Why is hub2 unable to contact MCN?

[Leon_P]

Hello all,

My setup has 2 hubs, Hub1 with 2 indexers and a Master Cluster node and hub2 with another 2 indexers and a standby Master Cluster node.

Hub1 is working as expected however hub2 is unable to contact the MCN.

None of the 3 servers in hub2 are able to do the health check of the MCN and when I do

“curl –k –vvv https://IP:8089/services/server/health/splunkd/local “

It just times out.

I can curl to the local MCN in each hub and get the expected Unauthorized reply but not between hubs.

When I do TCPdump I can see the traffic hitting the MCN but never completing. Below is the output of the connection,

* Trying IP

* Connected to IP (IP) port 8089 (#0

* ALPN, offering h2

* ALPN, offering http/1.1

* Successfully set certificate verify locations:

*  CAfile: /etc/pki/tls/certs/ca-bundle.crt

CApath : none

* TLSv1.3 (OUT), tls handshake, Client hello (1):

* OpenSSL  SSL_Connect : SSL_ERROR_SYSCALL in connection to  IP:8089

* Closing Cconnection 0

any help would be much appreciated

Regards 

Leon

[ITWhisperer · Accepted solution]

This doesn't appear to be a Splunk question, more a question for your network/infrastructure team.

For example, are the routing tables and switches set up correctly?

[Leon_P]

Hi,

Thanks, it was an MTU issue 🙂