DocWiki - User contributions [en]

Cisco Plug and Play Application -- Troubleshooting

2013-04-12T03:43:29Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

__TOC__

== Introduction ==

The Cisco Plug and Play Application simplifies branch network rollout by securely and automatically delivering the bootstrap configuration on the Cisco ISR and ISR-G2 routers during deployment.

The Cisco Plug and Play Application downloads the bootstrap configuration from the Cisco Prime Infrastructure and deploys it. The Cisco Plug and Play Application connects to the Cisco Plug and Play Gateway to communicate with the Cisco Prime Infrastructure for downloading the bootstrap configuration.

The Cisco Plug and Play Application automates and monitors the deployment progress, starting from delivering the bootstrap configuration, and until the entire deployment operation is complete. It thereby reduces the total deployment time and costs involved in this operation.

This document captures all the troubleshooting information of both iOS application and Windows application.

== iOS Application ==

=== Supported Platform ===

iPad or iPhone running iOS version 5.0 or higher 

== Windows Application ==

=== Supported Operating system ===

*Windows XP
*Windows 2000
*Windows Vesta
*Windows 7

'''''Note: Windows 8 is not supoprted at this time.'''''

=== Troubleshooting ===

===== Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching =====

'''Message Type:''' 

Error message 

'''Symptom:''' 

A popup error whill be shown saying that "Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching". 

'''Solution:'''

Make sure that the application is not running. If running, either close the application before launching it again or continue to use the already running instance.

==== A device is being deployed. Terminating the deployment process might affect the device configuration. Do you want to terminate? ====

'''Message Type:''' 

Confirmation/Alert message. 

'''Symptom:''' 

While deployment is in progress, if use tries to close the application, this alert will be shown 

'''Solution:''' Either wait till the deployment completes or close the application by clicking ‘Yes’; clicking ‘Yes’ will terminate the deployment. If you click ‘No’ the deployment will complete 

==== Unable to load the help document ====

'''Message type:''' 

'''Symptom:''' This error message will be shown when you launch the user guide/trouble shooting guide from the application.

'''Solution:''' Make sure that Adobe PDF reader is installed properly.

==== Bootstrap configuration download failed ====

'''Message Type:''' Error message

'''Symptom:''' Bootstrap configuration download failed

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure that there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

==== Deployment server not configured. Configure the deployment server before start downloading the configuration. ====

'''Message type:''' Error message.

'''Symptom:''' This error message will be show when bootstrap configuration download requested using a valid PIN.

'''Solution:''' Before downloading the bootstrap configuration, make sure that the Cisco Prime infrastructure and Cisco Plug and Play gateway are configured under the settings.

==== Communication Failed. Check the Plug and Play gateway settings and the server status. ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

==== SSL certificate store save failed (or) Connection or SSL certificate download failed to the server ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server. Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway. If Cisco Plug and Play HTTPS port is configured with non-default, then reconfigure the application settings with correct HTTPS port. 

==== Deploy option not enabled even After connecting the App with device ====

'''Message Type: '''

NA

'''Symptom: '''

This will happen when drivers not installed for cable

'''Solution: '''

User has to manually install the drivers for USB console cable then connect the cable

==== Logging in to device even after disconnecting the cable ====

'''Message Type: '''

NA

'''Symptom: '''

When user removes the cable while app connected to device. The App still shows that its connecting/logging in to device. This is happens due to the connecter which acts as proxy for app

'''Solution: '''

User has to close and open the app

==== Device Deployment failed ====

'''Message type:'''

Error Message

'''Symptom: '''

App deployes all the configured clis to device and waits for cns config initial to succeeded .due to some issue on the device when cns config initial not getting initiated. App will wait for 2mins to check if initial is initiated. After two mins if still device is having the cns config initial, App will show error message saying that deployment failed

'''Solution: '''

User has to troubleshoot on the device why the cns initial not triggered

==== Deployment failed, but the device config is not reveted to initial state ====

'''Message Type: '''

NA

'''Symptom: '''

when deployment fails due to any valid reasons and config on the device not reverted to initial state

'''Solution: '''

App will do config backup and restore only on factory default routers(dayzero). For day1 devices, revert will not happen.

Cisco Plug and Play Application -- Troubleshooting

2013-04-12T03:40:25Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

__TOC__

== Introduction ==

The Cisco Plug and Play Application simplifies branch network rollout by securely and automatically delivering the bootstrap configuration on the Cisco ISR and ISR-G2 routers during deployment.

The Cisco Plug and Play Application downloads the bootstrap configuration from the Cisco Prime Infrastructure and deploys it. The Cisco Plug and Play Application connects to the Cisco Plug and Play Gateway to communicate with the Cisco Prime Infrastructure for downloading the bootstrap configuration.

The Cisco Plug and Play Application automates and monitors the deployment progress, starting from delivering the bootstrap configuration, and until the entire deployment operation is complete. It thereby reduces the total deployment time and costs involved in this operation.

This document captures all the troubleshooting information of both iOS application and Windows application.

== iOS Application ==

=== Supported Platform ===

iPad or iPhone running iOS version 5.0 or higher 

== Windows Application ==

=== Supported Operating system ===

*Windows XP
*Windows 2000
*Windows Vesta
*Windows 7

'''''Note: Windows 8 is not supoprted at this time.'''''

=== Troubleshooting ===

===== Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching =====

'''Message Type:''' 

Error message 

'''Symptom:''' 

A popup error whill be shown saying that "Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching". 

'''Solution:'''

Make sure that the application is not running. If running, either close the application before launching it again or continue to use the already running instance.

==== A device is being deployed. Terminating the deployment process might affect the device configuration. Do you want to terminate? ====

'''Message Type:''' 

Confirmation/Alert message. 

'''Symptom:''' 

While deployment is in progress, if use tries to close the application, this alert will be shown 

'''Solution:''' Either wait till the deployment completes or close the application by clicking ‘Yes’; clicking ‘Yes’ will terminate the deployment. If you click ‘No’ the deployment will complete 

==== Unable to load the help document ====

'''Message type:''' 

'''Symptom:''' This error message will be shown when you launch the user guide/trouble shooting guide from the application.

'''Solution:''' Make sure that Adobe PDF reader is installed properly.

 

==== Bootstrap configuration download failed ====

'''Message Type:''' Error message

'''Symptom:''' Bootstrap configuration download failed

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure that there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

 

==== Deployment server not configured. Configure the deployment server before start downloading the configuration. ====

'''Message type:''' Error message.

'''Symptom:''' This error message will be show when bootstrap configuration download requested using a valid PIN.

'''Solution:''' Before downloading the bootstrap configuration, make sure that the Cisco Prime infrastructure and Cisco Plug and Play gateway are configured under the settings.

 

==== Communication Failed. Check the Plug and Play gateway settings and the server status. ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

 

==== SSL certificate store save failed (or) Connection or SSL certificate download failed to the server ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server. Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway. If Cisco Plug and Play HTTPS port is configured with non-default, then reconfigure the application settings with correct HTTPS port. 

==== Deploy option not enabled even After connecting the App with device ====

'''Message Type: '''

NA

'''Symptom: '''

This will happen when drivers not installed for cable

'''Solution: '''

User has to manually install the drivers for USB console cable then connect the cable

==== Logging in to device even after disconnecting the cable ====

'''Message Type: '''

NA

'''Symptom: '''

When user removes the cable while app connected to device. The App still shows that its connecting/logging in to device. This is happens due to the connecter which acts as proxy for app

'''Solution: '''

User has to close and open the app

==== Device Deployment failed ====

'''Message type:'''

Error Message

'''Symptom: '''

App deployes all the configured clis to device and waits for cns config initial to succeeded .due to some issue on the device when cns config initial not getting initiated. App will wait for 2mins to check if initial is initiated. After two mins if still device is having the cns config initial, App will show error message saying that deployment failed

'''Solution: '''

User has to troubleshoot on the device why the cns initial not triggered

==== Deployment failed, but the device config is not reveted to initial state ====

'''Message Type: '''

NA

'''Symptom: '''

when deployment fails due to any valid reasons and config on the device not reverted to initial state

'''Solution: '''

App will do config backup and restore only on factory default routers(dayzero). For day1 devices, revert will not happen.

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T07:27:59Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

__TOC__

== Introduction ==

The Cisco Plug and Play Application simplifies branch network rollout by securely and automatically delivering the bootstrap configuration on the Cisco ISR and ISR-G2 routers during deployment.

The Cisco Plug and Play Application downloads the bootstrap configuration from the Cisco Prime Infrastructure and deploys it. The Cisco Plug and Play Application connects to the Cisco Plug and Play Gateway to communicate with the Cisco Prime Infrastructure for downloading the bootstrap configuration.

The Cisco Plug and Play Application automates and monitors the deployment progress, starting from delivering the bootstrap configuration, and until the entire deployment operation is complete. It thereby reduces the total deployment time and costs involved in this operation.

This document captures all the troubleshooting information of both iOS application and Windows application.

== iOS Application ==

=== Supported Platform ===

iPad or iPhone running iOS version 5.0 or higher 

== Windows Application ==

=== Supported Operating system ===

*Windows XP
*Windows 2000
*Windows Vesta
*Windows 7

'''''Note: Windows 8 is not supoprted at this time.'''''

=== Troubleshooting ===

===== Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching =====

'''Message Type:''' 

Error message 

'''Symptom:''' 

A popup error whill be shown saying that "Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching". 

'''Solution:'''

Make sure that the application is not running. If running, either close the application before launching it again or continue to use the already running instance.

==== A device is being deployed. Terminating the deployment process might affect the device configuration. Do you want to terminate? ====

'''Message Type:''' 

Confirmation/Alert message. 

'''Symptom:''' 

While deployment is in progress, if use tries to close the application, this alert will be shown 

'''Solution:''' Either wait till the deployment completes or close the application by clicking ‘Yes’; clicking ‘Yes’ will terminate the deployment. If you click ‘No’ the deployment will complete 

==== Unable to load the help document ====

'''Message type:''' 

'''Symptom:''' This error message will be shown when you launch the user guide/trouble shooting guide from the application.

'''Solution:''' Make sure that Adobe PDF reader is installed properly.

 

==== Bootstrap configuration download failed ====

'''Message Type:''' Error message

'''Symptom:''' Bootstrap configuration download failed

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure that there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

===== =====

==== Deployment server not configured. Configure the deployment server before start downloading the configuration. ====

'''Message type:''' Error message.

'''Symptom:''' This error message will be show when bootstrap configuration download requested using a valid PIN.

'''Solution:''' Before downloading the bootstrap configuration, make sure that the Cisco Prime infrastructure and Cisco Plug and Play gateway are configured under the settings.

===== =====

==== Communication Failed. Check the Plug and Play gateway settings and the server status. ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

==== ====

==== SSL certificate store save failed (or) Connection or SSL certificate download failed to the server ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server. Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway. If Cisco Plug and Play HTTPS port is configured with non-default, then reconfigure the application settings with correct HTTPS port.

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T07:26:07Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

__TOC__

== Introduction ==

The Cisco Plug and Play Application simplifies branch network rollout by securely and automatically delivering the bootstrap configuration on the Cisco ISR and ISR-G2 routers during deployment.

The Cisco Plug and Play Application downloads the bootstrap configuration from the Cisco Prime Infrastructure and deploys it. The Cisco Plug and Play Application connects to the Cisco Plug and Play Gateway to communicate with the Cisco Prime Infrastructure for downloading the bootstrap configuration.

The Cisco Plug and Play Application automates and monitors the deployment progress, starting from delivering the bootstrap configuration, and until the entire deployment operation is complete. It thereby reduces the total deployment time and costs involved in this operation.

This document captures all the troubleshooting information of both iOS application and Windows application.

== iOS Application ==

=== Supported Platform ===

iPad or iPhone running iOS version 5.0 or higher 

== Windows Application ==

=== Supported Operating system ===

*Windows XP
*Windows 2000
*Windows Vesta
*Windows 7

'''''Note: Windows 8 is not supoprted at this time.'''''

=== Troubleshooting ===

===== Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching =====

'''Message Type:''' 

Error message 

'''Symptom:''' 

A popup error whill be shown saying that "Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching". 

'''Solution:'''

Make sure that the application is not running. If running, either close the application before launching it again or continue to use the already running instance.

==== A device is being deployed. Terminating the deployment process might affect the device configuration. Do you want to terminate? ====

'''Message Type:''' 

Confirmation/Alert message. 

'''Symptom:''' 

While deployment is in progress, if use tries to close the application, this alert will be shown 

'''Solution:''' Either wait till the deployment completes or close the application by clicking ‘Yes’; clicking ‘Yes’ will terminate the deployment. If you click ‘No’ the deployment will complete 

==== Unable to load the help document ====

'''Message type:''' 

'''Symptom:''' This error message will be shown when you launch the user guide/trouble shooting guide from the application.

'''Solution:''' Make sure that Adobe PDF reader is installed properly.

==== Bootstrap configuration download failed ====

'''Message Type:''' Error message

'''Symptom:''' Bootstrap configuration download failed

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure that there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

===== =====

==== Deployment server not configured. Configure the deployment server before start downloading the configuration. ====

'''Message type:''' Error message.

'''Symptom:''' This error message will be show when bootstrap configuration download requested using a valid PIN.

'''Solution:''' Before downloading the bootstrap configuration, make sure that the Cisco Prime infrastructure and Cisco Plug and Play gateway are configured under the settings.

===== =====

==== Communication Failed. Check the Plug and Play gateway settings and the server status. ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

==== SSL certificate store save failed (or) Connection or SSL certificate download failed to the server ====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server. Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway. If Cisco Plug and Play HTTPS port is configured with non-default, then reconfigure the application settings with correct HTTPS port.

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T07:22:56Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

__TOC__

== Introduction ==

The Cisco Plug and Play Application simplifies branch network rollout by securely and automatically delivering the bootstrap configuration on the Cisco ISR and ISR-G2 routers during deployment.

The Cisco Plug and Play Application downloads the bootstrap configuration from the Cisco Prime Infrastructure and deploys it. The Cisco Plug and Play Application connects to the Cisco Plug and Play Gateway to communicate with the Cisco Prime Infrastructure for downloading the bootstrap configuration.

The Cisco Plug and Play Application automates and monitors the deployment progress, starting from delivering the bootstrap configuration, and until the entire deployment operation is complete. It thereby reduces the total deployment time and costs involved in this operation.

This document captures all the troubleshooting information of both iOS application and Windows application.

== iOS Application ==

=== Supported Platform ===

iPad or iPhone running iOS version 5.0 or higher 

== Windows Application ==

=== Supported Operating system ===

*Windows XP
*Windows 2000
*Windows Vesta
*Windows 7

'''''Note: Windows 8 is not supoprted at this time.'''''

=== Troubleshooting ===

===== Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching =====

'''Message Type:''' 

Error message 

'''Symptom:''' 

A popup error whill be shown saying that "Another instance of Cisco Plug and Play Application is running. Terminate the previous instance before launching". 

'''Solution:'''

Make sure that the application is not running. If running, either close the application before launching it again or continue to use the already running instance.

===== A device is being deployed. Terminating the deployment process might affect the device configuration. Do you want to terminate? =====

'''Message Type:''' 

Confirmation/Alert message. 

'''Symptom:''' 

While deployment is in progress, if use tries to close the application, this alert will be shown 

'''Solution:''' Either wait till the deployment completes or close the application by clicking ‘Yes’; clicking ‘Yes’ will terminate the deployment. If you click ‘No’ the deployment will complete 

===== Unable to load the help document =====

'''Message type:''' 

'''Symptom:''' This error message will be shown when you launch the user guide/trouble shooting guide from the application.

'''Solution:''' Make sure that Adobe PDF reader is installed properly.

===== Bootstrap configuration download failed =====

'''Message Type:''' Error message

'''Symptom:''' Bootstrap configuration download failed

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure that there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

===== Deployment server not configured. Configure the deployment server before start downloading the configuration. =====

'''Message type:''' Error message.

'''Symptom:''' This error message will be show when bootstrap configuration download requested using a valid PIN.

'''Solution:''' Before downloading the bootstrap configuration, make sure that the Cisco Prime infrastructure and Cisco Plug and Play gateway are configured under the settings.

===== Communication Failed. Check the Plug and Play gateway settings and the server status. =====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' 

*Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server.
*Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway.

===== SSL certificate store save failed (or) Connection or SSL certificate download failed to the server =====

'''Message Type:''' Error message

'''Symptom:''' This error message will be shown when bootstrap download requested using a PIN.

'''Solution:''' Check the Cisco Prime infrastructure and Cisco Plug and Play gateway status. If either or both are not running, restart the server. Make sure there is a proper IP connectivity between laptop and the Cisco Prime infrastructure and Cisco Plug and Play gateway. If Cisco Plug and Play HTTPS port is configured with non-default, then reconfigure the application settings with correct HTTPS port.

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T06:52:40Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T06:45:20Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

2013-04-09T05:49:43Z

Nkanagar:

Cisco Plug and Play Application -- Troubleshooting

Introduction

ASA Configuration Troubleshooting

2011-06-02T09:27:01Z

Nkanagar: /* IOS Version for ASA Device */

==IOS Version for ASA Device==

The minimum supported IOS version of the ASA device is '''8.x and later'''.

==ASA Related Logs on CE Server==

The ASA server related logs on CE server can be found @ /var/log/CNSCE/asa/asa.log. The ASA device supports IOS version 8.2 onwards.

==Configuring the ASA device==
The following commands should be configured on ASA device to communicate with CE server to work using the call home protocol.

'''auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>'''

'''auto-update poll-period <period_in_minutes>'''

'''auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig'''

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==Invalid remote host.==

Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.

==Enable auto-update server logging on ASA device==

To enable auto-update server logging on ASA device, execute the following commands:

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed ==
When you get this error message, check the following:

1. Check whether the ASA device is created on CE server.

2. If the device is created on CE side, then check the auto-update server CLI on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time, the following log (not identical but similar) can be seen on the ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

== Prerequisite for ASA/ASDM image upgrade ==

Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.

boot system disk0:/<a-valid-asa-image-name>

asdm image disk0:/<a-valid-asdm-image-name>

Without these two CLIs, neither the ASA image or ASDM image upgrade will happen.

== ASA/ASDM image upgrade fails with error "could not open flash" ==

This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.

== ASA/ASDM image upgrade know issues ==
Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

CSCsx01913 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWEMethod=LookUpBug&SWECmd=InvokeMethod&_sn=IKBj7sBC4EkIHUlNyM6tklrz7QKKu.BWcYHr6yGqDfo_&SWEService=CSCBookMarkService&SWEC=1&Identifier=CSCsx01913&SWEHo=cdetsweb-prd.cisco.com&SWETS=1304503304&SWERF=1]

CSCtn98874 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn98874]

CSCtn65993 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn65993]

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

ASA Configuration Troubleshooting

2011-06-02T09:25:46Z

Nkanagar: /* IOS Version for ASA Device */

==IOS Version for ASA Device==

The minimum supported IOS version of the ASA device is '''8.x onwards'''.

==ASA Related Logs on CE Server==

The ASA server related logs on CE server can be found @ /var/log/CNSCE/asa/asa.log. The ASA device supports IOS version 8.2 onwards.

==Configuring the ASA device==
The following commands should be configured on ASA device to communicate with CE server to work using the call home protocol.

'''auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>'''

'''auto-update poll-period <period_in_minutes>'''

'''auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig'''

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==Invalid remote host.==

Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.

==Enable auto-update server logging on ASA device==

To enable auto-update server logging on ASA device, execute the following commands:

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed ==
When you get this error message, check the following:

1. Check whether the ASA device is created on CE server.

2. If the device is created on CE side, then check the auto-update server CLI on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time, the following log (not identical but similar) can be seen on the ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

== Prerequisite for ASA/ASDM image upgrade ==

Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.

boot system disk0:/<a-valid-asa-image-name>

asdm image disk0:/<a-valid-asdm-image-name>

Without these two CLIs, neither the ASA image or ASDM image upgrade will happen.

== ASA/ASDM image upgrade fails with error "could not open flash" ==

This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.

== ASA/ASDM image upgrade know issues ==
Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

CSCsx01913 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWEMethod=LookUpBug&SWECmd=InvokeMethod&_sn=IKBj7sBC4EkIHUlNyM6tklrz7QKKu.BWcYHr6yGqDfo_&SWEService=CSCBookMarkService&SWEC=1&Identifier=CSCsx01913&SWEHo=cdetsweb-prd.cisco.com&SWETS=1304503304&SWERF=1]

CSCtn98874 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn98874]

CSCtn65993 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn65993]

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

Cisco Configuration Engine -- Troubleshooting

2011-05-11T06:42:22Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* [[Troubleshooting Cisco Configuration Engine Installation]]
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_General|Troubleshooting the Cisco Configuration Engine Services for General issues]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration/Image/ASDM image upgrade Troubleshooting]]
* [[General_Troubleshooting|General Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

Troubleshooting an Image Update

2011-05-11T06:40:35Z

Nkanagar:

To troubleshoot an image update, see the following sections:

==Information About Log Files==

The Log4j file is used as the logging facility for the Cisco Configuration Engine server and the image server. The property file is located at: ''<INSTALL_DIR>/CSCOcfgs/conf/logs.properties''. You can control the logging behavior by editing the logs.properties configuration file. This file is located at:

cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/conf.

The default level for logging is set to Debug. Accepted values are Debug, Info, Warn, Error, and Fatal.

* /var/log/CNSCE/imgsrv/imgsrv.log—Contains log messages from the server concerning the actions that you have performed that pertain to images, such as creating, updating, or deleting images. This log file also contains detailed message exchanges between the image server and devices during image distribution and activation.

* /var/log/httpd/*.log, /var/log/CNSCE/tomcat/*.out, *.txt, *.log—Contains log messages related to the status of the web server

* /var/log/CNSCE/websvc—Contains log messages related to the web service APIs

* /var/log/CNSCE/imgw/*—Contains log messages related to the IMGW

==Cannot Activate Image==

'''Problem''': You are trying to activate an image but cannot activate it.

'''Possible Cause''': This problem can occur if the activation template does not contain the correct configuration. If the activation radio button is not checked when you associate the image with the device.

'''Solution''': To resolve this problem, make sure that the configuration is correct. Then try again to activate the image. Make sure the box is checked when associating the image with the device.

http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/image.html#wp1230605.

==Activation Failed Due to Device Error==

'''Problem''': Activation failed due to a device error. The device does not load the specified image.

'''Solution''': To resolve this problem, make sure that the image information matches the image that you have downloaded.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

==Image update failed with error type MSG_IMAGE_UPDATE_STOPPED==
'''
Symptom : '''

Image update stops and you receive the following error message:
2004-01-13 19:04:52,677 [c7200-1] DEBUG message.EvtMsgSender - Sent msg to Identifier=1074049490996 of Type=MSG_IMAGE_UPDATE_STOPPED.

'''Possible Cause : '''

This problem could occur for one of the following reasons:

– The file system could not be found.

– The space was insufficient for distributing the specified image.

– The server was unable to access the image file from a specified location.
'''
Solution :'''

To resolve this problem, follow these steps:

Step 1 If the job stopped because the file system was not found, check the imagsvr log file to verify whether the file system name in the destination field is correct. This log file is located at: /var/log/CNSCE/imgsvr.log.
'''
Example:'''
2005-11-03 15:31:39,974 [TP-Processor9] DEBUG action.UpdateImageProcess - RefCISDevice: ImageID=[d2NonAgent],CN=[d2NonAgent],Inventory Device Ref=[d2NonAgent],Password=[null],Activations=[{}],ActivationTemplate=[DemoRouter.cfgtpl],Img_And_Dist=[{image1=HashCode=[558448476],Name=[DIST1131057049654],ImgRef=[image1],�Destination=[Colorado],Location=[http://cluster-rm/cns/LoadPage?HtmlFilename=home.html],EraseFileSys=[true],OverWrite=[true]., image2=HashCode=[457703260],Name=[DIST1131057049658],ImgRef=[image2],Destination=[Denver],Location=[http://cluster-rm/cns/LoadPage?HtmlFilename=home.html],EraseFileSys=[true],OverWrite=[false].}].

Step 2 If the job stopped because the space was insufficient for distributing the specified image, check the imagsvr log file to verify whether the file system has sufficient space for downloading the specified image. This log file is located at: /var/log/CNSCE/imgsvr.log.

'''Example:'''

2004-01-13 19:18:21,563 [c7200-1] DEBUG evaluation.DeviceEvaluator -DeviceEvaluation=[Reachable=[true], Distribution Eval List Size=[1]: List=[Required=[true],Reason=[Compare ImageFile in RunningImageInfo, Check FreeSpace and Running Image MD5.],ErrorInfo=[null],SufficientSpace=[false].,], Activation Eval List Size=[1]: List=[Required=[true],Reason=[Compare ImageFile in RunningImageInfo, Check FreeSpace and Running Image MD5.],ErrorInfo=[null],SufficientSpace=[false].,].].
2004-01-13 19:18:21,563 [c7200-1] DEBUG distribution.DevicePerformer - Distribution is required, but Space is not sufficient.

Step 3 If the job stopped because the server was unable to access the image from the specified location, make sure that the you can access the URL in the image location field.
'''
Example:'''
2005-11-04 15:52:52,690 [Thread-377] DEBUG evaluation.DeviceEvaluator - Retrieving Inventory from Device=[ImageID=[d1],CN=[d1],Inventory Device Ref=[d1],Password=[null],Activations=[{}],ActivationTemplate=[DemoRouter.cfgtpl],Img_And_Dist=[{img4=HashCode=[1543307114],Name=[DIST1131144742987],ImgRef=[img4],Destination=[California],Location=[http://hostname/cns/LoadPage?HtmlFilename=home.html],EraseFileSys=[true],OverWrite=[true].}].]...

==Image activation==
'''
Symptom :'''

Correct image is not being activated on the device
'''
Possible Cause :'''

This problem could occur if the activation template does not contain the correct configuration.

'''Solution : '''

To resolve this problem, make sure that the configuration is correct. Then try again to activate the image.

Sample activation template:

no boot system

boot system flash:/<image name>

Troubleshooting an Image Update

2011-05-11T06:24:18Z

Nkanagar:

Troubleshooting Configuration Update

2011-05-11T06:18:59Z

Nkanagar:

To troubleshoot a configuration update, see the following sections:

==Config update failed==
'''Symptom: '''

The Device configuration update fails.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

To verify that TibGate is up and running, enter the following command:

/etc/rc.d/init.d/EvtGateway status

/etc/rc.d/init.d/EvtGatewayCrypto status

Note If encryption is enabled, the TibGate ports begin with even numbers that begin from 11014. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11013. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine Setup program. Make sure that the number of devices on each TibGate port does not exceed the maximum. For details, see the "Scalability Among Event Gateway Ports" chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click Ok.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

If the device in the Cisco Configuration Engine was initially set as None, then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. If during the Cisco Configuration Engine setup, a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

Step 2

Check the following on the device:

a. Make sure that the following Event ID string is defined:cns id string <id string> cns id string <id string> event
The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:cns event <configengine hostname> 11011 keepalive 30 10

Note Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the Cisco Configuration Engine user interface.

Note You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine setup, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:cns config partial <CE hostname> <http port>

Step 3 If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

• In the Cisco Configuration Engine host, do the following:

– To start event listener, enter the following commands:cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools./cns-listen "cisco.>"

– Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

• In the device, use the debug cns config all command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

Step 4 Rerun the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==Config job stuck or The configuration update is stuck in queue after data migration.==

'''Symptom : '''

The configuration update is stuck in queue after data migration.
'''
Solution : '''

After data migration from release 2.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches what is defined on the old host.

Note The country code and the company code in the OpenLDAP schema are case sensitive.

Step 1 To reinitialize the system, enter the following command:/opt/ConfigEngine/CSCOcnsie/reinitialize

Step 2 To run data migration again, enter the following command:/opt/ConfigEngine/CSCOcnsie/bin/datamigrate

Step 3 To run the Setup program again, enter the following command:/opt/ConfigEngine/CSCOcnsie/setup

Note Make sure that you run the Setup program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then rerun the Setup program.

Step 4 When entering the Setup parameters, make sure that the country code and the company code information for the new host matches what is defined on the old host.

For detailed information about the parameters in the Setup program, see the Cisco Configuration Engine Administration Guide.

==The configuration update is stuck in the queue after data backup and restore.==
'''Problem : '''

The configuration update is stuck in the queue after data backup and restore.
'''
Solution : '''

When you back up data and restore it, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches what is defined on the old host.

Note The country code and the company code in the OpenLDAP schema are case sensitive.

Step 1 To reinitialize the system, enter the following command:/opt/ConfigEngine/CSCOcnsie/reinitialize

Step 2 To run data restore again, enter the following command:/opt/ConfigEngine/CSCOcnsie/bin/datarestore

Step 3 To run the Setup program again, enter the following command:/opt/ConfigEngine/CSCOcnsie/setup

Note Make sure that you run the Setup program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then rerun the Setup program.

Step 4 When entering the Setup parameters, make sure that the country code and the company code information for the new host matches what is defined on the old host.

For detailed information about the parameters in the Setup program, see the Cisco Configuration Engine Administration Guide.

==CNS-Enabled Device Unable to Connect with CCE==

'''Problem''': A device is created in the Cisco Configuration Engine user interface but the device indicator displays a red status.

'''Possible Cause''': The red status indicates that the device is unable to connect with Cisco Configuration Engine or it is still trying to connect. A connection delay might occur due to the device setting of the backoff timer. After the time has expired, the indicator does not turn to green, follow the steps given below.

'''Solution''': To resolve this problem, follow these steps:

1. Make sure that the Event ID and Config ID match with what is defined on the device.

Do the following from the Cisco Configuration Engine user interface:

a. Choose '''Devices''' > '''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device, then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Click Next. The Select Group Membership page appears.

e. Click Next. The Device IDs page appears.

f. Verify that the Event ID and Config IP match with what is defined on the router.

2. Make sure that the device type is Agent Enabled Device. From the Cisco Configuration Engine user interface, do the following:

a. Choose '''Devices'''>'''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device. Then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d .Verify that the device type is Agent Enabled Device.

3. Ping or telnet to the device to verify that the device is reachable from Cisco Configuration Engine.

4. From the Cisco Configuration Engine server, make sure that TibGate, httpd, and the Java process are up.

* To verify that all TibGates are up, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': For information about TibGate event gateway ports, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

* To verify that httpd is up, enter the following command:

''''httpd status'''

* To verify that the Java process is up, enter the following command:

'''ps –ef | grep –i java | grep ConfigEngine''''

5. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive the events, enter the following command:

''''cns event <configengine hostname or ip address> keepalive 30 10'''

c. To verify that the Cisco Configuration Engine hostname or IP address is reachable from the device, enter the following command:

'''ping <configengine hostname or ip address>'''

d. If you are unable to reach the device through the ping command, use the '''ip host''' command to configure the device:

'''ip host <hostname> <ip address>'''
'''ip host <hostname.domainame> <ip address>'''

e.(Optional) To resolve hostnames, set up the DNS on the device by entering the following command:

'''ip name-server <ip address of DNS>'''

6. If the device status changes from green to red after Cisco Configuration Engine set up, follow the steps in “Device Status” section.

==CNS-Enabled Device Configuration Update Failed==

'''Problem''': The Device configuration update fails.

'''Possible Cause''': This problem can occur for one of the following reasons:

* Invalid commands in the configuration template
* Device is not online (RED)

'''Solution''': To resolve this problem, follow these steps:

If the device appears RED (offline), go to Step 2 and 3 to make the device GREEN (online) before proceeding with step 1.

a. In the Cisco Configuration Engine host, start the event listener and enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen ?cisco.>?'''

Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.
In the device, use the '''debug cns all''' command to enable debugging. If debug messages displays the CNS_INVALID_CLI_CMD as shown below, the config template might contain invalid commands. Apply those commands one by one on the router to find which command failed and remove or fix them from the template.
<pre>
85E1E440: 7572653E 3C696465 6E746966 6965723E ure><identifier>
85E1E450: 31323635 38333937 32393339 32313C2F 12658397293921</
85E1E460: 6964656E 74696669 65723E3C 636F6E66 identifier><conf
85E1E470: 69672D69 643E4643 48313333 39543032 ig-id>myDevice
85E1E480: 383C2F63 6F6E6669 672D6964 3E3C6572 </config-id><er
85E1E490: 726F722D 696E666F 3E3C6C69 6E652D6E ror-info><line-n
85E1E4A0: 756D6265 723E3930 3C2F6C69 6E652D6E umber>90</line-n
85E1E4B0: 756D6265 723E3C65 72726F72 2D6D6573 umber><error-mes
85E1E4C0: 73616765 3E434E53 5F494E56 414C4944 sage>CNS_INVALID
85E1E4D0: 5F434C49 5F434D44 3C2F6572 726F722D _CLI_CMD</error-
85E1E4E0: 6D657373 6167653E 3C2F6572 726F722D message></error-
85E1E4F0: 696E666F 3E3C2F63 6F6E6669 672D6661 info></config-fa
85E1E500: 696C7572 653E ilure>
</pre>

2. Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

c. To verify that TibGate is up and running, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': If encryption is enabled, the TibGate ports begin with even numbers that begin from 11012. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11011. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine set up program. Make sure that the number of devices on each TibGate port does not exceed the maximum.

For details, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click '''Ok'''.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

f. If the device in the Cisco Configuration Engine was initially set as '''None''', then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

3. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:

'''cns event <configengine hostname or ip address> keepalive 30 10'''

'''Note''': Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the Cisco Configuration Engine user interface.

'''Note''': You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:

'''cns config partial <CE hostname> <http port>'''

4. If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

* In the Cisco Configuration Engine host, start the event listener by enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen “cisco.>”'''

* Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

* In the device, use the debug '''cns config all''' command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

5. Re-run the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==Configuration Update Stuck in Queue After Data Migration==

'''Problem''': The configuration update is stuck in queue after data migration.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

'''Solution''': After data migration from release 3.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data migration again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datamigrate'''

3. To run the set up program again, enter the following command:

'''opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.

<pre>
Example:

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

==Configuration Update Stuck in Queue After Data Backup and Restore==

'''Problem''': The configuration update is stuck in the queue after data backup and restore.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

''''Solution''': When you back up data and restore it, the OpenLDAP schema is transferred to a new host. To re-use the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data restore again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datarestore'''

3. To run the set up program again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.
<pre>
Example

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

==Config job failed with parser error==
'''Problem : '''

The configuration update job failed with “%CNS-3-XML_SEMANTIC: CNS_FW_XML_PARSE_ERROR”

'''Solution : '''
To resolve this problem, follow these steps:

Step 1 Identify which CLI in the configuration job template caused the error

Step 2 Type that CLI directly on the device and see whether the CLI is support.

Step 3 If the CLI results an error, it means the CLI is not supported or has problem in the IOS version that the customer is using, report the problem to cns-ios-sw mailer. If the CLI has no problem in executing on the device, report to cs-ce mailer for further debug.

Troubleshooting Configuration Update

2011-05-11T06:17:27Z

Nkanagar:

Troubleshooting Configuration Update

2011-05-11T06:15:15Z

Nkanagar: /* The configuration update is stuck in queue after data migration. */

To troubleshoot a configuration update, see the following sections:

==Config update failed==
'''Symptom: '''

The Device configuration update fails.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

To verify that TibGate is up and running, enter the following command:

/etc/rc.d/init.d/EvtGateway status

/etc/rc.d/init.d/EvtGatewayCrypto status

Note If encryption is enabled, the TibGate ports begin with even numbers that begin from 11014. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11013. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine Setup program. Make sure that the number of devices on each TibGate port does not exceed the maximum. For details, see the "Scalability Among Event Gateway Ports" chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click Ok.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

If the device in the Cisco Configuration Engine was initially set as None, then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. If during the Cisco Configuration Engine setup, a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

Step 2

Check the following on the device:

a. Make sure that the following Event ID string is defined:�cns id string <id string>�cns id string <id string> event
The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:�cns event <configengine hostname> 11011 keepalive 30 10

Note Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the �Cisco Configuration Engine user interface.

Note You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine setup, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:�cns config partial <CE hostname> <http port>

Step 3 If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

• In the Cisco Configuration Engine host, do the following:

– To start event listener, enter the following commands:�cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools�./cns-listen "cisco.>"

– Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

• In the device, use the debug cns config all command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

Step 4 Rerun the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==Config job stuck or The configuration update is stuck in queue after data migration.==

'''Symptom : '''

The configuration update is stuck in queue after data migration.
'''
Solution : '''

After data migration from release 2.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches what is defined on the old host.

Note The country code and the company code in the OpenLDAP schema are case sensitive.

Step 1 To reinitialize the system, enter the following command:/opt/ConfigEngine/CSCOcnsie/reinitialize

Step 2 To run data migration again, enter the following command:/opt/ConfigEngine/CSCOcnsie/bin/datamigrate

Step 3 To run the Setup program again, enter the following command:/opt/ConfigEngine/CSCOcnsie/setup

Note Make sure that you run the Setup program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then rerun the Setup program.

Step 4 When entering the Setup parameters, make sure that the country code and the company code information for the new host matches what is defined on the old host.

For detailed information about the parameters in the Setup program, see the Cisco Configuration Engine Administration Guide.

==CNS-Enabled Device Unable to Connect with CCE==

'''Problem''': A device is created in the Cisco Configuration Engine user interface but the device indicator displays a red status.

'''Possible Cause''': The red status indicates that the device is unable to connect with Cisco Configuration Engine or it is still trying to connect. A connection delay might occur due to the device setting of the backoff timer. After the time has expired, the indicator does not turn to green, follow the steps given below.

'''Solution''': To resolve this problem, follow these steps:

1. Make sure that the Event ID and Config ID match with what is defined on the device.

Do the following from the Cisco Configuration Engine user interface:

a. Choose '''Devices''' > '''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device, then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Click Next. The Select Group Membership page appears.

e. Click Next. The Device IDs page appears.

f. Verify that the Event ID and Config IP match with what is defined on the router.

2. Make sure that the device type is Agent Enabled Device. From the Cisco Configuration Engine user interface, do the following:

a. Choose '''Devices'''>'''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device. Then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d .Verify that the device type is Agent Enabled Device.

3. Ping or telnet to the device to verify that the device is reachable from Cisco Configuration Engine.

4. From the Cisco Configuration Engine server, make sure that TibGate, httpd, and the Java process are up.

* To verify that all TibGates are up, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': For information about TibGate event gateway ports, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

* To verify that httpd is up, enter the following command:

''''httpd status'''

* To verify that the Java process is up, enter the following command:

'''ps –ef | grep –i java | grep ConfigEngine''''

5. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive the events, enter the following command:

''''cns event <configengine hostname or ip address> keepalive 30 10'''

c. To verify that the Cisco Configuration Engine hostname or IP address is reachable from the device, enter the following command:

'''ping <configengine hostname or ip address>'''

d. If you are unable to reach the device through the ping command, use the '''ip host''' command to configure the device:

'''ip host <hostname> <ip address>'''
'''ip host <hostname.domainame> <ip address>'''

e.(Optional) To resolve hostnames, set up the DNS on the device by entering the following command:

'''ip name-server <ip address of DNS>'''

6. If the device status changes from green to red after Cisco Configuration Engine set up, follow the steps in “Device Status” section.

==CNS-Enabled Device Configuration Update Failed==

'''Problem''': The Device configuration update fails.

'''Possible Cause''': This problem can occur for one of the following reasons:

* Invalid commands in the configuration template
* Device is not online (RED)

'''Solution''': To resolve this problem, follow these steps:

If the device appears RED (offline), go to Step 2 and 3 to make the device GREEN (online) before proceeding with step 1.

a. In the Cisco Configuration Engine host, start the event listener and enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen ?cisco.>?'''

Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.
In the device, use the '''debug cns all''' command to enable debugging. If debug messages displays the CNS_INVALID_CLI_CMD as shown below, the config template might contain invalid commands. Apply those commands one by one on the router to find which command failed and remove or fix them from the template.
<pre>
85E1E440: 7572653E 3C696465 6E746966 6965723E ure><identifier>
85E1E450: 31323635 38333937 32393339 32313C2F 12658397293921</
85E1E460: 6964656E 74696669 65723E3C 636F6E66 identifier><conf
85E1E470: 69672D69 643E4643 48313333 39543032 ig-id>myDevice
85E1E480: 383C2F63 6F6E6669 672D6964 3E3C6572 </config-id><er
85E1E490: 726F722D 696E666F 3E3C6C69 6E652D6E ror-info><line-n
85E1E4A0: 756D6265 723E3930 3C2F6C69 6E652D6E umber>90</line-n
85E1E4B0: 756D6265 723E3C65 72726F72 2D6D6573 umber><error-mes
85E1E4C0: 73616765 3E434E53 5F494E56 414C4944 sage>CNS_INVALID
85E1E4D0: 5F434C49 5F434D44 3C2F6572 726F722D _CLI_CMD</error-
85E1E4E0: 6D657373 6167653E 3C2F6572 726F722D message></error-
85E1E4F0: 696E666F 3E3C2F63 6F6E6669 672D6661 info></config-fa
85E1E500: 696C7572 653E ilure>
</pre>

2. Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

c. To verify that TibGate is up and running, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': If encryption is enabled, the TibGate ports begin with even numbers that begin from 11012. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11011. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine set up program. Make sure that the number of devices on each TibGate port does not exceed the maximum.

For details, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click '''Ok'''.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

f. If the device in the Cisco Configuration Engine was initially set as '''None''', then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

3. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:

'''cns event <configengine hostname or ip address> keepalive 30 10'''

'''Note''': Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the Cisco Configuration Engine user interface.

'''Note''': You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:

'''cns config partial <CE hostname> <http port>'''

4. If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

* In the Cisco Configuration Engine host, start the event listener by enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen “cisco.>”'''

* Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

* In the device, use the debug '''cns config all''' command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

5. Re-run the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==Configuration Update Stuck in Queue After Data Migration==

'''Problem''': The configuration update is stuck in queue after data migration.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

'''Solution''': After data migration from release 3.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data migration again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datamigrate'''

3. To run the set up program again, enter the following command:

'''opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.

<pre>
Example:

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

==Configuration Update Stuck in Queue After Data Backup and Restore==

'''Problem''': The configuration update is stuck in the queue after data backup and restore.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

''''Solution''': When you back up data and restore it, the OpenLDAP schema is transferred to a new host. To re-use the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data restore again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datarestore'''

3. To run the set up program again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.
<pre>
Example

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

Troubleshooting Configuration Update

2011-05-11T06:14:57Z

Nkanagar:

To troubleshoot a configuration update, see the following sections:

==Config update failed==
'''Symptom: '''

The Device configuration update fails.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

To verify that TibGate is up and running, enter the following command:

/etc/rc.d/init.d/EvtGateway status

/etc/rc.d/init.d/EvtGatewayCrypto status

Note If encryption is enabled, the TibGate ports begin with even numbers that begin from 11014. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11013. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine Setup program. Make sure that the number of devices on each TibGate port does not exceed the maximum. For details, see the "Scalability Among Event Gateway Ports" chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click Ok.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

If the device in the Cisco Configuration Engine was initially set as None, then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. If during the Cisco Configuration Engine setup, a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

Step 2

Check the following on the device:

a. Make sure that the following Event ID string is defined:�cns id string <id string>�cns id string <id string> event
The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:�cns event <configengine hostname> 11011 keepalive 30 10

Note Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the �Cisco Configuration Engine user interface.

Note You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine setup, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:�cns config partial <CE hostname> <http port>

Step 3 If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

• In the Cisco Configuration Engine host, do the following:

– To start event listener, enter the following commands:�cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools�./cns-listen "cisco.>"

– Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

• In the device, use the debug cns config all command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

Step 4 Rerun the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==The configuration update is stuck in queue after data migration.==

'''Symptom : '''

The configuration update is stuck in queue after data migration.
'''
Solution : '''

After data migration from release 2.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches what is defined on the old host.

Note The country code and the company code in the OpenLDAP schema are case sensitive.

Step 1 To reinitialize the system, enter the following command:/opt/ConfigEngine/CSCOcnsie/reinitialize

Step 2 To run data migration again, enter the following command:/opt/ConfigEngine/CSCOcnsie/bin/datamigrate

Step 3 To run the Setup program again, enter the following command:/opt/ConfigEngine/CSCOcnsie/setup

Note Make sure that you run the Setup program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then rerun the Setup program.

Step 4 When entering the Setup parameters, make sure that the country code and the company code information for the new host matches what is defined on the old host.

For detailed information about the parameters in the Setup program, see the Cisco Configuration Engine Administration Guide.

==CNS-Enabled Device Unable to Connect with CCE==

'''Problem''': A device is created in the Cisco Configuration Engine user interface but the device indicator displays a red status.

'''Possible Cause''': The red status indicates that the device is unable to connect with Cisco Configuration Engine or it is still trying to connect. A connection delay might occur due to the device setting of the backoff timer. After the time has expired, the indicator does not turn to green, follow the steps given below.

'''Solution''': To resolve this problem, follow these steps:

1. Make sure that the Event ID and Config ID match with what is defined on the device.

Do the following from the Cisco Configuration Engine user interface:

a. Choose '''Devices''' > '''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device, then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Click Next. The Select Group Membership page appears.

e. Click Next. The Device IDs page appears.

f. Verify that the Event ID and Config IP match with what is defined on the router.

2. Make sure that the device type is Agent Enabled Device. From the Cisco Configuration Engine user interface, do the following:

a. Choose '''Devices'''>'''Edit Device'''. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device. Then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d .Verify that the device type is Agent Enabled Device.

3. Ping or telnet to the device to verify that the device is reachable from Cisco Configuration Engine.

4. From the Cisco Configuration Engine server, make sure that TibGate, httpd, and the Java process are up.

* To verify that all TibGates are up, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': For information about TibGate event gateway ports, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

* To verify that httpd is up, enter the following command:

''''httpd status'''

* To verify that the Java process is up, enter the following command:

'''ps –ef | grep –i java | grep ConfigEngine''''

5. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive the events, enter the following command:

''''cns event <configengine hostname or ip address> keepalive 30 10'''

c. To verify that the Cisco Configuration Engine hostname or IP address is reachable from the device, enter the following command:

'''ping <configengine hostname or ip address>'''

d. If you are unable to reach the device through the ping command, use the '''ip host''' command to configure the device:

'''ip host <hostname> <ip address>'''
'''ip host <hostname.domainame> <ip address>'''

e.(Optional) To resolve hostnames, set up the DNS on the device by entering the following command:

'''ip name-server <ip address of DNS>'''

6. If the device status changes from green to red after Cisco Configuration Engine set up, follow the steps in “Device Status” section.

==CNS-Enabled Device Configuration Update Failed==

'''Problem''': The Device configuration update fails.

'''Possible Cause''': This problem can occur for one of the following reasons:

* Invalid commands in the configuration template
* Device is not online (RED)

'''Solution''': To resolve this problem, follow these steps:

If the device appears RED (offline), go to Step 2 and 3 to make the device GREEN (online) before proceeding with step 1.

a. In the Cisco Configuration Engine host, start the event listener and enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen ?cisco.>?'''

Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.
In the device, use the '''debug cns all''' command to enable debugging. If debug messages displays the CNS_INVALID_CLI_CMD as shown below, the config template might contain invalid commands. Apply those commands one by one on the router to find which command failed and remove or fix them from the template.
<pre>
85E1E440: 7572653E 3C696465 6E746966 6965723E ure><identifier>
85E1E450: 31323635 38333937 32393339 32313C2F 12658397293921</
85E1E460: 6964656E 74696669 65723E3C 636F6E66 identifier><conf
85E1E470: 69672D69 643E4643 48313333 39543032 ig-id>myDevice
85E1E480: 383C2F63 6F6E6669 672D6964 3E3C6572 </config-id><er
85E1E490: 726F722D 696E666F 3E3C6C69 6E652D6E ror-info><line-n
85E1E4A0: 756D6265 723E3930 3C2F6C69 6E652D6E umber>90</line-n
85E1E4B0: 756D6265 723E3C65 72726F72 2D6D6573 umber><error-mes
85E1E4C0: 73616765 3E434E53 5F494E56 414C4944 sage>CNS_INVALID
85E1E4D0: 5F434C49 5F434D44 3C2F6572 726F722D _CLI_CMD</error-
85E1E4E0: 6D657373 6167653E 3C2F6572 726F722D message></error-
85E1E4F0: 696E666F 3E3C2F63 6F6E6669 672D6661 info></config-fa
85E1E500: 696C7572 653E ilure>
</pre>

2. Check the following on the Cisco Configuration Engine:

a. Make sure that the Event ID and Config ID match with what is defined on the device.

b. Make sure that the object status for the device in Cisco Configuration Engine is green. Green indicates that the Cisco Configuration Engine and the device are connected.

c. To verify that TibGate is up and running, enter the following command:

'''/etc/rc.d/init.d/EvtGateway status'''
'''/etc/rc.d/init.d/EvtGateway status'''

'''Note''': If encryption is enabled, the TibGate ports begin with even numbers that begin from 11012. If encryption is not enabled, the TibGate ports begin with odd numbers that begin from 11011. Each TibGate port can support a maximum of 500 devices. You specify the number of the TibGates during the Cisco Configuration Engine set up program. Make sure that the number of devices on each TibGate port does not exceed the maximum.

For details, see the “Scalability Among Event Gateway Ports” chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

d. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) that is defined in the Cisco Configuration Engine user interface, matches with what is defined on the device. Otherwise, use the resync device command to reset the CNS password.

To use the resync command from the Cisco Configuration Engine user interface, do the following:

a. Go to Devices > Resync Device. The Resync Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device you want to resynchronize. Then click the icon for the device.

c. In the confirmation window, click '''Ok'''.

e. Make sure that the downloading configuration semantics and syntax for the device are correct.

f. If the device in the Cisco Configuration Engine was initially set as '''None''', then deleted, and then re-created as an agent-enabled device, you must rename the Config ID and Event ID on both the device and the Cisco Configuration Engine user interface.

g. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device.

3. Check the following on the device:

a. Make sure that the following Event ID string is defined:

cns id string <id string>
cns id string <id string> event

The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive events, enter the following command:

'''cns event <configengine hostname or ip address> keepalive 30 10'''

'''Note''': Make sure that the TibGate port of this device is correct. The TibGate port must match the port that is defined in the Cisco Configuration Engine.

c. If the authentication feature is enabled in the Cisco Configuration Engine, make sure that the device password (cns password <password string>) matches what is defined in the Cisco Configuration Engine user interface.

'''Note''': You cannot see the password setting after you configure it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the Resync Device feature in the Cisco Configuration Engine.

d. During the Cisco Configuration Engine set up, if a port other than the default port 80 is configured for HTTP, make sure that the same port number is also configured on the device. To configure the http port on the device, enter the following command:

'''cns config partial <CE hostname> <http port>'''

4. If you have tried all the preceding steps and the device configuration update still fails, enable the debugging tools.

* In the Cisco Configuration Engine host, start the event listener by enter the following commands:

'''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/tools'''
'''./cns-listen “cisco.>”'''

* Check the cfgsrv log file. This file is located at: /var/log/CNSCE/cfgsrv/cfgsrv.log.

* In the device, use the debug '''cns config all''' command to enable debugging. Analyze the output to verify that the device is set up correctly with proper connectivity.

5. Re-run the scenario, check the event traffic and the information from the device, capture the data, and then contact the Cisco TAC for assistance.

==Configuration Update Stuck in Queue After Data Migration==

'''Problem''': The configuration update is stuck in queue after data migration.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

'''Solution''': After data migration from release 3.0 to 3.5, the OpenLDAP schema is transferred to a new host. To reuse the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data migration again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datamigrate'''

3. To run the set up program again, enter the following command:

'''opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.

<pre>
Example:

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

==Configuration Update Stuck in Queue After Data Backup and Restore==

'''Problem''': The configuration update is stuck in the queue after data backup and restore.

'''Possible Cause''': This problem can occur if you did not enter the correct country code and company code information during the set up program.

''''Solution''': When you back up data and restore it, the OpenLDAP schema is transferred to a new host. To re-use the existing OpenLDAP schema for the new host, make sure that the country code and the company code information on the new host matches with what is defined on the old host. Follow these steps:

1. To reinitialize the system, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/reinitialize'''

2. To run data restore again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/bin/datarestore'''

3. To run the set up program again, enter the following command:

'''/opt/ConfigEngine/CSCOcnsie/setup'''

'''Note''': Make sure that you run the set up program in bash shell. If the shell is not in bash, press ctrl-c to exit. Configure your shell in bash, and then re-run the set up program.

4. When entering the set up parameters, make sure that the country code and the company code information for the new host matches with what is defined on the old host.

'''Note''': The country code and the company code in the OpenLDAP schema are case sensitive.

For detailed information about the parameters in the set up program, see the Cisco Configuration Engine Administration Guide.
<pre>
Example

Choose operational mode of system. 0=internal directory mode,
1=external directory mode. [0]
Enter country code: us
Enter company code: cisco
</pre>

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

Troubleshooting the General

2011-05-11T06:08:05Z

Nkanagar:

==Device status changes from green to red in a few minutes==

'''Symptom :'''

After Cisco Configuration Engine setup, the device status changes from green to red in a few minutes. This problem occurs on the Solaris 10 platform, right after restarting the Cisco Configuration Engine services.

'''Possible Cause :'''

This problem could occur if the TibGate processes shut down a few minutes after starting.

'''Solution : '''

To resolve this problem, follow these steps:

Step 1 To check whether the TibGate processes are running, enter one of the following commands:

/etc/init.d/EvtGateway status

/etc/init.d/EvtGatewayCrypto status

Step 2 If the TibGate processes are not running, ask your System Administrator to disable NISPlus service.
Step 3 If the device status is still red, see the "CNS-Enabled Device Unable to Connect with Cisco Configuration Engine" section for a possible solution.

==TibGate can’t be started on Linux server==
'''Symptom :'''

On Linux server, the CE server kept crashing or TibGate processes couldn't startup with the following error messages: /ce/ConfigEngine/CSCOcnsie/bin/TibGate: error while loading shared libraries: /ce/ConfigEngine/CSCOcommon/lib/libibmldap.so: cannot restore segment prot after reloc: Permission denied Start Dispatcher TibGate (Event Gateway) process at port 11011 /ce/ConfigEngine/CSCOcnsie/bin/TibGate: error while loading shared libraries: /ce/ConfigEngine/CSCOcommon/lib/libibmldap.so: cannot restore segment prot after reloc: Permission denied Start TibGate (Event Gateway) process at port 11013

'''Possible Cause :'''

SELinux is enabled.

'''Solution : '''

1. Disable SELinux, edit /etc/selinux/config, change SELINUX=disabled (was enabled)
2. uninstall CE, and then reboot the server before reinstall CE.

==httpd can’t start==
'''Symptom:'''

After CE setup, httpd don’t start with the following error message.

# httpd restart

Stopping tomcat...

FAILEDng httpd: [FAILED]

.....

Checking if the following ports have been cleared:8009 8005 Starting tomcat...Waiting for tomcat to initialize...
Starting httpd: Syntax error on line 66 of /opt/ConfigEngine/CSCOcnsie/conf/mod_jk.conf-cns:
SSLRequire not allowed here [FAILED]

'''Solution: '''

Give customer CE 3.5.1

==httpd can’t start (cont.)==
'''Symptom:'''

After CE setup, httpd don’t start with the following error message.

'''Workaround:'''

Setup CE in non SSL only mode

Step 1 rerun “setup”

Enable cryptographic (crypto) operation between Event Gateway(s)/Configserver and device(s) (y/n)? [n] y

Enter absolute pathname of server key file: [/root/ssl/server.key]

Enter absolute pathname of server certificate file: [/root/ssl/server.crt]

Enabling plaintext operation will increase security risk.

Enable plaintext operation between Config Server and devices/GUI

administration (y/n)? [y] n

Enable plaintext operation between Event Gateway and devices (y/n)? [y] n

==Device stays in red (without port auto-assignment enabled)==
'''Symptom : '''

A device is created in the Cisco Configuration Engine GUI but the device displays as red and the port auto assignment is disabled.
Possible Cause : The red status indicates that the device is unable to connect with Cisco Configuration Engine or it is still trying to connect. A connection delay might occur due to the device setting of the backoff timer. If after the time has expired, the indicator does not turn to green, follow the steps given below.

'''Solution :'''

To resolve this problem, follow these steps:

Step 1 Make sure that the Event ID and Config ID match with what is defined on the device. Do the following from the Cisco Configuration Engine user interface:

a. Choose Devices > Edit Device. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device, then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Click Next. The Select Group Membership page appears.

e. Click Next. The Device IDs page appears.

Verify that the Event ID and Config ID match with what is defined on the router.

Step 2 Make sure that the device type is Agent Enabled Device. From the Cisco Configuration Engine user interface, do the following:

a. Choose Devices > Edit Device. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device. Then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Verify that the device type is Agent Enabled Device.

Step 3 Ping or telnet to the device to verify that the device is reachable from Cisco Configuration Engine.

Step 4 From the Cisco Configuration Engine server, make sure that TibGate, httpd, and the Java process are up.

• To verify that all TibGates are up, enter the following command:ps -ef | grep tibgate

Note For information about TibGate event gateway ports, see the "Scalability Among Event Gateway Ports" chapter in the Cisco
Configuration Engine Installation and Configuration Guide, 3.5.3.

• To verify that httpd is up, enter the following command: httpd status

• To verify that the Java process is up, enter the following command:ps -ef | grep -i java | grep ConfigEngine

Step 5 Check the following on the device:

a. Make sure that the following Event ID string is defined:cns id string <id string> cns id string <id string> event
The default value of the <id string> is the hostname of the device. This ID must be the same as the Config ID defined in the Cisco Configuration Engine host.

b. To verify that the Cisco Configuration Engine hostname or IP address is specified to receive the events, enter the following command:cns event <configengine hostname or ip address> 11011 keepalive 30 10

To verify that the Cisco Configuration Engine hostname or ip address is reachable from the device, enter the following command:ping <configengine hostname or ip address>

d. If you are unable to reach the device through the ping command, use the ip host command to configure the device: ip host <hostname> <ip address> ip host <hostname.domainame> <ip address>

(Optional) To resolve hostnames, set up DNS on the device by entering the following command:ip name-server <ip address of DNS>
Step 6 If the device status changes from green to red after Cisco Configuration Engine setup, follow the steps in "Device Status Changed from Green to Red After Setup" section.

==Device can’t be auto-discovered or stays red with port auto-assignment enabled==

'''Symptom :'''

After Cisco Configuration Engine setup, the device status stays in red or can’t be auto-discovered. This problem occurs when port allocation feature is enabled during setup.

'''Possible Cause :'''

Dispatcher process can’t redistribute a new tibgate port to the agent successfully when port auto-allocation is enabled.

'''Solution : '''

To resolve this problem, follow these steps:

Step 1 To check whether the dispatcher TibGate processe is running, enter one of the following commands:/etc/init.d/EvtGateway status – the plain-text dispatcher tibgate on 11011 should be running if plain-text is enabled during setup (default)/etc/init.d/EvtGatewayCrypto status – the crypto dispatcher tibgate on 11012 should be running if crypto is enabled during setup

Note: Debuging page: http://<ce-host>/cns/ResourceInit?name=port

Step 2 Make sure “cns trusted-server all-agents ce-host” and “cns config partial ce-host [encrypt]” commands are configured on the device. Where ce-host is the IP address or the hostname of the CE. “Encrypt” should be specified is crypto is enabled.

Step 3 If results from step 1 and 2 are verified and devices are still not green, then increase the value of WAIT_AFTER_CONFIG in $CISCO_CE_HOME/conf/resource.properties file, then restart CE by using command $CISCO_CE_HOME/bin/setup -r command.

==No “group name” in device auto discovery GUI==
'''Symptom :'''

Device auto discovery GUI can’t display “Group Name” column after 2000 devices.

'''Possible Cause :'''

IE6.0.

'''Solution : '''

1. This is a IE6.0 specific issue. User need to upgrade the IE version.

==Can’t access CE login page on Linux server==
'''Symptom :'''

After CE setup is done, user can’t access the login page on Linux server.

'''Possible Cause :'''

Firewall on the Linux server is enabled.

'''Solution : '''

CE uses port 80 and 443 to access GUI pages. User need to talk to his/her system administrator to enable those ports. If it’s a lab server, user can use the following comments to disable the firewall:

# /etc/init.d/iptables save

# /etc/init.d/iptables stop

==Error during Web Services deployment==

'''Symptom:'''

Error during Web Services deployment.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Step 1 Check the httpd status (web server status).

/etc/init.d/httpd status

Step 2 Check whether the Cisco Configuration Engine service endpoint is up:

http://<CE hostname>/cns/services/CEAdminService

http://<CE hostname>/cns/services/CEConfigService

http://<CE hostname>/cns/services/CEImageService

http://<CE hostname>/cns/services/CEExecService

http://<CE hostname>/cns/services/CENSMService

Step 3 If the httpd status is okay, deploy all or individual services.

• Go to: cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin.

• To deploy all services, enter the following command:./deploy.all.websvc

• To deploy an individual service, enter the following command:./deploy.<service>.websvc

==Device can’t be activated==

'''Symptom:'''

Device is not getting the initial configuration after reload. The initial configuration does not work.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Make sure that you can access the device from Cisco Configuration Engine and that you can access �Cisco Configuration Engine from the device.
Use the ping command to validate connectivity.

Step 2 Make sure that the device is agent-enabled.

In router configuration mode, enter cns ?. If the cns command list is displayed, the device is agent-enabled. If the device is not agent-enabled, this command fails.

Step 3 Make sure that the Cisco Configuration Engine is set up properly.
Cisco Configuration Engine is set up in either crypto or plaintext mode. Make sure that the device setup and the Cisco Configuration Engine setup are consistent.

Step 4 Make sure that the system processes are running properly. Enter the following on the Cisco Configuration Engine server:

To verify that all TibGates are up, enter the following command:/etc/rc.d/init.d/EvtGateway status and/or /etc/rc.d/init.d/EvtGatewayCrypto status

Note For information about TibGate event gateway ports, see the "Scalability Among Event Gateway Ports" chapter in the Cisco Configuration Engine Installation and Configuration Guide, 3.5.

To verify that httpd is up, enter the following command: /etc/init.d/httpd status

To verify that the Java process is up, enter the following command:/ps -ef | grep -i java | grep ConfigEngine

Step 5 Check the object status for the device in Cisco Configuration Engine. If the status is green, the Cisco Configuration Engine and the device are connected.

If the status is red, verify that the Event ID and Config ID match with what is defined on the device. From the Cisco Configuration Engine user interface, do the following:

a. Choose Devices > Edit Device. The Edit Device page appears with a Groups list.

b. From the Groups list, choose the group that contains the device, then click the icon for the device.

c. From the left pane, choose Edit Information. The Enter Device Information page appears.

d. Click Next. The Select Group Membership page appears.

e. Click Next. The Device IDs page appears.

f. Verify that the Event ID matches with what is defined on the router.

Step 6 Verify the agent setup on the device.

In non-configuration mode, enter the show run command to display the agent settings that are running. Then verify the following:

ip host <ce_host.domain_name> <ce_ipaddress>

''cns trusted-server <ce_host.domain>
cns trusted-server all-agents <ce_host.domain_name>
cns id string <ce_ipaddress>
cns id string <ce_ipaddress> event
cns event <ce_ipaddress> <ce_serverport>
cns config init <ce_ipaddress>
cns config partial <ce_ipaddress>
cns exec''

Note If port auto-assignment is enabled, the <ce_serverport> in the cns event <ce_ipaddress>
command can be omitted.

Step 7 If the authentication feature is enabled in Cisco Configuration Engine, make sure that the device password (cns password <password string>), matches with what is defined in the Cisco Configuration Engine user interface.

Note You cannot see the password setting after you have configured it on the router, nor can you edit the password in Cisco Configuration Engine. Therefore, you must reset the password. To reset the password, use the resync device feature in Cisco Configuration Engine.

Step 8 If you have tried all of the preceding steps but the initial configuration still does not work, use the debug cns config all command to enable debugging on the agent. Analyze the output to verify that the agent is set up correctly with proper connectivity.

Step 9 If the initial configuration still does not work, reboot the device.

Troubleshooting the General

2011-05-11T06:02:44Z

Nkanagar:

Troubleshooting the General

2011-05-11T05:59:28Z

Nkanagar:

Troubleshooting the General

2011-05-11T05:48:48Z

Nkanagar:

Troubleshooting the General

2011-05-11T05:47:48Z

Nkanagar: New page: ==Device status changes from green to red in a few minutes== '''Symptom :''' After Cisco Configuration Engine setup, the device status changes from green to red in a few minutes. This ...

Cisco Configuration Engine -- Troubleshooting

2011-05-11T05:46:29Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* [[Troubleshooting Cisco Configuration Engine Installation]]
* Checking the Version Number
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_General|Troubleshooting the Cisco Configuration Engine Services for General issues]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration/Image/ASDM image upgrade Troubleshooting]]
* [[General_Troubleshooting|General Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

Troubleshooting Cisco Configuration Engine Installation

2011-05-10T07:19:00Z

Nkanagar:

=='gethostbyaddr()' error==

'''Symptom:'''

Installation aborted with error message “Hostname value retrieval by system calls 'gethostbyaddr()' and command 'hostname' have different values returned. Please correct it also make sure 'ifconfig' is set in your PATH before installing Config Engine 3.5”

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Make sure the hostnames configured in /etc/hosts, /etc/sysconfig/network and/or DNS server are consistent with what’s returned by “hostname –s” command.

Step 2 Make sure the ifconfig command is in the $PATH environment variable

==Can’t reinstall CE==
'''Symptom:'''

If a install shell is accidentally closed, reinstall is not allowed.

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 use ce_uninstall –force to uninstall any partially installed packages and rerun ce_install.sh again.

Note: If the user typed ^Z to suspend the install process in the background, they need to either resume the install process or kill the install process.

Troubleshooting Cisco Configuration Engine Installation

2011-05-10T07:17:31Z

Nkanagar:

Troubleshooting Cisco Configuration Engine Installation

2011-05-10T07:15:19Z

Nkanagar:

==IOS Version for ASA Device==

=='gethostbyaddr()' error==

'''Symptom:'''

Installation aborted with error message “Hostname value retrieval by system calls 'gethostbyaddr()' and command 'hostname' have different values returned. Please correct it also make sure 'ifconfig' is set in your PATH before installing Config Engine 3.5”

'''Solution: '''

To resolve this problem, follow these steps:

Step 1 Make sure the hostnames configured in /etc/hosts, /etc/sysconfig/network and/or DNS server are consistent with what’s returned by “hostname –s” command.

Step 2 Make sure the ifconfig command is in the $PATH environment variable

Troubleshooting Cisco Configuration Engine Installation

2011-05-10T07:14:36Z

Nkanagar:

Troubleshooting Cisco Configuration Engine Installation

2011-05-10T07:13:50Z

Nkanagar: New page: == 'gethostbyaddr()' error == '''Symptom:''' Installation aborted with error message “Hostname value retrieval by system calls 'gethostbyaddr()' and command 'hostname' have different ...

Cisco Configuration Engine -- Troubleshooting

2011-05-10T07:12:42Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* [[Troubleshooting Cisco Configuration Engine Installation]]
* Checking the Version Number
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration/Image/ASDM image upgrade Troubleshooting]]
* [[General_Troubleshooting|General Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

ASA Configuration Troubleshooting

2011-05-04T10:12:21Z

Nkanagar:

==Minimum supported IOS version of ASA Device==

The Minimum supported IOS version of the ASA device is '''8.x and later'''.

==ASA related logs on CE Server==

ASA server related log on CE server can be found @ /var/log/CNSCE/asa/asa.log.

The Minimum supported IOS version of the ASA device is 8.2 onwards.

==Configuring the ASA device==
Following CLIs should be configured on ASA device to communicate with CE server and work using call home protocol.

auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>

auto-update poll-period <period_in_minutes>

auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==Invalid remote host.==

Make sure to add appropriate name <ce-server-ip-address> <ce-server-hostname> cli. As a work around you may use the IP address of CE server in auto-update server CLI instead of hostname.

==How to enable auto-update server logging on ASA device.==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

== Prerequisite for ASA/ASDM image upgrade. ==

Along with auto-update server configuration, following CLI should be exist on ASA device to ASA/ASDM image upgrade to happen.

boot system disk0:/<a-valid-asa-image-name>

asdm image disk0:/<a-valid-asdm-image-name>

Without these 2 CLIs the neither ASA image or ASDM image upgrade will happen.

== ASA/ASDM image upgrade fails with error "could not open flash" ==

This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on device before performing the image upgrade operation.

== ASA/ASDM image upgrade know issues ==
Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

CSCsx01913 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWEMethod=LookUpBug&SWECmd=InvokeMethod&_sn=IKBj7sBC4EkIHUlNyM6tklrz7QKKu.BWcYHr6yGqDfo_&SWEService=CSCBookMarkService&SWEC=1&Identifier=CSCsx01913&SWEHo=cdetsweb-prd.cisco.com&SWETS=1304503304&SWERF=1]

CSCtn98874 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn98874]

CSCtn65993 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn65993]

ASA Configuration Troubleshooting

2011-05-04T10:09:15Z

Nkanagar: /* ASA/ASDM image upgrade know issues */

==Minimum supported IOS version of ASA Device==

The Minimum supported IOS version of the ASA device is '''8.x and later'''.

==ASA related logs on CE Server==

ASA server related log on CE server can be found @ /var/log/CNSCE/asa/asa.log.

The Minimum supported IOS version of the ASA device is 8.2 onwards.

==Configuring the ASA device==
Following CLIs should be configured on ASA device to communicate with CE server and work using call home protocol.

auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>

auto-update poll-period <period_in_minutes>

auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==Invalid remote host.==

Make sure to add appropriate name <ce-server-ip-address> <ce-server-hostname> cli. As a work around you may use the IP address of CE server in auto-update server CLI instead of hostname.

==How to enable auto-update server logging on ASA device.==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

== Prerequisite for ASA/ASDM image upgrade. ==

Along with auto-update server configuration, following CLI should be exist on ASA device to ASA/ASDM image upgrade to happen.

boot system disk0:/<a-valid-asa-image-name>

asdm image disk0:/<a-valid-asdm-image-name>

Without these 2 CLIs the neither ASA image or ASDM image upgrade will happen.

== ASA/ASDM image upgrade know issues ==
Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

CSCsx01913 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWEMethod=LookUpBug&SWECmd=InvokeMethod&_sn=IKBj7sBC4EkIHUlNyM6tklrz7QKKu.BWcYHr6yGqDfo_&SWEService=CSCBookMarkService&SWEC=1&Identifier=CSCsx01913&SWEHo=cdetsweb-prd.cisco.com&SWETS=1304503304&SWERF=1]

CSCtn98874 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn98874]

CSCtn65993 [http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn65993]

ASA Configuration Troubleshooting

2011-05-04T10:04:57Z

Nkanagar:

==Minimum supported IOS version of ASA Device==

The Minimum supported IOS version of the ASA device is '''8.x and later'''.

==ASA related logs on CE Server==

ASA server related log on CE server can be found @ /var/log/CNSCE/asa/asa.log.

The Minimum supported IOS version of the ASA device is 8.2 onwards.

==Configuring the ASA device==
Following CLIs should be configured on ASA device to communicate with CE server and work using call home protocol.

auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>

auto-update poll-period <period_in_minutes>

auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==Invalid remote host.==

Make sure to add appropriate name <ce-server-ip-address> <ce-server-hostname> cli. As a work around you may use the IP address of CE server in auto-update server CLI instead of hostname.

==How to enable auto-update server logging on ASA device.==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

== Prerequisite for ASA/ASDM image upgrade. ==

Along with auto-update server configuration, following CLI should be exist on ASA device to ASA/ASDM image upgrade to happen.

boot system disk0:/<a-valid-asa-image-name>

asdm image disk0:/<a-valid-asdm-image-name>

Without these 2 CLIs the neither ASA image or ASDM image upgrade will happen.

== ASA/ASDM image upgrade know issues ==
Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

CSCsx01913[http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWEMethod=LookUpBug&SWECmd=InvokeMethod&_sn=IKBj7sBC4EkIHUlNyM6tklrz7QKKu.BWcYHr6yGqDfo_&SWEService=CSCBookMarkService&SWEC=1&Identifier=CSCsx01913&SWEHo=cdetsweb-prd.cisco.com&SWETS=1304503304&SWERF=1]

CSCtn98874[http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn98874]

CSCtn65993[http://cdetsweb-prd.cisco.com/erm_enu/start.swe?SWECmd=InvokeMethod&SWEMethod=LookUpBug&SWEService=CSCBookMarkService&SWERF=1&SWEC=1&Identifier=CSCtn65993]

ASA Configuration Troubleshooting

2011-05-03T09:41:44Z

Nkanagar:

Cisco Configuration Engine -- Troubleshooting

2011-05-03T06:28:10Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* Checking the Version Number
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[General_Troubleshooting|General Troubleshooting]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration/Image/ASDM image upgrade Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

ASA Configuration Troubleshooting

2011-05-03T06:24:02Z

Nkanagar:

ASA Configuration Troubleshooting

2011-05-03T06:17:49Z

Nkanagar: /* How to enable auto-update server logging on ASA device. */

ASA Configuration Troubleshooting

2011-05-03T06:17:35Z

Nkanagar: /* Configuration not pulled. */

ASA Configuration Troubleshooting

2011-05-03T06:16:38Z

Nkanagar:

ASA Configuration Troubleshooting

2011-05-03T06:03:09Z

Nkanagar: /* Configuring ASA device. */

==Configuring ASA device.==
Following CLIs should be configured on ASA device to communicate with CE server and work using call home protocol.

auto-update device-id [hostname] | [hardware-serial] | [ipaddress] | [mac-address]| string <device-name>

auto-update poll-period <period_in_minutes>

auto-update server https://<username>:<password>@<ce-server>:<port>/cns/ASAConfig

'''where'''
* '''device-name''' : Name of the ASA device.

* '''period_in_minutes''' : Poll period in minutes. On elapse of poll period, the ASA device will contact the CE server to pull its configuration and Image related information.

* '''username''' : CE Server's admin username.

* '''password''' : Password configured to the ASA device while creating the device on CE server.

* '''port''' : HTTPS server port. By default the port specifies to 443. If this port changed during setup, then the same should be used here.

==How to enable auto-update server logging on ASA device.==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated on CE server and running configuration on ASA device are same and current.

ASA Configuration Troubleshooting

2011-05-03T05:55:03Z

Nkanagar:

==Configuring ASA device.==
Following CLIs should be configured on ASA device to communicate with CE server and work using call home protocol.

auto-update device-id [hostname] | srting <device_name>

auto-update poll-period <period_in_minutes>

auto-update server <ASA_SERVLET_URL_ON_CE_SERVER>

==How to enable auto-update server logging on ASA device.==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated on CE server and running configuration on ASA device are same and current.

ASA Configuration Troubleshooting

2011-05-03T04:50:09Z

Nkanagar:

== How to enable auto-update server logging on ASA device. ==

'''Execute the following commands.'''

ASA-Device(config)# '''logging enable'''

ASA-Device(config)# '''logging console 6'''

ASA-Device# '''debug auto-update server'''

ASA-Device# '''debug auto-update client'''

== Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed. ==
'''Check the following.'''

1. Check whether the ASA device is created on CE server.

2. if the device is created on CE side, then check the auto-update server cli on ASA to verify that the CLI is having correct username and password.

3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

== Configuration not pulled. ==
This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.

1. Enable console/terminal logging on ASA device.

2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time following log (not identical but similar) can be seen on ASA device console.

'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''

'''%ASA-6-725001: Starting SSL handshake with server inside:10.104.58.246/33894 for TLSv1 session.'''

'''%ASA-6-725002: Device completed SSL handshake with server inside:10.104.58.246/33894'''

'''Auto-update client: Sent DeviceDetails to /cns/ASAConfig of server cede1'''

'''Auto-update client: Processing UpdateInfo from server cede1'''

''' Component: config, [URL: https://cnsce-asauser:naveen@cede1:443/cns/ASAConfigProvider?deviceID=ASA-5520-246], checksum:xd2423c0873e3338bec5042a3e143b5e8'''

'''%ASA-6-725007: SSL session with server inside:10.104.58.246/33894 terminated.'''

'''%ASA-6-302014: Teardown TCP connection 23 for inside:cede1/443 to identity:10.104.58.246/33894 duration 0:00:00 bytes 1336 TCP Reset-I'''

'''Auto-update client: no need to update cfg'''

3. If the logging says that '''no need to update cfg''', then the configuration associated on CE server and running configuration on ASA device are same and current.

ASA Configuration Troubleshooting

2011-05-03T04:38:12Z

Nkanagar:

ASA Configuration Troubleshooting

2011-05-03T04:26:32Z

Nkanagar:

== How to enable auto-update server logging on ASA device. ==

'''Execute the following commands.'''

ASA-Device(config)# logging enable

ASA-Device(config)# logging console 6

ASA-Device# debug auto-update server

ASA-Device# debug auto-update client

ASA Configuration Troubleshooting

2011-05-03T04:25:19Z

Nkanagar:

== How to enable auto-update server logging on ASA device. ==
Execute the following commands.
ASA-Device(config)#logging enable
ASA-Device(config)#logging console 6
ASA-Device#debug auto-update server
ASA-Device#debug auto-update client

ASA Image Distribution Activation Troubleshooting

2011-05-03T04:18:46Z

Nkanagar:

'''java.lang.SecurityException: Device Authentication Failed.'''

Check whether the device is created on CE server

ASA Image Distribution Activation Troubleshooting

2011-05-03T04:18:07Z

Nkanagar: New page: '''java.lang.SecurityException: Device Authentication Failed.'''

'''java.lang.SecurityException: Device Authentication Failed.'''

Cisco Configuration Engine -- Troubleshooting

2011-04-29T09:58:20Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* Checking the Version Number
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[General_Troubleshooting|General Troubleshooting]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration Troubleshooting]]
* [[ASA_Image_Distribution_Activation_Troubleshooting|ASA Image Distribution and Activation Troubleshooting]]
* [[ASA_ASDM_Image_Distribution_Activation_Troubleshooting|ASA ASDM Image Distribution and Activation Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]

ASA Configuration Troubleshooting

2011-04-29T09:56:10Z

Nkanagar: Removing all content from page

ASA Configuration Troubleshooting

2011-04-29T09:52:57Z

Nkanagar: New page: ==Failed to Create the Device on Remote Database== '''Problem''': You get the following error message: Failed to create the Device. Could not create Object: DN= [cn=jctest, ou=CISDev...

==Failed to Create the Device on Remote Database==

'''Problem''': You get the following error message:

Failed to create the Device. Could not create Object: DN=
[cn=jctest, ou=CISDevices,ou=CISObjects,ou=configengine,o=cisco
[LDAP: error code 50 - no write access to parent]

'''Solution''': To resolve this problem, follow these steps:

1. On the remote directory server machine, stop the OpenLDAP server by entering the following commands:

*In Solaris, enter: /etc/init.d/NetAppOpenLDAP stop
*In Linux, enter: /etc/rc.d/init.d//NetAppOpenLDAP stop

2. Open the $CISCO_CE_INSTALL_ROOT/openldap/etc/openldap/slapd.conf file. Then add the following:

# open write permission to support external directory
access to *
by * write
by * read
by anonymous auth

3. To start the OpenLDAP server, enter the following commands:

* In Solaris, enter: /etc/init.d/NetAppOpenLDAP start
* In Linux, enter: /etc/rc.d/init.d//NetAppOpenLDAP start

Cisco Configuration Engine -- Troubleshooting

2011-04-29T09:52:46Z

Nkanagar: /* Contents */

__TOC__

==Introduction==

The Cisco Configuration Engine is a network management software that acts as a configuration service for automating the deployment, management, and upgrading of network devices and services. Each Configuration Engine manages a group of Cisco devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Cisco Configuration Engine automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

==Contents==

This document contains troubleshooting information for the Cisco Configuration Engine. It contains the following sections:
* Checking the Version Number
* [[Troubleshooting_Logging_and_Connection_Issues|Troubleshooting Logging and Connection Issues]]
* [[Cisco Configuration Engine -- Troubleshooting Installation Checks]]
*[[Troubleshooting_the_Open_Lightweight_Directory_Access_Protocol_and_the_Berkeley_Data_Base|Troubleshooting the Open Lightweight Directory Access Protocol and the Berkeley Data Base]]
* [[Troubleshooting_the_Cisco_Configuration_Engine_Services|Troubleshooting the Cisco Configuration Engine Services]]
* [[Troubleshooting_the_Web_Services|Troubleshooting the Web Services]]
* [[Troubleshooting_the_Initial_Configuration|Troubleshooting the Initial Configuration]]
* [[Troubleshooting_Configuration_Update|Troubleshooting Configuration Update]]
* [[Troubleshooting_an_Image_Update|Troubleshooting an Image Update]]
* [[Troubleshooting_IMGW|Troubleshooting IMGW]]
* [[Troubleshooting_IMGW|Troubleshooting the Router]]
* [[General_Troubleshooting|General Troubleshooting]]
* [[ASA_Configuration_Troubleshooting|ASA Configuration Troubleshooting]]

'''Note:''' This is not an administration manual. For comprehensive information about administering the Cisco Configuration Engine, see the Cisco Configuration Engine Administration Guide at ''http://www.cisco.com/en/US/docs/net_mgmt/configuration_engine/3.5/administration/guide/CE_ag.html''.

==Checking the Version Number==

To check the version number of the Cisco Configuration Engine software, do one of the following:
*Start the Cisco Configuration Engine application, and look for the version number in the displayed login screen.
*Use the version command. This command is located in the '''cd $CISCO_CE_INSTALL_ROOT/CSCOcnsie/bin''' directory.

[[Category:Configuration Engine Troubleshooting]]
[[Category:Configuration Engine]]