New pvs 2209 servers not working

[Dennis van der Velde]

Hello all,

 

Recently we added 2 new pvs machines to our farm, but now that we try to boot devices from these machines they hang at "Connecting to the Provisioning. Please wait..." before timing out

 

We are using Xencenter 8.2 with W10 / VDA 2212 / PVS 2209 and our devices have a seperate BDM partition.

We checked and tested everything, but maybe we are missing something.

 

 

 

[Robert Young1709152714]

Can both PVS servers access the vdisk ? is the replication and version status ok across all PVS Servers ? 

[Dennis van der Velde]

Hello Robert, both servers can reach their stores and replication status is ok.

We don't use versions.

[Carl Fallis]

So the login you posted it is going to a login in server in the PVS site you want and the PVS server you added to the farm are in that site set to service the vdisks and targets in the site?  The PVS server show up in the same site in the console as the other servers? 

[Dennis van der Velde]

1 hour ago, Carl Fallis said:

So the login you posted it is going to a login in server in the PVS site you want and the PVS server you added to the farm are in that site set to service the vdisks and targets in the site?  The PVS server show up in the same site in the console as the other servers? 

 

This is correct, both servers show up just fine in their respective sites, devices that we boot with any of the pre existing pvs servers boot just fine.

[Kelan Rowe]

The target (screenshot local ip) gets no response (or no useful response) to PVS login packets sent to that pvs server (screenshot login server ip and port 6910).
Wireshark on that PVS server while booting should show packets arriving and replies going out.
Procmon on that PVS server could show same packets, and perhaps some additional useful detail.

What does resource manager show for listening ports

 

[Dennis van der Velde]

15 hours ago, Kelan Rowe said:

The target (screenshot local ip) gets no response (or no useful response) to PVS login packets sent to that pvs server (screenshot login server ip and port 6910).
Wireshark on that PVS server while booting should show packets arriving and replies going out.
Procmon on that PVS server could show same packets, and perhaps some additional useful detail.

What does resource manager show for listening ports

 

 

Hello Kelan,

 

I'll get on those traces today.

 

Our resource manager looks identical to your screenshot.

[Dennis van der Velde]

Hello all, we found the issue!

 

These new machines are Server 2019 and got a new set of gpo's from our infrastructure team, we just removed these and streaming started to work, we're now going to take a closer look at these policies.

 

Thanks everyone for your input!

[Robert Young1709152714]

Great news. Please let us know what policy was causing it. We'll get it created into a KB article for others. 

[Dennis van der Velde]

On 5/16/2023 at 2:32 PM, Robert Young1709152714 said:

Great news. Please let us know what policy was causing it. We'll get it created into a KB article for others. 

 

I've just been made aware that this policy is the newest server 2019 security baseline as described by microsoft, do you know of any other customers with similar issues?

[Robert Young1709152714]

Hi Dennis, Checked some recent cases but no others reporting similar. 

 

Are your policies to allow all the PVS traffic in place over the baseline policy ? 

https://docs.citrix.com/en-us/tech-zone/build/tech-papers/citrix-communication-ports.html#provisioning-services

 

[Dennis van der Velde]

1 hour ago, Robert Young1709152714 said:

Hi Dennis, Checked some recent cases but no others reporting similar. 

 

Are your policies to allow all the PVS traffic in place over the baseline policy ? 

https://docs.citrix.com/en-us/tech-zone/build/tech-papers/citrix-communication-ports.html#provisioning-services

 

 

Hello Robert, Thanks for checking!

Yes these are still in place, we've just tested some main suspects but so far nothing yet.

[Eric Sim]

Hey Everyone,

My first post here and I have been pulling my hair out for the last week on this issue.   

I'm having a similar issue with BDM with a boot partition on the Target Devices.  This is a new\fresh install of LTSR 2203 CU3 on Win2019 PVS servers.  Works fine if the PVS servers and Target Devices are on the same subnet.  However, if the Target Device and PVS servers are on different subnets I get the "Connecting to the Provisioning. Please wait Login request timed out!" message.   Everything appears to be passing according to the network level firewall logs and the Windows Firewall is off on the PVS severs.   If I disable the target device or remove the vDisk from it via the PVS console, the Target Device does recognize it and it displays a message on the bootup screen.  I mention this because it appears there is at least at some level of two-way communications between the PVS server and Target Device when on different subnets.  Even in Resource Monitor of the PVS there is network activity to the Target device.   Not sure what else to check at this point.     

 

Thanks,

Eric