FOG UEFI Boot Hyper-V 2016
-
Ha! Yeah, I had to fight to use Hyper-V in the first place…
I work for a federal government contracting company and we have orders to harden our systems, network, infrastructure, etc by the end of the year. One of our guys already created an image of a 2016 server with a hardened baseline. I was hoping I could just blow that image to a VM, rather than use the generic ISO and rebuild all the security hardening from scratch every time we need to set up a server.
-
@ty900000 while this is off point of your post.
I know of a company that must compily with USGCB/STIG/NIST standards. Those policies are typically applied by GPO generally. They use MDT to build a baseline system with some of the “stuff” already in the box and configured for compliance the rest is applied by GPO.
They use MDT to build the reference image using a virtual machine running under VMWare. Once that reference image is created on the VM, they sysprep it and power it off. (now this is a feature of VMWare so I can’t speak for Hyper-V). The shutdown VM is then turned into a VM template. When ever they need a new virtual machine they just clone the vm template to a virtual machine. No external services are required here other than MDT to build the golden image to start with. By using MDT they can refresh their vm template on some interval with the latest windows updates and STIG requirements.
But we still should identify the proper settings to pxe boot a hyper-v vm. I know this won’t be the last time this issue comes up on the forums. UEFI is here to stay.
-
Okay, yeah. I just did a quick Google and Hyper-V can make templates akin to VMWare’s operation. (I’m new to Hyper-V, myself) That may be our best option going forward. Thanks for the tip.
And, it is possible our network is wonky. I’m the same guy from the Multicast being really slow issue: https://forums.fogproject.org/topic/10017/fog-server-cpu-requirements. So, it wouldn’t surprise me if 99% of the world had this working and my company is part of the 1% with a bad network setup.
But, yeah. If this is a more common issue than just me, I’m more than willing to help in any way I can with it.
-
I tested the UEFI boot with a physical laptop, a brand new Dell Latitude E5570 and I got this iPXE error.
I took a video of it as it was PXE booting and did confirm it picked up the ipxe.efi configuration file from DHCP.
I went to that website and it just says try the latest version of iPXE. Is this just an iPXE error and not a FOG error?
It does copy an image down just fine when I boot from legacy NIC.
I’m sorry for being such a hassle with all this!
-
@ty900000 Well that was one check I was going to ask you to try.
I’m a bit supersized that it is sending the 32 bit FOS stuff to the target computer. The 5570 should be a 64 bit system. The error message was basically the hand off between iPXE (ipxe.efi) and FOS (bzImage32) failed.
Are we forcing the 32 bit kernels for some reason on this host or in the global settings. Its not like iPXE to pick the wrong kernels for booting.
-
No, I haven’t made any changes to force 32 bit anything to anything else. Where would I look to double check?
-
@ty900000 I’m currently running 1.4.0-RC-4 and I just tested on both types of VMs for this reply and they work.
Gen1 (Legacy) picks up undionly.kpxe and Gen2 (UEFI) pulls down ipxe.efi on Hyper-V 2016 VMs . -
Nice… At this point, it really doesn’t surprise me that it seems to work for everyone else since our network infrastructure is so old and unmanageable.
-
Did you happen to have any luck with Hyper-V 2016 this weekend? I’m in the process of setting up a testing environment at my company, but wanted to see if you had any luck. Thanks!
-
@ty900000 negative. Real life got in the way once again sorry.
-
That’s cool; I understand.
-
I just wanted to post to close this out.
I got a test environment working with better switches and FOG was able to pass 64-bit UEFI traffic correctly the first time, every time. Thanks all for the big help! I really appreciate it!
