topic vSZ - command "set scg ip" not allowed in AP script in SmartZone and Virtual SmartZone

vSZ - command "set scg ip" not allowed in AP script

mrwolf — Tue, 12 Feb 2019 09:56:49 GMT

Hi all,
we need to change IP address of our vSZ-H, which is hosted on our own public cloud infrastructure.

Though we are pretty confident that we did it well in the past, declaring FQDN instead of IP address in "set scg ip" command, we want to make sure that all of our APs are correctly configured before going live with new IP address.

APs are distributed over many customers, thus DHCP 43 is not an option.

We would like to push an AP script command, as suggested in the following KB article: https://support.ruckuswireless.com/articles/000004979

Also, as per this article, "any AP CLI command will be accepted" into the AP script.

However, when we upload the script, we get the following error: "command[set scg ip] is not allowed in AP CLI Script file."

Script is very simple, as following:

#define AP FW version
fw_version=5.1.0.0.595
#define Model class
model=all
# Command
set scg ip FQDN

Any clue on how to upgrade scg ip remotely (with no easy SSH access)?

Re: vSZ - command "set scg ip" not allowed in AP script

martin_martin — Tue, 12 Feb 2019 10:38:22 GMT

Hi Marco,

As far as I know that has not been changed.
Please raise a case via the support portal to have a support engineer look at it.

Regards
Martin

Re: vSZ - command "set scg ip" not allowed in AP script

tony_heung — Tue, 12 Feb 2019 12:26:35 GMT

Starting from SZ OS 5.1.0.0.268, the following commands are excluded in the AP CLI Script feature in order to protect the integrity and stability of the system.

AP CLI Command Blacklist

reboot
set factory
set scg reset
set scg init
set scg ip
set scg disable/enable
set hub disable/enable
set interface
set password
set login

As Martin suggested above, please contact support desk who can advise you the best way moving forward.

--tony

Re: vSZ - command "set scg ip" not allowed in AP script

michael_brado — Tue, 12 Feb 2019 19:31:20 GMT

Try using a real FQDN (!)

Re: vSZ - command "set scg ip" not allowed in AP script

brian_powers_51 — Tue, 12 Feb 2019 20:59:58 GMT

Marco,

While not pretty, you could in theory do this from the CLI of the SZ. Something like the following should work.

remote ap-cli "set scg ip IP/FQDN"
remote ap-cli "set scg ip IP/FQDN"

There's a bit of a delay between inputting one command and a return of "OK", so using something like AutoHotkey to add your own delay in automating this could help you accomplish what you're trying to do.

Likewise you could change the set to get and verify they are all configured as you desire. The delay between the response(s) will be the pain point I imagine.

Re: vSZ - command "set scg ip" not allowed in AP script

mrwolf — Wed, 13 Feb 2019 15:02:56 GMT

Thank you guys for your hints. Since we're talking about only 10 to 20 APs with scg configured as IP address instead of FQDN, I think we'll proceed manually with remote-ap-cli (if it works).

To avoid having the same problem in the future, we would like to put FQDN also in ICX switches configurarion. However, it seems to accept IP addresses only. Do you know if this is going to change on future fw releases?

Re: vSZ - command "set scg ip" not allowed in AP script

mrwolf — Thu, 14 Feb 2019 10:46:11 GMT

Hi Brian,
unfortunately the remote "set scg ip" option won't work in my scenario.
AP gets the new vsz address, but always shows "SSH tunnel connected to ..." the old address.

I have tested with a local AP and the only way to force it joining the "new" vsz ip is to provide a scg init command, and after that provide the set scg ip command.
Unfortunately I see no way to do that remotely, as after "scg init" command the SSH tunnel gets lost, and I can't reach AP anymore through remote ap-cli to provide next command.

Am I missing something?

Re: vSZ - command "set scg ip" not allowed in AP script

brian_powers — Thu, 14 Feb 2019 13:33:37 GMT

Bummer. You could try a few different commands to see the end result. I'll try a few routes as time permits myself as we may run into your pickle at some point down the road ourselves.

set scg reset says that it changes the state to unmanaged. Might can try that after setting the new IP/FQDN
set scg resetfull says "similar to init but AP doesn't go for reboot"

Not sure if any would do what you're trying to do, but I use set scg reset more than I've used set scg init in the past when I wanted to restart an APs SSH tunnel process.

Re: vSZ - command "set scg ip" not allowed in AP script

mrwolf — Thu, 14 Feb 2019 13:46:30 GMT

I probably tried all possible combination to no avail.
I managed to SSH to one AP and what I found out looks somewhat strange:

set scg disable
set scg ip del 
set scg reset

At this point, SSH tunnel went down.

set scg resetfull
set scg ip new.vsz.fqdn
set scg enable

At this point, AP immediately brings up SSH tunnel WITH OLD IP ADDRESS, despite there's no trace left of it on the get scg config output. 😞
It probably goes away after reboot, but I didn't want to give any service outage so I haven't tried that.

So the trick was to block SSH and HTTPS access to old controller IP address before entering previous commands. This way it looks good, joining new controller address.

I will look into this further, since in a few days I have to perform vSZ final migration to the new IP address, and don't want to make more mistakes.

Re: vSZ - command "set scg ip" not allowed in AP script

toomas_kadarpik — Mon, 23 May 2022 13:18:28 GMT

you need to add also

remote ap-cli "set scg ip IP/FQDN" ; reboot

Toomas 3kgroup

Re: vSZ - command "set scg ip" not allowed in AP script

syamantakomer — Fri, 29 Jul 2022 21:56:59 GMT

Hi All,

SZ has an option called switch over cluster.

Use it to move your AP from one Cluster to another, it is safe, simple and it always works.

Refer the link below.

https://docs.commscope.com/bundle/sz-512-sz100-vsze-administrator-guide/page/GUID-083279C0-ED57-4024-9C3C-C561B63466DC.html

Re: vSZ - command "set scg ip" not allowed in AP script

matt_haywood_9c — Sun, 31 Dec 2023 05:40:28 GMT

I know this is too late to help you, but we are going through the same thing. Here is what we figured out. Hopefully this will help those of you who are facing the same challenge.

Using the GUI within the existing VSZ:
Use the "switch over clusters" option within the vsz gui which works for all zones running 5.0.0 and higher. This is the easiest, fastest option.
Navigate to a zone or an AP you want to migrate.
Select the AP or multiple AP's, the click on the More drop down box for the AP's and select "Switch Over Clusters".
This will present a dialogue box. Enter the public IP of the new VSZ. Click OK.
Wait for 5 minutes for AP's to appear and push data to the new VSZ.

For zones below 5.0.0.0:
We can run the commands on an AP either via directly connecting to it via SSH OR by SSH'ing to the vsz, then entering enable and using remote ap-cli <ap mac addy> "ap cli command in quotes"

The commands to get an AP connected to a new VSZ (without the AP needing to reboot):
This is once you are SSH'ed to the AP directly:
##run this to confirm the scg ip currently being reported by AP
get scg
##run this to change the scg ip to the new IP
set scg ip <new ip addy>
##run this to force the AP to break the current tunnel and establish a new tunnel using the current scg ip
set scg reset full

Voila. Wait 5 minutes before all the data starts to populate in the new vsz.

Note: to run the above commands using the remote ap-cli here is the commands from CLI of VSZ in enable mode
remote ap-cli XX:XX:XX:XX:XX:XX "get scg"
remote ap-cli XX:XX:XX:XX:XX:XX "set scg ip <XXX.XXX.XXX.XXX>"
remote ap-cli XX:XX:XX:XX:XX:XX "set scg reset full"

Again, voila. Now wait 5 minutes for the data to start populating in the new vsz.