Setting up and troubleshooting PXE in Deployment Solution
search cancel

Setting up and troubleshooting PXE in Deployment Solution

book

Article ID: 453982

calendar_today

Updated On:

Products

Deployment Solution IT Management Suite

Issue/Introduction

PXE lets a computer start up over the network instead of from its local hard drive, so Deployment Solution can load an imaging or installation job before the operating system even boots. This guide covers two things: getting PXE working for the first time (or after an upgrade), and working through the most common reasons PXE stops responding.

You don't need deep networking knowledge to follow this guide, but you should have access to the Symantec Management (SMP Server or Notification Server (NS)) Console and to the Site Server your computers boot from.

Environment

ITMS 8.7.x, 8.8.x
Deployment Solution (DS) 8.7.x, 8.8.x

Resolution

How PXE boot works, in plain terms

When a computer tries to PXE boot, four things happen in order:

  1. The computer asks the network for an IP address (the same way any computer does when it starts up), and along with that address it learns which server to boot from.
  2. It downloads a small boot file from that server.
  3. That boot file asks the Site Server what to do next — is there a job waiting for this computer, or should it just start Windows normally?
  4. If there's a job, the computer loads a temporary environment (WinPE or LinuxPE) and Deployment Solution runs the job. If there isn't a job, the computer boots normally.

Knowing this order matters because "PXE isn't working" can mean something different at each step — a computer that never sees a boot prompt has a different problem than one that sees a menu but then boots straight to Windows.

A message that isn't actually an error: if you ever see "M0F" during a PXE boot attempt, that's Deployment Solution telling the computer "there's no job for you, go ahead and boot normally." It's expected behavior, not a failure, whenever a computer doesn't have a job assigned.

What you need before PXE will work

Deployment Solution's PXE role is called the Network Boot Service (NBS). It runs on a Site Server and needs a few things in place:

  • Two Windows services, running in this order:
    • Symantec Network Boot Service (PXE)
    • Symantec Network Boot Service (TFTP)
  • Microsoft XML Core Services 6.0 installed on the Site Server
  • IIS (Internet Information Services) installed on the Site Server, which is required for the newer iPXE-based boot method
  • A DHCP server on your network, since PXE relies on it for the computer's IP address

Setting up PXE, step by step

  1. Confirm the services are running. On the Site Server, open Computer Management → Services and confirm both Symantec Network Boot Service (PXE) and Symantec Network Boot Service (TFTP) are started, in that order.
  2. Register the Site Server for Network Boot Service. In the console, go to: Settings → Notification Server → Site Server Settings Find your Site Server and make sure the Network Boot Service option is checked for it.
  3. Build a PXE boot environment. Go to: Settings → Deployment → Manage Preboot Configurations By default you'll see two entries, "LinInstall" and "PEInstall" — these are templates, not something a computer can actually boot into yet. Click Add to create a real PXE environment and give it a name. After saving, check the Status link at the top of the page. It should show the environment has finished building and has been sent to your Site Server. This can take a few minutes — if you don't want to wait, you can run the Delta Update task, or open the Deployment Solution agent on the Site Server and click Update.
  4. Turn on the PXE response policies. On SMP Server, go to: Settings → Deployment → NBS Global Settings
     Make sure this is switched On, and select Apply NBS settings immediately so the change takes effect right away instead of waiting for the next scheduled cycle.
    Then go to: Settings → Deployment → NBS General Settings Turn on PXE acknowledgment. If you plan to image brand-new machines that Deployment Solution doesn't already know about, also turn on Respond to unknown computers — without this, new/unmanaged computers will never get a PXE response. At the bottom of this page you should see your Site Server listed. If it isn't listed, one of the earlier steps hasn't taken effect yet.
  5. Turn on the Site Server component policies. Go to: Settings → Agents/Plug-ins → Deployment → Windows x64 or x86
    Turn on Deployment Task Server Components (x86/x64) - Install Policy and its matching Upgrade Policy.

 

Once these five steps are done, a computer on the same network as the Site Server should see a PXE boot menu when it starts up.

If PXE stops working after it was previously working

Work through these checks roughly in order — each one rules out a common cause before you move to the next.

  1. Check whether the setup steps above still hold true. This is especially worth doing right after an upgrade, since an upgrade can leave one of these settings in a stale state:
    1. Are both NBS services still running?
    2. Did the PXE boot environment (Preboot Configuration) rebuild and finish replicating to the Site Server?
    3. Are the NBS Global and General Settings still switched on?
  2. Confirm basic networking still works. Have the computer try to start up and confirm it gets an IP address at all. If it doesn't, this is a DHCP or network issue, not a Deployment Solution issue.
  3. Check the computer's firmware settings. Confirm whether it uses legacy BIOS or UEFI, and whether Secure Boot is turned on. A UEFI computer needs a different boot file than a legacy BIOS computer, and Secure Boot can block an unsigned boot file outright.
  4. If the computer is on a different subnet or VLAN from the Site Server, PXE requests may not be reaching it. PXE relies on network broadcasts, which routers don't forward by default. Ask your network team to configure IP Helpers pointing to both your DHCP server and your PXE/Site Server — this is the recommended fix for cross-subnet PXE, rather than relying only on DHCP options 66/67.
  5. Check for a firewall or port issue. PXE needs ports 67, 69, and 4011 open on the Site Server. Temporarily disabling the firewall is a quick way to test whether a port is being blocked.
  6. Test with a computer that's known to work, on the same network segment. If a known-good computer also fails, the problem is environment-wide (server, network, or configuration). If only the original computer fails, the problem is specific to that machine or its network drop.
  7. Check the PXE log on the Site Server. The log file is called SBSLog_PXE and by default lives in the same folder as the PXE service — commonly under Altiris Agent\Agents\Deployment\Task Handler\SBS, though this can vary depending on how your environment was installed. Look for an entry showing the computer's IP and MAC address around the time it tried to boot:
    1. If you see the request logged, PXE received it — the problem is likely in how it responded, or in the boot environment configuration.
    2. If you don't see the request at all, it never reached the Site Server — that points back to networking, DHCP, or a firewall/port issue.
    3. If you see a line mentioning a response failure, the Site Server received something back from the SMP Server but couldn't use it.
      This can happen if a firewall or proxy is interfering with that traffic, or if the SMP Server itself returned an error page instead of a normal response.
    4. If only certain network cards or hardware models fail while others work fine, this can be a NIC firmware compatibility issue. Broadcom's iPXE snponly build resolves this in many cases — see the related article link below.

After you've made a change

  • The computer should reach the PXE boot menu without timing out.
  • If the computer has a job waiting, it should load into the imaging environment and the job should start.
  • If the computer doesn't have a job waiting, it's normal and expected for it to boot straight into Windows — that's not a failure.
  • Test on more than one computer, and more than one hardware model if possible, before considering the issue fully resolved — especially if the fix involved rebuilding the PXE boot environment.

When to contact support

If you've worked through the steps above and PXE still isn't responding, contact Broadcom support with the following ready — it will save time:

  • Whether the computer sees no PXE prompt at all, sees a menu that then fails, or boots without ever running the assigned job
  • Whether the computer is on the same network segment as the Site Server, or a different one
  • The relevant section of the SBSLog_PXE log from around the time of the failed attempt
  • What was upgraded recently, if this started after an upgrade

Additional Information

  • How do I set up PXE services on a Deployment 8.x server?: https://knowledge.broadcom.com/external/article/179647
  • Requirements to PXE Boot a client: https://knowledge.broadcom.com/external/article/220619
  • PXE troubleshooting: https://knowledge.broadcom.com/external/article/266653
  • DS 8.x PXE Troubleshooting: https://knowledge.broadcom.com/external/article/181630
  • iPXE / snponly build: https://knowledge.broadcom.com/external/article/444113
Powered by Wolken Software