topic Re: PnP: System health check error? in Controllers

PnP: System health check error?

bsestan71 — Fri, 01 Mar 2019 12:31:24 GMT

Hi all,

I've recently started to test the PnPapplication with some switches.

Option 43 is configured and my switches get listed in the unplanned device section.

However, when I am trying to provision them with some uploaded configuration, the status gets to ´Device_conf´ state but ends up in an ´Error´ as in the picture below.

The strange thing is, the configuration file gets fully uploaded on the devices but once the error appears, no further actions are possible (usage of the device in a project,...etc).

Can anyone please explain to me the meaning of this error?

Thanks in advance!

-B

Re: PnP: System health check error?

sairasan — Wed, 21 Sep 2016 18:05:21 GMT

Hi Belma,

Could you verify if device has connectivity to APIC-EM after the config push?

Re: PnP: System health check error?

aradford — Wed, 21 Sep 2016 21:38:31 GMT

Not wanting to jump to conclusions here, but does your config have "aaa authorisation" commands in it?

Re: PnP: System health check error?

suchhegd — Wed, 21 Sep 2016 21:55:00 GMT

It looks like pnp server did not receive any response from the device/agent and the pnp device is the same state in this case in PROVISIONING_CONFIG state for more than 16 minutes.If no response is received for a request from the agent the pnp service moves the device to error state after 16 minutes.Could you please check whether the device is able to ping the ip address of the cluster on whice the pnp-service is running.

Regards

Sucheta

Re: PnP: System health check error?

bsestan71 — Thu, 22 Sep 2016 07:21:56 GMT

Yes, the controller is pingable from the switch... any ideas about it?

Re: PnP: System health check error?

bsestan71 — Thu, 22 Sep 2016 07:23:35 GMT

Yes, there are some aaa authorisation commands. Can you explain to me why this could cause the issue?

Re: PnP: System health check error?

bsestan71 — Thu, 22 Sep 2016 07:27:32 GMT

The controller is pingable after pushing the configuration... I read sth about the VLAN 1 and how it is used by default for the pnp communication, but in my config file it is used for sth else, could that be the possible reason? But I don't get why it needs it at all if there is communcation established on an IP layer?

Thanks for your help in advance!

-B

Re: PnP: System health check error?

aradford — Thu, 22 Sep 2016 07:31:09 GMT

If you are using non-vlan 1, you should use the pnp startup-vlan command on the upstream device.

Re: PnP: System health check error?

aradford — Fri, 23 Sep 2016 01:01:32 GMT

yes. There is an issue with "aaa command authorisation" commands. A long story as to why, but they cause a problem today.

aaa authentication is ok.

we are going to resolve the "aaa command authorisation", but it is a problem now.

Do you have that in your configuration

Re: PnP: System health check error?

bsestan71 — Fri, 23 Sep 2016 06:20:45 GMT

Yes, I have aaa authorization commands... Is there a way to walk around the problem?

Re: PnP: System health check error?

aradford — Fri, 23 Sep 2016 06:24:24 GMT

not today. People are using PI to push that bit of the config post deployment.

we are working to address this.

specifically it is the "command authorisation" that causes the issue.

The config actually works, it is just PnP application thinks it has failed.

Re: PnP: System health check error?

bsestan71 — Fri, 30 Sep 2016 08:54:13 GMT

Thank you for your inputs.

VLAN 1 is issued in our configuration for some other process and the manuals say it’s the default one for communication in the PnP process.

But could you maybe explain the usage of the VLAN for the communication between the controller and the device?

Will it use any other available VLAN if VLAN 1 is not available?

Why is communication on a VLAN level necessary if there is an IP layer communication ?

Re: PnP: System health check error?

aradford — Fri, 30 Sep 2016 11:38:14 GMT

when you have a device (switch) and it boots up, the only VLAN that is defined is VLAN1.

DHCP runs and assigns an IP address to the interface VLAN1. (interface vlan 1 is an SVI, if you are familiar with that term).

This IP address will be used to communicate to the APIC-EM as VLAN1 is the only interface that will have an IP address and is the management IP address.

If you wish to use a different VLAN for management, then you need to tell the switch to boot up and run DHCP on a vlan interface other than vlan 1.

You use the "pnp startup-vlan xx" command on the upstream device. When the pnp switch boots up, it will use CDP to discover the upstream neighbour and be told to use vlan "xx" for management ("xx" is the vlan number eg. 22). The switch will first create the SVI "interface VLAN xx", and use DHCP to get an IP address. it will then use that IP address for communication. All active ports on the switch will also be in vlan "xx".

I hope that helps.

Adam

Re: PnP: System health check error?

bsestan71 — Mon, 03 Oct 2016 13:08:33 GMT

It definetly puts some light on the issue...

is there a way/command to get some debug messages,logs,... to see if it really is due to the vlan setup?

Re: PnP: System health check error?

aradford — Mon, 03 Oct 2016 23:12:39 GMT

the simplest way is to see if you can ping the controller when the device has an issue.

apart from that there are the following debugs:

pap-switch: debug pnp all

upstream switch: show cdp tlv app

if pnp-startup vlan is doing the right thing, you should see the following:

- interface vlan xx created

- and active ports will have the following configuration

interface GigabitEthernet1/0/48

switchport access vlan XX

macro description CISCO_SMI_EVENT

Re: PnP: System health check error?

bsestan71 — Tue, 04 Oct 2016 06:28:38 GMT

Thank you for your help! I'll try to do some debugging and hopefully resolve the issue.