APIC-EM and 2960 stacking switche

[jwiget]

Dear all

I do my first steps with APIC-EM PNP version 1.3.1.9

What works is to deploy images and configurations to standalone switches like 2960S and 2960X.

Now I'm trying to do the same to 2960S an 2960X stacked switches.

At the projects in device configurations, I tried all possible options but not one helps to start the update.

I get an error:

On the switch I cleared all possible pnp entries:

crypto key zeroize

no crypto pki certificate pool

no pnp profile pnp-zero-touch

end

wr er

del nvram:*.cer

Is there a trick or did I forgot a seeting at APIC-EM?

Thanks and Best Regards

Jochen

[Vincent Fortrat]

Hi Jochen,

I have exactly the same issue as you. I am using APIC-EM 1.3.2 and a stack of two 2960X running 15.2(2)E5 out-of-the-box. They are plugged on a stack of 3650 running IOS 16.3.2.

Any idea ?

Vincent

[aradford]

I will check on this.  I have not tested stacking on 2960, will chat to engineering.

Adam

[aradford]

It is supported and has been tested.

Are you configuring the PnP rule as a stack?

Adam

[Vincent Fortrat]

Hi Adam,

Yes, stacking is enabled on the PnP rule :

The stack is even correctly discovered by APIC-EM :

I have the same behaviour as Jochen. Here is the last logs I got from APIC-EM :

Failed health check since device is stuck in non-terminal state DEVICE_INFO_REQUESTED for more than threshold time: 0 hours, 16 minutes, 0 seconds

[aradford]

Thanks for that.

Do you have console access to the 2960 stack?  Can you ping the APIC-EM server from the 2960?

Has the config been pushed at all to the switch?

Are you using VLAN 1 for management vlan?

One other thing (and I hate to ask this), I have been testing with 12.2(5b), might be worth trying a later version of PnP agent (just to rule out software).

Adam

[jwiget]

Hi Adam

I create a project with PNP rule stacking as Vincent.

The project discover all stacks members..

I had checked the project status when the job starts

1. connect to the devices

2. established a secure channel to the switches

3. Get device information

... and at step 3 the job goes in a time out.

Has the config been pushed at all to the switch? .... I wan to check this.

I made a sniffer trace and the switche had all the time connection to the APIC-EM.

My uplink switch has a different VLAN than VLAN1. I use the VLAN 592 and the  uplink port is configures as access port.

I try the version 15.2.2E3 that is the min. recommended version for the 2960S switches.

Jochen

[Vincent Fortrat]

Same observation as Jochen.

To me, the configuration is not pushed as it occurs after the IOS upgrade.

I've been using the same configuration which worked for a standalone 3560CX : PNP in VLAN201, Dynamic desirable mode and port-channel with VLAN 999 as native configured on the upstream switch.

I will try upgrading the 2960X to a more recent IOS release to check.

Vincent

[Vincent Fortrat]

Same behaviour after upgrading my stack to 15.2(4)E2. After the job times out, I am still able to reset it which cleans the device configuration and reload it. Means that communication with APIC-EM is fine.

[Vincent Fortrat]

When I enable debug pnp all on the stack, I have these logs over and over :

Jan 10 16:29:45.059: PNPA-inventory:

Stacked switch udi[1]:PID:WS-C2960X-24PS-L,VID:V04,SN:FOC2030V0H4

Jan 10 16:29:50.264: PNPA-infra: PKI Initialized[0]

Jan 10 16:29:50.264: PNPA-infra: Failed to start SUDI pki session

Jan 10 16:29:50.264: PNPA-connection: _psm.54.encap=pnp

Jan 10 16:29:50.264: PNPA-connection: _psm.54.wkr.don=A6903D4 rcp=pnp-zero-touch

Jan 10 16:29:50.264: PNPA-connection: _pnms.msg=A6903D4 xet=3

Jan 10 16:29:50.264: PNPA-connection: _ppsm.snd.don=A4E4F40

Jan 10 16:29:50.264: PNPA-connection: _psm.54.snd.don=1 stc=0

Jan 10 16:29:55.706: PNPA-infra: PKI Initialized[0]

Jan 10 16:29:55.706: PNPA-infra: Failed to start SUDI pki session

Jan 10 16:29:55.706: PNPA-connection: _psm.55.encap=pnp

Jan 10 16:29:55.706: PNPA-connection: _psm.55.wkr.don=A69058C rcp=pnp-zero-touch

Jan 10 16:29:55.706: PNPA-connection: _pnms.msg=A69058C xet=3

Jan 10 16:29:55.706: PNPA-connection: _ppsm.snd.don=A4E4F40

Jan 10 16:29:55.706: PNPA-connection: _psm.55.snd.don=1 stc=0

[aradford]

Engineering has been able to reproduce this issue.  Standby for an update.

[Vincent Fortrat]

Great ! Thanks Adam, let us know when you have an update. For the moment, I will try deploying the first switch in the stack as standalone, pre-provision the others and power them on when PnP is finished. Should work.

[jwiget]

Great! Thanks Adam for your assistance.

Wait for the update. We use the APIC-EM first in our test environment, so I can test no our other switches 3650 an 3850.

[aradford]

yes, I have tested stacking of those.  They should be fine.  I have documented a few things in my  PnP blogs.

Adam Radford's Blog

[casanavep]

Figured that issue out.  Must use TAR images when stacking.  This forces the use of archive download-sw method, which patches all stack members vs the master switch only.