@MichaelPower said in FOG & iPXE Anywhere - issues from boot menu:
Just wondering if a working bzImage I can use that boots under Secure Boot?
The issue is exactly that. bzImage is not signed so the uefi firmware will not boot it. That is the root of the issue. You could self sign ipxe and bzImage but then you will need to update the certificates in each computer to include your self signed certificate. Its possible but it is quite a bit of work to get it all setup.
@lucancurtismahoney First let me start with the yada-yada-yada. Imaging over wifi is not supported by the developers of FOG. Imaging over wifi has its use cases but also is not advised because wifi is a shared resource and your entire wifi network will suffer if you try to image over wifi. You would be better served to get a supported (by the manufacturer) usb ethernet adapter and pxe boot over that.
With that said it might be possible to image over wifi if FOS is configured in an (unsupported) way. It will require a custom FOS Linux kernel and some tweaks to the virtual hard drive to add in the needed bits to configure wifi.
Below is a FOG USB debug image that contains a modified bzImage and init.xz files. Use rufus to burn to a 1GB usb drive. The image is less than 500MB so don’t waste a large usb on this boot image.
Understand this boot image WILL NOT WORK out of the box. We will use this for debugging your network adapter. Many network adapters need specific drivers to work with a linux kernel. We will find out what that firmware is with this debug usb.
ip a s If you see something like wlXXXXX then the driver is loaded and you are done.grep -i -e firmw /var/log/messages My bet is there will be a message from the intel wireless (iwlwifixxxxx) saying that it needs a specific firmware to load. Take a clear snapshot of the name of the firmware name with a mobile phone and post it here. I will patch the kernel with the required firmware and upload it with additional instructions.https://drive.google.com/file/d/1psCrPVzBTvlakLkCMvhdoScAEZp1CKE6/view?usp=drive_link
@Gordon-Taylor said in ASUS NUC14RV iPXE PXE boot:
if i use a USB Stick with D:\EFI\BOOT\bootx64.efi (ipxe.efi from tftp folder) then i can get them to register and image
Start HTTP Boot over IPv4 on MAC: MACADDRESS and it just hangs here and doesn’t start iPXE
is PXE booting and HTTP Boot over IP two different things? and is this somehting i can get working.
In the first section that is good, that you can get it to image with booting from a usb drive. That means ipxe and bzImage (FOS) supports that hardware.
On the second part, yes http booting and pxe booting are two different methods. Of course http booting uses tcp over the http protocol, and pxe booting uses udp over the tftp protocol.
I don’t know how you can tell the computer what ip address and boot file to boot from. But if you copied ipxe.efi to /var/www/html/fog directory you can (should) be able to download ipxe.efi over the http protocol.
But that said those devices should be able to pxe boot. That feature will typically need to be enabled in the network configuration section of the firmware (I don’t know these computers, so I can only speak generally). The intel nics have the pxe booting firmware built in, so it should work.
Does it even look like its attempting to pxe boot and then failing over to booting over http? Does the F12 menu say anything about pxe booting (it may need to be enabled in the firmware before its displayed on the boot menu)
@Nyeine I’ve got an Orin Nano at home and an AGX at work. I’m not sure you can image them with FOG. TBH I have never tried, so it would be interesting to find out.
One comment before I get too deep into this, if you use for your dhcp server either WIndows 2016 or later or linux as your dhcp server, you can setup profiles with your dhcp server to automatically send the right ipxe boot loader based on the pxe booting computer. You won’t need to mess with the ipxe.efi files like you have. You can surely continue to do it that way, I just wanted to let you know there might be an easier way to go about it.
So you are able to pxe boot into the iPXE boot loader, as soon as you pick a menu option that is where the wheels come off, so to say. Looking at the screen shot the process is failing at the handoff between ipxe and FOS Linux (arm_Image+arm_init). Its hard to tell if its ipxe or fos linux at fault.
I have a process to create a debug usb image for x64, but I haven’t tried to create one for arm. In theory if you have a working Jetson Orin running ubuntu you should be able to follow this to create a FOS linux usb boot image: https://forums.fogproject.org/topic/7727/building-usb-booting-fos-image In your case you don’t want to use bzImage and init.xy but use the arm_Imag… (to replace bzImage) and arm_init (to replace init.xz). The idea here is to see if you can select register from the grub menu to get FOS Linux to boot on the jetson nx. If it can then the issue is with ipxe. If it doesn’t hopefully you can debug with the usb boot image.
You may need to build a custom linux kernel for the Jetson. Just for reference https://docs.nvidia.com/jetson/archives/r36.3/DeveloperGuide/SD/Kernel/KernelCustomization.html
@joshua_mchugh I’m not sure if there is a good and proper way to do it but there maybe some way to go about it.
If you use an unattend.xml file that file and windows can place the computer into the proper OU. The idea is to use a post install script programmed in bash to dynamically update the unattend.xml script at deployment time. You can’t use fog group per se to do this since they are really “set groups” where the groupings are only used to bulk update parameters. But if your OU can’t be calculated you can use the user fields in the host record, and or the image name could be determined in the post install script.
I’ve got some examples of how to calculate a host name and OU based on the target IP address of the computer being imaged. This isn’t your solution but shows you what is possible in a post install script in the links below.
https://forums.fogproject.org/post/69726
https://forums.fogproject.org/post/69725
In one section of the links above it shows how to post a question at deploy time that could change how the OU path is calculated before the unattend.xml script is updated. The last tip is to use a post install script to leave bread crumbs behind so that the setupcomplete.cmd or the first run section of the unattend.xml file can find and integrate into an OU path. At one deployment we had to first set the target system’s OU to a clean OU used specifically for imaging because the OU GPOs would break OOBE/WinSetup. Once the system was fully configured we use the unattend.xml auto login and first run section to call a VBS script to read the bread crumb (info saved in a text file) to then finally move the computer to the correct OU.
None of these are proper, but as they say if all you have is a hammer, everything looks like a nail.
@tatanas Let me ask why are you renaming the host in the windows UI? Do you not know the actual name of the system at imaging time?
Second question: are you using the fog client service at all?
@Mightmar I wonder if the devs for iPXE has changed something in the ipxe source code to cause this error message about autoexec.ipxe not found. This should be supplied by the fog project add on files. I’ll take a look at the compiler to see if something has changed. You should not see this error.
Reinstalling 1.5.10 will fix the error of the latest build of iPXE. Also you mentioned about a later version of FOG. Yes you can install that over 1.5.10 without issue. It should also have updated (but not the newest version of iPXE).
@Mightmar Just a few points of info to give you.
So to say it another way, if you find issues with iPXE not supporting certain hardware, I would always upgrade the version of iPXE first and just remember that if you reinstall FOG it will replace the updated versions of iPXE and the FOS Linux kernel with the ones that were shipped with the current release of FOG. While I don’t know what the current release of FOG is I believe there are sub release later that 1.5.10 that fix a few discovered issues.
@alexamore90 Lets try to unpack this.
You have 3 ESXi servers connected to an unmanaged switch.
This part is a bit unclear. After deploying on a few pcs the speed dropps to 900mb/min (watch your unit of measure). Normally its up to 22GB/min (again assuming you are getting this number from partclone).
After deploying to a few PCs the speed drops. Is this simultaneous deployments or consecutive deployments the speed drops?
Unmanaged switch: So this isn’t an enterprise class switch. You may have issues with throughput on the switch itself. The aciscs might not be fast enough for the amount of data your are trying to push through. Look at the throughput listed in the technical documentation for the switch.
You didn’t mention the uplink speed from the ESXi servers to this switch. On a well managed 1GbE network you should get around 6GB/min throughput. On a well managed 10GbE network I’ve seen 13-15GB/min. So your 22GB/min seems a bit higher than expected. I can say with a physical FOG server connected via 1GbE link, I can saturate that 1GbE link with 3 concurrent image deployments. When that happens the error rate increases and the throughput drops off quote a bit.
The other thing if you are trying to do concurrent deployments with these 3 FOG servers, make sure the drives on ESXi are SSD or NVME drives and not spinning disks for performance reasons.
In the end I don’t think this is a FOG server issue specifically, rather something in the environment that is causing the speed issue.
@ALV_SUPECOLES This seems to be similar to this thread: https://forums.fogproject.org/topic/17759/ipxe-initialising-devices
In this case uefi firmware was updated then iPXE stops at initializing devices. If compiling and installing the latest version of iPXE doesn’t solve the problem then we will have to wait for either iPXE developers or Lenovo to fix the problem. https://forums.fogproject.org/topic/15826/updating-compiling-the-latest-version-of-ipxe
@nicolas-moraes We have to be careful some Soho routersthe don’t behave well with pxe booting. Some will put its IP address as the boot server even if you have dhcp option 66 configured. I don’t know the edgerouter, but if there is a bootp option make sure that is turned on too.
The edgerouter is based on vyos so it should behave correctly. Make sure when you define dhcp option 66 its the IP address of the fog server and for dhcp option 67 the boot file name needs to be all lower case. Make sure you don’t have a leading or trailing white space in the name.
If you have double checked everything then get a witness computer and load wireshark on it. Make sure you setup a capture filter of port 67 or port 68 start the scanning then pxe boot the computer until you get the error message then stop scanning.
What you are looking for is the DORA sequence
Discover (sent by target computer, akin to hello world, please configure me)
Offer (sent by one or more dhcp server, I would there to be only one of these and from your edgerouter).
Request (sent by the target computer)
Ack/Nack (sent by the dhcp server)
The interesting packet will be the OFFER.
Look at the packet, there should be an ethernet header section with the following fields.
Next-Server: this should be the IP address of your fog server (this is the bootp part)
Boot-FIle: this should be the name of the ipxe file to load.
If either of those are blank some pxe clients will not boot if they look at the bootp fields.
In the dhcp options section you should see option 66 and 67 that should mirror the values in the bootp part.
@JYost well there is two ways.
I think you will be better served by option 1 in the case of upgrades, but the quickest route is #2 which will download the older binaries for iPXE.
@RocksAndRolls I’m not sure how much additional help I can provide here but where it failing is at the end of the imaging process, the target system logs into the ftp server on the FOG server using the fogproject user account. That fogproject user MUST be able to rename the captured file in /images/dev from the mac address and the move the directory from /images/dev/<mac_address> to /images/<image_name>.
If you have verified you can log into the fog server via ftp as the fogproject user using the password saved in the fog ui then it has to be a permission issue on the /images directory.
The image capture process is
FOS Engine -> connects to /images/dev NFS share and creates a directory that matches it’s mac address
FOS Engine -> Uploads the disk connect as the root user (on the FOS Engine)
FOS Engine -> Connects to the FOG server as fogproject user and issues a mv command to move the directory from /images/dev/<mac_address> to /images/<image_name>
FOS Engine -> Logs out of ftp and completes the cleanup before reboot.
@danieln said in "Windows Other" vs "Windows 10" when creating new Windows 11 images?:
Windows 10 - (9)
This selector was put in place many years ago to deal with the quirks in the OS between the early versions of windows. While there are some minor differences between win10 and win11 disk formats the FOS imaging engine is now robust enough to manage it. So from an imaging standpoint the developers could change the label to “Windows 10&11 - (9)” and be syntactically correct. Who knows what Win 12 will bring.
@rurap said in Slow restoration of Windows 11 with FOG on Proxmox:
02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [10ec:8161] (rev 15)
03:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [10ec:8168] (rev 15) - This is the built-in network card
and the other two are Realtek cards, which appear to be identical.
Technically they are not identical, they have the same family name but one is a 8161 and the other is a 8168 of the rev 15 generation.
Just confirming that the /var/log/messages file exists and the /var/log/syslog one doesn’t ? The 8168 model has been around for years as you can see by the rev numbers. I believe they need nic specific firmware to operate. That should be called out in the boot up messages.
In researching this it seems one instant the 8169 driver was being installed instead of the 8168 linux kernel driver. This will take some looking by lspci -knn | more will list out all installed pci hardware with the “kernel drivers in use” for the hardware. As a hint for looking through the big list the section you are interested in starts with “03:00.0 Ethernet controller” since that is the built in nic you found in the previous post. Lets see if its using the 8169 driver instead.
Edit: I keep seeing reference to these kernel parameters in posts about debugging this nic r8168.aspm=0 r8168.eee_enable=0 pcie_aspm=off Not sure the importance, but noting it here for future reference.
Edit2: This command may help give the answer on driver than looking through the entire list of lspci commands: inxi -Naz
@ITCC Just to be clear you complied the latest version of iPXE using the instructions I provided? If that’s the case and it failed, then there is not much we can do because something in Lenovo’s firmware causing the software to hang. If rolling back the firmware isn’t an option (I don’t know what they were correcting with the update) I think we are stuck unless the iPXE developers have any idea why it might be getting stuck.
@rurap From historical experience if we have an issue with a network card/chip set it will be realtek.
For that realtek nic, can you get the hardware ID of that card, in windows you can get it from the device manager vendor and Id numbers. They will be 4 hex digit codes both the vendor and device id.
You can get them from FOS linux running on the target computer. It will probably be easiest to get from FOS Linux since I will need you to get some info from there for the second part of the question.
Schedule a debug capture/deploy to one of these vostros. Before you hit the scheduled task button tick the debug checkbox. Then schedule the task.
PXE boot the target computer, after several screens of text you need to clear with the enter key you will be dropped to the command prompt.
Key in the following
lspci -nn | grep -i net
Search for the Realtek nic in question and capture the hex codes in the square brackets in the form of [XXXX:XXXX]
Some nics require special firmware to work correctly with linux. Run this command to see if any firmware messages were logged. I should know this by now but I forget if the log is syslog or messages file. So you might have to adjust.
grep -i -e firm /var/log/syslog
Hint: If you want to make it easier for copying and pasting to the target computer do the following after you pxe boot into debug mode.
ip a spasswd make it something simple like hello it will be reset at the next reboot.From there you can copy and paste using the apps.
@ITCC I would start with seeing if snp.efi works instead of ipxe.efi. I have doubts that this will solve the issue, but this is the easiest test.
The second recommendation is to update iPXE to the latest version using this tutorial: https://forums.fogproject.org/topic/15826/updating-compiling-the-latest-version-of-ipxe
The third recommendation is to keep checking for updates to the firmware because it looks like lenovo created an inconsistency in their firmware.
@rurap Well, I thought it said the current version at the top…
OK for a plan B then, with the fog server console, navigate to /var/www/html/fog/service/ipxe directory. In that directory run this command file bzImage. The file command should tell you about that kernel image with a version number embedded in it. Note the version number and post it here.
@rurap said in Slow restoration of Windows 11 with FOG on Proxmox:
I’m not sure what you meant by the FOS kernel
There is a customized linux distro that gets copied to the target computer during pxe booting. You will see that as bzImage and init.xz. To check the version of FOS linux from within the web ui go to fog settings->kernel update. From there it will tell you the version and give you options to update it if needed.
So from your testing you can rule out the OS being deployed. I kind if figured that but ruling it out is always good at helping us narrow down the root of the issue.
So now its down to the network adapter and or the disk controller/nvme. If we could use your idea of process of elimination (one you verify you are on the latest version of FOS Linux) to see where the problem isn’t.
Also we might want to schedule a debug deployment so we can get to the command line on the target system within FOS linux. I would search /var/log/syslog on the target computer for the keyword firmware to see if there are any error messages wanting a specific version of a firmware driver.