TCP Offload features on all Mellanox NICs must be disabled before installing vCenter Server Heartbeat

Products

• VMware

Issue/Introduction

Symptoms:

After installing vCenter Server Heartbeat on a server with TCP Offload Engine (TOE) enabled Mellanox NICs, you may experience these symptoms:

• Operating system failure (blue screen error)
• Packet filter installs but cannot filter traffic
• Packet filter installs but the server is not visible on the network

Resolution

vCenter Server Heartbeat is incompatible with TOE, a common feature of 10GB Ethernet cards.

Some newer models of Ethernet cards offer a TOE to help manage TCP/IP communications. vCenter Server Heartbeat is intended to manage the passing or filtering of selected IP addresses, therefore the TOE function must be disabled to allow vCenter Server Heartbeat to exercise intelligent control of TCP/IP communications, depending on whether the server is the active or passive server.

Prior to installing vCenter Server Heartbeat, you must disable these TOE features on all NICs:

• Offload IP Security
• Offload TCP Segmentation
• Offload TCP/IP Checksum

To disable these features:

1. Locate these features on the Advanced tab of the NIC Properties dialog (Computer Management > Device Manager > Network Adapters). Depending on the NIC and driver combination, the features may be called by slightly different names than those listed above. Consult the NIC documentation before making any changes.
2. Uninstall the Packet Filter
   1. Stop the vCenter Server Heartbeat service and set NFserverR2 service to manual for the duration of this procedure.
   2. (Skip to step c if the server does not use teamed NICs.) Dissolve any existing NIC team using the vendor-supplied software.
   3. If uninstalling on a Passive server, disconnect the Public Network Cable.
   4. From a command prompt change the directory to C:\VMware\vCenter Server Heartbeat\r2\bin.
   5. Run the command:
      
      nfpktfltr uninstall "\VMware\vCenter Server Heartbeat\r2\drivers\nfpktfltr\"
      
      
   6. Delete C:\winnt\system32\drivers\nfpktfltr.sys.
   7. Delete C:\winnt\nfpktfltr*.
   8. Verify that these key(s) have been removed:
      1. Open Regedt32.
      2. Go to HKLM\SYSTEM\CurrentControlSet\Enum\Root\nfpktfltr_mp (highlight nfpktfltr_mp if it exists) and select Security from the menu.
      3. Assign Full Access to the Everyone and System groups (if not already assigned). If there are any other groups without Full Access, assign them the same access as well.
      4. Delete this key.
      5. Follow steps a-d above for CurrentControlSet1 and CurrentControlSet2 as required. The Miniport should be in the same location in the subfolders.
      6. Follow same procedure for HKLM\SYSTEM\CurrentControlSet\Services\nfpkfltr adding 'Full Control' where required to remove the keys completely.
      7. To confirm they have been removed, open Device Manager and select Show Hidden Devices. They should all be gone completely.
      8. Restart the server before re-installing and verify the keys have been removed from Device Manager.
         
         
3. Install the Packet Filter:
   1. Stop the vCenter Server Heartbeat services and set NFserverR2 service to manual for the duration of this procedure.
   2. From a command prompt change the directory to C:\VMware\vCenter Server Heartbeat\r2\bin.
   3. Run the command:
      
      nfpktfltr install "\VMware\vCenter Server Heartbeat\r2\drivers\nfpktfltr\"
      
      
   4. Select Yes to all the unsigned driver windows. (You may or may not see these).
   5. Deselect the checkbox for the filter from the VMware Channel NICs.
   6. (Skip this step if the server does not use teamed NICs.) Recreate the teamed NICs using the vendor-supplied software.
   7. Restart the server after installing the drivers.
   8. When the server has restarted, check the packet filter configuration with the commands getfilter and getstate (the servers should respond with PassThru on the active server and Filter on the passive server) and getloadstate (the servers should respond with Filter on both the active and passive servers).
      
      Note: The getloadstate command is only available in vCenter Server Heartbeat 6.3 and later.
      
      
   9. Reconnect Public Network Cable if installing on passive server.
   10. Set the NFserverR2 service to automatic again and start vCenter Server Heartbeat.
   11. If required, perform a series of test switches Primary to Secondary and then Secondary to Primary again. This will prove the packet filter is installed and operational.
   12. Uncheck the Packet Filter from the Channel NICs
   13. TCP Offload can be enabled on the Channel NICs but must not be enabled on the Public NIC.

Additional Information

vCSHB-Ref-1919

vCenter Server Heartbeat をインストールする前にすべての NIC で TCP オフロード機能を無効にする必要がある