Can't connect to new ESXi 5.5 hosts with vSphere Client

[MarkBowker]

Completed fresh install of ESXi 5.5 on two new Dell PowerEdge servers last night.

Trying to connect to them through the vSphere client fails.

I can ping both servers with no problems from the server where the vSphere client is installed (it is not a DC but a Windows 2003 server -  it does have .Net 3.5 SP1 installed).

If I try to open the IP of the hosts in a web browser, http://xxx.xxx.xxx.xxx times out however if I try http://xxx.xxx.xxx.xxx:902  It connects to the server, but rather than getting the web page I'm used to expecting with 5.1 I get this message:

"220 VMware Authentication Daemon Version 1.10: SSL Required, ServerDaemonProtocol:SOAP, MKSDisplayProtocol:VNC, VMXARGS supported, NFCSSL supported. I get this exact same message if I telnet in on port 902.  So I know I can talk to the host, but have no clue why I can't log in to it or have it display  the tools in a web browser."

Trying to use the same IP with port 902 in the vSphere client to login I get this error:

vSphere Client could not connect to "xxx.xxx.xxx.xxx"

An unknown connection error occurred. (The client received an invalid response from the server. (The server committed a protocol violation. Section=ResponseStatusLine))

I did notice there was a 2 hour and 4 minute time difference between the host server and the client server.  I reset time to match in BIOS of the host server.  Testing afterwards yielded the same results.

Probably unrelated, but throwing it out there in case it points to an answer, when running the "Test Management Network", ping passes for the default gateway and the secondary DNS server (which is google 8.8.8.8) but fails for the Primary DNS server (local IP) and fails resolving host name.

Any thoughts, help or solution would be much appreciated.  I need to get this client's network virtualized this week, and I'd prefer not to have to fall back to 5.1 if possible.

Thanks

Mark Bowker

[a_p_]

Do you need to external DNS server on the ESXi host or only for VMs? If it's not needed for the host, consider to remove it.

Unless you are using public IP setting for the host, please provide the settings (IP address, subnet mask, gateway address) and also provide some details about the physical network, i.e. subnetting, VLANs, firewalls, ... (assuming the vSphere Client is in another subnet). Btw. did you try to connect to the ESXi host from within the hosts subnet? Does this work?

André

[MarkBowker]

Thanks for the reply.  Technically don't need the secondary DNS for the host.  I can remove it.  Was mostly for connectivity test. Still a little confused why the ping to the default gateway and Google's DNS server passes, but the local DNS server on the 192.168.1.x range fails

There are no VLANs.

Servers will be set up to talk to the SAN on subnet 172.29.29.0/24 but currently are not.

The management NIC is on subnet 192.168.1.0/24

Managment NIC is vmnic2

IPv6 is disabled.  Both servers are assigned IPv4 static.

Settings are 192.168.1.250 and 192.168.1.251, subnet 255.255.255.0 and gateway 192.168.1.49

As noted can ping them successfully.  Just can't get the web browser to display the tools page or connect through the vSphere Client.

Firewall is Sonicwall NSA2400

LAN to LAN matrix has Any to Any allow.

[a_p_]

What about using the vSphere Client in the host's subnet? If this works, there might be something in the firewall which needs to be changed (e.g. routing)!? Are you able to ping other addresses in the LAN when you enter them in the host's "Test Management Network" screen?

André

[MarkBowker]

Not possible to use the client in the host subnet.  That subnet is for the SAN network only and consists of the SAN, two switches and the two ESXi 5.5 servers (and neither of the primary nic's on the two servers have been configured yet for the SAN subnet since I can't access them with the client yet.

Oddly adding the IP of the server where the vSphere client is installed (as a secondary DNS server for test purpose) passes the Management Network test ping, however the DNS server IP and hostname resolution still fails. the server the vSphere client is installed on is 192.168.1.8, and the DNS server is 192.168.1.18.  In theory they should both pass the ping test.

//edit   let me back up on that.  The server that has the client installed does have one NIC configured for the LAN network and one NIC configured for the SAN network, however neither of the servers have the primary onboard nic configured for the SAN network yet because I can't connect to them. I've also tried connecting on the DNS server that is only on the LAN and get the same results.

[a_p_]

I'm a little bit confused now. You are saying that you cannot use the client in the host subnet, but according to the IP addresses you provided, it's in the same network already (192.168.1.x)!? Anyway, are you able to ping the DNS server from other systems? I'm asking because Windows 2008 and newer block pings by default and you need to allow ICMP traffic in the Windows firewall.

André

[MarkBowker]

Windows Firewall is disabled on the DNS server which is also the only DC (Windows server 2003).

On the management server (also 2003) where the vSphere client is installed if I try the IP of the hosts in a web browser it 404's in both cases.  If I try it with port 902 I get the message in this screen shot. (also same message if I telnet to the hosts) If I try this with the IP only without the port, the web page 404s

If I use the client and try to connect with port 902 I get this message.

In theory I can see that I'm connecting to the hosts, but authentication is failing in the client, and the web browser is not displaying the standard welcome screen.

If I try to connect using the client without a port, I get a generic error that the "Client could not send a complete request to the server".

Does that help clear things up?  I'll call VMware support on this tomorrow, so don't waste much time on it.  I totally appreciate your help though!~!!!  Was just hoping to get it resolved quickly to move on to virtualizing their servers.

[MarkBowker · Accepted solution]

This is resolved.

And it's one of those things that you can just kick yourself for.

I was trying this on two servers, both 2003 servers and using IE8

Tested a theory using a VPN connection from my laptop Windows 8 IE 10 and it worked perfectly, then tested on a 2008 R2 server using IE9 and it worked perfectly.

Installed Chrome on the two 2003 servers and worked perfectly.

So in the end it was IE8 that was not compatible and causing all the problems!!

Thanks again to you André for trying to help!

Mark

//edit.  Actually here's the exact reason it wasn't working

5.5 uses OpenSSL ciphers and we're not going to be able to get it working on 2003 32-bit
http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=2049143&sl...
there's a hot fix for 2003 x64 but not 32-bit

Message was edited by: Mark Bowker

[DumpCheck]

That KB has been updated with a bypass method a few days ago. Short story is slapping the relevant server into accepting weaker ciphers via an added xml line. Unfortunately, it seems to artificially weaken it more than it needs to (ALL, rather than specifying a cipher list that includes what XP/2003 can barely do), so user beware regarding excessively weakened SSL transport security. This may violate your company's security stance/policies.

[larstr]

Mark,

It's also working on 2003 32-bit after applying the MS hotfix (http://hotfixv4.microsoft.com/Windows%20Server%202003/sp3/Fix192447/3790/free/351385_ENU_i386_zip.ex...) and editing config.xml as described in the kb article (VMware KB: vSphere Client and vSphere PowerCLI may fail to connect to vCenter Server 5.5 due to a Ha...) you linked above.

Lars

[FelipeSE]

Error vsphere client:

an unknown connection error occurred

It works for me and solve the problem:

On Vcenter Server Edit vpxd.cfg and Add the <cipherList>ALL</cipherList> parameter between the  <vmacore><ssl>...</ssl></vmacore>

Restart the vCenter Server service