R82.10 fail to install on xcp-NG no drive detected

[nadmin]

R82.10 has installation issues on virtualization platforms. See to issues on VMware and proxmox (in these forums)

Check_Point_R82.10_T467.iso (Check_Point_R82_T777.iso works perfectly, have used XCP-ng with Check Point for years)

BIOS and UEFE (serial and vga) all tested

Anaconda prompts:

Do you wish to proceed with the installation? [OK]

Which keyboard type is attached to this computer? [US]

Fatal Error, No disk found, Press OK to abort installation.

Tried UEFI boot without success, various versions of broken. If choose VGA (LOM) usually get No drive found. Other times it never gets to anaconda.

4 vCPUs, 4GB RAM for the test in lab

Increasing RAM didn't solve.

If I exit out to command line/grub and run "ls": (hd0) (cd0)

1 time of of all the experiments it worked. I can't reproduce it in 20+ attempts. Best recollection I created the VM without automatically starting it. Changed NIC to not use TX check summing. Set boot firmware to uefi, and started it. That one time it worked without prompting me to choose from Boot from local drive / GAIA -UEFI - Serial/ GAIA - UEFI VGA. I snapshotted the one that worked and created a template from it for testing.

But it really seems R82.10 has a problem with virtualization.

Between the virtual bios log and the UEFI boot menu messages flash by:

BdsDxe: failed to load Boot0002 "UEFI Misc Device 2" from PciRoot(0x0)/Pci/(0x3,0x0)/VenHw(3D3CA290-B9A5-11E3-B75D-B8AC6F7D65E6,01004003): Not Found

BdsDxe: loading Boot0001 "UEFI Misc Device 1" from PciRoot(0x0)/Pci/(0x3,0x0)/VenHw(3D3CA290-B9A5-11E3-B75D-B8AC6F7D65E6,01004016)

BdsDxe: starting Boot0001 "UEFI Misc Device 1" from PciRoot(0x0)/Pci/(0x3,0x0)/VenHw(3D3CA290-B9A5-11E3-B75D-B8AC6F7D65E6,01004016)

[PhoneBoy]

What virtual hardware options are there for disk/storage in xcp-ng and which one have you configured?

[nadmin]

XCP-ng has Xen under the hood.

When creating a VM, you select a storage repository (local storage, NFS, SMB, etc). and an amount in GiB. There is no driver to select.

It works fine with the R82 ISO. For R82.10, it doesn't. That one time it worked with R82.10, copies from that template work. But I cannot reproduce a working VM.

[Bob_Zimmerman]

What storage driver does R82 show it's using? I expect it to use virtio, but this command should tell you:

[Expert@DallasticXL-s01-01:0]# lspci -vv | egrep -i "^[0-9a-f].+(SAS|SATA|SCSI|NVM)" | cut -d' ' -f1 | xargs lspci -k -s
00:13.0 SATA controller: Intel Corporation Atom Processor C3000 Series SATA Controller 0 (rev 11)
	Subsystem: Intel Corporation Device 7270
	Kernel driver in use: ahci

What happens if you install R82, then upgrade in place to R82.10?

[nadmin]

lspci
00:00.0 Host bridge: Intel Corporation 440FX — 82441FX PNC [Natoma] (rev 02)
00:01.0 ISA bridge: Intel Corporation 82371SB PI IX3 ISA [NatomazTriton II]
00:01.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [NatomazTriton II] 
00:01.2 USB controller: Intel Corporation 82371SB PIIX3 USB [NatomazTriton II] (rev 01)
00:01.3 Bridge: Intel Corporation 82371AB/EB/NB P11X4 ACPI (rev 03)
00:02.0 VGA compatible control ler: Cirrus Logic GD 5446
00:03.0 Unassigned class [ff80]: XenSource, Inc. Xen Platform Device (rev 01)​

lspci -vv | egrep -i "^[0-9a-f].+(SAS|SATA|SCSI|NVM)"
lspci -vv | egrep -i "(SAS|SATA|SCSI|NVM)"

IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton III] (prog-if 80 [ISA Compatibility mode-only controller, supports bus mastering)
        Subsystem: Red Hat, Inc. Qemu virtual machine
        Physical Slot: 1
        Control: I/O+ Mem- BusMaster+ SpecCycle- MemVINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
        Status: Cap- 66MHz UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 0
        Region 0: [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
        Region 1: [virtual] Memory at 000003f0 (type 3, non-prefetchable)
        Region 2: [virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
        Region 3: [virtual] Memory at 00000370 (type 3, non-prefetchable)
        Region 4: I/O ports at c100 [size=16]
        Kernel driver in use: ata_piix

Driver ata_piix

This is from the R82.10 that worked and I can't preproduce it.

I will spin up a R82 and compare, then upgrade to R82.10 and compare again.

[Bob_Zimmerman]

Is that the full output from lspci?

PIIX3 IDE? Gross! I can't imagine that being used for the primary storage. Maybe it's where the optical drive is attached?

Can you get an lspci from a VM where the installation fails? The RHEL installer uses tmux, so you should be able to get a shell using Control-B, then 2 (Control-B then 1 should take you back to the installation interface).

[nadmin]

Thanks for sharing good tricks.

The R82 box:

00:03.0 SCSI storage controller: XenSource, Inc. Xen Platform Device (rev 01)

lspci -k -s 3

00:03.0 SCSI storage controller: XenSource, Inc. Xen Platform Device (rev 01)

              Subsystem: XenSource, Inc. Xen Platform Device

              Kernel driver in use: xen-platform-pci

R82.10 at the No disk found.

Ctrl-B, 2

lspci

00:03.0 SCSI storage controller: XenSource, Inc. Xen Platform Device (rev 01)

lspci -k -s 3

00:03.0 SCSI storage controller: XenSource, Inc. Xen Platform Device (rev 01)

              Subsystem: XenSource, Inc. Xen Platform Device

              Kernel driver in use: xen-platform-pci

I carefully compared, same in R82 and the R82.10. Just not happy in R82.10 installer.

[Bob_Zimmerman]

So they both see the same SCSI controller? Now I'm very interested to see what happens if you install R82 then upgrade to R82.10.

[nadmin]

Will do that this afternoon and report back

[nadmin]

Unfortunately my usual tricks of installer agent disable, installer agent enable didn't get the CPUSE download to work. The sk on the consent flags didn't work either. I did the FTCW to set it up as a SMS, and it won't update to R82.10 because "missing license". Neither clish or webgui.

[Chris_Atkinson]

Did you try applying an eval license already?

[nadmin]

No, because in a lab I need to build R82.10 base systems, not install R82 and acquire evals for each one of them to upgrade to R82.10. I use the base 15 day license for lab testing. I build the lab using terraform and ansible.

[Bob_Zimmerman]

As you mentioned, there isn't much customization available for hardware presented to guests under Xen. I doubt we're going to find a way to get installation from ISO working on XCP without some weird, unsupported customizations of the ISO. Maybe try one of the CloudGuard Network for Private Cloud images instead? You can configure them using cloud-init (as I discuss in my post about building a long-lived API target), which arguably makes them easier to set up than an installation from ISO.

If those don't work, you should probably consider other hypervisors for your lab environment.

[nadmin]

I appreciate the comment.

My perspective is that R82.10 has had several big issues with different hypervisors (reboot loop, etc. documented here in the community). It looks like something changed under the hood in R82.10.

This definitely matters to me before migrating a fleet of R81.20 firewalls to R82.10. I might wait for R82.20.

[emmap]

XCP and Xen are not supported virtualisation platforms so we can only provide best effort support here and wouldn't recommend running production systems over them. Officially the only supported platforms are VMWare, KVM, Hyper-V, Nutanix and Azure Local.

[Bob_Zimmerman · Accepted solution]

Quite a lot has changed internally, yes. R81.20 was based on RHEL 7.9 (kernel 3.10.0-1160), R82 is based on RHEL 8.6 (kernel 4.18.0-372.9.1), and R82.10 is based on RHEL 9.4 (kernel 5.14.0-427.13.1). Major changes to the kernel, drivers, boot process, userspace, etc.