Moderators group

JJ Fullmer

@Valer
@Tom-Elliott may have already fixed this, but if you’re using refined that would also need to be signed. We should be able to just have it signed by our new secure boot system and then it should be happy.
But also, the newer version of ipxe has proper support for SANBOOT in uefi mode, so you may be able to skip over refined and just use SANBOOT to boot to disk, try SANBOOT as the exit mode on a host and see if works, if it does you can change your global default and have an easier time.

JJ Fullmer

@Tom-Elliott said in How to upgrade to FOG 1.6?:

Client state What the task does
Setup Mode (platform key cleared) Enrols outright. Nothing to confirm, nobody at the keyboard.
Normal (keys present, Secure Boot off) FOS stages the MOK request itself, non-interactively. Someone answers the blue MokManager screen once on the next reboot.
Already enforcing Secure Boot Cannot run — the machine will not boot FOS in the first place. Use the live USB route for those.

One minor correction, with secure boot enabled on a new machine, if you boot to the signed shim you can use the Mok enrollment boot issue without needing to disable secure boot, but you do have to be physically at each machine to enroll.

JJ Fullmer

@csurepair I think Elite is referencing snapdragon elite? I actually don’t see any intel options for the laptop 7.
So you may need it to boot to the arm pxe file, but you’ll also need a new image for arm64 I imagine.
Microsoft also did something like this with the surface GO for business, there was a surface go 4 but all of a sudden no more surface go 4 being made and the product line was dead. They made a similarly priced (at the time, not anymore) 12" surface tablet but snapdragon based. We opted to not change our entire cpu architecture, so sadly I don’t have any experience with getting this working. I know @rodluz has done a lot with getting arm working with FOG and may be of more help if booting to arm kernel and init doesn’t work.

JJ Fullmer

@csurepair Is this surface laptop an intel cpu, or is it a qualcomm cpu?

JJ Fullmer

@Strahd I would try updating PHP to 8.3, @Tom-Elliott managed to test it and it worked with 7.4 but I’d still suggest updating your PHP for best results and best security practice. I found (though didn’t test) a guide online right quick https://php.watch/articles/php-8.3-install-upgrade-on-debian-ubuntu#php83-ubuntu-quick there are many others out there.

I would also go in the database and see what your schema version is

mysql -u root fog
select * from schemaVersion;

318 is the latest I believe, if yours says 318 and is stuck in a loop, maybe you can try forcing it down and then trying the schema update again. i.e.

mysql u root fog
update schemaVersion set vValue=317 where vID=1;

Then open your fog server, it will redirect you to update the schema, and see if it takes then.

Also any time you’re attempting an install and it fails, if you could grab and share the error log it mentions i.e. /root/fogproject/bin/error_logs/fog_error_1.6.0-beta. 3064. log that would be very helpful.

There’s something specific to your instance that we need to find and fix. Maybe you have a firewall running sudo ufw status ?

george1421

@thezman007 I would say the pcap file you provided is a model of how a proxy dhcp and dhcp server should interact. The first part of the pcap is perfect.

The second part starting at second #19. The client issues a dhcp discover and the dnsmasq answers right away, the client had to issue a second discover request before the main dhcp server @ 2.2 address responded. This pattern is repeated at the end of the pcap (you can see this if you look at the pcap with wireshark).

So this is only me reading the tea leaves but I think there is something up with your main dhcp server because its being slow to respond to dhcp requests. Understand I only can see 25 second pcap but I find it abnormal. When things go sideways (and it probably will) get a pcap of the failure, that’s going to tell us what’s missing.

I’m going to remove your pcap from your post because its not needed now.

george1421

@thezman007 said in PXE partial success, no tftp:

My current setup seems to allow our PXE boot to partially work, but ultimately fails. It appears that our proxyDHCP via dnsmasq is working and our main DHCP server is handing out IPs while our fog server is directing devices to itself for PXE services, but the overall process fails once tftp should be serving the .efi file. We’ve tried using a different computer when attempting to PXE to try and eliminate model specific quirks. I’ve also tried changing the file dnsmasq should serve (snponly.efi or ipxe.efi) with no change. tftp via locahost works as expected, tftp over LAN fails. There are NO tftp requests seen from tcpdump during PXE boot, but I can’t provide that data until my tech returns on-site next week.

This is the most important section.

what I want you to do is run tcpdump from the fog server. I want you to use the pcap filter of port 67 or port 68 or port 4011 or port 69

That will capture dhcp, proxy-dhcp and tftp.

ref: https://forums.fogproject.org/topic/9673/when-dhcp-pxe-booting-process-goes-bad-and-you-have-no-clue?_=1769224516191

Review the pcap with wireshark. You should see the DORA process if the fog server is on the same subnet as the pxe booting client.

Discover
Offer
Request
Ack/Nack

What will be important to watch is to make sure the client is getting two offer packets. Once will be from your main dhcp server and the second one from dnsmasq. If you are not seeing the one from dnsmasq server then that is the start of the problem. If you do see two and one is from your dnsmasq server then go to the next part.

Now that you verified that dnsmasq is seeing the DISCOVER packet and responded with an OFFER packet then after DORA you should see the client call back to dnsmasq on port 4011. In that transaction the client will be told the boot server and boot file. Verify these are correct.

And finally the client should reach out to the FOG server over tftp to first request the file size then request the file. So there will be two tftp communications, then the file should download.

george1421

@Jamaal This problem is solvable but it make take some effort on your part.

Lets start with the basics.

For the DHCP IP zone where your pxe booting clients live, you need to set dhcp options 66 to the IP address of your fog server. And for dhcp options 67 that needs to be snponly.efi or snp.efi. With those settings configured on a MS Windows based dhcp server a pxe booting client should boot. Make sure on your dhcp server that is responding to bootp and dhcp requests. Its been a while since I messed with windows but on the dhcp server there should be a setting of dhcp bootp or both. Select both.

Now lets talk about WDS for a second. A WDS server can use dhcp options 66 and 67 as above, but it can also run a proxy dhcp service that tells the client to ignore the dhcp options and come talk to it for boot information after it gets an IP address for the dhcp server. This maybe called a netboot service or something like that on your WDS server. Its not part of the main WDS service. If this service is still enabled it will override any settings you make in dhcp for pxe booting.

So how do you figure this out to what’s wrong?

The easiest and most complicated issue is to identify what is flying down your network during the pxe booting process. You can do this with wireshark on a witness computer (computer not part of the pxe booting process). This witness computer can either be a ms windows or linux computer, the key is to have wireshark loaded. When you start up a capture use a capture filter of port 67 or port 68 or port 4011 That will limit what wireshark sees to only the dhcp packets. Make sure the witness computer is connected to the same subnet as the pxe booting computer.

Start the packet capture and then attempt to pxe boot the target computer. Continue to capture the packet until the pxe booting computer either reaches the fog iPXE menu or errors out. Then stop the capture.

In the top section you should see the DORA (discover, offer, request, and finally ack/nack) process. The process goes as follows:
Client -> Discovery
Server-> Offer
Client -> Request
Server -> Ack/Nack

In this process you are most interested in the one or more OFFER packets. In a normal network you should only see one OFFER packet. When WDS is involved you will see one OFFER packet from your main dhcp server and a second OFFER packet from your WDS server. If you are seeing the OFFER from your WDS server then you don’t have the proxy-dhcp service disabled, and that is causing your issue. If you are seeing two offer packets from two different dhcp servers, such as a primary / secondary setup make sure both dhcp server are configured to boot from FOG server.

Now what do you do if you only have one OFFER packet and its still not working. This is where you need to select the OFFER packet and then look at the data in the parameters box. There will be the bootp fields of next-server and boot-file these need to be configured for the fog server IP and snp.efi. Then in the dhcp options section options 66 and 67 need to be set correctly. If one or the other sections are not set correctly you will get random machines not booting while others are.

If you can’t figure it out save the packet capture file “be sure you only captured the dhcp process” and up load the file to a file share site and post the link here and one of us will take a look to see what’s wrong. But I think from what I covered here you should be able to figure out what the pxe booting client is being told to do incorrectly.

george1421

@alperi The bit if detail you are missing is what the kernel parameters were that was sent to the fog client. From what you posted it appears that the FOG server has all of the bits in the right spots.

In the kernel parameters that are passed to bzImage during boot up it lists where the FOS engine can find the deployment server. I would verify the IP addresses are correct. If everything appears correct with the parameters, we can debug this a bit more by debug deploy and then manually interact with the fos engine from the target PC’s console.

S	Sebastian Roth
J	JJ Fullmer
F	fry_p
X	x23piracy
Q	Quazz
F	falko
G	george1421
C	cml
C	ch3i
A	andyroo54
C	chad-bisd
V	VincentJ
N	need2

Moderators

Posts

Member List