Upgrade troubleshooting: Cisco DCNM SMI-S (CIM) server and Java 11
With the introduction of support for Java 11, older versions of Cisco DCNM may encounter compatibility issues. The following section covers potential workarounds. Collection occurs from the SMI-S (CIM) server component of the DCNM the data collector is collecting from. The version of Java used by IT Analytics disables some insecure TLS algorithms by default. If collection fails with the following error in the collector logs, the version of Cisco DCNM may be incompatible and not allow collection using the TLS algorithms enabled by default with Java 11.
Failed to establish JDBC connection to: jdbc:jtds:sqlserver://... java.sql.SQLException: Network error IOException: null at net.sourceforge.jtds.jdbc.JtdsConnection.<init> (JtdsConnection.java:437)
Upgrade Cisco DCNM to the latest version to enable secure collection. If upgrade is not possible, a workaround can be attempted to restore compatibility. If the following steps do not resolve the issue, your version of Cisco DCNM is not supported.
Edit <collector install dir>/java/conf/security/java.security.
Search for jdk.tls.disabledAlgorithms.
Copy the existing lines and comment (to have a backup for easy restore).
#jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ # EC keySize < 224, 3DES_EDE_CBC, anon, NULL jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, 3DES_EDE_CBC, anon, NULLOne at a time, remove an algorithm from the jdk.tls.disabledAlgorithms and test the collection, starting at the last algorithm and working backward. Stop once you reach an algorithm containing 'keySize <'.
Remove one algorithm - for example NULL
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, 3DES_EDE_CBC, anonSave the file.
Run checkinstall and verify collection succeeds.
If checkinstall does not succeed, restore jdk.tls.disabledAlgorithms to its original state.
Change to DH keySize<768 - for example.
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 768, \ EC keySize < 224, 3DES_EDE_CBC, anon, NULL
Save the file.
Run checkinstall and verify collection succeeds.
If a working configuration is found, restart the collector service.