DHCP Autoconfiguration

[NetworkSeb]

Hi All,

I'm currently looking to setup DHCP autoconfiguration for some of our switches which I've managed to setup and is working well on my test environment.

With DHCP auto conf the notes say the config served by a TFTP server (option 67) has to be one generated from a switch. We're hoping to have a system where we can generate these configs ourselves allowing us to, for example have the configs generated before the switches actually arrive!

So therefore, my question is, how does the switch know that a config is one generated from a switch and not user generated? I've diffed, cmp'd, checksummed and visually inspected but I can't figure it out! As the nores say, the using a config we've modified results in the switch in a reboot loop of applying the same config over and over.

Thanks,

NS

[Dennis Handly]

What model switches do you have?

[NetworkSeb]

We have a variety of procurve switches : 2626, 2610, 2620, 2910, 2920, 5406, 8212. I was hoping that the mechanism behind the checking would be the same across all the HP procurve range!

[EricAtHP]

If you look at the top of the config output, it shows the model of switch and version information. In the past, I have created a config on a switch, copied it off, edited it for another identical switch with only minor differences and it worked beautifully. While it is possible to create config files for a different model switch, the chances of messing it up grow greatly. I think the support statement just indicates that the support teams won't help you because it is too easy to mess things up.

You do have another option too. IMC has the ability to automatic deployment of new switches based on a template and a list of unique info like IP address, hostname, etc.

So the mechanism is basically just the text at the top of the config file. Nothing too special.

You also mentioned that some people have mentioned boot loops. The process works like this. The switch boots and requests an IP address. If the DHCP server is configured with a reservation for that switch and it includes the config file name and TFTP server address, the switch will download the file and compare to its saved config. If it is different, then it replaces the saved config with the downloaded config and reboots. If it is the same, which it hopefully will be the second time around, it will finish the boot process. You can imagine that if the TFTP version of the config file referenced a port that doesn't physically exist, thent he downloaded config will never match the saved config and the switch will continuously reboot.

Does that help?

[NetworkSeb]

Thanks, that is helpful. 

I'm currently looking at our 2610s and they don't seem to have a ; Ver line (I call it a version string) in their running config, is this something that was introduced only in newer switches? If so, how does the checking work for older switches with no version string line?

Also does the number in the version string increment in some way or does it just need to be present and correct similar to the model and firmware line?

Thanks once again!

[EricAtHP]

The version string is new but is ignored for this purpose. It is just the J number, the part number, at the beginning of the first line that is checked. On some switches it is possible to include a "IGNORE" string after the J number to make a more universal config. Check out the Mgmt & Config Guide for your switches. I was looking at the guide for a 5400R but found the same functionality on a 2530. When you copy a config off a switch add the "add-ignore-tag" option at the end of the copy command.

[NetworkSeb]

Thanks Eric, you've helped us nail down what we think may be a bug!

We've ended up going through our config and uploading the config to the tftp server line by line and reloading in between.

When we add an ip authorized manager for a specific host on a 255.255.255.255 netmask, the switch protests and ends up in a boot loop. e.g.:

ip authorized-managers XXX.XXX.XXX.XXX 255.255.255.255 access manager

adding a whole subnet the switch seems to be happy. e.g.:

ip authorized-managers XXX.XXX.XXX.0 255.255.255.0 access manager

Interesting this works okay with offering a 255.255.255.254 netmask (tieing down to two addresses) but obviously we want to tie access down to only 1!

Any pointers to why this may be the case? We're using a HP 2610-24 (J9085A) as our test switch on firmware R.11.112.

Thanks,

NS

[NetworkSeb]

Just in case anyone else is following this thread or finds it in the future, we have the same issue as above when enabling snmpv3. Once it is enabled the switch always sees the config as 'changed' or 'different' and ends up in a reboot loop.

We are therefore having to append "no dhcp config-file-update" to the end of our configs and manually remove them when we want the switch to fetch it's config from our tftp server.

Thanks for all your help, Eric!

[EricAtHP]

Interesting. When you enable SNMPv3, it generates an engine ID. I wonder if it is what is causing the problem. Try issuing the "include-credentials" command so that it will be included in the config instead of hidden in the background. Regarding the ACL issue,  I would recommend that you contact support so that they can investigate and report the issue.