-	~~Status: FAILED~~	+
-	>>NTP status should be enabled and configured	+

	Summary [EDGE]:		Summary [EDGE]:
		+	===============
		+	Device has to be properly configured for one or more components
		+
		+	[CORE:]
		+	Verifying encryption-service State
		+	----------------------------------
		+	Status: FAILED
		+	Service Config State Operational State
		+	----------- ------------ -----------------
		+	Encryption-service Disabled Shutdown
		+	>>Encryption Service should be Enabled
		+	>>Encryption Service status should be in 'Running' state
		+
		+	Verifying Encryption-service Identity Settings
		+	----------------------------------------------
		+	Status: FAILED
		+	>>No active Encryption-service Identity is configured.
		+	>>Please configure an active Windows Domain Encryption Service Identity.

-	===============	+	Summary [CORE]: Applicable only on CORE WAEs
-	Device has to be properly configured for one or more components	+	============================================
		+	Device has to be properly configured for one or more components

-	~~[CORE:] Verifying encryption-service State</pre>~~
-	~~----~~
-	~~<pre>~~
-	~~Status: FAILED~~
-	~~Service Config State Operational State~~
-	~~----------- ------------ -----------------~~
-	~~Encryption-service Disabled Shutdown~~
-	~~>>Encryption Service should be Enabled~~
-	~~>>Encryption Service status should be in 'Running' state~~

-	~~Verifying Encryption-service Identity Settings~~</pre>	+	</pre>
-	~~----~~	+
-	~~<pre>~~	+
-	~~Status: FAILED~~	+
-	~~>>No active Encryption-service Identity is configured.~~	+
-	~~>>Please configure an active Windows Domain Encryption Service Identity.~~	+

-	~~Summary [CORE]: Applicable only on CORE WAEs~~
-	~~============================================~~
-	~~Device has to be properly configured for one or more components~~

-
-	~~</pre>~~
	'''Below is the output from a Core WAE that is configured correctly:'''		'''Below is the output from a Core WAE that is configured correctly:'''
-	<pre>	+	<pre>Core#acc mapi verify encryption-settings [EDGE:]
-	Core#acc mapi verify encryption-settings [EDGE:]	+

	Verifying Mapi Accelerator State		Verifying Mapi Accelerator State

Mkorenba at 01:38, 24 April 2013

2013-04-24T01:38:28Z

Show changes

Mkorenba at 01:37, 24 April 2013

2013-04-24T01:37:05Z

← Older revision		Revision as of 01:37, 24 April 2013
Line 297:		Line 297:
	==== Step 2 - In 5.0.3 a new diagnostic command was introduced to check some of the required settings. ====		==== Step 2 - In 5.0.3 a new diagnostic command was introduced to check some of the required settings. ====

-	~~====~~ '''̶accelerator mapi verify encryption settings''' ~~====~~	+	'''̶accelerator mapi verify encryption settings'''

	1.CLI does various validity checks. It output is summary of ability to accelerate encrypted MAPI traffic as edge or core.		1.CLI does various validity checks. It output is summary of ability to accelerate encrypted MAPI traffic as edge or core.
Line 353:		Line 353:
	[CORE:]		[CORE:]

-	Verifying encryption-service State<br>----------------------------------<br>       Status: OK<br>Verifying Encryption-service Identity Settings<br>----------------------------------------------<br>       Status: OK<br>Summary [CORE]: Applicable only on CORE WAEs<br>============================================<br>       Device has proper configuration to accelerate encrypted traffic<br><br>	+	Verifying encryption-service State<br>----------------------------------<br>       Status: OK<br>Verifying Encryption-service Identity Settings<br>----------------------------------------------<br>       Status: OK<br>Summary [CORE]: Applicable only on CORE WAEs<br>============================================<br>       Device has proper configuration to accelerate encrypted traffic<br><br>

	==== Step 3- Manually verify the WAE settings that are not checked by the diagnostic command above. ====		==== Step 3- Manually verify the WAE settings that are not checked by the diagnostic command above. ====

← Older revision		Revision as of 01:57, 24 April 2013
Line 598:		Line 598:
	09/25/2012 18:47:54.147(Local)(9063 0.0) NTCE (147733) SendNextCmd isDuringSend 0, WriteQueue size 1 isDuringClose 0 [SrlibServerTransport.cpp:308]		09/25/2012 18:47:54.147(Local)(9063 0.0) NTCE (147733) SendNextCmd isDuringSend 0, WriteQueue size 1 isDuringClose 0 [SrlibServerTransport.cpp:308]
	09/25/2012 18:47:54.147(Local)(9063 0.1) NTCE (147740) Send Key response to the Client</pre>		09/25/2012 18:47:54.147(Local)(9063 0.1) NTCE (147740) Send Key response to the Client</pre>
-	==== <br> Resolution 1: Consult the configuration guide and verify the object in AD has the correct permissions. "Replicating Directory Changes" and "Replicating Directory Changes All" must both be set to allow. ====	+	==== <br> Resolution 1: Consult the configuration guide and verify the object in AD has the correct permissions. "Replicating Directory Changes" and "Replicating Directory Changes All" must both be set to allow. ====

-	http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v511/configuration/guide/policy.html#wp1256547	+	http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v511/configuration/guide/policy.html#wp1256547

-	<br>	+	<br>
		+
		+	==== Problem 2: There is a time skew between the Core WAE and the KDC it attempts to retrieve the key from<br> ====

	'''Output from sr-errolog on Core WAE'''<br>		'''Output from sr-errolog on Core WAE'''<br>
Line 609:		Line 611:
	10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507888) Identity MacchineAcctWAAS found in the Map [SRDiIdMgr.cpp:702]		10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507888) Identity MacchineAcctWAAS found in the Map [SRDiIdMgr.cpp:702]
	10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507901) DN Info found for domain pdidc.cisco.com [SRIdentityObject.cpp:168]		10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507901) DN Info found for domain pdidc.cisco.com [SRIdentityObject.cpp:168]
-	10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507923) DRS_SPN: E3514235-4B06-11D1-AB04-00C04FC2DCD2/e4c83c51-0b59-4647-b45d-780dd2dc3344/PDIDC.CISCO.COM for PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:51]	+	10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507923) DRS_SPN: E3514235-4B06-11D1-AB04-00C04FC2DCD2/e4c83c51-0b59-4647-b45d-780dd2dc3344/PDIDC.CISCO.COM for
		+	PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:51]
	10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507933) CREATED srkr obj(0x2aaaac0008c0) for spn (exchangeMDB/pdidc-exchange1.pdidc.cisco.com) [SRKeyMgr.cpp:134]		10/23/2012 01:31:33.507(Local)(1832 0.1) NTCE (507933) CREATED srkr obj(0x2aaaac0008c0) for spn (exchangeMDB/pdidc-exchange1.pdidc.cisco.com) [SRKeyMgr.cpp:134]
	10/23/2012 01:31:33.508(Local)(1832 1.6) NTCE (508252) Import cred successfull for pn: PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:135]		10/23/2012 01:31:33.508(Local)(1832 1.6) NTCE (508252) Import cred successfull for pn: PDI-7541-DC@PDIDC.CISCO.COM [GssCli.cpp:135]
	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511151) CreateSecurityContext: gss_init_sec_context failed [majorStatus = 851968 (0xd0000)] [GssCli.cpp:176]		10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511151) CreateSecurityContext: gss_init_sec_context failed [majorStatus = 851968 (0xd0000)] [GssCli.cpp:176]
-	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511170) GSS_MAJOR ERROR:851968 msg_cnt:0, Miscellaneous failure (see text)CD2 [GssCli.cpp:25]	+	'''10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511170) GSS_MAJOR ERROR:851968 msg_cnt:0, Miscellaneous failure (see text)CD2 [GssCli.cpp:25]
	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511177) GSS_MINOR ERROR:2529624064 msg_cnt:0, Clock skew too great [GssCli.cpp:29]		10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511177) GSS_MINOR ERROR:2529624064 msg_cnt:0, Clock skew too great [GssCli.cpp:29]
	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511182) gsskrb5_get_subkey failed: 851968,22, [GssCli.cpp:198]		10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511182) gsskrb5_get_subkey failed: 851968,22, [GssCli.cpp:198]
-	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511188) session(0x2aaaac0008c0) Error: Invalid security ctx state, IsContinue is false with out token exchange [SRKeyRetriever.cpp:386]	+	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511188) session(0x2aaaac0008c0) Error: Invalid security ctx state, IsContinue is false with out token exchange
-	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511193) session(0x2aaaac0008c0) Failed to Retrieve Key from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com error:1 [SRKeyRetriever.cpp:267]	+	[SRKeyRetriever.cpp:386]
		+	10/23/2012 01:31:33.511(Local)(1832 1.6) ERRO (511193) session(0x2aaaac0008c0) Failed to Retrieve Key from AD for SPN:exchangeMDB/pdidc-exchange1.pdidc.cisco.com error:1
		+	[SRKeyRetriever.cpp:267]'''
	10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]		10/23/2012 01:31:33.511(Local)(1832 0.0) ERRO (511213) Key retrieval failed with Status 1 [SRKeyMgr.cpp:157]
	</pre>		</pre>