Error on Third-Party HW: "Nexus cannot be licensed"

marcg

(kind of a companion post to this one)

Trying to run Nexus on third-party HW, I get a popup in the Nexus GUI and the log messages below.

Aug  4 17:50:00 pfSense pfnet-controller[68404]: WARNING Nexus cannot be licensed on this system due to: serial number unavailable.
Aug  4 17:50:00 pfSense pfnet-controller[68404]: WARNING 556785 [[2600:xxxx:xxxx:xxxx:a09b:7b40:8d9d:f63a]:16038] GET /api/mim/controller/identity (DONE 0.458ms) ERROR: {"errcode":401,"errmsg":"400 Netgate Nexus is not supported on this sytem"}

What specific serial number is the code is looking for? Is it the system-serial-number returned by dmidecode? Are there format restrictions: length, types of characters, etc.?

I might be able to update the BIOS on the system with a suitable value. Thinking of using something random and unique to my machine like an MD5 hash of the current config.xml.

Thx.

[26.03.1-RELEASE][admin@pfSense.home.arpa]/root: dmidecode -s system-serial-number
Default string
[26.03.1-RELEASE][admin@pfSense.home.arpa]/root: dmidecode -t system
# dmidecode 3.7
# SMBIOS entry point at 0x78a3a000
Found SMBIOS entry point in EFI, reading table from /dev/mem.
SMBIOS 3.3.0 present.

Handle 0x0001, DMI type 1, 27 bytes
System Information
        Manufacturer: Default string
        Product Name: Default string
        Version: Default string
        Serial Number: Default string
        UUID: 03000200-0400-0500-0006-000700080009
        Wake-up Type: Power Switch
        SKU Number: Default string
        Family: Default string

cybrnook

Seeing the same issue on my protectli boxes.

patient0

@marcg are you using a device with coreboot? In case of Protectli I'd open a ticket with Protectli about it. You may be able to add a serial yourself since it's Dasharo based.

This is the dmidecode after I set a serial number in Proxmox. I'll test a bit more in the coming days what Nexus accepts but my guess is it just can't be empty.

Handle 0x0100, DMI type 1, 27 bytes
System Information
        Manufacturer: QEMU
        Product Name: Standard PC (Q35 + ICH9, 2009)
        Version: pc-q35-11.0
        Serial Number: 817483739472
        UUID: xxxxxxxx-yyyy-zzzz-89bb-e3d81d611128
        Wake-up Type: Power Switch
        SKU Number: Not Specified
        Family: Not Specified

The following worked for me. Nexus was running and the update check succeeded:

817483739472

With the following the license check failed but Nexus still ran. Of course it could be because I changed them in a short interval or some other technical reason

tom was here
tom-was-here
%A13E83^9+SKU
n
a15u847332b8

We have to wait for Netgate to comment on it.

marcosm

The requirement for the serial and UUID is essentially that they're set. It's tied to the license similarly to NICs being tied to the NDI.

luckman212

related to Netgate model that can handle 5-10Gbps IMIX I'm awaiting delivery of a temporary protectli vault (coreboot) which should arrive in a week or so. I plan on purchasing pfSense+ for it. Anything I have to do to in the bios to make sure that works?

marcg

@marcosm , @patient0 , thanks for your responses.

The device is a HUNSN RJ09.

It has an AMI BIOS, v 2.21.1278. I don't see an option in the BIOS settings to set a serial number. I reached out to the manufacturer yesterday. Sounds like they're going to send me an updated BIOS. If that doesn't work out, I might try the AMIDEEFIx64.efi utility.

I'll update this thread with anything useful that I learn.

fwit

Just for your information: I have this box in use: https://www.ipu-system.de/produkte/ipu624s.html

I used AMIDEEFIx64.efi to change the Serial Number and UUID.

Heads up: Serial Number "123456789" did NOT work. I had to use "817483739473" (same format as @patient0 working value) instead. Not sure exactly why, could be length, or something else about the format.

Handle 0x0001, DMI type 1, 27 bytes
System Information
	Manufacturer: Default string
	Product Name: Default string
	Version: Default string
	Serial Number: 817483739473
	UUID: xxxxxxxx-xxxx-xxxx-yyyy-1841663eef00
	Wake-up Type: Power Switch
	SKU Number: Default string
	Family: Default string

As soon as I set this, the "WARNING Nexus cannot be licensed on this system due to: serial number unavailable." error stopped appearing, and the firewall is now recognized in the Nexus GUI.

@marcosm would it be possible to get some insight from Netgate on why this specific number/format is required (or accepted) and "123456789" isn't?

luckman212

What about systems with coreboot? From what I understand, AMIDEEFIx64.efi is for AMI BIOS based systems only.

I did some searching but it's rabbit holes everywhere. E.g. Populate SMBIOS serial number · Issue #432 · system76/firmware-open or Have a anyidea? that change the serial number of DMI? - coreboot - mail.coreboot.org

marcg

@fwit said in Error on Third-Party HW: "Nexus cannot be licensed":

I used AMIDEEFIx64.efi to change the Serial Number and UUID.
<snip>
@marcosm would it be possible to get some insight from Netgate on why this specific number/format is required (or accepted) and "123456789" isn't?

Thanks for this info. Guidance from Netgate on acceptable formats would be useful.

In my case, I'm expecting the solution from the manufacturer to result in a serial number of this form: "HS01C232221P2228528" (format of printed serial number on the device). If that's not acceptable for some reason, I'll try AMIDEEFIx64.efi.

marcosm

The 1..9 case in particular is ignored because of various reasons but currently in general it should just work so long as it's set.

cybrnook

@marcg , please update with what protectli gets back to you with. I have 4 x protectli boxes, currently running a VP2420 and am in the same boat (as using the latest AMI BIOS from protectli, which coincidentally is also the release bios for most of their units).

dennypage

@patient0 FWIW, it also appears to require q35 as the machine type for qemu.

patient0

@dennypage I have not tried anything else, I use Q35 for all the VMs for two or three years on Proxmox. Have you actually tried with i440fx as machine type?

marcg

@cybrnook said in Error on Third-Party HW: "Nexus cannot be licensed":

@marcg , please update with what protectli gets back to you with.

Sorry, my box is not Protectli. You might try reaching out to the manufacturer.

AMIDEEFIx64.efi may be another option. Further up in the thread, someone mentioned using it successfully. Waiting for a reponse from my manufacturer before going that route, though. There are multiple versions of AMIDEEFIx64.efi on the web, and I don't know whether there are dependencies on the installed AMI BIOS version.

cybrnook

@marcg Ah, totally missed that yours wasn't a protectli. Yeah.... I saw the AMIDEEFIx64.efi mention above, and I've downloaded a couple versions of it already and will likely go that route relatively soon. Was hoping though that this would have been a bit easier as I have multiple boxes that will need to be updated, so a bit wonky even if it's a one time upgrade to get it there.

I guess another thing maybe we need to wonder about is that if serial hasn't been set by the manf, and we have to set that value by hand (assuming AMI BIOS in this case), is that a persistent value that will survivie BIOS updates as well as CMOS resets? Or are we going to have to print a sticker with the serial number you're going to create and have it handy everytime there is an update or reset needed?

dennypage

@patient0 said in Error on Third-Party HW: "Nexus cannot be licensed":

I have not tried anything else, I use Q35 for all the VMs for two or three years on Proxmox. Have you actually tried with i440fx as machine type?

Yes. I run qemu directly rather than via Proxmox. I wasn't specifying a machine type previously. The default is "pc-i440fx-10.2". Even with a serial number and UUID it did not work. Only after changing to q35 (pc-q35-10.2), did it work.

cybrnook

So, using the AMIDEEFIx64.efi binary, I was able to add the system serial (used the serial number from the stickers on the bottom of my protectli's). The Nexus dashboard page now loads:

With that said, a few things of note. I noticed that the value (/ss) is not persistent across BIOS updates. So if one was to manually set this value, and then update the BIOS, you will again need to set this value after the BIOS update.

Also, can someone help me understand the "Configuration" -> "License" page? Now that Nexus loads, I can see that it's complaining I don't have a paid for license (the $49.99 a year Nexus license). Is this going to be an issue in the future for those that are using home systems on pfsense +, which I am, that will then need to purchase a license down the road to use the system once Nexus is the only option?

cybrnook

Okay, seemingly using my full name and email used when obtaining the current license I am using for pfsense + allowed me to register the license online with the "Add License" button.

I assume in 1 year I can just "refresh" my existing license for another year...

Wolf666

Hello, I have a MinisForum TH50 with an AMI BIOS. After struggling a bit, I successfully set the Serial Number of my device.
I used AMIDEEFIx64.efi, then from the EFI shell I generated a configuration file using the command AMIDEEFIx64.efi /DMS config.ini.
I edited the file in WordPad to insert the Serial Number, then went back to the shell and ran AMIDEEFIx64.efi config.ini.
That’s how I completed the process.

cybrnook

@Wolf666 from shell you can also just run AMIDEEFIx64.efi /ss to see what the current value is. Mine came back as Default or something similar. You can then run AMIDEEFIx64.efi /ss 123456789 or whatever number you’re using for your serial (obviously not 1-9). Then run an open /ss again to confirm it took. You’ll see your output stating where it was a “r” read command or a “w” write command.

No need to hop out and into a text editor, you can do it all in a single efi shell session.