AP9631 rev5 in SMT1500i: Firmware 6.2.0->6.8.8 results in HTTP/HTTPS breaking

[Anonymous user]

Host Name Sync: Disabled

Stat:         P+ N4+ N6+ A+
Bootmon:     bootmon:v1.0.9
AOS:         aos:v6.8.8
App:         sumx:v6.8.8

Http:            enabled
Https:            enabled
Http Port:         80
Https Port:         443
Minimum Protocol:    TLS1.1
Limited Status Access:    disabled
Lim. Status Page Used:    n/a

SSH works.

When connecting with HTTP or HTTPS the NMC reboots (can bee seen on the network, boot sequence tries to pull characteristic information).

HTTP(S) did work in 6.2.0 with this card

This looks like a genuine bug in 6.8.8 to me (if I should guess it sound exactly like the problem with version 6.3.8 4 years ago - reducing the MTU is NOT an option for me.)

I considered to downgrade but could not find any other version of the firmware for SmartUPS with AP6931 than 6.8.8

How to solve this?

[Anonymous user]

The problem from 2016 that sounds similar is found here:

https://www.se.com/in/en/faqs/index?page=content&id=FA235265

[BillP]

Hi,

Have you tried to re-flash the firmware? I suggest re-flashing manually by following the instruction in FAQ FA156047

Start by putting the bootmon on the card, then the aos and finally the sumx. 

[Anonymous user]

I used the manual usb flash drive method. I put all bin files at once in apcfirm.

I will do it in 3 passes again, but to be honest i cant see why this would change anything, since all components are OK:

 Stat : P+ N4+ N6+ A+

Is it possible to go back to the original firmware by doing the factory reset??

[Anonymous user]

So now I did a factory reset (and this landed me in in 6.8.8., not in the original firmware).

I had to set a new password for user apc.

then put on in individual steps:

1) bootmon

2) aos

3) sumx

It  did not solve the problem.

I did this again in individual steps via SSH:

1) bootmon

2) aos

3) sumx

Again, the problem with HTPP(S) remains there, no access to the web UI, but ssh and snmp work.

I still conclude: this must be a BUG in the 6.8.8 firmware.

When is it going to be fixed?

 Or where can I get an earlier 6.2.0 firmware for Smart-UPS with AP9631 without that bug? I have not found it online.

[BillP]

Hi,

I do not have access to firmware 6.2.0 Here is a link to firmware 6.2.1 https://schneider-electric.box.com/s/t82frub87zelgpfx639yltoixdldw9hx

To down grade the card you will need to uncompress the firmware and install manually. Ftp the bootmon, then the aos, and finally the sumx. 

Note: firmware 6.2.1 does not include current security features and is no longer supported by Schneider Electric. 

[BillP]

Hi,

We have released firmware 6.9.2 for your card. You can download it from this link. 

https://schneider-electric.app.box.com/s/r9zwcptew9uoispxndxtxpafqqhen1rg

[Anonymous user]

Unfortunately V6.9.2 does _not_ fix the bug. The problem remains.

I will try V6.2.1

[Anonymous user]

Bill, for your information, with 6.2.1 the Web UI does work again on my card. However, the SSH implementation does not offer cipher suites that are accepted by OpenSSH nowadays, so that is the downside of this firmware.

In any case thank you for come back to me so quickly with the latest firmware and an older version that was not available online.

I think it would definitely be appropriate if APC provides a working firmware for the AP9631 cards, considering their pricing.

When do you think could that we the case?

Best regards!

[BillP]

Hi Jongen,

Are you trying to access the NMC via IP address or DNS name?

There is an issue with firmware 6.8.8 and 6.9.2 where you can not access the web interface via the DNS name if the hostname and domain are not configured correctly on the device.

To resolve this log in using the IP address and go to:

Configuration >> Network >> DNS >> Configuration     

This issue has already been reported to quality team.

-Gavan

[Anonymous user]

Hi Gavan,

Hello Gavan,

then we are talking about two different problems. The web access reboots the NMC in all these cases:

-http(s)://ipaddress

-http(s)://hostname

-http(s)://hostname.domain

And I do have the hostname configured properly using the CLI, I am not able to do it via the Web UI, as it is not working (also not when using the IP address).

Best regards!

[BillP]

Hi,

Try flashing the card to 6.7 https://schneider-electric.box.com/s/d39j0lnrwq3onari9m4ztk74ggwyumsq

Again you will need to FTP the firmware starting with the bootmon, then the aos, and finally the sumx. 

[Anonymous user]

Good call Bill,

the web ui is working for me on 6.7.2.

Now running this stack:

Stat:         P+ N4+ N6+ A+
Bootmon:     bootmon:v1.0.9
AOS:         aos:v6.7.2
App:         sumx:v6.7.2

Is it safe to run AOS and App 6.7.2 on Bootmon 1.0.9 ?

I hope this check helps the development team to isolate the problem with the web UI and looking forward to a newest firmware update where the web UI is working again!

Best!

[Anonymous user]

BTW is the devel team aware that there are configurations that cannot be set using the CLI but only the web UI?

Examples:

-syslog server

-timezone

-DST

If I am wrong I am happy to learn how these would be set using the CLI.

Best

[tofu_apc]

Edit: to be clear, mine does not reboot. It has the issue that Gavan mentioned in a reply.

I also have run into this issue with 6.8.8 and 6.9.2 on my AP9631.

On my home network, I use the .lan "tld", so the AP9631 is normally accessed as "https://rhodes.lan". However, I was not able to configure the hostname as that, so it is actually configured as "rhodes.ups.lan". It is immediately trying to redirect like so (using wget for clarity):

--2020-10-04 03:41:00-- https://rhodes.lan/
Resolving rhodes.lan (rhodes.lan)... 10.0.0.7
Connecting to rhodes.lan (rhodes.lan)|10.0.0.7|:443... connected.
WARNING: cannot verify rhodes.lan's certificate, issued by ‘CN=5A1234567890,OU=Internally Generated Certificate,O=American Power Conversion Corp,L=Default Locality,ST=Default State,C=US’:
Unable to locally verify the issuer's authority.
WARNING: certificate common name ‘5A1234567890’ doesn't match requested host name ‘rhodes.lan’.
HTTP request sent, awaiting response... 303 See Other
Location: https:///home.htm [following]
https:///home.htm: Invalid host name.

I have been able to use accessing as the full DNS name and accessing by IP address as workarounds.

[BillP]

Hi Tofu,

This will be fixed in firmware 6.9.4, the two workarounds are to use the IP address as you are already doing or go into the DNS settings on the NMC and set the hostname to match the DNS name.

-Gavan

[pgpc_apc]

On 10/5/2020 12:09 AM, Gavan said:

This will be fixed in firmware 6.9.4

The APC website includes release notes for 6.9.4 (https://www.apc.com/shop/us/en/products/UPS-Network-Management-Card-v6-9-4-Firmware-for-Smart-UPS-Ga..., but there is no link to download the firmware.  Where can we find 6.9.4?

[BillP · Accepted solution]

See below:

https://www.se.com/ww/en/faqs/FA410359/

-Gavan

[tofu_apc]

6.9.4 fixed the hostname redirect issue on my AP9631 - thanks!

[BillP]

Thanks for the link but I wonder why the APC website continues to be one of the hardest sites to get to the correct link for a download?

Very frustrating!

[Anonymous user]

I can confirm that 6.9.6 is the latest version working with HTTP/HTTPS for my SMT after 6.7.2 (last working version). The versions in between did not work with HTTP/HTTPS here.