Management Center HA Failover Fails Due to Missing SSH Host Keys

Products

• Management Center
• Management Center - VA

Issue/Introduction

When attempting to configure High Availability (HA) failover on Management Center (MC) version 4.1.x post upgrade from 3.3.x, the secondary node may fail to join the primary with a communication channel error.

The secondary node fails to establish the initial connection to the primary.

 

Environment

Management Center: 4.1.x

Cause

The failover_sshd service on the primary node is trapped in a crash loop because it cannot find or load the required ECDSA host keys. Since the service is not running, it does not listen on TCP port 2025, causing the secondary node's connection attempt to be refused.

Resolution

Recreate the missing SSH host keys on the Primary Management Center via the serial console. 
Please perform the below steps:

1. Log into the Primary Management Center CLI.
2. Run the following commands:

enable# configure terminal
(config)# ssh-console
(config-ssh-console)# host-keys
(config-host-keys)# create key-type ecdsa key-curve nistp256

3. If the output returns "already exists", delete the existing key first and then recreate it:

(config-host-keys)# delete key-type ecdsa
(config-host-keys)# create key-type ecdsa key-curve nistp256

4. Re-initiate Failover:

 Primary: Run failover make-primary to generate a fresh token.
 Secondary: Run failover make-secondary using the new token.