vCSA fails to join to 2012AD

[ChrisStanford]

Pulling my ever thinning hair out here. 

I am unable to join my 6.5 vcsa to a 2012 AD.  When I use the CLI, I get the following errors: 

Error: LW_ERROR_KRB5_REALM_UNKNOWN [code 0x0000a39f].

Cannot find KDC for requested realm.

I have double checked DNS settings and I have correctly forward/reverse lookup zones.  I have a time server that is synching across the domain.  This is a closed lab so I am unable to upload logs.

Is there a newer version of the appliance available?  Am I missing something here?

[daphnissov]

Does it also fail from the PSC UI page?

[ChrisStanford]

Yes.  I used the CLI because I read it was the "workaround."  I have just found a newer version of the vCSA and will be trying that next.

[daphnissov]

How are you specifying your domain? Do you have the hostname set to FQDN? I've seen this before with 2012 and it seems it is less tolerant to non-optimal configurations than earlier levels of AD.

[Gidrakos]

I ran into the same error when setting up mine last week for testing.

Make sure that your VCSA thinks it has the correct hostname. DNS may be resolving correctly, but VCSA seems very finicky about what hostname it is getting from DNS vs. what you entered during setup vs. what is being passed to the domain controller as the FQDN. Run "hostname" and/or check /etc/hosts to verify.

I had found a couple articles/threads about this when I was setting things up but can't find them again....will keep looking.

[ChrisStanford]

Thank you for the suggestions.  Still having this issue.  I have redeployed the appliance several times now, all with similar results.  Just got approvals to go back to the SMBv1 to try.  Drawing straws here...

[ChrisStanford]

So, I have downloaded and installed vcsa 6.51Uc and am able to successfully log in using the administrator@vsphere.local account.  However, I still cannot join to my 2012AD domain and am getting "ERROR_CONNECTION_REFUSED[code 0x000004c9].

• I have enabled SMBv1 on both DCs,
• I have tried the from the gui and the cli(using the /opt/likewise/bin/domainjoin-cli command).
• I know we are talking to the AD because when using the cli I intentionally put an incorrect password and it responded with a bad password error.
• Firewalls are disabled on both DCs.

Due to the disconnected nature of this lab, I am unable to upload any logs.  Please, any suggestions?

[Gidrakos]

Sorry to hear you're still having issues.

If you ssh into vcsa, open the shell, and run "hostname" does it give you back the FQDN including appropriate domain that exactly matches the DNS entry?

See this KB for more info: VMware Knowledge Base

Also, what's in your /etc/hosts file?

You may need to, when deploying vcsa, pause between steps 1 and 2 (initialize/setup and configure/first boot), ssh into vcsa and add localhost to your hosts file. I can't find the original thread, but here's what VMware told someone else:

Pause the install process right before phase 2.

Open a console to the appliance, enable SSH

On the appliance, echo "::1 localhost.localdom localhost" >> /etc/hosts

Explicitly adding localhost to /etc/hosts seems to perform some magic underneath during the configuration portion of vcsa.

[RajeevVCP4]

Try to off firewall on DC

[ChrisStanford]

Will try this.  Thank you!

Broke down and entered ticket with VMware.

cds

[ChrisStanford]

Firewalls are turned off.

[ChrisStanford]

Running the hostname command provides the FQDN that does match my DNS entry.  Incidentally it is vcsa.mydomainname.com.  I also checked the contents of the /etc/hosts file.  Its contents are copied below.

#Begin /etc/hosts (network card version)

#End /etc/hosts (network card version)

#VAMI_EDIT_BEGIN

#Generated by Studio VAMI service.  Do not modify manually.

127.0.0.1 vcsa.mydomainname.com vcsa localhost

::1 vcsa.mydomainname.com vcsa localhost ipv6-localhost ipv6-loopback

#VAMI_EDIT_END

Thanks for all your help!!

chris

[ChrisStanford]

Upgraded to a newly released version.  Problem resolved.