HP Command View not working through Windows Firewall

[grahamuk2015]

Hi,

I have setup a new Server 2012 R2 server and installed HP P6000 Command View for our EVA to replace an old 2003 (Which didn't have a firewall enabled) server but it won't work when the Windows Firewall is enabled. I basically get the message "Connecting to Discovery" and then it says "Failed to connect to Discovery. The Management Group (MG) certificate may not be installed. Please refer to help for more information (Which I did).". The certificate is installed and I can log in ok when the firewall is disabled. I have opened the following ports in and out as listed in the installation guide 2372, 2374, 5988, 5989, 2376, 2377, 2379, 860, 2386, 3202.

Any help would be appreciated.

Thanks,

Graham

[DavidGlass]

Can someone at Hewlett-Packard not answer this? I have hit the exact same problem. I have added all the ports listed in the manual, and it is not enough. How can I tell which ports need to be opened if the list in the manual is not correct?

[Benchi]

Create new FW rule for application xf.exe and allow any protocol, and specify for Domain profile - depends if you need acces from anther network.

Xf.exe is by default in C:\Program Files (x86)\Hewlett-Packard\XF\bin\win-32 folder.

[DavidGlass]

Benchi,

Thanks for this answer. My workaround was to allow TCP protocol on any port for any program, while locking down the scope to the ip addresses of the SAN management server and my own PC. I will try also limiting the program to XF.

I had an exchange of emails with HP Customer Relations that ended with the advice to open a support case. I have not done this because the problem is with the documentation, not the installation.

-David

[verderider]

I tried creating fw rule per your note, still having same issue.

"Failed to connect to Discovery. The Management Group (MG) certificate may not be installed.

Thank you in advance for any additional hints to get this dang thing to work again.

rgs,

christopher

[DavidGlass]

Christopher, Due to other HP software now on my SAN management servers I am currently using a firewall rule that allows any protocol, any port, any program for a small set of management servers, iLOs, and my PC. However, this was not enough. I found I had to import the certificate manually with the Microsoft Management Console to make Command View work with Internet Explorer. I think the problem is that the normal process puts the certificate in the current user store, probably Administrator, but it needs to be in the Local Computer store so the EVA admin user can use it. Here are the steps: First, save the certificate to a file instead of opening it. Take defaults to save it to a file named "domain.cer" Now, import it with the Microsoft Management Console: 1) Type mmc in the Start screen and select mmc.exe Jump to step 8 if you already have a Snap-in for Certificates (Local computer). 2) File --> Add/Remove Snap-in... 3) Select Certificates 4) Click Add > 5) Select Computer account radio button, then click Next > 6) Select radio button for option to manage Local computer, then click Finish 7) Click OK to close "Add or Remove Snap-ins" dialogue 😎 At Console Root, expand Certificates, then Trusted Root Certification Authorities, then select Certificates 9) Click Action --> All Tasks --> Import... 10) Make sure Local Machine radio button is selected 11) Browse to your saved certificate file, click Open, then Next 12) Select "Place all certicates in the following store" radio button 13) Browse to "Trusted Root Certification Authorities" if not already selected 14) Click Next, then Finish 15) Check your SAN Manager certificate is now in the Local Computer store. 16) Exit Command View P6000 and relaunch it.

[DaveArnoldHPE]

Thanks for the detailed explanation.   I already had domain.cer on my server, but it failed to work until I followed your instructions.  PERFECT!

[Dennis_Handly]

This is the wrong company for Servers, Storage, Networking and Software. Please use the Hewlett Packard Enterprise Community:
https://community.hpe.com/t5/Storage-Area-Networks-SAN/bd-p/itrc-248