Forum Discussion

williamtan's avatar
williamtan
Icon for Altostratus rankAltostratus
Mar 03, 2019

gtm_add failed

I'm planning to join new GTM to existing GTM sync group. Both GTM have same big3d version. Existing GTM external interface is set to allow default. When I try to type gtm_add in new GTM it showed error message as below.

 

root@(NEWGTM)(cfg-sync Standalone)(Active)(/Common)(tmos) run gtm gtm_add X.X.Y.Y Retrieving remote and installing local BIG-IP's SSL certs ... Enter root password for X.X.Y.Y if prompted ssh: connect to host X.X.Y.Y port 22: Connection refused

 

ERROR: Can't read remote cert via /usr/bin/ssh.

 

==> Done <== root@(NEWGTM)(cfg-sync Standalone)(Active)(/Common)(tmos)

 

application delivery
BIG-IP DNS

19 Replies

Sort By
  • Surgeon's avatar
    Surgeon
    Ret. Employee
    Mar 03, 2019

    TCP port 22 need to be allowed on the existing GTM to allow ssh. Certificates exchange is made via ssh.

     

  • RaghavendraSY's avatar
    RaghavendraSY
    Icon for Altostratus rankAltostratus
    Mar 03, 2019

    Please check the Self-IP configuration for the interface/VLAN and confirm whether the Port Lockdown setting is allowed ssh.

     

  • RaghavendraSY_7's avatar
    RaghavendraSY_7
    Icon for Cumulonimbus rankCumulonimbus
    Mar 03, 2019

    Please check the Self-IP configuration for the interface/VLAN and confirm whether the Port Lockdown setting is allowed ssh.

     

  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Mar 03, 2019

    Do you have the AFM module / packet filters / another firewall device in between the GTMs that may be blocking this traffic?

    From the bash prompt try doing a netcat from one GTM to the peer GTM device to see if it can connect.

    nc -v X.X.Y.Y 22

  • williamtan's avatar
    williamtan
    Icon for Altostratus rankAltostratus
    Mar 04, 2019

    I found the root cause. The old GTM configured packet filter rule and only allow few ip to ssh. Thank you for all your effort. Really appreciate.