tftp export timing out

[quist]

I am trying to use tftp to upload/export the configuration file to an OpenBSD tftp server which is on the same LAN as the PA box.

The address of the PA is 192.168.2.1 and the OpenBSD server 192.168.3.1

The file transfer process seems to be timing out at the ACK phase (server -> PA).

Here's the command:

admin@fs> tftp export configuration source-ip 192.168.2.1 remote-port 69 from running-config.xml to 192.168.3.1

And the CLI output:

mode set to octetConnected to 192.168.3.1 (192.168.3.1), port 69

putting /opt/pancfg/mgmt/saved-configs/running-config.xml to 192.168.3.1:running-config.xml [octet]

Transfer timed out.

Here's the tcpdump from the server end:

tcpdump: listening on bnx0, link-type EN10MB

15:08:09.425788 192.168.2.1.60530 > 192.168.3.1.69: [udp sum ok] 27 WRQ "running-config.xml" (DF) (ttl 64, id 0, len 55)

15:08:09.427420 192.168.3.1.27411 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 4994, len 32)

15:08:14.431952 192.168.2.1.60530 > 192.168.3.1.69: [udp sum ok] 27 WRQ "running-config.xml" (DF) (ttl 64, id 0, len 55)

15:08:14.433542 192.168.3.1.18764 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 34391, len 32)

15:08:14.434888 192.168.3.1.27411 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 6242, len 32)

15:08:19.434963 192.168.3.1.18764 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 42027, len 32)

15:08:19.444958 192.168.3.1.27411 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 7569, len 32)15:08:19.451921 192.168.2.1.60530 > 192.168.3.1.69: [udp sum ok] 27 WRQ "running-config.xml" (DF) (ttl 64, id 0, len 55)

15:08:19.453516 192.168.3.1.27360 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 49047, len 32)

15:08:24.445032 192.168.3.1.18764 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 36935, len 32)

15:08:24.455032 192.168.3.1.27411 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 39363, len 32)

15:08:24.455046 192.168.3.1.27360 > 192.168.2.1.60530: [udp sum ok] udp 4 (ttl 64, id 32590, len 32)

Any ideas?

The equivalent scp command does work.

[jdelio]

May I ask what version of the PAN devices are in use?

[quist]

My PAN version is: 4.1.1. I have a PA-2050.

[jdelio]

Thanks for the update..

I researched this a little, and I see this being reported in a couple of cases, but no real solution has been posted.

In order to determine cause, what we really need to do is open a ticket with us and take some packet captures of the tftp and the scp traffic at all 4 stages - receive, transmit, firewall, drop, and then look at the traffic to see exactly what is going on.

I apologize for the inconvenience.