BMS LCM: instance fails due to tftp open timeout

[vageesan]

   "PXE-E32 TFTP open timeout" message is seen and hence BMS instances are not able to do tftp boot.

Dheeraj also saw this issue in his setup.After cluster bring up ,instance came up only once with tftp boot.On deleting and re-spinning the instance, instance started failing in tftp boot.

Build: ocata-5.0-215.

[Dheeraj Gautam (dgautam)]

This issue was happening due to the default security group.

It was verified that ping from baremetal to Underlay was working (both sides) but during pxe, TFTP (port 69 and other random ports) packets will be sent to-and-fro. QFX/MX blocks those packets and causes the PXE to fail.

By default Ingress/0.0.0.0/ANY/ANY rule is not there causing almost all traffic to block from openstack to baremetal.

[Dheeraj Gautam (dgautam)]

re-assigning back to Vageesan to retry after updating the default security group.

[Jeba Paulaiyan (jebap)]

Auto SG configs should be taken care by design.

[Jeba Paulaiyan (jebap)]

Notes:

Incase of BMS LCM the TFTP and PXE boot traffic should be passed to the openstack node. The default security group applied on the fabric devices blocks these and BMS LCM fails. To workaround this, add Ingress/0.0.0.0/ANY/ANY rule to the security group.