A document explaining in detail workaround for CSCvw63161

1. Automated workaround for
CSCvw63161
Jeff Keown – High Touch Engineer

2. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CSCvw63161
ZTP failing with error in creating downloaded_script.py
• Affects only 16.12.4
• Prevents ZTP from starting and auto provisioning switches
• Workaround is to console into the switch and create a ‘guest-share’
directory in flash:

3. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround
• By default, unconfigured Cisco IOS devices attempt to download a config file named router-confg or
router.cfg (Autoinstall feature)
Autoinstall Configuration guide reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/configuration/15mt/fundamentals-15-mt-
book/cf-autoinstall.html
• In lab testing, we were able to successfully create the guest-share directory, and automatically reboot
unconfigured cat9k switches with the following router-confg file:
Router-confg:
file prompt quiet
do mkdir flash:guest-share
!
kron occurrence reload in 1 oneshot
policy-list reload
kron policy-list reload
cli reload
!
end

4. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround
• It was observed that if the switch’s DHCP server offered a boot file via
dhcp option 67, autoinstall would not start
• The successful workaround flow involves:
1) Allow the switch to boot and download the router-confg file via
autoinstall. This requires the switch to obtain an address via DHCP
which does not offer DHCP option 67 bootfile
2) Once the guest-share directory has been created, and the switch has
automatically reloaded, the switch needs to obtain another DHCP
address that does offer the option 67 boot file for ztp to start.

5. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround - Options
The workaround can be accomplished in one of two ways:
1) Initially put the switch on a vlan that uses a DHCP scope that does not
offer option 67. After the switch has the guest-share directory created
and reboots, move the switch’s port to a vlan that uses a DHCP scope
that offers the ztp required option 67 boot file.
2) Initially disable option 67 from the switch’s DHCP scope. Allow time
for autoinstall to create the directory and reboot the switch. Then enable
the DHCP scope option 67, and ztp should run.

6. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround – TFTP Server Options
• TFTP Server Options
• 1) Put the router-confg file on a TFTP sever on the switch’s Vlan. The switch will send a
broadcast TFTP request, which the TFTP server should respond to.
• 2) Put the router-confg file on a central TFTP server. Configure an ip helper-address on
the switch’s default gateway, pointing to the TFTP server. TFTP is forwarded by default
with the helper-address config, so nothing else needs to be configured.
• 3) Copy the router-confg file to another Cisco router or switch that the switch can reach
(either via broadcast or helper address), and configure it to serve the file via TFTP.
Config t
tftp-server flash:router-confg

7. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround – Process Log Highlights
Switch#delete /f /r flash:gs-script
Switch#dir | inc guest-share
Switch#dir | inc gs-scr
Switch#wr erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
!!!! rebooting now, bootfile option disabled on dhcp server so autoinstall can run and create the guest-
share directory, then reboot
!!!! relevant dhcp scope config (bootfile option remarked out)
#option bootfile-name "http://10.85.134.66/ztp.py";
Switch#reload
System configuration has been modified. Save? [yes/no]: no
Reload command is being issued on Active unit, this will reload the whole stack
Proceed with reload? [confirm]

8. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround – Process Log Highlights
Would you like to enter the initial configuration dialog? [yes/no]:
%Error opening tftp://10.85.134.66/network-confg (No such file or directory)
%Error opening tftp://10.85.134.66/cisconet.cfg (No such file or directory)
Press RETURN to get started!
Loading router-confg from 10.85.134.66 (via GigabitEthernet0/0): !
[OK - 144 bytes]
*Jan 14 19:30:15.268: %SYS-5-CONFIG_P: Configured programmatically by process DHCP Autoinstall
from console as vty0
*Jan 14 19:30:15.269: %SYS-5-CONFIG_I: Configured from tftp://10.85.134.66/router-confg by console
*Jan 14 19:30:15.269: AUTOINSTALL: Tftp script execution successful for Gi0/0.
*Jan 14 19:30:15.269: %SYS-5-CONFIG_P: Configured programmatically by process DHCP Autoinstall
from console as vty0
*Jan 14 19:31:18.919: %SYS-5-RELOAD: Reload requested by vty0. Reload Reason: Reload Command.
Chassis 1 reloading, reason - Reload command

9. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround – Process Log Highlights
The switch automatically rebooted. while it was rebooting, we re-enabled the dhcp scope boot file
option, and restarted the dhcp service
--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
Loading http://10.85.134.66/ztp.py
*Jan 14 19:36:19.302: %IM-2-IOX_ENABLEMENT: Switch 1 R0/0: ioxman: IOX is ready.day0guestshell
installed successfully
Current state is: DEPLOYED
day0guestshell activated successfully
Current state is: ACTIVATED
day0guestshell started successfully
Current state is: RUNNING
Guestshell enabled successfully

10. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Automated Workaround – Process Log Highlights
Jan 14 19:41:12.022: %SYS-5-CONFIG_P: Configured programmatically by process PnP Agent
Discovery from console as vty0
Jan 14 19:41:12.022: %PNP-6-PNP_SAVING_TECH_SUMMARY: Saving PnP tech summary (pnp-tech-
discovery-summary)... Please wait. Do not interrupt.
Jan 14 19:41:17.615: %SYS-5-CONFIG_P: Configured programmatically by process PnP Agent
Discovery from console as vty0
User Access Verification
Username: admin
Password:
ZTP>