Question:
I am trying to use WDS to create Windows images on a VM, but I encounter an unexpected iPXE boot loader (version 1.21.1) instead of the expected PXE boot loader. I do not know who installed iPXE or where it is hosted, and I have no documentation or SOPs for it. I suspect it is running on a VirtualBox VM, based on the configuration settings screen that shows innotek GmbH as the manufacturer and VirtualBox as the product. However, I cannot find the IP or MAC address of the iPXE host, even after using the arp -a command. How can I locate and uninstall iPXE from my network?
Answer:
How to locate and uninstall iPXE from your network
iPXE is an open source network boot firmware that can be used to boot operating systems over the network. It can be installed on various devices, such as network cards, hard disks, CD-ROMs, or USB drives. It can also be embedded into a virtual machine’s BIOS, such as VirtualBox.
If you encounter an unexpected iPXE boot loader when trying to use Windows Deployment Services (WDS) to create Windows images on a virtual machine, it means that iPXE is interfering with the normal PXE boot process. This can happen if someone installed iPXE on your network without your knowledge or documentation, or if you inherited a network with iPXE already installed.
To locate and uninstall iPXE from your network, you need to follow these steps:
The first step is to identify which device or virtual machine is hosting the iPXE boot loader. You can do this by looking at the iPXE configuration settings screen that appears when you try to boot from the network. This screen will show you the IP and MAC address of the iPXE host, as well as the manufacturer and product name of the device or virtual machine.
For example, if you see a screen like this:
“`
iPXE 1.21.1 — Open Source Network Boot Firmware — http://ipxe.org
Features: DNS HTTP iSCSI TFTP AoE bzImage ELF MBOOT PXE PXEXT Menu
net0: 52:54:00:12:34:56 using 82540em on PCI02:03.0 (open)
[Link:up, TX:0 TXE:0 RX:0 RXE:0] [Link status: Down (http://ipxe.org/38086101)]
Configuring (net0 52:54:00:12:34:56)……………… ok
net0: 192.168.0.10/255.255.255.0 gw 192.168.0.1
net0: fe80::5054:ff:fe12:3456/64
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
net0: fe80::5054:ff:fe12:3456/64
gw fe80::5054:ff:fe12:3456
Press Ctrl-B for the iPXE command line…
iPXE>
“`
You can see that the iPXE host has the following information:
- IP address: `192.168.0.10`
- MAC address: `52:54:00:12:34:56`
- Manufacturer: `82540em`
- Product: `PCI02:03.0`
- Open the VirtualBox Manager and select the virtual machine that is hosting iPXE.
- Click on the Settings button and go to the System tab.
- Under the Motherboard section, uncheck the Enable EFI (special OSes only) option.
- Click on the OK button to save the changes and close the Settings window.
- Start the virtual machine and verify that it boots from the PXE boot loader instead of the iPXE boot loader.
You can also press `Ctrl-B` to enter the iPXE command line, where you can use the `show` command to display more information about the iPXE host, such as the firmware version, the build options, and the configuration settings.
Step 2: Find the iPXE host on your network
The next step is to find the physical or virtual location of the iPXE host on your network. You can do this by using various network tools, such as ping, traceroute, nmap, or arp.
For example, you can use the `ping` command to test the connectivity and latency of the iPXE host:
“`
C:\> ping 192.168.0.10
Pinging 192.168.0.10 with 32 bytes of data:
Reply from 192.168.0.10: bytes=32 time=1ms TTL=64
Reply from 192.168.0.10: bytes=32 time=1ms TTL=64
Reply from 192.168.0.10: bytes=32 time=1ms TTL=64
Reply from 192.168.0.10: bytes=32 time=1ms TTL=64
Ping statistics for 192.168.0.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms “`
You can see that the iPXE host is reachable and has a low latency.
You can also use the `traceroute` command to trace the route and hops of the packets from your device to the iPXE host:
“`
C:\> tracert 192.168.0.10
Tracing route to 192.168.0.10 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 192.168.0.1 2 <1 ms <1 ms <1 ms 192.168.0.10
Trace complete.
“`
You can see that the iPXE host is only two hops away from your device, and the first hop is your gateway.
You can also use the `nmap` command to scan the ports and services of the iPXE host:
“`
C:\> nmap -sV 192.168.0.10
Starting Nmap 7.91 ( https://nmap.org ) at 2024-02-13 19:31 GMT
Nmap scan report for 192.168.0.10
Host is up (0.0010s latency).
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
80/tcp open http iPXE httpd 1.21.1
Service Info: OS: iPXE
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.23 seconds
“`
You can see that the iPXE host is running a web server on port 80, and the service version is iPXE httpd 1.21.1.
You can also use the `arp` command to display the ARP cache of your device, which maps the IP addresses to the MAC addresses of the devices on your network:
“`
C:\> arp -a
Interface: 192.168.0.100 — 0x2
Internet Address Physical Address Type 192.168.0.1 00-11-22-33-44-55 dynamic 192.168.0.10 52-54-00-12-34-56 dynamic “`
You can see that the iPXE host has the MAC address `52-54-00-12-34-56`, which matches the one shown on the iPXE configuration settings screen.
Using these network tools, you should be able to narrow down the possible candidates for the iPXE host on your network. You can then verify the identity of the iPXE host by physically inspecting the device or virtual machine, or by accessing its management interface.
Step 3: Uninstall iPXE from the iPXE host
The final step is to uninstall iPXE from the iPXE host. The exact method of uninstalling iPXE depends on how it was installed and where it is hosted.
If iPXE was installed on a physical device, such as a network card, a hard disk, a CD-ROM, or a USB drive, you can uninstall iPXE by removing or replacing the device, or by flashing the device’s firmware with a different boot loader.
If iPXE was installed on a virtual machine, such as VirtualBox, you can uninstall iPXE by changing the virtual machine’s BIOS settings, or by deleting or replacing the virtual machine’s disk image.
For example, if you are using VirtualBox, you can uninstall iPXE by following these steps:
Alternatively, you can delete the virtual machine that is hosting iPXE, or replace its disk image with a new one that does not have iPXE embedded.
By
following these steps, you should be able to locate and uninstall iPXE from your network, and use WDS to create Windows images on your virtual machine without any interference.
Leave a Reply