Troubleshooting

EcoStruxure IT Gateway restore fails when the locale of the Windows computer where the Gateway is installed is set to Italian, Portuguese, or Spanish. Set the operating system locale to English to perform the restore.  

Issue Some Gateway Appliances were shipped with bad ISO images. The networking functionality does not work properly on affected units.    Symptoms A system plugged into LAN 2 is unable to receive a DHCP address  A system plugged into LAN 2 with a statically assigned IP is unable to reach Webmin  The appliance does not receive an IP address when connected on LAN1  Affected Units Affected units were assembled in or prior to November 2019.  The assembled date is found on the package label.   appliance_assembly_date_360016634397.png   What To Do Contact Customer Support for assistance with this issue.      

When the Gateway is unable to keep up with the polling interval for a device, a Device Communication Alert warning alarm is generated. The alarm message is <device name> is responding slowly to polling. The Device Communication Alert alarm is generated after five consecutive polls exceed the polling interval. The alarm clears after five consecutive polls complete within the polling interval. You can do one or more of the following: Reduce the number of devices the Gateway is polling at 1 minute (Gateway 1.13 and newer). Reduce the number of devices the Gateway is polling. Add more CPU and memory to the Gateway. Investigate network latency issues, or put the Gateway on the same local area network (LAN) as the device.  

  Some Galaxy UPSs report serial numbers that are not unique, such as XXXXXXXXXX or 0123456789. These serial numbers are unsupported in EcoStruxure IT Gateway version 1.9.0 and newer. If you discovered a Galaxy device that reports these generic serial numbers, the Galaxy device will show as offline after the Gateway is updated to version 1.9.0 or newer, and a new Galaxy device will be added with a unique identifier. You can delete the offline Galaxy devices from the device list.

The EcoStruxure IT Gateway must uniquely identify devices to support data analytics and sensor history. The Gateway attempts to use the device's serial number as the unique identifier whenever possible, since IP addresses change, devices are removed and re-added to a network, or a device is connected to different Gateways.  In some cases, the device serial number must be set manually. Device serial number is missing or invalid In most cases, if the serial number is missing or empty, or it matches a list of invalid values like1234567890 or N/A, the Gateway attempts to use the MAC address for SNMP or the IP Address + server ID + port for Modbus. This not perfect for this situation, but it is the best alternative. If the Gateway fails to find a unique identifier, the device discover fails and is reported the Gateway's discovery log. Devices have the same unique identifier If two devices have the same unique identifier, usually one device will be discovered, and then when the second is discovered, the first will be removed and replaced by the second since it appears to be the same device. In some cases, depending on the timing, both devices could be discovered, and then will lose connectivity when the Gateway is updated to the next version.  Manually set the serial number on a device You might need to set the serial number on a device if a unique identifier cannot be not found. Consult the documentation or the device's manufacturer for how to do this if necessary. If you can update the serial number manually, it's most likely done through the device's own user interface. It might also be possible to set it using SNMP or Modbus. Contact customer support if you need assistance. You may need to supply the SNMP MIB or Modbus map to determine the address of the serial number.    

  When you replace a device and reuse the IP address and device configuration credentials from the old device, the new device will show as offline in the Gateway. Delete the offline device from the Gateway device list, and then manually rediscover the new device. How to replace a device in EcoStruxure IT Gateway

Support for unsafe ciphers was removed as part of a security update in EcoStruxure IT Gateway version 1.8.0. Devices using the Redfish protocol must now support 2048 bit certificates.  Symptom Devices that do not meet this requirement do not discover in Gateway 1.8.0 and newer. There is no indication of a certificate error when you run a new discovery. When you update your Gateway from a previous version, Redfish devices are listed as offline. Resolution Install a new certificate on the Redfish device that supports 2048 bit server certificates.

Support for unsafe ciphers was removed as part of a security update in EcoStruxure IT Gateway version 1.8.0. NetBotz 4.x devices must now support 2048 bit certificates.  Symptom Devices that do not meet this requirement do not discover in Gateway 1.8.0 and newer. There is no indication of a certificate error when you run a new discovery. When you update your Gateway from a previous version, NetBotz devices are listed as offline. Resolution Install a new 2048 bit certificate on the NetBotz device. Self-signed automatically generated SSL certificates use 2048-bit encryption as of NetBotz version 4.5.4.

Contact support for information about Gateway versions older than 1.16. Note: An imported SSL certificate signed by a trusted certificate authority or a CA certificate imported to the keystore will not persist through an EcoStruxure IT Gateway update. You must import the certificate again after you update your Gateway software. Windows These command examples are formatted for use in the Windows command prompt. Using PowerShell requires using single quotes instead of the double quotes displayed below. EcoStruxure IT Gateway stores the user interface SSL certificates in two Java keystore files in the C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore\ directory: dcos.keystore (PrivateKeyEntry) dcos.truststore (trustedCertEntry) Verify the contents of the Java keystores Open C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\application-installer.yaml  In the server: > ssl: section, find the line key-store-password and remember the password for the keystores. Open a command prompt window and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Type the command  "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe” -list -v -keystore dcos.keystore Enter the password you remembered in step 2. Verify the keystore contents are displayed without error. Type the command  "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -list -v -keystore dcos.truststore Enter the password you remember from step 2 when prompted. Verify the keystore contents are displayed without error.  Create a new keystore for the trusted SSL certificate Stop the EcoStruxureITGateway-x.x.x.x service. Delete the existing keystore file, C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore\dcos.keystore. Open a command prompt and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Type the command "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -genkey -alias dcos -keyalg RSA -keystore dcos.keystore -keysize 2048 The other values might need to match the values present on the CA. Some values are required by the CA, and others might be optional. This depends on the CA configuration. Use the .csr file to create a new certificate signed by the Trusted CA. This could be a CA run by your company, or it might need to be sent to a third-party Certificate Authority. Use the same password you remembered in step 2 of the ‘Verify the contents of the Java keystores” section. Verify that the file dcos.keystore now exists in the keystore folder. Start the EcoStruxureITGateway-x.x.x.x service.  Create a certificate signing request and a new SSL certificate signed by a trusted CA Type the command:   "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -certreq -alias dcos -keystore dcos.keystore -file newSxOnGW.csr Enter the required values when prompted. The first value must match the hostname or FQDN (Fully Qualified Domain Name) of the server where EcoStruxure IT Gateway is installed. Import the Root CA and Web Server SSL certificates to the EcoStruxure IT Gateway keystore Copy rootca.crt and newSxOnGW.crt to the machine where EcoStruxure IT Gateway is installed. Stop the EcoStruxureITGateway-x.x.x.x service. Open a command prompt and change the directory to C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\gateway\conf\keystore Import the root CA certificate. Type the command   “C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -importCert -trustcacerts -alias root -file rootca.crt -keystore root.truststore Import the Web Server SSL certificate. Type the command "C:\Program Files\EcoStruxureITGateway\<current Gateway install version>\jre\bin\keytool.exe" -importCert -trustcacerts -alias dcos -file newSxOnGW.crt -keystore dcos.keystore Make sure the root CA certificate is imported to the internet browser on all the computers that will be used to access the Gateway user interface. Start the EcoStruxureITGateway-x.x.x.x service. EcoStruxure IT Gateway will now use the new signed certificate, and no SSL Certificate security warning will be displayed by the browser when the Gateway user interface is launched. C:\Program Files\EcoStruxureITGateway\<version>\gateway\conf\keystore\dcos.keystore (PrivateKeyEntry) C:\Program Files\EcoStruxureITGateway\<version>\gateway\conf\keystore\dcos.truststore (trustedCertEntry) Linux EcoStruxure IT Gateway stores the user interface SSL certificates in two Java keystore files in the /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore directory: dcos.keystore (PrivateKeyEntry) dcos.truststore (trustedCertEntry) Verify the contents of the Java keystores Open /opt/EcoStruxureITGateway</current Gateway install version>/gateway/conf/application-installer.yaml  In the server: > ssl: section, find the line key-store-password and remember the password for the keystores. Open a command prompt window and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Type the command  '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool.exe' -list -v -keystore dcos.keystore Enter the password you remembered in step 2. Verify the keystore contents are displayed without error. Type the command  'opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -list -v -keystore dcos.truststore Enter the password you remember from step 2 when prompted. Verify the keystore contents are displayed without error.  Create a new keystore for the trusted SSL certificate Stop the EcoStruxureITGateway-x.x.x.x service. Delete the existing keystore file, /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore/dcos.keystore. Open a command prompt and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Type the command '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -genkey -alias dcos -keyalg RSA -keystore dcos.keystore -keysize 2048 The other values might need to match the values present on the CA. Some values are required by the CA, and others might be optional. This depends on the CA configuration. Use the .csr file to create a new certificate signed by the Trusted CA. This could be a CA run by your company, or it might need to be sent to a third-party Certificate Authority. Use the same password you remembered in step 2 of the ‘Verify the contents of the Java keystores” section. Verify that the file dcos.keystore now exists in the keystore folder. Start the EcoStruxureITGateway-x.x.x.x service.  Create a certificate signing request and a new SSL certificate signed by a trusted CA Type the command:   '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -certreq -alias dcos -keystore dcos.keystore -file newSxOnGW.csr Enter the required values when prompted. The first value must match the hostname or FQDN (Fully Qualified Domain Name) of the server where EcoStruxure IT Gateway is installed. Import the Root CA and Web Server SSL certificates to the EcoStruxure IT Gateway keystore Copy rootca.crt and newSxOnGW.crt to the machine where EcoStruxure IT Gateway is installed. Stop the EcoStruxureITGateway-x.x.x.x service. Open a command prompt and change the directory to /opt/EcoStruxureITGateway/<current Gateway install version>/gateway/conf/keystore Import the root CA certificate. Type the command   '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -importCert -trustcacerts -alias root -file rootca.crt -keystore root.truststore Import the Web Server SSL certificate. Type the command '/opt/EcoStruxureITGateway/<current Gateway install version>/jre/bin/keytool' -importCert -trustcacerts -alias dcos -file newSxOnGW.crt -keystore dcos.keystore Make sure the root CA certificate is imported to the internet browser on all the computers that will be used to access the Gateway user interface. Start the EcoStruxureITGateway-x.x.x.x service. EcoStruxure IT Gateway will now use the new signed certificate, and no SSL Certificate security warning will be displayed by the browser when the Gateway user interface is launched. /opt/EcoStruxureITGateway/<version>/gateway/conf/keystore/dcos.keystore (PrivateKeyEntry) /opt/EcoStruxureITGateway/<version>\gateway/conf/keystore/dcos.truststore (trustedCertEntry)