Move_to_CLIP_MGMT_IP.xml not working correctly

[mierswa]

Hello,

After the ZTP+ process provisions the switch, we typically run the script Move_to_CLIP_MGMT_IP to update the hostname and management IP address.

The script generally works as expected, but its state consistently shows as an error.

I have the full debug output available, but I prefer not to share it here. I can provide it through a more secure channel if needed.

This error appears:

Device is re-added to XIQ-SE

Waiting 5 seconds before re-connecting
Attempting to re-connect on new CLIP IP
Failed to connect to 172.24.111.200
Traceback (most recent call last):
  File "<string>", line 1298, in <module>
  File "<string>", line 1274, in main
  File "<string>", line 366, in sendCLI_showCommand
  File "<string>", line 204, in exitError
RuntimeError: Failed to connect to device: 172.24.111.200 

I can connect to the newly added switch via XIQ-SE without any issues.
Is there anything we can do to provide more information that would help resolve this issue?

[ronaldvdwerf]

It looks like a credential issue. Usualy it would take some time before NAC is configured for the new IP. Is the device profile using a NAC user?

[mierswa]

Yes, XIQ-SE has a RADIUS user named "xiq-se-admin", which can log in. The script can run with the user's permissions or "XIQ-SE Administrator" rights.

A user authenticated via the Web UI and belonging to the "FH-SWF-Static-Admins" user group can execute the script. When the script is executed, the personalized login of that user is used.

The user group "FH-SWF-Static-Admins" has the same privileges as the "XIQ-SE Administrator" role.

This is shown in the script’s debug output.

Script Name: Move to CLIP Mgmt IP github
Date and Time: 2025-08-13T10:36:24.898
XIQ-SE User: <my-static-admin-account>
XIQ-SE User Domain: 
IP: 10.40.48.86
Move_to_CLIP_Mgmt_IP_github version 2.1 on XIQ-SE version 24.7.11.22
nbiQuery response = {administration: {serverInfo={version=24.7.11.22}}}
nbiQuery version = 24.7.11.22

Script rights out of the permissions tab:

Screenshot:

[lgastevens]

Hi, I'm the author of that script, if it has not been modified. Please supply the full log and I'll take a look.
Note that I have not updated that script in a while, there is a Onboard Mgmt CLIP workflow which superseeds that script, it can do the same + fetch the desired IP/sysname from a CSV file optionally.

[mierswa]

I’ve sent you the debug output as a private message via the Extreme Networks Community portal. I’m not sure how to share it here directly without modifying the data, and I prefer not to post debug output containing sensitive information publicly on the internet.

[mierswa]

Hi, I'm the author of that script, if it has not been modified. Please supply the full log and I'll take a look. Note that I have not updated that script in a while, there is a Onboard Mgmt CLIP workflow which superseeds that script, it can do the same + fetch the desired IP/sysname from a CSV file optionally.

It works with the Onboard Mgmt CLIP workflow, but it requires providing a CSV file in the correct format. With the old script, it was very convenient that the “MGMT CLIP IP” and “NAME” information could be entered directly in the workflow by an administrator.

It would be great if the new Onboard script could also support this option.

[lgastevens]

Hi

> It would be great if the new Onboard script could also support this option.

It does already, just omit the CSV file and provide the CLIP IP as an absolute value:

The failure of the script is in connecting to the new switch CLIP IP... but it was reachable and successfully added to XIQ-SE; I think these are issues I already fixed in the Onboard Mgmt CLIP workflow; but let me see if I can update the script also..

[lgastevens]

Hi, would you like to try the updated version ? Attached.

Move_to_CLIP_Mgmt_IP.xml

[mierswa]

Hi, would you like to try the updated version ? Attached.

Move_to_CLIP_Mgmt_IP.xml

Hi,

I’ve tested the new version and it works fine. To get a better long-term perspective, I’ll ask some other admins who regularly enroll switches to test it as well. As soon as I have more insights about the functionality, I’ll get back to you.

Thanks a lot for your help.

[mierswa]

We tested the script over a longer period, and it worked reliably. However, it’s a bit slow — it takes around 2 minutes for a switch to complete the process.

Some administrators suggested that it would be useful if the script could only rename switches (without changing the IP address). However, I believe that the requirements, NAC engines (switch systems), and the XIQ inventory would also need to be updated accordingly.

For now, we’re using a temporary IP address to rename the switches and running the script twice. It’s not ideal, but it works.

Is there another script that can handle the rename task more directly?

[lgastevens]

Hi, by the way I did publish the new script version on Github.
Now, if you just want to change the switch name, you don't need a script for that. XIQ-SE can do that natively.
Right click the switch and Configure, set the new sysname:

And you can also go set the same name as ISIS sysname:

Then follow through to Enforce Preview... and then enforce Device & Fabric Connect.

[ZdenekPala]

Thank you. No problem. I was not sure. Sincerely yours Zdeněk Pala Sent from mobile phone. 8. 10. 2025 v 12:56, Ludovico Stevens ***@***.***>:  [https://avatars.githubusercontent.com/u/10697590?s=20&v=4]lgastevens left a comment (extremenetworks/ExtremeScripting#263)<https://protect.checkpoint.com/v2/r01/___https://github.com/extremenetworks/ExtremeScripting/issues/263%23issuecomment-3380961659___.YzJ1OmV4dHJlbWVuZXR3b3Jrc2l0OmM6bzoxZjllMDdlODhiYjcyM2U0MWYyYTJhNTUzN2Y5OTdkZTo3OmE1ZmU6ZTBkMzlkMDNiZDU1ZmFkMzUxMjU0MTgxNjEzMjUwYTA2MjY0ODFmMGIzNjI5MzZmMzE3MjBmNjE4NmY1OGFhODpoOlQ6Rg> Hi, by the way I did publish the new script version on Github. Now, if you just want to change the switch name, you don't need a script for that. XIQ-SE can do that natively. Right click the switch and Configure, set the new sysname: image.png (view on web)<https://protect.checkpoint.com/v2/r01/___https://github.com/user-attachments/assets/263c1bf4-76fe-45be-9146-8eee3560aabe___.YzJ1OmV4dHJlbWVuZXR3b3Jrc2l0OmM6bzoxZjllMDdlODhiYjcyM2U0MWYyYTJhNTUzN2Y5OTdkZTo3OjU0OTg6YmU0ZDNjMTk2ZTE0ZDg3MDBmYzQyNTA0OGVlYTMyODNlNjZjZTJiMmNjYjI0OTAwNmE4ZWVhZTMxMjczMDNjYTpoOlQ6Rg> And you can also go set the same name as ISIS sysname: image.png (view on web)<https://protect.checkpoint.com/v2/r01/___https://github.com/user-attachments/assets/891e2003-fc1b-48a1-a723-053395206b94___.YzJ1OmV4dHJlbWVuZXR3b3Jrc2l0OmM6bzoxZjllMDdlODhiYjcyM2U0MWYyYTJhNTUzN2Y5OTdkZTo3OmU0MzY6YjY5NjNiN2NkOGJiYjM3NzBlMmQ3ZTI0ZTAwYmUxMmI1YmZhMGQ1NzBhZGE3M2U5YjViNWJmYjAzMzdkMDUwOTpoOlQ6Rg> Then follow through to Enforce Preview... and then enforce Device & Fabric Connect. — Reply to this email directly, view it on GitHub<https://protect.checkpoint.com/v2/r01/___https://github.com/extremenetworks/ExtremeScripting/issues/263%23issuecomment-3380961659___.YzJ1OmV4dHJlbWVuZXR3b3Jrc2l0OmM6bzoxZjllMDdlODhiYjcyM2U0MWYyYTJhNTUzN2Y5OTdkZTo3OmNmZWY6OGZmZDQ5ZjRjY2RhMmQ1OTg5ZTU2NzNmNDA3ZmJjNjM5YWJjZmRhMTExYTFiZTEyYThhMjUxZmJlODBhYjQ0ZTpoOlQ6Rg>, or unsubscribe<https://protect.checkpoint.com/v2/r01/___https://github.com/notifications/unsubscribe-auth/AD4OJHCSJFXDYWZNRYP5RDT3WTUSVAVCNFSM6AAAAACDY5RFRSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGOBQHE3DCNRVHE___.YzJ1OmV4dHJlbWVuZXR3b3Jrc2l0OmM6bzoxZjllMDdlODhiYjcyM2U0MWYyYTJhNTUzN2Y5OTdkZTo3OmNmODE6N2M0NGU5OGM0MTM5ZDQwMzZkY2JjNDg2MzI4ZmMzYTA1MDhmMWMwMWUyNjBlM2M3MjBiYmEyYzdlZDg2YjU3MTpoOlQ6Rg>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>