I have a not-so newly installed LMS4.2 Linux appliance. Here is my configuration archive summary:
Config Archival Status
No. of Devices
Successful 7 Failed 1338 Partially Successful0 Total1345 Configuration Never Collected 1338
[Code].....
Which seems to mean that SSH does not work, which is false as I manually connects to the device from the LMS host successfully. Network devices access is authenticated against ACS servers using TACACS+ so there should be no problem with credential discrepency here.
I beleive in the past these devices could not be managed bij RME config management, but now it says in the supported device table:The following features are supported:Network Topology Layer 2 ServicesFault ManagementInventory CollectionConfiguration Deploy Protocols: TELNET, SSH, TFTP, RCPConfiguration Fetch Protocols: TELNET, SSH, TFTP, RCP.The password and enable pasword are correct and simply work when I try a telnet from the server.The gui is not CLI but menu driven.RME just says:TELNET: Failed to establish TELNET connection to 10.1.1.7 - Cause: Authentication failed on device 3 times. PRIMARY-RUNNING config Fetch Operation failed for TFTP. Could not detect SSH protocols running on the device.
I have a question about a daily archive sync job. I have the job set to run by device type groups. My question is, when I delete or add devices, will they automatically be added to the job?
I've inherited a server running Ciscoworks LMS 4.0 to manage our plethora of switches. Running 'Configuration > Configuration Archive > Synchronization' against a Catalyst 3750 switch called switch1 successfully retrieved the Running, Startup, and VLAN configs.Running the same command the following day on switch1 failed and returned this in the job execution result:Unable to get results of job execution for device. Retry the job after increasing the job result wait time using the option:Admin > Collection Settings > Config > Config Job Timeout Settings I modified the job result wait time setting to be 600 seconds, tried again and received the same timeout failure. I have also seen this same Failed message on other devices, but have never actually received the configs for them, so I feel switch1 is a better place to start.What are the first things I should check in CiscoWorks for a problem like this? Is there a particular software revision I should be on with LMS 4.0? What timeout value should be used for Archive Synchronization?
On our cisco 3750 switches we can take config backups with the archive command. After every "write mem" it rights the config to our backup server. We would like to do this also for our asa 5520 with version 8.2(2). I also searched in the command reference guide, but I can't seem to find the proper command to do it.
we have an LMS 3.2 in which it cannot archive the configuration for a couple of routers. The output is the following:
Failed to fetch the configuration. Check the dcmaservice.log for details. TELNET: Failed to establish TELNET connection to x.x.x.x - Cause: connect timed out.
The issue is that i have configured all devices to be accessed through SSH first and then through telnet. I have tested SSH access from LMS with putty.
I am getting some weir behaviour in my LMS 4.2 setup. I am doing and Archiveupdate job and am receiving a partial success for roughly 1400 devices. Here is some output.
Execution Result: STARTUP CM0057 PRIMARY STARTUP Config fetch SUCCESS, archival failed for xxxxxx Cause: CM0210 Unable to generate processed config Action: Verify that archive exists for device. RUNNING
[code]...
I went on and checked the dcmaservice log file.I found the following entry at the same time of this particulair job
ERROR,[Thread-72920],com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.analyzer.IOSConfigletRules,loadRules,42,Could not locate configlet rule file : com/cisco/nm/xms/xdi/pkgs/SharedDcmaIOS/analyzer/IOSConfigletRules.ser [ date taken out ],ERROR,[Thread-72920],com.cisco.nm.rmeng.dcma.configmanager.DeviceArchiveManager,archiveNewVersionIfNeeded,1115,CM0210 Unable to generate processed config
I then searched if I had the IOSConfigletRules.set file on the box. And no it is not there. My question is this the reasson that I have som manny partial sucess archive results?
In our organisation we have multiple Nexus 5000 switches, which Cisco LMS 4.2.2 cannot get the running-config and startup-config from with the Archive Management process. When it does try to get them, I get a error as follows:
*** Device Details for SF-DERA-01 *** Protocol ==> Unknown / Not Applicable Selected Protocols with order ==> TFTP,SSH,SCP
Iam using LMS 3.2. In short, there is 2 type of router, 2800series and 2900series. These device already join to TACACS server. When I try to sync archive I got:
- failed on 2900series - successful on 2800series
I have doing same config (credential, snmp, protocol for sync archive), for those device on ciscoworks but why I find the error??
I have a number of devices such as Cisco Call Manager, or Cisco Wireless Controllers, etc that I want to remain in DCR but would like to exclude from the Config Archive process. Is there any way of excluding an individual device from this process?
I'm having trouble syncing the config archive for some of my nodes.
I get the error 'partially successful' (see attatched PNG).
I've looked in the dcmaservice.log (also attatched), and I can see the extended error message:
[ Wed Jan 11 09:49:30 CET 2012 ],ERROR,[Thread-2137],com.cisco.nm.rmeng.dcma.configmanager.DeviceArchiveManager,getLatestConfigFileVersion,168,CM0021: Version does not exist in archive $1 Cause: Version may have been deleted [ Wed Jan 11 09:49:30 CET 2012 ],INFO ,[Thread-2137],com.cisco.nm.rmeng.dcma.configmanager.DeviceArchiveManager,getSysObjectID,425,SYS OID
I would like to check the file structure / permissions, but since I don't know what '$1' refers to, I'm stuck.
The bootloader used by the device is U-Boot, which is also licensed under the terms of the GPL. Sadly these parts are missing from the source code package provided by D-Link. Therefore I am asking you to add the U-Boot sources to the provided archive or post them here in the forum.
I'm trying to do configuration archiving in Prime Infrastructure 1.2 with a 5508 WLC (7.4).The job always fails (Admin -> Background Jobs) with the following error (see attachement):"SNMP: Failed to establish SNMP connection xxxx - Cause: Device is Unreachable. Check the ReadOnly community string." I double checked the SNMP credentials, they do match. For testing I also added a Public community just for the PI. Same result.Am I missing something?Is this not intended for Wireless Controllers?
I can't install or extract any file or archive downloaded through shared connection from the 1st PC via a LAN ... tried new LAN and tried switch the LANs but doesn't work always a CRC error when extract an archive or file corrupted when install anything downloaded:this is what I tried so far
-tried download and extract on a 2nd installed windows (I have dual boot) and its same CRC error -tried another non built-in LAN card pci-E x1 and its the same CRC error -tried restore bios to default and its same CRC error -tried putting a laptop on the same line instead of my PC and it works no errors no problems
I have an issue with accessing a Cisco NCS (ver.1.3.0.20) form the GUI interface. It claim the password is wrong...From the CLI I have access.... Ah I can just change the passwords I thought. But no way.. dosent work!
I am position to migrate from CatOS 6509 switch to native IOS 6509 switch. long time ago, there was some site to convert automatically based on copy and paste onto the tool, but i can not find.
Does anybody know how to convert CatOS configuration to Native IOS configuration ? It is not IOS change, but it is configuration convert.
I have double-checked credentialn and access rules on the module and they seem OK. I am trying to add the module with the Admin credentials and ssh/telnet access is permited.
Is this the right way or I'm missing something. Module version is A2(3.2a)
We are using ACS v5.2.0.26.3 in 802.1X certificate based authentication. Now, when we added CRL functionality into ACS it fails in CRL validation and gives following error message:
LastErrorMessage=CRL PKI verification failed Certificate Revocation list [URL]
We have installed root, device and server certificates from CA, but for management we are still using self-signed certificate.
Question is, which certificate is used when validating downloaded CRL file - one used for EAP-TLS or one used for management interface?
How I can check which certificate ACS server is using for CRL validation?
I dont understadn how this works but basically I have enabled dhcp or so I thought bu clients dont get a lease. The vlan does but clients connecting to the switchports attached to the vlan do not get a lease and cant connect to anything. If I static the ip or use my server to issue dhcp then it's fine still some issues since I am cluceless but I dont understand what I have to do to get dhcp to work on the fa0-3 ports.
Router#sh running-config Building configuration... Current configuration : 1015 bytes !
I am using LMS version 3.2 and i am not able to generate EOS/EOL report with error no connection to Cisco.Saw an update i LMS portal as this:
Now Available! LMS 3.2:Patch for un-interrupted service of Cisco.com download for Device/Software/PSIRT/EOX updates (To be applied on or before 15-June-2011)
so upgraded the patch cwcs33x-win-CSCto46927-0.zip and restarted the demeon as read in the read me file for the patch.Now the job execution status is always shows running, its neither fail nor pass.
I have a 3845 that will not let me ping to the internet from my PC.On interface g0/0 I have a connection to a internet connection (another router), using DHCP to get it's address (it gives g0/0 IP 192.168.0.3).On interface g0/1, I have a connection to my LAN (I assign the interface IP 10.10.1.1).
I can ping the router. The router can ping the internet, do DNS resolution, etc.I have ensured routing is enabled. The only route I have configured is a default static route: 0.0.0.0 0.0.0.0 192.168.0.1.Oddly, if I choose 0.0.0.0 0.0.0.0 g0/0, I cannot ping sites on the internet from the router.
I tried setting up ip nat inside for my LAN and ip nat outside for the WAN/internet uplink, but this did not work.
This was the issue, I missed finishing the NAT setup.I can make the router ping out all day, and have my PCs ping the router, but getting the connection between the two is not working.
I try upgrade ACS 5.3.0.40 to new version 5.4.0.46. Everything looks ok:
ACS-machine/acsadmin# application upgrade ACS_5.4.0.46.tar.gz rep01 Do you want to save the current configuration ? (yes/no) [yes] ? Generating configuration. Saved the running configuration to startup successfully
% CARS Install application required post install reboot...
Broadcast message from root (pts/0) (Thu Dec 6 23:36:41 2012):
The system is going down for reboot NOW!
Application upgrade successful
But ACS machine (vmware instance) can't boot with this result: Volume group "smosvg" not found. (for details see attachment)
I am trying to upgrade ISE from 1.1.0 to 1.1.2.145 but failed. Find the details below.
DR-ise-pdp-01/admin# application upgrade ise-appbundle-1.1.2.145.i386.tar.gz ISE1 Save the current ADE-OS running configuration? (yes/no) [yes] ?
Generating configuration... Saved the ADE-OS running configuration to startup successfully Initiating Application Upgrade... Stopping ISE application before upgrade... Running ISE Database upgrade... % Application upgrade failed. check logs for more details.
We've got a central office (actually quite small) where several IPSec connections connect to. Two of these connections are Cisco 881 routers. One of them works fine, the other craps out after 24 hours (coincidentally also the IKE key lifetime). When I mean "craps out", it means the VPN worked fine from the get go, until 24 hours later. Only a reload will bring back the VPN tunnel. I've verified my PFS and DPD configurations are solid, because these kind of symptoms would most likely occur when these configurations aren't in order.
The two 881 configurations are quite similar. The only differences between the two are some details in the PPPoE configurations and (quite obviously) the IP address space for the two sites. Both operate on the premise of a point to point connection (no multipoint stuff going on here).
I am trying to join my ACS 5.1 to my AD. In the External Identity Stores > Active Directory I have put in the AD administrator details and hit the test button and the test succeeds.
However, when I try to save changes it fails with an eror saying it can't connect to the LDAP server.
Error while configuring Active Directory:Error while configuring Active Directory:Unexpected LDAP Error Can't contact LDAP server due to unexpected configuration or network error.Please try the --verbose option or run 'adinfo --diag' to diagnose the problem.Join to domain 'Mydomain.local', zone 'null' failed.
I have done this lots of times and never had any issue once the test connection succeeds.
I've checked the time and timezones on both ACS and AD and they are the same.
Using CCP installed Easy VPN after setup completed ran the test and it failed see below; What commands can I enter to check this? New at VPN so I am sure I have something miss configured.
Router Details Attribute Value Router Model 851W Image Name c850-advsecurityk9-mz.124-4.T7.bin IOS Version 12.4(4)T7 Host name My Router Test Activity Summary: Activity Status Checking interface status... Failed
Test Activity Details Activity Status Checking interface status... Failed
Troubleshooting Results ; Failure Reason(s)Recommended Action(s)All the crypto applied interface(s) are down or no crypto applied interface is present Make the connection up and then proceed with VPN troubleshooting.
