VMware Capacity Planner Test problems - "RPC server unavailable"

[Support444]

Hi there,

I am currently inserting some windows servers into the capacity planner and have hit some obstacles. I am unsure on how to get the WMI test to succeed with the windows firewall turned on. I have enabledthe file and printer sharing exception, this allows the Registry, perf mon and IPC$ tests to succeed. If I turn the firewall off, all is well, but if I turn it back on, the WMI test fails with the RPC server is unavailable error. I can't/shouldn't turn off the firewalls for each problem server as they are production machines in a corporate environment.

Can someone please give me some insight on how to get past this problem?

many thanks

[habibalby]

Hello,

Add a rule in your Firewall to allow these Ports 135, 137, 138, 139, 445 and 443 "SSL" or add them in the Exception list of ports.

Best Regards,

Hussain Al Sayed

[Support444]

Hi,

thank you for your contribution, I have added these TCP ports to the windows firewall exception list and the problem perisists. As I understand it , the initial connection is based on a dynamic port range, i.e. random.

I am in correspondance with my local VMware Rep, hopefully he can come up with a game plan.

[habibalby]

Hello,

Does the Clients/Servers which you are trying to convert having a Firewall Enabled? If Yes, add those ports to the target machine or try to disable it for the time the conversion is going-on and once it's converted, you can trun on your Firewall back to ON.

If you are worried of trneds or something, remove the Default-Gateway if its not being used to access off-subnet network.

Best Regards,

Hussain Al Sayed

[Support444]

Hi there,

Yes the clients have a firewall up, Iw ould need a really good reason to take it down for the several weeks of data collection. I have added those ports to the machines but the WMI test still fails. When I take dowh the firewall, I can see the process that is being invoked on the client side. it is the file C:\WINDOWS\system32\wbe\wmiprvse.exe

I thought if I add that exe as an exception, that it would work, but no go there either.

thanks for any assistance

[Craig_Baltzer]

If you go into the firewall configuraiton and turn on logging (Windows Firewall, Advanced Tab, Security Logging Settings button, Log dropped and successful connections) what ports are specifically being attempted and blocked? It would be worthwhile to see if you're getting a consistent "random" port number when you connect.

may also help in controlling what "random" ports are used...

[Support444]

		action	protocol	src-ip	dest-ip	src-port	dest-port	size	tcpflag	tcpsyn	tcpack tcpwin
11/12/2008	8:43:46	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2191	135	48	S	2853968550	0	65535	-	-	-	RECEIVE
11/12/2008	8:43:49	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2191	135	48	S	2853968550	0	65535	-	-	-	RECEIVE
11/12/2008	8:43:55	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2191	135	48	S	2853968550	0	65535	-	-	-	RECEIVE
11/12/2008	8:44:07	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2192	135	48	S	1178825449	0	65535	-	-	-	RECEIVE
11/12/2008	8:44:10	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2192	135	48	S	1178825449	0	65535	-	-	-	RECEIVE
11/12/2008	8:44:16	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2192	135	48	S	1178825449	0	65535	-	-	-	RECEIVE
11/12/2008	8:44:28	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2193	445	48	S	486333468	0	65535	-	-	-	RECEIVE
11/12/2008	8:44:28	OPEN-INBOUND	TCP	xxx.xx.63.227	xxx.xx.76.120	2194	139	-	-	-	-	-	-	-	-	-
11/12/2008	8:44:28	OPEN-INBOUND	TCP	xxx.xx.63.227	xxx.xx.76.120	2195	139	-	-	-	-	-	-	-	-	-

Ok sorry about the placment of this paragraph, i don't seem to be able to get the caret above or below the tables. I applied the registry key to narrow the range of ports (TCP 5000 - 5005) on the server with the Collection software on it. Above is the before WFL (windows firewall log) and below is the after WFL both from the client machine. This is weird as the destination port has changed but not the source port. This is confusing the heck out of me now, because looking at the top table, all the ports in the dest-port column (135,445,139) are in the exception list on the windows firewall on the client, the machine being tested. The other port range for the source port (2191-2195) don't seem to be affected by the registry modification... Any thoughts?

11/12/2008	9:17:18	OPEN-INBOUND	TCP	xxx.xx.63.227	xxx.xx.76.120	2213	135	-	-	-	-	-	-	-	-	-
11/12/2008	9:17:18	OPEN-INBOUND	TCP	xxx.xx.63.227	xxx.xx.76.120	2214	135	-	-	-	-	-	-	-	-	-
11/12/2008	9:17:18	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2216	5000	48	S	1288605442	0	65535	-	-	-	RECEIVE
11/12/2008	9:17:21	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2216	5000	48	S	1288605442	0	65535	-	-	-	RECEIVE
11/12/2008	9:17:27	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2216	5000	48	S	1288605442	0	65535	-	-	-	RECEIVE
11/12/2008	9:17:39	DROP	TCP	xxx.xx.63.227	xxx.xx.76.120	2217	5000	48	S	296758368	0	65535	-	-	-	RECEIVE
11/12/2008	9:17:42	DROP	TCP	xxx.63.227	xxx.xx.76.120	2217	5000	48	S	296758368	0	65535	-	-	-	RECEIVE
11/12/2008	9:17:48	DROP	TCP	xxx.63.227	xxx.xx.76.120	2217	5000	48	S	296758368	0	65535	-	-	-	RECEIVE

[Craig_Baltzer]

Be worth having another look at the firewall rules that are active. Rather than mucking with the UI I find using "netsh" gives a much better view. is the reference with all of the available commands. I'd start with a

• netsh firewall show state

• netsh firewall show portopening

• netsh firewall show allowedprogram

and see what is open. Then try using (where xxx is the port number and portdescription is a text description of the port)

• netsh firewall add portopening ALL xxx PortDescription ENABLE ALL

for the ports that you need open and see if that gets rid of the drops (it needs to be done on the server that you're trying to run capacity planner against, not the capacity planner server itself; the firewall in W2K3 is inbound only so there isn't anything to set on the capacity planner server itself). Once you get that working then you can change the first "ALL" to TCP or UDP, and the last ALL to SUBNET (if the capacity planner server and the server you're trying to collect information on are on the same subnet) or CUSTOM xxx.xxx.xxx.xxx where xxx.xxx.xxx.xxx is the IP address of the capacity planner server

[Support444]

Hi again,

the solution to the problem was to add the REMOTEADMIN firewall exception to each target server with this RPC Server unavailable problem.

netsh firewall set service REMOTEADMIN ENABLE CUSTOM <ip of machine doing the remote access>

you can change custom to subnet or all depending on what level of access you want.

I sincerely hope this helps someone else :smileygrin:

cheers