cancel
Showing results for 
Search instead for 
Did you mean: 

3 switches won't back up config in xmc (File not found / missing)

3 switches won't back up config in xmc (File not found / missing)

Keith9
Contributor III

I have daily config backup configured for 7 am for two groups, core and access. I have all our switches sucessfully backing except 3 of them.  I have 11 switch stacks in our access switch group and 3 of these stacks have the this message

File Not Found/Missing -Error: Could not connect with TFTP server at 10.1.0.110

File Not Found/Missing -Error: Could not connect with TFTP server at 10.1.0.110

File Not Found/Missing - The device was unable to contact the TFTP server.  Check that the TFTP server is runinng and connectivity is okay.

 

So the question poses, why just 3 switch stacks showing this error?  I have an ACL on all fo them SSH-access.pol, and I put the netsight server IP in it (10.1.0.110/32) and verified it worked by opening a terminal session to every switch stack.  This resolved my issue with the bulk of them, besides changing the SSH account after that broke when I changed to radius authentication.

So I have 2 valid core switch stacks backing up and 8 access switch stacks backing up.  I’m not sure whats up with the last 3.  They can ping and log in from the XMC web GUI.  There’s nothing impeding their path to XMC.

Thanks for any helpful hints.

1 ACCEPTED SOLUTION

Keith9
Contributor III

Ok well talking this through in the thread here got me looking more closely at the routing tables.  Netsight VM traffic was exiting our 2nd core switch (all vm’s are mlag’d between 2 cores).  Some VM’s go out one core, some the other.

The second core had that transport network advertised in its OSFP configuration and an IP interface on it, however that WAN is not connected.  We were going to earmark a port on it to go “swing the cable” in the event something happened to our primary core switch, however we don’t have any ports for that right now and we have a different, alternative backup path should we need to reach those locations out core 2.

So the 192.168.100.x/24 transport network that 3 remote sites were on, were not making it through to the second core switch.  I mean you could ping and trace PAST that network, but the EXOS switch INSISTED (as Stefan K. shows some examples) to use the interface in that 192.168.100.x network.  So to end users and servers, traditionally they noticed no issue.  They live and work in different IP networks that are all in the routing table.

 

So I removed that VLAN from core 2’s OSPF configuration and now it traverses an OSPF link we have between both cores and out that WAN provider that is physically connected into our core 1 switch stack.

 

(Our core switch stacks are X690’s, our access stacks are X450G2’s or 5520’s depending on location).

 

So in actuality this was a routing issue and now I was able to retrieve configurations successfully.

 

Thanks for talking me through it.  Sometimes you don’t notice the mundane details until you start typing it out and having a casual conversation.

 

View solution in original post

13 REPLIES 13

Stefan_K_
Valued Contributor

Hmm, interesting. Maybe it’s time for some tcpdumps and port-mirros.. 🙂 

 

Keith9
Contributor III

sudo ufw staus

stats: inactive

 

iptables --list

ab94b130ff494fbf83570ff2565b33a4_3446d0f5-5680-4c79-a687-af860b881570.jpg

 

I dont know, its completely bizarre.

Stefan_K_
Valued Contributor

Try

sudo ufw status

to check the current rules or

sudo ufw disable

to simply disable it. Might also be something in iptables?

unconfigure access-list acl1 ports 1:13 ingress

 

Keith9
Contributor III

Nevermind, a lot of trial and error with tab completion , found it

unconfigure access-list ports 1:13 ingress

 

anyway that didn’t make a difference.

 

When logged into netsight server at 10.1.0.110 it can ping and traceroute fine to a troubled switch.  The switch cannot ping or traceroute to netsight.  It can ping from its loopback0 ip if I use the ping command with the from.

 

One VR-Default.  VR-Mgmt exists on the switch too, but isn’t used for anything.

 

Odd thing is I can have both sides ping at the same time, you’d think they’d see each others packets hitting at the same time and say Oh ok good… but no only get a response from netsight pinging out using the ping command at the ubuntu cli.

Keith9
Contributor III

Let me ask you this, if I want to remove an acl1 from a port to test, how…

 

configure access-list acl1 ports 1:13 ingress

 

 

How can I take acl1 off port 1:13 in the above example .

GTM-P2G8KFN