SCCM 1810 / Cisco IP Helpers / PXE UEFI

[OPA-MAS]

Morning

 

I'm looking for a little help please with the following;

 

Problem:

 

We are able to PXE boot using legacy anytime of the day but uefi only works when there isnt much traffic on the network (Evenings and Mornings)

 

UEFI also works on VLANs with low traffic

 

Any help would be great

 

Thank you

 

Setup:

 

- Windows Server 2016 Datacenter with SCCM 1810 using ConfigMgr PXE Responder not WDS

- 2x Windows DHCP Servers

- 2x Cisco Core Switches (Cisco 4900M) with IP Helpers (see below)

- We have no wds dhcp options set

 

VLAN interface on each core switch:

 

interface Vlan302

description ***PC_VLAN302***

ip address 10.0.33.2 255.255.255.0

ip helper-address 10.0.53.137 <<<<<<<<<<<<<< DHCP Server 1

ip helper-address 10.0.53.138 <<<<<<<<<<<<<< DHCP Server 2

ip helper-address 10.0.54.76 <<<<<<<<<<<<<< SCCM PXE Server

no ip proxy-arp

ip pim dr-priority 3

ip pim sparse-dense-mode

standby 32 ip 10.0.33.1

standby 32 timers 1 3

standby 32 preempt

standby 32 authentication md5 key-chain HSRP_hash_key

!

[FN-GM]

That looks ok to me.

 

Does this happen on different model of machines or just one? I had massive problems getting a Dell machine to PXE via UEFI reliably. Bios update fixed it.

 

Are you able to post a config of the switch port that device is connected to please?

[OPA-MAS]

Thank you for your fast reply

 

No it's happening on everything even on the Hyper-V Cluster which is connected to the both core switches on a 20 Gbps NIC.

 

Here is one port config but its happening on all ports

 

Thanks

 

Port Config:

 

interface GigabitEthernet1/0/43

switchport access vlan 302

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

!

[FN-GM]

No Problem!

 

I was looking for portfast - you already have that set!

 

Do you have DHCP Snooping configured?

[OPA-MAS]

I'm glad in a way its not just me

 

DHCP Snooping is disabled on both cores and all the edge switches.

 

 

Core:

 

Switch DHCP snooping is disabled

DHCP snooping is configured on following VLANs:

none

DHCP snooping is operational on following VLANs:

none

DHCP snooping is configured on the following L3 Interfaces:

 

Insertion of option 82 is enabled

circuit-id default format: vlan-mod-port

remote-id: 7cad.740d.ce00 (MAC)

Option 82 on untrusted port is not allowed

Verification of hwaddr field is enabled

Verification of giaddr field is enabled

DHCP snooping trust/rate is configured on the following Interfaces:

 

Interface Trusted Allow option Rate limit (pps)

----------------------- ------- ------------ ----------------

 

Edge:

 

Switch DHCP snooping is disabled

DHCP snooping is configured on following VLANs:

none

DHCP snooping is operational on following VLANs:

none

DHCP snooping is configured on the following L3 Interfaces:

 

Insertion of option 82 is enabled

circuit-id default format: vlan-mod-port

remote-id: 7010.5c09.0d00 (MAC)

Option 82 on untrusted port is not allowed

Verification of hwaddr field is enabled

Verification of giaddr field is enabled

DHCP snooping trust/rate is configured on the following Interfaces:

 

Interface Trusted Allow option Rate limit (pps)

----------------------- ------- ------------ ----------------

[FN-GM]

I don't think it is a network issue with your Cisco gear. It looks fine to me. One last check - can I see a sample config of your uplinks between switches please?

 

When this happens does the machine get a DHCP lease and just fails to PXE or does it not it get a lease at all? - This way be can rule it as a PXE issue or DHCP issue.

[OPA-MAS]

That was my thinking but it was doing the same on our old SCCM setup.

 

I dont understand why its working when no one is on the network.

 

PXE just fails but on PXE Legacy its fine

 

Thanks

 

Hyper-V to Core Link

 

interface TenGigabitEthernet1/5

description ***Public***

switchport trunk allowed vlan VLANS

switchport trunk allowed vlan add VLANS

switchport mode trunk

spanning-tree portfast trunk

spanning-tree bpduguard enable

!

 

interface TenGigabitEthernet1/6

description ***Public***

switchport trunk allowed vlan VLANS

switchport trunk allowed vlan add VLANS

switchport mode trunk

spanning-tree portfast trunk

spanning-tree bpduguard enable

!

 

Core to Edge Link

 

 

interface TenGigabitEthernet2/1

description **TRUNK TO HUB**

switchport trunk native vlan 301

switchport trunk allowed vlan VLANS

switchport trunk allowed vlan add VLANS

switchport mode trunk

udld port aggressive

!

 

 

Edge to Core

 

interface TenGigabitEthernet1/0/1

description ****TRUNK TO CORE***

switchport trunk native vlan 301

switchport trunk allowed vlan VLANS

switchport trunk allowed vlan add VLANS

switchport mode trunk

udld port aggressive

!

[FN-GM]

have you modified the TFTPWindowsSize on your SCCM server? I used to do this but it caused issues for me.

https://ccmexec.com/2016/09/tweaking-pxe-boot-times-in-configuration-manager-1606/

 

 

These 2 are unrelated but:

 

I would take this off the links that connect to your servers. You shouldn't have BDPU packets from your servers, if you do the filter might be better as it will simply dump them instead of err-disabling the ports your servers use. Disabling the ports will bring down your network. Personally I wouldn't have either on.

 

spanning-tree bpduguard enable

 

 

 

I would also remove this from the uplinks. Even with the the trunk keyword it isn't meant to be used on uplinks. Its meant to be used if you use trunks to client devices that run VMs.

 

spanning-tree portfast trunk

Edited January 16, 2019 by FN-GM

[OPA-MAS]

Nope havent changed the TFTPWindowsSize

 

Looks like we will have to make someone do nights to image everything lol

 

I will keep searching but there is nothing out there about this problem

 

I will also look into them unrelated things

 

Thanks for all your help