Forum Discussion

RahulGupta's avatar
RahulGupta
Icon for Nimbostratus rankNimbostratus
Oct 25, 2024

Issue while migrating config from 4000s to r4600

Hi All, we are trying to migrate config from 4000s to r4600. We have created UCS on 4000s but while loading it on a tenant on r4600, we got an error saying ""load sys partition all platform migrate " - failed -- 010713d0:3: Symmetric Unit key decrypt failure - decrypt failure, configuration loading error: high-config-load-failed".

Before loading the UCS from 4000s device to tenant, we copied the master key to the new tenant and verified it as well. 

The command used to load the UCS : load sys ucs <file name> no-license platform-migrate

Didn't see any other error logs in /var/log/ltm. 

Could someone suggest how to resolve this issue ? Please note we are using a CA device certificate and not self signed certificate for the device. Also the management IP, trunk name and number of trunk ports in the UCS are different from those on the tenant. 

 

  •  

     

    If you want to keep the management IP of the tenant, use the command below:

    load sys ucs <file name> platform-migrate no-license keep-current-management-ip

    If the UCS was generated from a cluster member, use reset-trust:

    load sys ucs <file name> platform-migrate no-license keep-current-management-ip reset-trust

    tmsh delete /cm trust-domain all && tmsh save sys config

     

    We have performed several migrations from iSeries to rSeries and used f5-journeys to adjust some settings in the UCS, which can help make the platform migration easier.

     

    https://my.f5.com/manage/s/article/K14986

    https://my.f5.com/manage/s/article/K000132494

    https://github.com/f5devcentral/f5-journeys#readme

    https://my.f5.com/manage/s/article/K000137313

    • RahulGupta's avatar
      RahulGupta
      Icon for Nimbostratus rankNimbostratus

      Do you think it was the different management IP which caused the issue ?

  • Command used to check master key on 4000s was f5mku -K and we copied it on tenant using f5mku -r <key value>

  • No, the issue you mentioned is related to the master key of the iSeries device, as you stated. My post was simply to add useful information to help complete the backup restore process.

    In my experience, when a restore failed with the error "Symmetric Unit key decrypt failure - decrypt failure, configuration loading error: high-config-load-failed," we recreated the tenant, copied the master key using f5mku -r <key value>, rebooted the tenant, and then executed the UCS restore.