Re: CNS v1.5 device config problems

jeff_caprock · ‎05-31-2006

We're running the 2116 appliance and Cisco 837 routers running 12.3.8T6 IP/FW/3DES code, and I'm having a horrible time creating my first cns router configs. I have enough created that when the 837 boots up, it successfully retrieves the initial config changes and installs the remaining cns parameters.

But, I can't get the 2116 to push changes down to the 837 nor will the 2116 push image updates. The cns debugs are saying that the socket was closed, that's it.

Does anyone have a sample cns config that they can share that shows how I can push the config changes and an IOS image to the router? I've verified that the CNS 2116 itself is configured correctly, I'm certain that my problem lies with the 837's config for cns.

Thanks, Jeff

David Stanford · ‎05-31-2006

What does an ssldump dump from the CNS? This might show where the connection is failing.

jeff_caprock · ‎06-01-2006

I don't have access to the CNS 2116 console, everything is done via the web browser. Below is my CPE config with respect to the cns config.

------------------------------------

cns trusted-server all-agents 10.0.0.1

cns event 10.0.0.1 11011

cns image retry 10

cns image password cisco

cns image server http://10.0.0.1

cns config notify all interval 1 old-format

cns config initial 10.0.0.1 80

cns config partial 10.0.0.1 80 inventory

------------------------------------

I can push any config changes that I want from the CNS at 10.0.0.1, that all works great. Just can't get an image sent to the CPE. Below is the error that is received when I try to create a cns job to send an image and activate it:

-------------------------------

*Feb 28 19:06:54.827: CNS Image Agent: xml error cb: entered

*Feb 28 19:06:54.827: CNS Image Agent: send status fail

*Feb 28 19:06:54.831: CNS Image Agent: attempting to send to destination(cisco.mgmt.cns.image.status.fail):

GTAGBI0001

Y2lzY28=

GTAGBI0001_1

FAIL

505

AUTHENTICATION FAILURE

not allowed to use that server url

1149170071289

---------------------------------------

and the job fails but never times out in the "query job" section of the cns.

I looked up the 505 error from a W3C listing of http codes, and it says that the CPE and the CNS web server are talking in two different and unsupported versions of http protocol.

Thanks, Jeff