`hana-firewall' program reports error "Interface XXX:XXX doesn't exist on the system" for secondary address
This document (7021193) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server for SAP Applications 12 Service Pack 1
SUSE Linux Enterprise Server for SAP Applications 12 Service Pack 2
SUSE Linux Enterprise Server for SAP Applications 12 Service Pack 2
Situation
Following document "Operating System Security Hardening Guide for SAP HANA" (p18), a node has been configured with following settings:
# ip a s
...
18: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 14:02:ec:95:04:41 brd ff:ff:ff:ff:ff:ff
inet 10.10.3.51/24 brd 10.10.3.255 scope global bond0
inet 10.10.3.52/24 brd 10.10.3.255 scope global secondary bond0:hanaph1
...
and /etc/sysconfig/hana-firewall is set as
...
INTERFACE_0="bond0"
INTERFACE_0_SERVICES="HANA_STUDIO_LIFECYCLE_MANAGER HANA_HTTP_CLIENT_ACCESS HANA_STUDIO HANA_DATABASE_CLIENT HANA_HIGH_AVAILABILITY HANA_SAP_SUPPORT HANA_SYSTEM_REPLICATION"
INTERFACE_1="bond0:hanaph1"
INTERFACE_1_SERVICES="HANA_STUDIO_LIFECYCLE_MANAGER HANA_HTTP_CLIENT_ACCESS HANA_STUDIO HANA_DATABASE_CLIENT HANA_SYSTEM_REPLICATION HANA_HIGH_AVAILABILITY HANA_DATA_PROVISIONING"
...
However, when executing 'hana-firewall dry-run' the following error was observed instead:
# hana-firewall dry-run
ERROR: Interface bond0:hanaph1 doesn't exist on the system.
# ip a s
...
18: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 14:02:ec:95:04:41 brd ff:ff:ff:ff:ff:ff
inet 10.10.3.51/24 brd 10.10.3.255 scope global bond0
inet 10.10.3.52/24 brd 10.10.3.255 scope global secondary bond0:hanaph1
...
and /etc/sysconfig/hana-firewall is set as
...
INTERFACE_0="bond0"
INTERFACE_0_SERVICES="HANA_STUDIO_LIFECYCLE_MANAGER HANA_HTTP_CLIENT_ACCESS HANA_STUDIO HANA_DATABASE_CLIENT HANA_HIGH_AVAILABILITY HANA_SAP_SUPPORT HANA_SYSTEM_REPLICATION"
INTERFACE_1="bond0:hanaph1"
INTERFACE_1_SERVICES="HANA_STUDIO_LIFECYCLE_MANAGER HANA_HTTP_CLIENT_ACCESS HANA_STUDIO HANA_DATABASE_CLIENT HANA_SYSTEM_REPLICATION HANA_HIGH_AVAILABILITY HANA_DATA_PROVISIONING"
...
However, when executing 'hana-firewall dry-run' the following error was observed instead:
# hana-firewall dry-run
ERROR: Interface bond0:hanaph1 doesn't exist on the system.
Resolution
This is due to the limitation on the NIC checking function used in hana-firewall script (HANA-Firewall-1.1.4-6.1). PTF was built and pending for confirmation. Customers encountering this issue should open a request with Technical Services to obtain a program Temporary Fix (PTF). Patch will be provided in future release.
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:7021193
- Creation Date: 10-Aug-2017
- Modified Date:03-Mar-2020
-
- SUSE Linux Enterprise Server for SAP Applications
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
