SNS-36xx BIOS Configuration

[Thomas Schmitt]

Hello,

I Activated UEFI Secure boot on SNS-3655 Applience and tryed to install ISE Application afterwards, but the possibility to boot from HDD is gone and I can't find anywhere a guide for BIOS configuration, because I changed almost every option, resetet multiple times to factory defaults but it doesn't work.

So I have 2 1/2 Questions:

1: is there some BIOS and RAID configuration guide for SNS36xx Applience?

2. How important is Option ROM for MRAID controller? Could this be the issue? (also after HUU for ISE usage and disabling from all unused Option ROM slots, its still not loaded)

and optional, 1/2 question, is there a short cut from uefi shell and/or from grub to check, if there ISE Apllication to load? -Just commands, without reading a book about UEFI and an additional book about grub? Because I have UEFI RHE Linux boot option, but it leads to grub and I think its because ISE installation cant be completed, but I'm not sure.

[Arne Bier]

Oh dear - did you by any chance upgrade the firmware on that UCS? The only firmware that will allow ISE to boot are the versions found under the ISE download section - all other UCS versions will prevent ISE from booting.

I was under the impression that SecureBoot was already enabled from factory.

Unfortunately, I don't have a SNS server to check settings - but I think TAC would be able to help you get this box back to its intended settings. It's best not to mess around in the BIOS.

[ahollifield]

@Arne Bier is correct, only specific BIOS versions listed on the ISE downloads page are supported.  SecureBoot should also have been enabled at the factory.  Field modification of any SNS BIOS is typically not needed.

[Thomas Schmitt]

Hello,

sure I use BIOS and Firmware for SNS appliance (with ISE in the name) and no, secure boot isn’t enabled by default, but, perhaps, is configured as manufacturer default, because even with reset to manufacturers default it’s not disabled.

also I opened a TAC and there are meanwhile 3 engineers on this issue, but they have no Idea what’s wrong and advice me just to replace raid controller, because after selecting HDD as boot option, actual boot order doesn’t change.

From my site, it isn’t an applicable option, because that appliance is already placed in customers DC and I have only L1 support onsite (mount appliance in rack/ take it out/ (dis)connect cables) and TAC can’t replace the whole appliance. Also time is one factor 

so it’s pretty miserable situation and I can’t even find a configuration guide 

[ahollifield]

Its possible that the RAID controller had a hardware of software failure during the upgrade.  The HHU will also upgrade the firmware of the RAID Card.  I think your only recourse at this point is to the follow the TAC process and get someone on-site who can replace the RAID Card.

[Thomas Schmitt]

Thank you for advice, but the question about Option ROM remains. How important is Option ROM for UEFI secure boot? Because I can see errors in log regarding Signature of some (4) software (unfortunately software name or something usable for identification isn’t  specified in that log)

Could Option ROM be the root case?

[Arne Bier]

If I had an SNS server to log into I would gladly tell you what a healthy system should look like. I would expect the TAC to be able to provide you screen-by-screen details to nurse that server back to health. 

What I am curious to know is, how did you get into this mess in the first place?

The server comes from factory in working condition. In most cases I just run the ISE HUU (Host Update Utility) and also if the ISE version is too old, I boot from the latest .ISO.

I am looking at a vanilla UCS C220M5 (not an SNS server) - Have you tried this?

And then there's this more drastic option

Another thing you might try is to post a question on the UCS Discussion Forum.

I don't know what the "Option ROM Status" really means, because on my UCS C220 M5 I am using RAID and the Network cards, but it says "Not Loaded"

One thing is clear - the SNS servers are so "special" that you can never boot another OS since Cisco has done something to it to prevent you booting anything other than ISE. Others have tried and failed. It's possible that they do something we have no access to.

[Thomas Schmitt]

I figured out an interesting issue.

If I try to install ISE from life USB stick (created and multiple times verified, following Cisco guide) , I get "error populating transaction" anaconda error

anaconda error

Also, if I try to install ISE from vKVM mapped ISO image, i get the same error.

But, if I remove the USB stick or disable USB port, ISE installation via mapped ISO Image continue like it should be till some point (depends on ISE version) and then hangs up. For example version 2.7 hangs up (10+ hours) on "CARSisePKG1 565/600",

Any Idea, whats wrong?

[davidgfriedman]

If we use the mapped ISO image, we often see hangs and sometimes the "Pane is dead" message as well. The freezes and pane messages are confirmed by Cisco TAC as being networking problems behind the scenes.  That's why we switched to USB, though we have not seen your particular USB problem.  The USB for us usually runs hell fast, letting us re-image the appliance in 45m - 1hr, before we can start executing the first-time login "setup" user / process.

[Thomas Schmitt]

I can exclude network issues, because I'm responsible for the network an there are no problems in LAN (like packet loss, Jitter, delay and so on). Furthermore, previously I configured a dedicated CIMC interface in a separate OoB network, so there ware multiple firewalls on the way, but now I changed CIMC network configuration to shared LOM, so the whole traffic is within LAN.

Bad HTML5 network driver is highly likely responsible for "network issues", in previous CIMC versions java was available vKVM and ISO image mapping, but it was "optimized"

[thomas]

Sounds like a good issue for TAC to troubleshoot or help with.

[Thomas Schmitt]

TAC is for now with 4 engineers, they are helpless. For now I was able to install ISE application from USB using another stick and front USB port (with adapter). But ISE Application still can't start because of "database priming failed" error while setup

It`s pretty sad situation, TAC doesn't have permission (from their managers) to replace the whole SNS Appliance and has no idea what's wrong. So they just advice me to replace one part after another (now I should replace the main board)

[Thomas Schmitt · Accepted solution]

Just for the case, someone has the same question and is looking for the answer:

1. you can, but don’t have to change BIOS configuration; manufacturer defaults are OK (in bold). You should check remote management settings.

2. RAID configuration isn’t part of manufacturing defaults, but you can recreate it. First create 2 RAID 1 groups and then connect them with RAID 0 in the same configuration step (or first RAID 0, then RAID 1, I don’t remember exactly)

3. ISE Application doesn’t require loaded OpinionROM.

4. 2 x 2 critical errors about not loaded drivers because of invalid UEFI signature do not cause any trouble.

5. Root cause for “Error populating transaction, anaconda is retrying” message was defect life USB stick. This error appeared also by installation via vKVM from mapped ISO image, while USB stick was inserted. Only after disabling USB port, this error disappeared 

5a) according to TAC, you should change the Motherboard in this case.

6. Another USB stick, created with fedora, and connected through adapter to USB front port, solved all problems and I was finally able to install ISE

6a) don’t try to install ISE via vKVM. I tried it at least 20 times with different ISE versions (2.4, 2.6, 2.7), 3 different BIOS und Firmware versions, also old one with Java. I even changed dedicated OoB CIMC interface to shared LOM for direct LAN access, it doesn’t changed anything. I waited 10+ hours to complete the installation 

7. after successfully installation, select from advanced boot option local HDD with “MRAID” option and ISE should automatically appear as boot name