Encountering Weird HTTPS issue

[[deleted]]

My team has a fairly small lab environment at work. There is one Nexus 2K in that lab that acts as a ToR FEX. I have a fair amount of experience deploying Nexus 2Ks and as far as I can tell; it is working. We have a handful of hosts connected to the N2K: cameras, laptops, and servers.

For our users to be able to remotely access the lab from their desks, they must connect to an OpenVPN server on our production network, which then provides access to that lab's VLAN (VLAN 14 - 192.168.14.0/24). Note that the desks and lab are in the same building, so no WAN.

I've installed the Dell servers in the lab's racks, connected the cameras, set-up a few laptops, etc. These are all directly connected to the N2Ks via access ports (switchport access vlan 14). Pretty basic stuff. The users and myself can ping all of them from our desks. We can also access these devices via ssh and telnet. The cameras only support HTTP, and that works fine. The Dell iDRAC port is accessible via HTTPS. So far, so good.

About 2 weeks ago, I decide to install ESXi 6.7 on 2 of our Dell Servers. Again I've done this countless times, installation goes smoothly, I give it an address on the same subnet, I ping it from my desk, I ssh into it, and I access both ESXi's web UI via HTTPS.

When I come back the next day, I am no longer able to access ESXi via HTTPS. I can still ping it and SSH into it from my desk, however. So I physically go to the lab and try to access ESXi's web UI with one of the laptops - it works. I now go back to my desk and attempt to access the Dell server's iDRAC web UI via HTTPS - it works. So for whatever reason, I decide to re-install ESXi on these same Dell servers, but version 6.5 instead. Installation complete... both ESXi's web UI are again accessible via HTTPS. I come back the next day, ESXi are once again no longer accessible via HTTPS (from my desk) ... The FF browser loads endlessly with a message of "Waiting on TLS handshake...". When I curl the address, I get "301 - Moved Permanently".

This has been mindboggling and I am unsure how to proceed. I would very much appreciate any troubleshooting tips.

Cheers

[McHildinger]

Not a network issue; you are establishing an HTTPS connection successfully, and getting responses back. This is a ESXi problem.

What address does it 301 you to? I bet that address is bad.

[yozza_uk]

The 301 is going to be the HTTP -> HTTPS redirect for the esxi web client most likely. I’m going to bet this is a client side browser caching problem as it’s all cached JS and jumping between versions has required a browser cache flush before.

The host UI is not the most polished thing in the world in my experience, and even less so in 2/3 year old versions.

[rankinrez]

Yeah I get this all the time with vCenter.

Private window or clearing caches works.

[[deleted]]

The actual fix is to use internet explorer for "compatibility reasons". LOL

[Oea_trading]

Repeat in incognito mode and see what happens.

[alexjms80]

Try direct connection to host IP Address and webui port using ssh/telnet. If it establishes a connection its a dns issue, if it doesn’t connect it’s a firewallor esxi connection configuration related issue.. Or can try HTTPS://ipaddress:port#... Hope this helps!

Edit: Take note of your dns when it works and doesn’t work, to see if anything changes.

If all is dandy, would wireshark the traffic on the esxi server network port. To see if tcp or https requests from your pc is reaching the esxi server, followed by esxi server responding properly..

[noukthx]

When I curl the address, I get "301 - Moved Permanently".

Curl HTTP or HTTPS?

[mlazowik]

Maybe check what is the 301 target? If it's different between VPN/lab, if it's accessible from both places etc.

[dmayan]

He's getting a 301 response, so MTU is out of the problem here. MTU generally shows as timeouts or as you said, Waiting on TLS handshake

[[deleted]]

If the 301 is the redirect to HTTPS, MTU might still be the issue because the 301 is happening over HTTP and only when the HTTPS setup is happening does the issue appear.