topic ICX 7250 9.0.10 config parsing error at boot in ICX Switches

ICX 7250 9.0.10 config parsing error at boot

tls — Mon, 19 May 2025 23:52:10 GMT

We have a small number of remaining ICX 7250s which are running 8.0.95. They are mostly in environments that require a quiet switch (albeit not fanless) with more than 12 POE ports, and I don't really have budget to replace them.

I upgraded one of our spares to 9.0.10j_cd7T213 to play around. There are the usual oddities I've also seen with version 10 (prompting for a username on "enable" seems like a behavior change specifically designed to enrage experienced network engineers...) but only one thing I really found concerning. By policy we disable all management except SSH and serial console on all network devices - it's non-negotiable.

Booting our standard configuration on the 7250 with 9.0.10 yields this, just before the console first prompts for login:

Config parsing complete: 0.43 percent time: 00:10 parsed: [ver 09.0.10j_cd7T213]
Error - Config send failed
Error [1 ui_common_send: Not able to apply - itc error please try again] parsing line: [no web-management https]

show run from a privileged exec does show the "no web-management https" statement, and it does not appear the switch is actually listening on port 443, but, more disturbingly, if I then interactively reconfigure the switch with "web-management https" and then "no web-management https" it throws the same "Config send failed" error and rejects all subsequent configuration statements.

Is this the kind of thing to expect from 9.0.10? I haven't tried downgrading a switch from 9 or 10 to 8, but maybe this is the time...

Re: ICX 7250 9.0.10 config parsing error at boot

Chandini — Tue, 20 May 2025 13:31:09 GMT

Hi Tls

Thank you for reaching us.

When you configure web-management https and then disable it using no web-management https, does the output of show web accurately reflect the current HTTPS status after each command?"

Thank you

Re: ICX 7250 9.0.10 config parsing error at boot

tls — Tue, 20 May 2025 19:57:07 GMT

As requested I did a little more poking around, starting from a clean reload every time. Unfortunately it appears the problem -- at boot time -- is non-deterministic; sometimes the "Config send failed" error appears in the boot messages, and sometimes it does not. Here is a log from a session where it appeared, and where I also run the test you requested. Note that I have snipped some irrelevant sections, which is indicated with [...].

May 20 19:26:18:012241:info:fi_debug:debug_logs:1:1641972499200: PS 1, Internal Power supply is up. Starting config parsing time: [Tue May 20 19:26:18 2025] Starting upgrade ... Upgrade done with exit status: 0 Config parsing complete: 0.43 percent time: 00:10 parsed: [ver 09.0.10j_cd7T213] Error - Config send failed Error [1 ui_common_send: Not able to apply - itc error please try again] parsing line: [no web-management https] Config parsing complete: 100.00 percent time: 00:39 parsed: [end] Finished config parsing time: [Tue May 20 19:26:57 2025] Elapsed time: 00:39 May 20 19:26:57:066517:info:fi_debug:debug_logs:1:5244977920: App Rx Event: 136 F1: 1 F2: 0 Sl:0 May 20 19:26:57:066636:info:fi_debug:debug_logs:1:5244977920: Cfg Parse Done. All-task initialization completed...final phase of system initialization started. May 20 19:26:57:066707:info:fi_debug:debug_logs:1:5244977920: Parse Time in Secs: 41 May 20 19:26:57:966457:info:fi_debug:debug_logs:1:5244977920: Successfully notified stack role 'none' to hmond [...] ******* Starting HMON service for SNMPD ******* console going online Press any key to continue... Ruckus-ICX login: Ruckus-ICX login: super Password: coresw-office>en Login:super Password: coresw-office#sh web HTTP server status: Disabled HTTPS server status: Disabled No web connection. coresw-office#sh run Current configuration: ! ver 09.0.10j_cd7T213 ! stack unit 1 module 1 icx7250-24p-poe-port-management-module module 2 icx7250-sfp-plus-8port-80g-module stack disable ! ! [...] ! no web-management https ! --More--, next page: Space, next line: Return key, quit: Control-c^C coresw-office#sh web HTTP server status: Disabled HTTPS server status: Disabled No web connection. coresw-office#conf t coresw-office(config)#no web-management https HTTPS already disabled coresw-office(config)#web-management https coresw-office(config)#end coresw-office#show web HTTP server status: Disabled HTTPS server status: Enabled No web connection. coresw-office#conf t coresw-office(config)#no web-management https Error - Config send failed coresw-office(config)#end coresw-office#show web HTTP server status: Disabled HTTPS server status: Disabled No web connection. coresw-office#conf t coresw-office(config)#web-management https coresw-office(config)#end coresw-office#show web HTTP server status: Disabled HTTPS server status: Enabled No web connection. coresw-office#conf t coresw-office(config)#no web-management https Error - Config send failed coresw-office(config)#end coresw-office#show web HTTP server status: Disabled HTTPS server status: Disabled No web connection. coresw-office#

So it looks like "show web" indicates that web management has been enabled or disabled per the configuration statements I enter live with "conf t", but, the "no web-management https" statement throws that config-send error. I am concerned that in the boot time config file parse, this might result in statements after it being skipped, or other unexpected behavior.

Re: ICX 7250 9.0.10 config parsing error at boot

tls — Tue, 20 May 2025 21:18:57 GMT

See below for a session log (some irrelevant sections elided with "[...]" of the experiment you requested. It appears the config commands do turn the web-management off and on, but, the no web-management https command throws an error and causes all subsequent commands in the same conf t session to error. My main concern here is whether the boot-time error (which doesn't happen at every boot - looks like about half the time) means I might be running with an incorrect config if it results in statements later in the saved config being skipped.

Re: ICX 7250 9.0.10 config parsing error at boot

tls — Wed, 21 May 2025 00:22:18 GMT

Hi - I keep trying to answer this and the forum seems to accept anything I post that has a long preformat or code block, but then it disappears shortly after. So I can't give you the example I'd like to provide. The answer to your question is that show web does show the current https status as disabled immediately after boot, but, if I interactively (conf t) enter web-management https, end, then show web, then another conf t, then no web-management https, I immediately get the config send error and all subsequent config commands fail. If I don't enter any more config commands, I can end and see that https is disabled with show web, but, further config commands failing is very concerning - it makes me worry that the parts of the configuration after the no web-management https statement may not be in effect at boot.

I also discovered that the problem does not happen at every cold boot. About half the time, the boot log will include the config send error, and about half the time not. It seems to happen more reliably on reload.

Re: ICX 7250 9.0.10 config parsing error at boot

Chandini — Thu, 22 May 2025 10:35:31 GMT

Hi Tls

Ack and Thank you for sharing the details.

When you were using version 8095, did you experience this issue, or has it only appeared after upgrading to version 9010j?

Also, would you be able to test the behavior on version 8095r to help isolate the problem?

Looking forward to your feedback.

Thank you

Re: ICX 7250 9.0.10 config parsing error at boot

tls — Wed, 28 May 2025 01:04:56 GMT

I downgraded the exact same switch to 8095r (I factory defaulted it first) and with the same configuration with the only difference that, of course, 8095 requires me to declare a router-interface, this error does not occur.