Solved

PXE Boot Problem on VLAN using IP helpers

Posted on 2009-05-07
13
4,407 Views
Last Modified: 2013-12-23
hello there-

im having some trouble with configuring a PXE boot. the situation is as following:

- we have a network with several VLAN's all on HP Switches.
- we have a DHCP and a PXE Boot Server that are both in the same VLAN.
- we have clients in all the other subnets that will need to be able to boot from the PXE server
- using Option43 on DHCP is not an option since it dont work with all hardware that we have in use

Toplogy:

192.168.A.1 = Main Switch / Layer3
192.168.A.2= First building switch - connected to main switch
192.168.A.3=Second building switch - connected to main switch
192.168.A.4=fourth building switch - connected to main switch
192.168.A.5=fifth building switch - connected to main switch

192.168.A.6=sub building switch - connected to 192.168.A.5
192.168.A.7=sub building switch - connected to 192.168.A.5
192.168.A.8=sub building switch - connected to 192.168.A.

every switch has one IP in every VLAN.
Clients will use the corresponding gateway - for 192.168.B.0/24 gateway = 192.168.B.1
on every switch, in every VLAN except the first one, we have IP Helper adresses.
the first ip helper points to our DHCP server
the second ip helper points to our Columbus / PXE server

- now what happens:
- sometimes machine dont get any response from DHCP
- sometimes machine gets response from DHCP but then fails with TFTP of the columbus.
- sometimes we see one gateway, sometimes we see 2, sometimes 3 on the PXE boot info.

all of our switches is HP equipment.
Has anyone had something like this before, or a clue why the system behaves like this?
were pretty stuck here, every of our consultants says something different about it, we tried all of the solutions, no change....

regards
Tiz
0
Comment
Question by:gilget
  • 7
  • 6
13 Comments
 
LVL 5

Expert Comment

by:0ren
ID: 24324278
on the hp switch
do you have under each vlan
ip helper-address
with the ip address of the dhcp server ?
0
 
LVL 5

Accepted Solution

by:
0ren earned 500 total points
ID: 24324312
this my working configuration

the dhcp should point to tftp server.
this is my dhcpd.conf

deny unknown-clients;
not authoritative;
option subnet-mask 255.0.0.0;
allow bootp;
allow booting;
ddns-update-style ad-hoc;

subnet 10.0.0.0 netmask 255.0.0.0 {
                                #option routers;
                                option broadcast-address 10.255.255.255;
}

group hosts {
                next-server 10.0.0.251;
                filename "pxelinux.0";

                host host1 {
                                hardware ethernet 00:11:22:33:44:5;
                                fixed-address 10.0.0.1;
                                }
                }

dont forget to restart after change

the tftp  should run on the same server as the dhcp.
the tftp directory /tftpboot should have 777 permissions
0
 
LVL 5

Expert Comment

by:0ren
ID: 24324327
next-server is the address of the tftp server
0
 
LVL 4

Author Comment

by:gilget
ID: 24324328
hello Oren

thank you for the fast response.

yes on the vlans, I have 2 Ip Helper adresses

ip helper-address 192.168.A.186 - DHCP Server
ip helper-address 192.168.A.141 - Columbus PXE Boot Server / TFTP

i cant have the TFTP and the DHCP on the same machine. Columbus PXE Boot Server acts as a DHCP Proxy as I have been told.

My DHCP Server is windows 2008 server.

thanks for your help
0
 
LVL 5

Expert Comment

by:0ren
ID: 24324382
i had problem with seperate dhcp and tftp servers.
with windows 2008 it might be worse but lets try
can you configure your dhcp to provide the above information ?
if so .
does the pxe client get that information ? ( ip , gateway ,tftp server etc )
0
 
LVL 4

Author Comment

by:gilget
ID: 24324521
hello there

i configured my DHCP to allow bootP now, but for the rest, Im not sure how to manage it on server 2008.

well as I told before, sometimes they get it, sometimes they dont!
if they get it, it looks like this:

- Gateway IP 192.168.B.1
- DHCP: 192.168.A.186
- DHCP Proxy: 192.168.A.141
PXE Bootserver: 192.168.A.141
but then it will get a timeout on the TFTP command....
also sometimes you dont have only one gateway, but it will say something like:
Gateway: 192.168.B.4      192.168.B.1
- wich seems to be odd if you look at our topology.
if I traceroute to my PXE server, hops ALWAYS go on 192.168.B.1 directly.

if I test the PXE boot from the same subnet as where my DHCP and PXE Boot servers are in, everything works just fine.
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 5

Expert Comment

by:0ren
ID: 24324606
"sometimes they get it, sometimes they dont!"
looks like you have another bogus dhcp on your network.
maybe even one you are unaware of it.

did you enable the tftp server and test it ?
make sure you can download files from.

i think also you should remove the tftp server from the ip helper-address
0
 
LVL 4

Author Comment

by:gilget
ID: 24324653
hello there

having a second helper-address for the TFTP/PXE/Columbus server was told to us by the supplier technicians.
i tried without this, but then it dont work at all.

PXE/TFTP/Columbus works fine on the subnet where the two servers (dhcp and columbus) reside in.
it dont work from all other subnets, or just sometimes- ;)

the fun thing is, i checked with wireshark, it dont look like there is a second DHCP or TFTP server running on the network-

all the best
thierry
0
 
LVL 4

Author Comment

by:gilget
ID: 24324742
ah yes, if I boot to windows, I always get an IP adress from the DHCP-
0
 
LVL 5

Expert Comment

by:0ren
ID: 24324862
the tftp  server is not dhcp server ( or is it ? ) therefor it doesnt show as one.
i dont think you need the tftp server address as ip helper-address.

check all your switches if the vlan configuration is not centrelized.
remove the second ip helper-address from all of them.

0
 
LVL 4

Author Comment

by:gilget
ID: 24325042
- TFTP server is not DHCP

DHCP server is 192.168.A.186
all other services (PXE TFTP COLUMBUS) are on 192.168.A.141

im doing some tests at the moment, will get back in some minutes-
0
 
LVL 4

Author Comment

by:gilget
ID: 24331127
hello there-

i made myself a little more knowledable about this.
First, Oren, thanks for Your help, I appreciate it a lot-

1. I had an error on my network configuration

- Only the Layer 3 switch needs an IP on every VLAN.
- If other switches (thats HP switches I dont know for others) than the layer3 switch have more than just an IP on the main VLAN, then you will run into problems with PXE boot. (dont ask me why all my switches had an adress on every vlan, it came with the initial setup - it actually makes no sense!)
I dont know why this behaviour is only with PXE boot, for normal tcp/ip your traceroutes always go the correct (shortest) way.

2. for the IP helpers

for this scenario you need 2 IP helpers, the first in the config should point to your DHCP the second one to the PXE boot server.
Ive been doing some reading on the net and I saw people making just one IP helper to the broadcast adress, but this is not a good Idea, cause one of the reasons to have VLANs is to get rid of the stupid broadcast. if you use 2 ip helpers pointed to both of your servers, then broadcasts will only go there.

also, I saw people doing ip forwards on tftp port and 4011, I guess You would only use this if you have restricted network access within Your VLAN, cause if You dont have any restrictions setup, having just a normal IP helper that points to one host, sends all broadcasts to the given host.

allrightey, I got it all, thats what I was looking for so hard.
Thanks for the help-it gave me a clue where to go search for the problem-

and thx god it was not a rogue DHCP - h3h3



0
 
LVL 4

Author Closing Comment

by:gilget
ID: 31578945
Ill acceppt this as Solutions cause it would probably on a Linux setup.
Basicaly great tips overall cause this pointed me towards where to look for the error.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now