VM creation status is reported as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Technical Articles ID: KB91070
Last Modified: 11/20/2018

Environment

McAfee Advanced Threat Defense (ATD) 4.6.0

Problem

You migrate to ATD 4.6.0 and automatic VM creation runs as part of the migration process. But, you see that the VM creation status indicator reports as Failed after the automatic VM creation has finished running.

Problem

The ATD console screen reports that the DHCP service fails to start during operating system boot sequence.

System Change

You migrated to ATD 4.6.0 using migration-4.6.0.21.517580.msu.

Before applying the migration package migration-4.6.0.21.517580.msu, your ATD was configured with non-default internal network for sandbox VM, which is either 192.168.50.0 or 192.168.112.0.

NOTE: This issue does not happen if you are using the default internal subnet 192.168.122.0.

Cause

The migration package migration-4.6.0.21.517580.msu does not migrate the internal DHCP server configuration properly when a non-default internal network is used for sandbox VM.
As the configuration is not migrated, the internal DHCP server fails after the completion of migration.

The VM creation process monitors network activity from the sandbox VM that is being created. If there is no network activity from newly created VM, the VM creation process considers the VM has failed to start and treats the entire VM creation as a failure.

The sandbox VM must obtain basic network information, such as its IP address, from the internal DHCP server. But, as the DHCP service fails to start, the sandbox VM being created fails to retrieve a basic network configuration. So, the VM creation process does not see network activity from the VM being created, and the entire VM creation process fails.

Solution

Technical Support is investigating this issue. As a temporary measure, implement the following workaround.

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Workaround

IMPORTANT: First verify your internal network setting for sandbox to determine if you are affected with this problem.

Log on to ATD CLI using cliadmin credentials.
Type show internal net and press Enter to verify your internal network address.
If your sandbox network is either 192.168.50.0 or 192.168.112.0, you are affected with this problem. Continue to the following steps for the workaround.
If your sandbox network has been 192.168.122.0 before and after migration to ATD 4.6.0, you are not affected with this problem.

Workaround:
IMPORTANT: The following steps require you to toggle internal network settings, which overwrite the damaged DHCP server configuration file in the backend. As part of the process, your ATD appliance reboots and runs the process for re-creating VMs. The whole process can take several hours if you have many VMs hosted on your ATD.

Log on to the ATD CLI using cliadmin credentials.
Type set internal net sandbox 192.168.122.0 and press Enter. You are prompted for confirmation. Type Y to confirm and continue.
Wait for the ATD reboot and VM creation to finish.
Depending on your network design:
Type set internal net sandbox 192.168.50.0 and press Enter
Or
Type set internal net sandbox 192.168.112.0 and press Enter.
You are prompted for confirmation. Type Y to confirm and continue.
Wait for the ATD reboot and VM creation to finish.
Check the VM profiles:
1. Log on to the ATD web manager using admin credentials.
2. Navigate to Policy, VM Profiles.
3. Confirm that the VM licenses are present.
  - If present, continue to the next step.
  - If not present:
    1. Click New and re-create the VM profile again.
    2. Complete both the Activate and Validate actions for your VM.
    3. Enter the license number and click Save.
      For further details, see the Create VM profile section of PD28107.
Check the analyzer profiles:
1. Log on to the ATD web manager as admin.
2. Navigate to Policy, Analyzer Profiles.
  - If the operating system name for the analyzer profile contains the expected VM, continue to the next step.
  - If the operating system name for the analyzer profile does not contain the expected VM:
    1. Click Edit.
    2. Select appropriate VM profile in the Analyzer Profile setting.
    3. Click Save.
Test the VM by manually submitting a sample to ATD using the analyzer profile you have checked in the previous step.

Affected Products

Advanced Threat Defense 4.6.x
Known Issue/Product Defect
Upgrade/Migrate

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

VM creation status is reported as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Environment

Problem

Problem

System Change

Cause

Solution

Workaround

Affected Products

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

VM creation status is reported as Failed after you migrate to Advanced Threat Defense 4.6.0 and perform automatic VM creation

Environment

Problem

Problem

System Change

Cause

Solution

Workaround

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title