Discovery problem (incomplete discovery)

Question

Hi Julian, &nbsp;
&nbsp;I have F5 MP installed on my RMS (SCOM R2). when i 
try discovering device it shows me "Attempt to connect to the iControl 
device socket: Success" with blue icon on extreme left with 'i' in it. I
 have attached the discovery screen shot for reference.
&nbsp;i am assuming that i have sucessfully discovered a device but it is not showing on SCOM console. &nbsp;&nbsp;Please help me know what i an doing wrong and add how to add this device to SCOM console?&nbsp;&nbsp;Regards, 
&nbsp;Pramod

julian_balog_34 · Answer

Hi Pramod, &nbsp;
&nbsp; Please enable the verbose trace logs for the F5 Monitoring Service. See the "Verbose Logging Support" section in this article: 
&nbsp; http://devcentral.f5.com/wiki/default.aspx/MgmtPack/GeneralTroubleshooting.html &nbsp;
&nbsp; Restart the F5 Monitoring Service and attempt a new discovery for the F5 device in question. Wait for a couple of minutes (I assume the discovery would just hang and not finish, in the state you mentioned), and then pack the trace.log file (in Program Files\F5 Networks\Management Pack\log folder) and the 'F5 Monitoring Log' event log and send them to us to managementpack(at)f5(dot)com. &nbsp;
&nbsp; Based on your brief description of the problem, I believe the F5 device discovery hangs in the state of performing the SSL certificate exchange with the F5 device, which immediately follows after successfully connecting to the iControl interface on the F5 device. You can also check a few things to make sure you have a clear shot for discovery. The following F5 Dev Central article would give you the details: http://devcentral.f5.com/wiki/default.aspx/MgmtPack/F5DeviceUserRoleSecurity.html &nbsp;
&nbsp; Mostly firewall and credential related stuff, but make sure at least these prerequisites are in place. We can probably tell more once we get a look at the trace logs.&nbsp;
&nbsp;Also, please provide the following information:&nbsp;
&nbsp;- F5 Management Pack version
&nbsp;- BIG-IP platform version
&nbsp;- big3d version (by running the following command in the shell: iqsh localhost)&nbsp;
&nbsp; Thank you. 
&nbsp; Julian &nbsp;

pramod_73248 · Answer

Hi Julian, &nbsp;
&nbsp;Thanks for the response. &nbsp;
&nbsp;Please find below the details: &nbsp;
&nbsp;- F5 Management Pack version : 2.1.4.389
&nbsp;- BIG-IP platform version : 10.2.0 (Build 1707.0 final) &nbsp;- big3d version (by running the following command in the shell: iqsh localhost) : 10.2.0.1707 &nbsp;&nbsp;Some More Info: &nbsp;
&nbsp;1. We have firewall in between our RMS server and F5 device and we have only port 443 &amp; 4353 only bi-directional. 
&nbsp;2. we have initially installed the f5 MP ver.2.1.3.217 and later upgraded to the latest, but none of them worked uptill now. 
&nbsp;3. we did wait for 20-30 minutes with no luck but this time we get some failure too in the log, please check and guide us to rectify the issue.
&nbsp;4. We are using root user to run the discovery.&nbsp;&nbsp;&nbsp;Not sure if this is relevent but FYI:&nbsp;&nbsp;On my RMS server (where we have installed the F5 MP and monitoring service) we don't have direct internet connection and use some proxy. If i remove the proxy settings (in internet explorer) discovery fails with: &nbsp;
&nbsp;'Unable to authenticate with F5 device'..... 'F5 Authorization required'....&nbsp;
&nbsp;But if i add the proxy settings, discovery never fails nor device get added to the SCOM console.&nbsp;
&nbsp;Regards,
&nbsp;Pramod

julian_balog_34 · Answer

Pramod, 
&nbsp;  
&nbsp; Thank you for the detailed feedback. I would try to troubleshoot this problem first without the proxy. I believe that you still have the same error condition with the proxy active, but somehow with the proxy you lose some transparency in the response you're getting from the F5 device. 
&nbsp;  
&nbsp; The HTTP 401 Authorization Required error that you're getting without the proxy, makes me believe that you're not able to connect to the iControl interface on the F5 device. From a web browser (on your SCOM management server) try to connect to https://device-ip/iControl/iControlPortal.cgi. This should take you to the iControl web-service (WSDL) interface on the F5 device, and you should be prompted with basic authentication credentials. Pass in the exact credentials that you plan to use with discovery. Are you able to get to the iControl WSDL interface? 
&nbsp;  
&nbsp; If you're not able to browse the iControl web-service interface (and you still get the HTTP authorization error), you'll have to make sure basic authentication is allowed with the F5 device. If you get through with connecting to the iControl web-service interface, the next step would be to check if you can telnet into the device's port 4353 (from the management server where you try to discover from). This would tell you if at least the firewall settings are OK for device inbound connections. 
&nbsp;  
&nbsp; Let's try to make the discovery work first without the proxy. Let me know the results for the steps suggested above and we'll take it from here. 
&nbsp;  
&nbsp; Thank you for your patience. 
&nbsp; Julian

pramod_73248 · Answer

Hi Julian, &nbsp;
&nbsp;Thanks for the valuable information. below are my observations: &nbsp;
&nbsp;1. If I remove the proxy settings, i can browse (iip &gt;) to the device interface without any issue but if i add the proxy settings, i am unable to reach to the device web-interface. &nbsp;
&nbsp;2. We are using the root user while discovery but we don't have the password of this user and always ask the device admin to put the password while doing the discovery. Security team has denied to give us the root password of the device. while connecting to the device over web-interface we are using some read-only user and able to browse through the interface. &nbsp;
&nbsp;Is it necessary to test the web-interface with root user only? &nbsp;
&nbsp;3. I can sucessfully telnet to the device on port 443 &amp; 4353 with or without proxy settings. &nbsp;
&nbsp;regards, 
&nbsp;Pramod &nbsp;

pramod_73248 · Answer

Hi Julian, 
&nbsp;  
&nbsp; Thanks alot for your help. I am able to discover the F5 devices. the issue was with the ROOT user as it didn't had the permission to use the Web interface of the devices. 
&nbsp;  
&nbsp; when i asked my device admin to connect to the web UI with the user ROOT he said that root doesn't have permission on the UI. then i asked him to type the credentials (while discovery) which has the admin permission on the UI. he typed the credential and discovery happened sucessfully. 
&nbsp;  
&nbsp; once again, thanks alot for your help. 
&nbsp;  
&nbsp; Do you have any doc which will help me to understand the post discovery task for F5 MP? if yes, appreciate if you could share the doc or any link for the same. 
&nbsp;  
&nbsp; regards, 
&nbsp; Pramod

Forum Discussion

Discovery problem (incomplete discovery)

Recent Discussions

APM Logon page logs

BIG-IP Edge Client installation stuck at "Status: Registering Modules"

PCI and Partitions

F5 Access 3.1.0 Crashes on Android 9 Devices

TMSH Command to list ASM policies not attached to any virtual servers in all partitions

Related Content

Service Discovery in F5 Distributed Cloud - Architecture Options

Out of the Shadows: API Discovery and Security

Service discovery and registration with BIG-IP

How to use F5 Distributed Cloud for API Discovery

Service Discovery and authentication options for Kubernetes providers (EKS, AKS, GCP)

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS