Forum Discussion
RahulGupta
Nimbostratus
NimbostratusIssue while migrating config from 4000s to r4600
Hi All, we are trying to migrate config from 4000s to r4600. We have created UCS on 4000s but while loading it on a tenant on r4600, we got an error saying ""load sys partition all platform migrate " - failed -- 010713d0:3: Symmetric Unit key decrypt failure - decrypt failure, configuration loading error: high-config-load-failed".
Before loading the UCS from 4000s device to tenant, we copied the master key to the new tenant and verified it as well.
The command used to load the UCS : load sys ucs <file name> no-license platform-migrate
Didn't see any other error logs in /var/log/ltm.
Could someone suggest how to resolve this issue ? Please note we are using a CA device certificate and not self signed certificate for the device. Also the management IP, trunk name and number of trunk ports in the UCS are different from those on the tenant.
- welinton_trigueiro
Cirrus
No, the issue you mentioned is related to the master key of the iSeries device, as you stated. My post was simply to add useful information to help complete the backup restore process.
In my experience, when a restore failed with the error "Symmetric Unit key decrypt failure - decrypt failure, configuration loading error: high-config-load-failed," we recreated the tenant, copied the master key using f5mku -r <key value>, rebooted the tenant, and then executed the UCS restore.
- welinton_trigueiro
If you want to keep the management IP of the tenant, use the command below:
load sys ucs <file name> platform-migrate no-license keep-current-management-ip
If the UCS was generated from a cluster member, use reset-trust:
load sys ucs <file name> platform-migrate no-license keep-current-management-ip reset-trust
tmsh delete /cm trust-domain all && tmsh save sys config
We have performed several migrations from iSeries to rSeries and used f5-journeys to adjust some settings in the UCS, which can help make the platform migration easier.
https://my.f5.com/manage/s/article/K14986
https://my.f5.com/manage/s/article/K000132494
RahulGuptaDo you think it was the different management IP which caused the issue ?
- RahulGupta
Command used to check master key on 4000s was f5mku -K and we copied it on tenant using f5mku -r <key value>
