Cloud Managed Networks

 View Only
Back to discussions
Expand all | Collapse all

AOS8 to 10 Migration - Pre-Validate Failure (dns error)

This thread has been viewed 101 times

  • 1.  AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Mar 29, 2024 07:51 AM
    Edited by MH33 Mar 29, 2024 08:10 AM

    The controller and APs are currently running 8.10.0.5 LSR

    We are migrating AOS8 Campus APs to Central. When trying to do a pre-validate check from the controller all APs are failing with the following error message :  

    Pre Validate Failed  dns error(Central) device-uswest4.central.arubanetworks.com  

    I was able to SSH into the AP and confirmed that it can resolve DNS, including the central FQDN, and also reach the internet

    As an extra validation, I ran a capture on the APs switchport. During the pre-validation, I see the AP resolve the record, but then it never attempted to reach out to any of the returned IPs.   It only reaches out to devices.arubanetworks.com

    I opened a TAC case, and they responded that they don't support migrations from AOS8 to AOS10???  We would need to involve Aruba professional services, even though this is a specific question about the documented process.

    Has anyone seen this error in the past and/or have recommendations on how to proceed?   Is it possible its a bug in the AOS8 code they are on (8.10.0.5).  I searched the defect database but could not find any documented bugs. 

    My only idea now is to upgrade to a later 8.10 version.

    If the documented method of converting AOS8 controller-managed APs doesn't work, what other methods are there to migrate a few hundred APs?



  • 2.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Mar 30, 2024 08:18 AM

    The documented method does work, we have done over 100 of them.  I have seen this error once or twice.  I got around it by changing the native VLAN on the port so the AP gets a fresh set of info from the DHCP server.  Then do a clear and use no-prevalidation on the ap convert command.  The ap convert process isn't perfect but it does work.  I'm guessing it's a bug too.  



    ------------------------------
    DanOBrien
    ------------------------------



  • 3.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Mar 31, 2024 07:22 AM

    I did some testing with 345 and a 503r using a virtual controller. 
    What I noticed on my firewall is that you need to open DNS, NTP and HTTPS. For NTP and DNS you can get away with running it locally as well. I did not run into any issues. Was running aid 8.9.

    There is a thread about it. What did your firewall report?



    ------------------------------
    Martijn van Overbeek
    Architect, Netcraftsmen a BlueAlly Company
    ------------------------------



  • 4.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Mar 31, 2024 09:28 AM

    Our Aruba SE replicated the issue in his lab, so I know it is not an issue with this specific environment.   I know it is not a firewalling issue because a capture of the switch port never sees the AP trying to communicate out.

    The workaround right now is forgoing the pre-validation and forcing the migration without the checks.

    The APs I have tested with so far have been successful, but unfortunately, without the pre-validation, we run the risk of an AP not being properly added to Greenlakes and having to track it down.

    For anyone in the future, the command is:  ap convert active specific-aps local-flash "image-name" no-pre-validation

    I'm waiting to hear back if this is a bug in just 8.10.0.5 or if potentially other 8.10 releases are impacted. 




  • 5.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 04:00 AM

    Hey everyone, I'm facing the same issue while migrating APs from AOS8 to AOS10. Following Aruba's guidance, I'm updating the APs to ArubaOS_Hercules_10.4.1. I've used the no-pre-validation command to force the migration, but I've noticed that the APs aren't properly registering in Aruba Central after the process, unless I perform a physical reset. This isn't a viable option since I have hundreds of APs to migrate. Has anyone managed to solve this issue without needing to physically reset the APs? Or is there any update regarding a fix for this bug in version 8.10.x?


    Original Message


  • 6.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 09:13 AM

    What we eventually did was just convert the APs to Instant Access on AOS 8 through the controller and then do the upgrades through Aruba Central, that worked fine.

     

    Martijn Paul van Overbeek
    Architect
    Work 443-333-5809
    Mobile 984-528-1279
    Email mvanoverbeek@blueally.com

     




    Original Message


  • 7.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 09:41 AM

    Thanks for the suggestion, Martijn. Unfortunately, I'm dealing with AP 315 models, which don't support conversion to Instant AP directly on version 8 of my controller. That's why Aruba Support recommended updating them to version 10.x. However, I encountered this issue during the migration, where the APs don't register in Aruba Central unless I perform a physical reset. Any ideas or workarounds for AP 315 models that could help in this situation?


    Original Message


  • 8.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 01:10 PM

    I am not familiar with the 315 versions but aren't you able to upgrade to an 8.x release that will be able to act as an Instant Access?

    Converting APs to Instant APs (arubanetworks.com). Again I am not familiar with the 315 though.

     

    Martijn Paul van Overbeek
    Architect
    Work 443-333-5809
    Mobile 984-528-1279
    Email mvanoverbeek@blueally.com

     




    Original Message


  • 9.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 01:17 PM
    Thanks for the response. I received guidance from Aruba Support to upgrade the AP 315 models to version 10.x, as they aren't compatible with IAP on version 8. I'm currently following that procedure, but I've run into this DNS and NTP error during the migration. Any insights on how to address this issue would be greatly appreciated


    Att,

    Leandro Silva (SAO)
    IT Infrastructure Analyst




    Original Message


  • 10.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 17, 2024 01:28 PM

    What I find strange is that the Aruba Support page says that for instance 8.11.1.2 is supported by the AP 315.

    Again we converted the AP on the controller to an IAP AP. If that is not possible the only thing I can think of is using that procedure I shared with an 8.x release and then convert in Aruba Central. I see online that the 315 is supported on several releases in the AOS 8 series.

     

     

    Martijn Paul van Overbeek
    Architect
    Work 443-333-5809
    Mobile 984-528-1279
    Email mvanoverbeek@blueally.com

     




    Original Message


  • 11.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 18, 2024 02:42 AM

    AP-315 is supported on 8.x versions. I have several of them running Instant in my lab and many more at customers. Controller conversion should work on these APs. At least it did in my case. 

    You can try staging Hercules image locally instead of going through Activate. 

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Guru 2024
    ------------------------------

    Original Message


  • 12.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted Oct 18, 2024 07:00 AM

    Thanks again for the input, Gorazd. Just to clarify, my controller is running version 8.10.0.12 LSR, and when I select the AP 315 to convert it to Instant, I get an error saying that the command is not supported for this AP model. Due to this, Aruba Support recommended that I upgrade the AP 315 to version 10.x to then migrate them to Aruba Central, as a physical reset is not a viable solution given the scale of the deployment. I am trying to upgrade to ArubaOS_Hercules_10.4.1.4_90528 and encountered a pre-check error related to NTP and DNS. I appreciate your suggestion, and I'll try staging the Hercules image locally. Any additional insights are very welcome.


    Original Message


  • 13.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted 2 days ago

    Depending on what the AP was before it became a CAP. If it was an IAP or UAP, you can use the redeploy command vs ap convert. If the AP was purchased as a CAP and you want to put controller-less code on, you will need to use the AP convert command. I have had issues across different hw products in 8.10 and different versions. You may have a couple more reboots on the redeploy command as it goes back to the original software like you would on factory reset button. Since they are 3xx series you could end up with a possible cert issue and may need to do manual upgrade. Its also easier if you set compliance for software in central. 

    The AP convert will also upgrade both boot banks as part of the process. I would generally say this is a safer measure for older hardware devices. It can reduce headaches when changing environments in the future.  There is no error checking on the redeploy command. You will have to go check all the serial numbers prior to doing the change. I provided the option for only redeploying an ap-name, but you can do it based on other options as well. 

    • show ap image version ap-name <ap-name>
      • check backup partition vs primary. {format 8.10.0.21 = cap software, 8.10.0.21-8.10.0.21 = controller-less software}
    • ap redeploy controller-less ap-name <ap-name> 


    Original Message


  • 14.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted 5 days ago

    Late to the thread but there is a defect ID for this now, which answers your last question about whether it is only 8.10.0.5. It is not. AOS-253282 / AOS-253299, fixed in 8.10.0.11, reported against 8.7.1.9 and later. HPE's description: the AP image conversion fails, show ap convert-status reports Pre Validate Failed, and it happens when Central used an IPv6 address.

    That fits your capture exactly. The AP resolved the name and then never opened a session to what came back, which is what you would expect if it got an address it could not use rather than an address it could not find. The dns error string is misleading. Your resolver was fine the whole time.

    So the fix is a version move, 8.10.0.11 at minimum. I would go to 8.10.0.12 or later regardless, since that is the floor both the AOS-10 migration prerequisites and VSG 035 Campus Migrate call for. The Central documentation page saying 8.10.0.5 is enough is the outlier and I would ignore it.

    On the APs you already pushed through with no-pre-validation, worth checking each one landed in the right group with a subscription attached, because that licensing and group check is precisely what validation was doing for you.



    ------------------------------
    Dustin Burns

    Lead Mobility Engineer @Worldcom Exchange, Inc.

    ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
    If my post was useful accept solution and/or give kudos
    ------------------------------



  • 15.  RE: AOS8 to 10 Migration - Pre-Validate Failure (dns error)

    Posted 2 days ago

    Reviving this since it still comes up. The pre-validate "dns error" is AOS-253282 / AOS-253299: conversion fails when Central resolves to an IPv6 address. Your capture, resolving the record then never contacting the returned IPs, is that bug's signature. Fixed in 8.10.0.11, so upgrade the 8.10 train and rerun it.

    And the documented controller conversion does work at scale once past this defect. If TAC says the migration isn't supported, push back, the process is documented.



    ------------------------------
    Dustin Burns

    Lead Mobility Engineer @Worldcom Exchange, Inc.

    ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
    If my post was useful accept solution and/or give kudos
    ------------------------------



Related Content