Hi Everybody!
I'm new to the field and new to my current place of work and that place of work is new to everything related to smart licensing, smart call-home, etc. Nobody here has touched IOS-XR until a month ago also. I am almost CCNA RS level knowledge wise. I have been tasked with getting the new NCS5501's we are installing to pull their smart licensing information. I've read the documentation on the NCS5501 relating to this process, but I'm clearly missing some dependencies...
Currently I have a test router configured with only the purpose of succeeding the SCH and pulling its smart license. I have a single port configured, the MgmtEth0/RP0/CPU0/0. It gets a DHCP address from our network and NATs out to the greater internet. The router is configured with a single ipv4 af static route to go to our default gateway.
I've configured the following:
domain name-server 4.2.2.2
!
http client vrf default
http client source-interface ipv4 MgmtEth0/RP0/CPU0/0
fpd auto-upgrade enable
ntp
server 74.6.168.73
server 107.155.79.108
server 129.128.12.20
server 174.94.155.224
!
call-home
service active
profile CiscoTAC-1
active
anonymous-reporting-only
reporting smart-call-home-data
!
!
interface MgmtEth0/RP0/CPU0/0
ipv4 address dhcp
I've confirmed the following:
NTP syncs successfully.
I can reach tools.cisco.com with a ping as well as a port 80 and port 443 telnet.
Yet whenever SCH attempts to reach cisco it reports back with an SSL error. There must be a dependency I'm missing somewhere. Is there something I need to do CA wise? Do I need to define one? When you do commands like checking for CRLs or certificates it appears there are none in the router.
Specifically I get this:
RP/0/RP0/CPU0:Nov 12 18:47:32.667 UTC: http_client[166]: %SECURITY-XR_SSL-3-CERT_VERIFY_ERR_2_PARAM : SSL certificate verify error: Error in fetching the issuer certificate/CRL 'Crypto Engine' detected the 'warning' condition 'Key data missing'
A "call-home trace all" gives me the repeating information. Seems to me to be saying, it reaches out, gets something back, writes it to a temp file, realizes it can't decrypt it, then throws it away.
4
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 HTTP req data free
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_resp_read: read http reponse "/tmp/call_home_http_1626434436.resp"
Nov 12 18:47:58.513 call_home/error 0/RP0/CPU0 t5414 httpc_file_resp_read: "/tmp/call_home_http_1626434436.resp" size is zero
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_del: remove file "/tmp/call_home_http_1626434436.resp"
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_del: remove file "/tmp/call_home_http_1626434436.post"
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 call_home_http_resp_data() status = 24
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 call_home_set_httpc_resp_status: is entered. tid (15), status (324), err_string ()
Nov 12 18:47:58.513 call_home/error 0/RP0/CPU0 t5414 call_home_http_resp_data(), httpc response error, Error during SSL communication
Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t14985 call_home_remove_httpc_resp_node() is entered
Nov 12 18:48:08.513 call_home/trace 0/RP0/CPU0 t14985 send_one_http_msg() is entered, url = https://tools.cisco.com/its/service/oddce/services/DDCEService
Nov 12 18:48:08.513 call_home/trace 0/RP0/CPU0 t14985 call_home_httpc_post() url https://tools.cisco.com/its/service/oddce/services/DDCEService, sid 1, len 10466
Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_httpc_post: HTTP send successfully
Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_wait_for_httpc_resp() is entered
Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_add_httpc_resp_node(): is entered
Nov 12 18:48:11.479 call_home/trace 0/RP0/CPU0 t5414 call_home_http_resp_data(): Received response for (nil) tid 16 sid 1 status 24
When I google this error I get pretty much no information, I must be missing something so basic it's not even worth mentioning. I can't seem to figure it out though... I don't have any Security background which probably isn't helping me solve this problem. Only RS.
Any help would be greatly appreciated. Thanks in advance!
