Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-6846

[OSP16][RHEL8.2] some nodes do not support Cipher Suite 17 in lanplus mode

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Minor Minor
    • None
    • rhel-8.2.0
    • ipmitool
    • None
    • Low
    • rhel-sst-cs-system-management
    • ssg_core_services
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Known Issue
    • Hide
      .`ipmitool` is incompatible with certain server platforms

      The `ipmitool` utility serves for monitoring, configuring, and managing devices that support the Intelligent Platform Management Interface (IPMI). The current version of `ipmitool` uses Cipher Suite 17 by default instead of the previous Cipher Suite 3. Consequently, `ipmitool` fails to communicate with certain bare metal nodes that announced support for Cipher Suite 17 during negotiation, but do not actually support this cipher suite. As a result, `ipmitool` aborts with the `no matching cipher suite` error message.

      For more details, see the related link:https://access.redhat.com/solutions/5931381[Knowledgebase article].

      To solve this problem, update your baseboard management controller (BMC) firmware to use the Cipher Suite 17.

      Optionally, if the BMC firmware update is not available, you can work around this problem by forcing `ipmitool` to use a certain cipher suite. When invoking a managing task with `ipmitool`, add the `-C` option to the `ipmitool` command together with the _number_ of the cipher suite you want to use. See the following example:
      -----
      # ipmitool -I lanplus -H myserver.example.com -P mypass -C 3 chassis power status
      -----
      Show
      .`ipmitool` is incompatible with certain server platforms The `ipmitool` utility serves for monitoring, configuring, and managing devices that support the Intelligent Platform Management Interface (IPMI). The current version of `ipmitool` uses Cipher Suite 17 by default instead of the previous Cipher Suite 3. Consequently, `ipmitool` fails to communicate with certain bare metal nodes that announced support for Cipher Suite 17 during negotiation, but do not actually support this cipher suite. As a result, `ipmitool` aborts with the `no matching cipher suite` error message. For more details, see the related link: https://access.redhat.com/solutions/5931381 [Knowledgebase article]. To solve this problem, update your baseboard management controller (BMC) firmware to use the Cipher Suite 17. Optionally, if the BMC firmware update is not available, you can work around this problem by forcing `ipmitool` to use a certain cipher suite. When invoking a managing task with `ipmitool`, add the `-C` option to the `ipmitool` command together with the _number_ of the cipher suite you want to use. See the following example: ----- # ipmitool -I lanplus -H myserver.example.com -P mypass -C 3 chassis power status -----
    • Done
    • None

      Description of problem:
      When using lanplus and forcing the cipher to be used we found that some nodes do not support Cipher Suite 17 in lanplus mode. It seems like in 16.0/8.1 the ipmitool version defaulted to C 3 but in 16.1/8.2 its defaulting to 17. In the previous examples you can see I was using -l lan and not lanplus.

      Version-Release number of selected component (if applicable):
      ipmitool-1.8.18-14.el8.x86_64

      How reproducible:
      Everytime

      Steps to Reproduce:
      1. Try to inspect a node or run the correct ipmitool command

      Actual results:
      Fails

      Expected results:
      Inspection successful

      Additional info:

      I peeled two from an existing OSP13 cluster to prep wider deployment. The two nodes import perfectly fine in 16.0 running on the same networks, but it fails in 16.1

              rhn-support-pcahyna Pavel Cahyna
              rhn-support-camorris Carl Morris
              Pavel Cahyna Pavel Cahyna
              Jeffrey Bastian Jeffrey Bastian
              Sarka Jana Janderkova Sarka Jana Janderkova
              Votes:
              0 Vote for this issue
              Watchers:
              14 Start watching this issue

                Created:
                Updated:
                Resolved: