VM creation status reports as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Technical Articles ID: KB91070
Last Modified: 5/7/2020

Environment

McAfee Advanced Threat Defense (ATD) 4.6.0

Problem 1

After you migrate to ATD 4.6.0, automatic VM creation runs as part of the migration process. But, you see that the VM creation status indicator reports as Failed after the automatic VM creation has finished running.

Problem 2

The ATD console screen reports that the DHCP service fails to start during operating system boot sequence.

System Change

You migrated to ATD 4.6.0 using migration-4.6.0.21.517580.msu.

Before applying the migration package migration-4.6.0.21.517580.msu, your ATD was configured with non-default internal network for sandbox VM, which is either 192.168.50.0 or 192.168.112.0.

NOTE: This issue does not happen if you are using the default internal subnet 192.168.122.0.

Cause

The migration package migration-4.6.0.21.517580.msu does not migrate the internal DHCP server configuration properly when a non-default internal network is used for sandbox VM. Because the configuration is not migrated, the internal DHCP server fails after the completion of migration.

The VM creation process monitors network activity from the sandbox VM that is being created. If there is no network activity from newly created VM, the VM creation process considers the VM has failed to start and treats the entire VM creation as a failure.

The sandbox VM must obtain basic network information, such as its IP address, from the internal DHCP server. But, because the DHCP service fails to start, the sandbox VM being created fails to retrieve a basic network configuration. So, the VM creation process does not see network activity from the VM being created, and the entire VM creation process fails.

Solution

This issue is resolved in ATD 4.6.2.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

IMPORTANT: First verify your internal network setting for sandbox to determine if this problem affects you.

Log on to the ATD CLI using cliadmin credentials.
Type show internal net and press Enter to verify your internal network address:
- If your sandbox network is either 192.168.50.0 or 192.168.112.0, this problem affects you. Continue to the following steps for the workaround.
- If your sandbox network has been 192.168.122.0 before and after migration to ATD 4.6.0, you are not affected with this problem.

IMPORTANT: The following steps require you to toggle internal network settings, which overwrite the damaged DHCP server configuration file in the back-end. As part of the process, your ATD appliance reboots and runs the process for re-creating VMs. The whole process can take several hours if you have many VMs hosted on your ATD.

Log on to the ATD CLI using cliadmin credentials.
Type set internal net sandbox 192.168.122.0 and press Enter. You are prompted for confirmation. Type Y to confirm and continue.
Wait for the ATD reboot and VM creation to finish.
Depending on your network design:
- Type set internal net sandbox 192.168.50.0 and press Enter
  Or
- Type set internal net sandbox 192.168.112.0 and press Enter.
You are prompted for confirmation. Type Y to confirm and continue.
Wait for the ATD reboot and VM creation to finish.
Check the VM profiles:
1. Log on to the ATD web manager using admin credentials.
2. Navigate to Policy, VM Profiles.
3. Confirm that the VM licenses are present:
  - If VM licenses are present, continue to the next step.
  - If VM licenses are not present:
    1. Click New and re-create the VM profile again.
    2. Complete both the Activate and Validate actions for your VM.
    3. Enter the license number and click Save.
      For more information, see the "Create VM profile" section of the ATD 4.6.x Installation Guide.
Check the analyzer profiles:
1. Log on to the ATD web manager as admin.
2. Navigate to Policy, Analyzer Profiles:
  - If the operating system name for the analyzer profile contains the expected VM, continue to the next step.
  - If the operating system name for the analyzer profile does not contain the expected VM:
    1. Click Edit.
    2. Select the appropriate VM profile in the Analyzer Profile setting.
    3. Click Save.
Test the VM by manually submitting a sample to ATD. Use the analyzer profile you have checked in the previous step.

Affected Products

Advanced Threat Defense 4.6.x (EOL)
Known Issue/Product Defect
Upgrade/Migrate

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

VM creation status reports as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Environment

Problem 1

Problem 2

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

VM creation status reports as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Environment

Problem 1

Problem 2

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title