SSL Updates?

[BillP]

Hi, I have just finished setting up and configuring a series of AP7830 and AP8841 PDUs.  When I went to activate HTTPS and SSH connectivity I started getting issues with connections due to the outdated security and SSL issues.  I am running AOS 3.7.3 on my AP7830 PDUs and 6.3.3 on my AP8841 PDUs.  Do the latest versions of the firmware for these models resolve this issue and if so, how do I obtain those firmware versions?

Thank you,

Bryan Krauthamer

bkrauthamer@onezero.com

[BillP]

Hi,

AP7830's are older and have been replaced by AP8830 which includes both a hardware/firmware update. AP7830 and AP7XXX models in general support TLS 1.0 at the latest AOS (3.9.2) but you'll likely have to modify web browser settings these days to get the TLS connection to work. SSH connections likely are outdated as well and may work if you tweak the settings in your client. 

Other AP7XXX SKUs were upgraded to AP7XXXB models. AP8XXX series and AP7XXXB model series do have updated SSL/TLS support, supporting TLS 1.2. SSH is up to date as well. And even so, we are still continuing to work on updating security protocols, cipher suites, etc as needed on this second generation hardware and firmware platform.

You can find latest updates here for both products: http://www.apc.com/us/en/tools/download/ 

I recommend to go to that link, filter by "Software/Firmware" and choose "Firmware Upgrades - Rackmount Power Distribution."

From there, you'll see SFRPDU392 download SKU for the AP7830 and other AP7XXX models and then SFRPDU2G656 as the latest for AP8XXX series models like AP8841 and AP7XXXB SKUs if you happen to get any other models at some point.

[BillP]

Hi Angela, it turns out my AP7830's are in fact the B2 hardware series. I just attempted to download the SFRPDU392 and upgrade one of my PDUs. During that process the upgrade failed and now my PDU is entirely unreachable by either Telnet or SSH or Web http/80) or Web 443/HTTPS.  Via the web it just tells me that:

Error: The application was not able to load.

You are attempting to access an APC device. There was a problem loading the application. Please login to the device via telnet for more details.

SSH and telnet simply fail to connect, say the connection timed out or that it was actively refused by the device.

Any suggestions other than a visit to my data center with a console cable?

[BillP]

Hi Bryan,

Can you clarify where you're seeing "B2"? I think you're seeing the mfg/hardware version which is not the same as the model SKU being AP7XXXB. And when I looked, AP7830 did not have "AP7830B" but rather was moved to AP8830 SKU when it was discontinued. AP7830 at 3.X firmware indicates the older hardware platform.

Usually with the error you've shown, Telnet (and SSH if client is working and configured to connect to the older device) should be working. This usually means that the AOS (APC OS) has loaded, either the new one or the pre-existing one, but there is a problem with loading the app file. We'd need to know which AOS and app is loaded and see what's what. And normally, you could just try the upgrade again if you can connect via FTP to the device. (Instructions here on how to try FTP: http://www.apc.com/us/en/faqs/FA156047

Did you get a result.txt or log file in the directory where you ran the .exe? I could look at that too and see if there is any indication of what occurred.

[BillP]

Hi Angela, yes, I can access the PDU via SSH.  It is only http/https which is not currently working.  The show system command is listed below as well as my result.txt

Result.txt:

Using AOS file        : AOS = apc_hw02_aos_392.bin

Using Application file: APP = apc_hw02_rpdu_392.bin

Checking network connection ...  Checking version information ... 

 *************** Next ************** 

Before Upgrading the NMC the AOS is: apc_hw02_aos_392.bin

Attempting to log in to 10.20.101.31 ... Log in sucessful

Loading OS, please wait ...                      OK

Please wait (2 minutes ) for system restart   OK

Attempting connection to verify restart        OK

Attempting to log in to 10.20.101.31 ... 

Could not log into 10.20.101.31.

Not all Network Management Cards were upgraded successfully:

10.20.101.31: Could not log into the Management Card's FTP server.

Encountered 1 failures during upgrade.

-----------------------------------------------------------------------

        About System

        Model Number      : AP7830

        Serial Number     : 5A1108E02900

        Manufacture Date  : 02/17/2011

        Hardware Revision : B2

        MAC Address       : 00 C0 B7 56 88 3C

        Flash Type        : AMD A29DL322DB

        Press to continue...

        -----------------------------------------------------------------------

        Module Information 

        Description : Network Management Card AOS

        -----------------------------------------------------------------------

        Name        : aos               Type        : APC OS

        Version     : 392               Sector      : 16

        Date        : 07/06/2016        Time        : 15:12:05

        CRC16       : C3FF

        Press to continue...

        Description : Network Management Card AOS

        -----------------------------------------------------------------------

        Name        : aos               Type        : APC OS

        Version     : 392               Sector      : 47

        Date        : 07/06/2016        Time        : 15:12:05

        CRC16       : C3FF

        Press to continue...

[BillP]

And yes, I did perform the entire 3.9.2 firmware upgrade again from the beginning with the same result.

Thanks!

[BillP · Accepted solution]

OK, thanks for the info and detail. This might be a timing issue on why the .exe is failing and then not uploading the second file (the application).

Can you find the rpdu_392 .bin file (which should be extracted to the folder where you put all the files from the firmware .exe) and try to manually upload/"put" that to the PDU via FTP? AOS loaded OK so we should try to just put on that 3.9.2 app and let it reboot and then check.

Manual FTP instructions for NMC1 devices should be in the FAQ I linked you to above. And let me know how that goes.