VPLEX: RecoverPoint: After RecoverPoint is upgraded to 5.1.3 and later there are ndu pre-check errors

           

   Article Number:     536001                                   Article Version: 7     Article Type:    Break Fix 
   

 


Product:

 

VPLEX Series,VPLEX Local,VPLEX Metro,VPLEX for All Flash,VPLEX VS2,VPLEX VS6,VPLEX GeoSynchrony 5.5,VPLEX GeoSynchrony 5.5 Patch 1,VPLEX GeoSynchrony 5.5 Service Pack 1,VPLEX GeoSynchrony 5.5 Service Pack 1 Patch 1

 

Issue:

 

 

   

      After an end-user upgrades their RecoverPoint cluster to 5.1.3 and later, communication errors may be seen on the VPLEX side. These errors may appear as the following in the ndu pre-check output:   
        
      [ERROR]:       
        Error while performing ndu pre-check 'Verify RecoverPoint cluster state': Cannot get value of attribute 'config-changes-allowed'.       
        Could not retrieve RPA id. Could not access RPA via SSL.       
        HTTP transport error: javax.net.ssl.SSLException: Received fatal alert: illegal_parameter       
        Received fatal alert: illegal_parameter       
        [ERROR]:       
        Error while performing ndu pre-check 'Verify no RecoverPoint consistency groups use synchronous protection policy.': HTTP transport error: javax.net.ssl.SSLException: Received fatal alert: illegal_parameter       
        Received fatal alert: illegal_parameter
   
   
    When importing a RecoverPoint certificate the following error may also be seen:   
        
      VPlexcli:/> rp import-certificate This command will cause the VPLEX CLI process to restart if security settings are modified. This will require a new log in from all connected CLI and GUI clients.To proceed type CONTINUE or hit enter to abort: CONTINUEPlease enter the IP address of the RecoverPoint cluster:0.0.0.0 Please verify that the IP address is correct and that the RecoverPoint cluster is reachable.    
   
    Additionally, the following error may be seen when attempting to add an RPA cluster to VPLEX:   
        
      VPlexcli:/> rp rpa-cluster add -o 0.0.0.0 -u admin -c cluster-1Enter rpa-cluster administrative password:Enter rpa-cluster administrative password again for verification: rp rpa-cluster Evaluation of <<rp rpa-cluster add -o 0.0.0.0 -u admin -c cluster-1>> failed. add: cause: Failed to add rpa-cluster '0.0.0.0'. cause: Failed to get port information of rpa-cluster '0.0.0.0'. cause: HTTP transport error: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target cause: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target cause: unable to find valid certification path to requested target    
                                                             

 

 

Cause:

 

 

RecoverPoint included some security enhancements in version 5.1.3 and later, which causes a cipher suite mismatch when VPLEX attempts to communicate with FAPI on the RPA cluster. Due to the cipher suite mismatch between the two products, the SSL (Secure Socket Layer) handshake fails.                                                           

 

 

Resolution:

 

 

Permanent Fix:   
    Dell EMC VPLEX Engineering is currently investigating this problem. Once a fix is available this article will be updated.   
   
    If you have encountered the issue this article mentions you will need to contact Dell EMC Customer Service for further assistance and mention this KB ID.