1. Troubleshooting - Enterprise Cloud Interface

Troubleshooting - Enterprise Cloud Interface

A collection of suggestions for troubleshooting Enterprise Cloud interface.

1.1. What browsers are compatible with Infinicenter Console?

Question:

What is the browser compatibility with Infinicenter Console?

Answer:

IBM provides the stated support level for the following operating systems:

  • Windows 7/8/10: fully, 32-bit or 64-bit
  • Linux®: best effort, 64-bit only
  • Mac OS X: best effort, 64-bit only

IBM provides the stated support level for the following operating systems and current browser combinations:

  • Microsoft® Internet Explorer 11 - fully (Windows only)
  • Microsoft Edge - best effort (Windows only)
  • Mozilla Firefox - fully (Windows), best effort (Linux, Mac OS X)
  • Google Chrome - fully (Windows), best effort (Linux, Mac OS X)
  • Note: RHEL/CentOS 6.x and older are not supported by Chrome, which requires a version of GLIBXX unavailable to RHEL/CentOS 6.

  • Apple Safari - none

As of 21 August 2017, current versions of supported browsers were: Internet Explorer 11 and later, Edge 40 and later, Firefox 55 and later, and Chrome 60 and later.

IBM provides best effort support because browser compatibility is an operating system-level support that does not offer.

Note:

  • Try the suggestions from Unable to connect to the console of any virtual machine before contacting Global Support Services.
  • Console Connect Web Console is compatible with any browser. However, Console Connect PlugIn Console on Windows is only compatible with desktop 32-bit Firefox version 44 and older or desktop 32-bit Internet Explorer and only in full-screen mode. Console Connect PlugIn Console on Linux is not compatible with any browser.
  • Cisco AnyConnect WebLaunch, the installation utility for the Cisco AnyConnect Secure Mobility client used for VPN Connect, is compatible only with 32-bit Internet Explorer on Windows. Use the standalone Cisco AnyConnect Secure Mobility Client as discussed in Cannot download Cisco AnyConnect Secure Mobility client.
  • No 64-bit desktop Windows browsers have been tested.
  • Internet Explorer in compatibility view has known issues with JavaScript and various JavaScript libraries. Consequently, Cloud Console does not support Internet Explorer in compatibility view. See Infinicenter Console displays incorrectly in IE compatibility view for additional information.
1.2. Why do I receive the error: Unable to connect to authd on host x.x.x.x?

Issue:

I receive the error: Unable to connect to authd on host x.x.x.x when I try to Connect to a virtual machine?

After establishing a VPN connection, selecting a server from the environment, and clicking Connect in Infinicenter Console, the VMware Remote Console (VMRC) browser plugin attempts to install, but the following error is returned:

Unable to connect to authd on host x.x.x.x

where x.x.x.x is a specific IP address.

Cause:

One or both of the two required ports, 902 and 903, for the host to communicate with the virtual machine via the VMRC browser plugin are being blocked.

Workaround:

This applies to all versions of Windows.

Verify whether the host PC can connect on ports 902 and 903 to the IP address in the error message.

    Note: In the following commands, x.x.x.x represents the IP address in the error message.

  1. Open a command prompt.
  2. Type the following:
  3. telnet x.x.x.x 902

    telnet x.x.x.x 903

If either fails, try the following:

  1. Open a command prompt.
  2. Type the following:
  3. netsh firewall add portopening tcp 902 required enable subnet

    netsh firewall add portopening tcp 903 required enable subnet

  4. Test connecting to the console again using Connect.
  5. If it fails, contact your network administrator to verify that the network firewall is not blocking these two ports.
  6. If they are both verified to be open through the network, contact Global Support Services.
1.3. Unable to connect to the console of any virtual machine

Question:

Unable to connect to the console of any virtual machine.

The user has:

  1. Verified that the VPN connection is configured correctly, and
  2. IBM has verified that the user is connecting to the RAS, and
  3. IBM has verified that the IAS policies are correct, and
  4. The user is still unable to use the Connect button within the Infinicenter environment, and
  5. The user is getting one of the following errors:
    1. Could not connect to x.x.x.x because the server actively refused the connection
    2. An error referencing an Invalid Handler
    3. Bad Handle 0xd7c, The handle is invalid
    4. C:\Program Files\Internet Explorer\plugins\vmware-remotemks.exe: this executable should not be invoked directly.
  6. When mounting, the user sees the error Unable to mount the file.

Cause:

Pop-up blocker or incorrect browser security settings.

Workaround:

This applies to all versions of Windows and all versions of Internet Explorer 6.0 or above.

Note: You must have local administrator rights to the PC to perform these steps.

1.4. Console screen is black and Ctrl+Alt+Del buttons are disabled

Issue:

Console screen is black and Ctrl+Alt+Del buttons are disabled.

After successfully establishing a VPN connection and clicking Connect, the console screen appears but is all black and the option buttons are grayed out.

This symptom is not consistent: sometimes it connects correctly and sometimes it will not connect.

Cause:

The vSphere client has been installed on the local machine.

Workaround:

Uninstall the vSphere client.

Note: If the issue persists, see Unable to connect to the console of any virtual machine.

1.5. How do I verify that ActiveX is enabled?

Question:

How do I verify if ActiveX is enabled?

The Console Connect plugin used by Infinicenter Console may not install properly, or at all, if ActiveX is disabled.

Answer:

Adjust security settings:

  1. Open Internet Explorer.
  2. On the Tools menu, click Internet Options.
  3. The Internet Options dialog appears.

  4. Select Security.
  5. Click Internet or, if you have added *.mgapp.ibm.com to trusted sites, Trusted Sites.
  6. Click Custom Level button.
    1. Select Enable under Automatic prompting for ActiveX controls
    2. Select Prompt under Download signed ActiveX controls.
    3. Select Enable under Run ActiveX controls and plug-ins.
  7. Click OK.
  8. Click Yes if prompted to change security zone.
  9. Click OK.
  10. Restart Internet Explorer.

If problems continue, follow the steps above and add the following in step 6:

  1. Verify Automatic Prompt for Download is enabled.
  2. Verify File Download is enabled.
  3. Verify Scripting of Java™ applets is enabled.
1.6. How do I reset persistence on an Internet service?

Question:

How do I reset persistence on an Internet service?

At times, it may be necessary to Reset the persistence on an Internet Service associated with a public IP address. To do this, persistence must be disabled, allowed to replicate, then re-enabled.

Answer:

  1. Log in to Infinicenter Console.
  2. Click Network.
  3. Select the Public IP that the Internet service is on.
  4. Select the appropriate Internet Service.
  5. Click Edit Service on the bottom left.
  6. Select Disabled - Stop all traffic to Node Services.
  7. Click Save.
  8. Wait about 5 minutes.
  9. Select the Public IP that the Internet service is on.
  10. Select the appropriate Internet Service.
  11. Click Edit Service on the bottom left.
  12. Select Enabled - Allow traffic to Node Services.
  13. Click Save.
1.7. Why am I prompted to install VMware Remote Console (VMRC) Plug-in for Internet Explorer?

Question:

Why am I prompted to install VMware Remote Console (VMRC) Plug-in for Internet Explorer?

Answer:

The first time you attempt to Connect to a Virtual Machine using Connect on the Devices tab of Infinicenter Console, the browser prompts the user to install the VMware Remote Console (VMRC) plug-in from VMware Inc.

This is a normal operation. Infinicenter Console requires the add-on to establish a connection to the virtual console port of a virtual machine using Connect.

1.8. Why can't I SSH to a Linux virtual machine using the root account?

Question:

Why can't I SSH to a Linux® virtual machine using the root account?

Answer:

For security reasons, Linux operating systems do not grant SSH access to the root account.

  1. Connect to the virtual machine in Infinicenter Console.
  2. Log in as root account.
  3. Create a super user account that has ssh access.
  4. Use the super user account.
1.9. Why do I have multiple environments in the Environment list?

Question:

Why do I have multiple environments in the Environment list?

Answer:

Customers can purchase multiple environments. Every environment purchased by the customer is listed under that customer name unless otherwise specified by the customer. All environments will appear in Environment. Users may not have access to all of the listed environments depending on the access defined in their role.

1.10. How do I resolve the Java error: PKIX path building failed?

Question:

How do I resolve the Java™ error: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed?

Answer:

This is not an Enterprise Cloud issue, it is a known Java behavior when the SSL certificate is updated on a server. An updated certificate is not automatically loaded into the certificate store on the customer's computer.

The solution is discussed on Stackoverflow: Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?.

1.11. Why is Device > {virtual machine} > View Tasks missing activities?

Question:

Why is Device > {virtual machine} > View Tasks missing activities?

Answer:

When you go to the Devices tab of the environment, select a virtual machine, and click View Tasks, only activities performed asynchronously against that virtual machine appear.

View Tasks presents the history of specific asynchronous virtual machine activity performed within the environment. The asynchronous virtual machine activities are:

  • Create: from Template, from Catalog, or Blank Server
  • Configure
  • Note: View Tasks shows only a configuration change; it does not provide details of the changes.

  • Power On
  • Power Off
  • Shutdown
  • Restart
  • Rename
  • Server Errors

View Tasks does not present changes made through Manage IP addresses.

1.12. Why is bursting unavailable (grayed-out) or missing?

Question:

Why is bursting unavailable (grayed-out) or missing?

Answer:

Availability of bursting requires a Statement of Contract (SOC) through sales or your service delivery manager that you understand the fees charged by IBM for bursting. Contact your service manager if you believe you were supposed to have this capability or would like to have this capability available to you.

IBM administrative systems must Allow Bursting in the environment for bursting to be available. Your service manager can verify that Allow Bursting is available for your environment.

Only users with an administrator role and users whose role includes the Manage Burst business operation have bursting available. Read-only users and non-administrator users without that business operation will not have bursting available.

Instance-based compute pools do not have bursting on the Resource tab. Bursting is not applicable to instance-based compute pools.

1.13. How do I uninstall previous plug-ins VMRC from Windows browsers?

Question:

How do I uninstall previous VMware Remote Console (VMRC) plug-ins from Windows browsers?

It may be useful to occasionally remove the plug-in used to connect to the console of virtual machines so that the latest version will install on the next attempt to connect to the console.

Answer:

Only Internet Explorer supports the VMRC plug-in.

You can verify that the plug-in is installed in Internet Explore before uninstalling it.

Verify Plug-in
  1. Click Tools.
  2. Click Manage Add-ons.
  3. The Manage Add-ons window appears.

  4. Select Show of All add-ons.
  5. Select VMware Remote Console Plug-in.
  6. Information regarding the plug-in appears.
Uninstall Plug-in
  1. Click Start in Windows.
  2. Click Control Panel.
  3. Control Panel appears.

  4. Click Programs and Features.
  5. Programs and Features appears.

  6. Select VMware Remote Console Plug-in.
  7. Click Uninstall.
  8. The Programs and Features confirmation dialog appears.

  9. Click Yes.
  10. The VMware Remote Console Plug-in installation program uninstalls the plug-in.

Note: If you have a directory of C:\Program Files\Common Files\VMware\VMware Remote Console Plug-in 5.1 with a subdirectory of Internet Explorer, you may remove that directory. That directory was used by earlier versions of the plug-in.

1.14. I use Internet Explorer in compatibility view and Infinicenter Console displays incorrectly.

Issue:

I use Internet Explorer in compatibility view and Infinicenter Console displays incorrectly.

Cause:

Internet Explorer in compatibility view has known issues with JavaScript and various JavaScript libraries. Consequently, Infinicenter Console does not support Internet Explorer in compatibility view.

Workaround:

Take Internet Explorer out of compatibility view:

  1. Press Alt.
  2. Select Tools > Compatibility View Settings.
  3. Clear all check boxes.
  4. Remove ibm.com from Websites you have added to Compatibility View.
  5. Click Close.
  6. Restart Internet Explorer to ensure the change is applied.
1.15. Why do the Cisco AnyConnect Secure Mobility client and VMware Remote Console (VMRC) fail in Chrome?

Question:

Why do the Cisco AnyConnect Secure Mobility Client and VMware Remote Console (VMRC) fail in Chrome?

Answer:

This is not an Enterprise Cloud issue; these third party components integrate into the browser using Netscape Plugin Application Programming Interface (NPAPI) and Google ended support for NPAPI in Chrome as discussed in Chrome help. This will not be completely resolved until Cisco and VMware update their components.

1.16. What URLs must I add to the Java Security Exception list?

Question:

What URLs must I add to the Java™ Security Exception list to support Enterprise Cloud features?

Answer:

Add the one or more of the following URLs to the Java Security Exception list if you experience Java security issues with VPN Connect or Console Connect.

Note: You need add only those URLs servicing your locations.

The Security Exception list is found at Control Panel > Java on the Security tab.

Feature Component URLs
VPN Connect CiscoAnyconnect
Secure Mobility Client
  • amb.sslvpn.mgapp.ibm.com
  • cua.sslvpn.mgapp.ibm.com
  • dac.sslvpn.mgapp.ibm.com
  • hk1.sslvpn.mgapp.ibm.com
  • mia.sslvpn.mgapp.ibm.com
  • sslvpn.eu.mgapp.ibm.com
  • sslvpn.mgapp.ibm.com (same as mia.sslvpn.mgapp.ibm.com)
  • stc.sslvpn.mgapp.ibm.com
  • uk5.sslvpn.mgapp.ibm.com
Console Connect VMware Remote
Console (VMRC)
  • us01.vmrcproxy50.enterprisecloud.mgapp.ibm.com
  • us01.vmrcproxy40.enterprisecloud.mgapp.ibm.com
    (GRA and AMA locations)
Console Applications lysewired
  • my.enterprisecloud.mgapp.ibm.com
  • account.cloud.mgapp.ibm.com
  • console.cloud.mgapp.ibm.com
  • services.cloud.mgapp.ibm.com
  • support.cloud.mgapp.ibm.com
1.17. Load balancing is not working within an environment.

Issue:

Load balancing is not working within an environment.

Cause:

  • An Internet service has not been created.
  • One of the servers' NIC drivers has been updated.
  • Persistence setting on the Internet service has maintained stickiness to other nodes.
  • Traffic is originating from a single IP address.

Workaround:

  • An Internet service has not been created.
  • An Internet service must be associated with a public IP address and the virtual machines must be attached to that Internet service as node services.

  • One of the servers' NIC drivers has been updated.
  • Have the customer:

    1. Connect to the server from Infinicenter Console.
    2. Disable the NIC associated with the node service.
    3. Restart the virtual machine, if possible but not required.
    4. Connect to the server from Infinicenter Console.
    5. Enable the NIC associated with the node service.
    6. Test load balancing.

  • Persistence setting on the Internet service has maintained stickiness to other nodes.
  • Reset persistence on the Internet service.

  • Traffic is originating from a single IP address.
  • In some cases, customers test load balancing using third party software where the testing software generates traffic from only one or two IP addresses. Depending on the load balancing algorithm, this can cause the traffic to always go to the same server.

    Try testing software that uses multiple IP addresses.