Hi Peng,
Can you set your SCS for verbose mode and send to us the log of machine, since provisioning until you get the error?
Best Regards!
--Bruno Domingues
Attached the full log as well as a screen capture for the vPro device platform in SCS console.
Peng,
Based on your logs, as you described the problem happens during provision phase and abort on updating ACLs:
| ERROR! | Error Configuring Intel AMT device: Failed Setting ACLs.: AMT Connection Error: SOAP Error [14]: "setACLs::RemoveUserAclEntry: SOAP Unknown error". |
| Debug | Setting ACLs. |
| Debug | Setting 802.1x in S0. |
| Debug | Setting environment detection. |
| Debug | Clear 802.1x wired profile settings. |
| Debug | Setting enabled interfaces. |
| Debug | Setting TLS options. |
| Debug | Setting Ping response |
| Debug | Setting Domain name to devlocal.local. |
| Information | Setting the Host name to hp-radia. |
| Debug | Setting Network parameters |
| Debug | Synchronizing Intel AMT device clock |
| Debug | Updating Intel AMT device RNG key |
As I can see in your printscreen, you are using AMT 3.0.1 and one possible cause can be mismatch of SCS ACLs for newer vPro features, in this case I would suggest you define in your profile only "admin" account with PT administration rights in order to make sure that is the case.
I would suggest also, update your AMT firmware for the newest version available.
Best Regards!
--Bruno Domingues
Hi Bruno,
Thanks for the help!
Based on your suggestion, I removed other user except for the built-in "admin" account with PT administration. After that, the old “setacls” error disappears. However, we are getting the following error message now:
4171 | ERROR! | Error Configuring Intel AMT device: AMT Connection Error: SOAP Error [24]: "commitChanges: Fault: 'Timeout' : Details: 'connect failed in tcp_connect()'". | 4/1/2011 9:12 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 2202 | DEVLOCAL\Localadmin | SATLITE78 | |
4171 | Information | Committing changes. | 4/1/2011 9:12 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 780 | DEVLOCAL\Localadmin | SATLITE78 | hp-radia.devlocal.local |
4171 | Warning | Failed Setting TLS PSK: AMT Connection Error: SOAP Error [24]: "setTlsPsk: Fault: 'Timeout' : Details: 'connect failed in tcp_connect()'". | 4/1/2011 9:12 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 2205 | DEVLOCAL\Localadmin | SATLITE78 | hp-radia.devlocal.local |
4171 | Information | Generating a new PID/PPS pair. | 4/1/2011 9:11 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 862 | DEVLOCAL\Localadmin | SATLITE78 | hp-radia.devlocal.local |
4171 | Warning | Failed Setting MEBx password: AMT Connection Error: SOAP Error [24]: "setMEBxPassword::GetAdminAclEntryStatus: Fault: 'Timeout' : Details: 'connect failed in tcp_connect()'". | 4/1/2011 9:11 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 2205 | DEVLOCAL\Localadmin | SATLITE78 | hp-radia.devlocal.local |
4171 | Warning | Failed Setting power policies.: AMT Connection Error: SOAP Error [-1]: "setPowerOptions: SOAP Unknown error". | 4/1/2011 9:11 | 17410FFB-A956-11DC-BBDA-FE9DD0E9000F | 2205 | DEVLOCAL\Localadmin | SATLITE78 | hp-radia.devlocal.local |
By the way, I ran Intel® AMT Scan Tool downloaded from http://communities.intel.com/docs/DOC-2061 but found no problem. ProvisonServerPing is OK.
Also attached the latest log file and screen captures,
Regards,
Pearson Peng
Person Peng,
Have you tried upgrade the firmware? Just for debugging purpose I would like to recommend you upgrade to latest firmware version:
DELL BIOS A16 with firmware version 3.2.20
Lenovo firmware version 3.2.20
Do a full unprovision and try it again, from this point there is no reason to not work.
Best Regards!
-- Bruno Domingues
Hi Bruno,
Unfortunately, we are still getting errors after upgrading the firmware. See attached for the logs and screen shot. Is there anything else I am missing?
Regards,
Pearson Peng
Peng,
As far I can see you moved to n-1 problem:
| 7884 | ERROR! | Proper certificate that matches the pre loaded certificate was not found in the user certificate store. PKI configuration failed. |
| 7884 | ERROR! | Error Configuring Intel AMT device: Failed to connect to un-configured Intel AMT device at IP 16.178.123.22: Proper certificate that matches the pre loaded certificate was not found in the user certificate store. PKI configuration failed. |
SCS is claiming that didn't find the proper certificate in ME. Are you using PKI mode with internal certificate? probably you should inject the hash again into the ME.
Best Regards!
--Bruno Domingues
Hi Bruno,
I am Pearson's colleague.At first thanks for your help.
You said the error was we used the PKI mode, in fact the error log was happened when we deleted the PID and PPS. When We set new PID and PPS ,the same error log was reappeared.This is the new log information.
Best Regards!
Giggs Song
Latest update is after using static IP addresses on both sides, we finally provision the vPro client in SCS successfully. However, we encountered a problem in HP Client Automation. The client is shown in "vPro Provisioning", but it cannot be found using Device Discovery Wizard in HPCA.
Attached serval screen captures for the issue. Is there any idea about the issue?
Giggs,
It's looks like a network issue, looking into log I can find this entry multiple times:
| ERROR! | Error Configuring Intel AMT device: Failed to connect to un-configured Intel AMT device at IP 16.178.123.22: AMT Connection Error: SOAP Error [25]: "getFullCoreVersion: SOAP Unknown error". |
and also:
| Debug | The SOAP connection with connection parameter set #16 failed: AMT Connection Error: SOAP Error [24]: "getFullCoreVersion: Fault: 'Timeout' : Details: 'connect failed in tcp_connect()'". |
Some ideas to fix it:
- Disable Windows Firewall;
- Check if you are able to ping vPro machine from console, using IP address and FQDN, and that FQDN reply match with IP address;
- Check if you are able to open connection to vPro machine in 16992 or 16993 port: from console open a telnet (e.g. telnet IP_address 16992);
At the end, vPro machine should be accessible from console using FQDN onto 16992 or 16993 port, if not you may face this kind of problem.
Best Regards!
--Bruno Domingues
Peng,
It looks like you have name resolution problem in your network. Do you have these machine's FQDN with alias in DNS? are you able to query this machines using FQDN?
Best Regards!
--Bruno Domingues
Hi Bruno,
I have confirmed that the machine's FQDN with alias provisionserver exists in DNS. I can nslookup the machines using both host names and FQDN.
The latest update is that after adding a digest user in the profile in SCS console, the client vPro device is discovered in Device Management in HP Client Automation. However, when we click on the vPro device to manage it, the following error pops up:
"Error: Unable to retrieve information for the selected device.
The possible cause could be the device is not available in network."
Attached the zipped screen captures and the stdout log file.
Hi Peng,
It's looks like that the root cause is your network, I would suggest you run the DiagTool on your server and also on your vPro machine in order to check the connectivity and dependecy.
The DiagTool generate a report, you can post here in order that we can identify the problem.
Best Regards!
--Bruno Domingues
Hi Bruno,
We decide to use PKI mode to provision the vPro client device and set up another testing environment with only two computers in a private network. We will not pursue the original issue. Thanks for the help!
