Chapter 4. Configuring Networking

On Red Hat Enterprise Linux 6:

1. Configure the firewall to allow TFTP service UDP on port 69.

   # iptables -A OUTPUT -i eth0 -p udp --sport 69 -m state \
   --state ESTABLISHED -j ACCEPT
   # service iptables save

2. Load the ip_conntrack_tftp kernel TFTP state module. In the /etc/sysconfig/iptables-config file, locate IPTABLES_MODULES and add ip_conntrack_tftp as follows:

   IPTABLES_MODULES="ip_conntrack_tftp"

1. Virtual machine starts
2. iPXE retrieves the network credentials using DHCP
3. iPXE retrieves the HTTP address using DHCP
4. iPXE chainloads the iPXE template from the template Capsule
5. iPXE loads the kernel and initial RAM disk of the installer

1. In the Satellite web UI, navigate to Hosts > Provisioning Templates, enter Kickstart default iPXE and click Search.
2. Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
3. Click the name of the template you want to use.
4. If you clone the template, you can make changes you require on the Template tab.
5. Click the Association tab, and select the operating systems that your host uses.
6. Click the Locations tab, and add the location where the host resides.
7. Click the Organizations tab, and add the organization that the host belongs to.
8. Click Submit to save the changes.
9. Navigate to Hosts > Operating systems and select the operating system of your host.
10. Click the Templates tab.
11. From the iPXE Template list, select the template you want to use.
12. Click Submit to save the changes.
13. Navigate to Hosts > All Hosts.
14. In the Hosts page, select the host that you want to use.
15. Select the Templates tab.
16. From the iPXE template list, select Review and verify that the Kickstart default iPXE template is the correct template.

17. To prevent an endless loop of chainbooting iPXE firmware, edit the /etc/dhcp/dhcpd.conf file to match the following example. If you use an isolated network, use a Capsule Server URL with TCP port 8000, instead of Satellite Server’s URL.

    1. Locate the following lines in the Bootfile Handoff section of the /etc/dhcp/dhcpd.conf file:

       } else {
         filename "pxelinux.0";
       }

    2. Add the following extra elsif statement before the else statement:

       elsif exists user-class and option user-class = "iPXE" {
         filename "http://satellite.example.com/unattended/iPXE";
       }

    3. Verify that the 'if' section matches the following example:

       if option architecture = 00:06 {
         filename "grub2/shim.efi";
       } elsif option architecture = 00:07 {
         filename "grub2/shim.efi";
       } elsif option architecture = 00:09 {
         filename "grub2/shim.efi";
       } elsif exists user-class and option user-class = "iPXE" {
         filename "http://satellite.example.com/unattended/iPXE";
       } else {
         filename "pxelinux.0";
       }

       Note

       For http://satellite.example.com/unattended/iPXE, you can also use a Red Hat Satellite Capsule http://capsule.example.com:8000/unattended/iPXE. You must update the /etc/dhcp/dhcpd.conf file after every upgrade. The content of the /etc/dhcp/dhcpd.conf file is case sensitive.

Chainbooting iPXE directly or with UNDI workflow

1. Host powers on
2. PXE driver retrieves the network credentials using DHCP
3. PXE driver retrieves the PXELinux firmware pxelinux.0 using TFTP
4. PXELinux searches for the configuration file on the TFTP server
5. PXELinux chainloads iPXE ipxe.lkrn or undionly-ipxe.0
6. iPXE retrieves the network credentials using DHCP again
7. iPXE retrieves HTTP address using DHCP
8. iPXE chainloads the iPXE template from the template Capsule
9. iPXE loads the kernel and initial RAM disk of the installer

1. In the Satellite web UI, navigate to Hosts > Provisioning Templates, enter PXELinux chain iPXE or, for UNDI, enter PXELinux chain iPXE UNDI, and click Search.
2. Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
3. Click the name of the template you want to use.
4. If you clone the template, you can make changes you require on the Template tab.
5. Click the Association tab, and select the operating systems that your host uses.
6. Click the Locations tab, and add the location where the host resides.
7. Click the Organizations tab, and add the organization that the host belongs to.
8. Click Submit to save the changes.
9. In the Provisioning Templates page, enter Kickstart default iPXE into the search field and click Search.
10. Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
11. Click the name of the template you want to use.
12. If you clone the template, you can make changes you require on the Template tab.
13. Click the Association tab, and associate the template with the operating system that your host uses.
14. Click the Locations tab, and add the location where the host resides.
15. Click the Organizations tab, and add the organization that the host belongs to.
16. Click Submit to save the changes.
17. Navigate to Hosts > Operating systems and select the operating system of your host.
18. Click the Templates tab.
19. From the PXELinux template list, select the template you want to use.
20. From the iPXE template list, select the template you want to use.
21. Click Submit to save the changes.
22. Navigate to Hosts > All Hosts, and select the host you want to use.
23. Select the Templates tab, and from the PXELinux template list, select Review and verify the template is the correct template.
24. From the iPXE template list, select Review and verify the template is the correct template. If there is no PXELinux entry, or you cannot find the new template, navigate to Hosts > All Hosts, and on your host, click Edit. Click the Operating system tab and click the Provisioning Template Resolve button to refresh the list of templates.

25. To prevent an endless loop of chainbooting iPXE firmware, edit the /etc/dhcp/dhcpd.conf file to match the following example. If you use an isolated network, use a Capsule Server URL with TCP port 8000, instead of Satellite Server’s URL.

    1. Locate the following lines in the Bootfile Handoff section of the /etc/dhcp/dhcpd.conf file:

       } else {
         filename "pxelinux.0";
       }

    2. Add the following extra elsif statement before the else statement:

       elsif exists user-class and option user-class = "iPXE" {
         filename "http://satellite.example.com/unattended/iPXE";
       }

    3. Verify that the 'if' section matches the following example:

       if option architecture = 00:06 {
         filename "grub2/shim.efi";
       } elsif option architecture = 00:07 {
         filename "grub2/shim.efi";
       } elsif option architecture = 00:09 {
         filename "grub2/shim.efi";
       } elsif exists user-class and option user-class = "iPXE" {
         filename "http://satellite.example.com/unattended/iPXE";
       } else {
         filename "pxelinux.0";
       }

       Note

       For http://satellite.example.com/unattended/iPXE, you can also use a Red Hat Satellite Capsule http://capsule.example.comf:8000/unattended/iPXE. You must update the /etc/dhcp/dhcpd.conf file after every upgrade. The content of the /etc/dhcp/dhcpd.conf file is case sensitive.

1. Install the ipxe-bootimgs RPM package:

   # yum install ipxe-bootimgs

2. Copy the iPXE firmware to the TFTP server’s root directory. Do not use symbolic links because TFTP runs in the chroot environment.

   • For chainbooting directly, enter the following command:

     # cp /usr/share/ipxe/ipxe.lkrn /var/lib/tftpboot/

   • For UNDI, enter the following command:

     # cp /usr/share/ipxe/undionly.kpxe /var/lib/tftpboot/undionly-ipxe.0

3. Correct the file contexts:

   # restorecon -RvF /var/lib/tftpboot/