Troubleshooting TL1 collection

When a TL1 collection fails, the node usually tells you why in its response. Capture that response with rConfig’s standard debug tools, then read the TL1 error code to find the cause.

Capture the exchange first

TL1 collection uses the same diagnostic tooling as any other device backup. Start there:

Live Debug Console streams the raw TL1 exchange in the UI. On TL1 devices, any M <ctag> DENY row is highlighted and the Analysis panel calls out the error codes it found, so you do not have to scan the stream by hand.
CLI debug runs the same collection with full output on the command line:

# Stream the raw TL1 exchange for a device (example device ID 6512)
php artisan rconfig:download-device 6512 -d

If the session never reaches a TL1 response at all, the problem is connectivity or login rather than TL1. Work through basic connectivity and authentication first, then come back to the error codes below.

Live debug console for a TL1 device with a highlighted M 9 DENY IIAC row and a matching DENY entry in the Analysis panel

The live debug console highlighting a TL1 DENY row

Reading TL1 DENY codes

A rejected command comes back as M <ctag> DENY followed by a four-character error code. The most common ones:

Code	Meaning	Usual cause
`IIAC`	Invalid access identifier	The TID or AID is unknown or unreachable, for example an RNE that is not currently behind this GNE.
`ICNV`	Invalid command / verb	The command verb is not recognised by the node.
`PLNA`	Not logged in	The command was sent before a successful `ACT-USER` login.

A single denied command fails that device’s collection and marks it config-failed, so the error code is the fastest route to the cause.

Common problems

No RNEs discovered

The GNE collects, but the TL1 Gateway panel shows no RNEs.

Confirm tl1Gateway is on in the template (setup).
Confirm the node actually fronts RNEs. Log into the GNE and run RTRV-NBR:ALL:2;. If it returns an empty COMPLD, the node is standalone and there is nothing to discover.

Every command fails, or the whole collection fails immediately.

Check sshAuth matches the node. A password node with a none template (or the reverse) fails at the SSH layer before TL1 starts.
Verify the GNE credentials by connecting directly. See basic connectivity and authentication.

An RNE returns IIAC

Collecting an RNE fails with DENY IIAC.

The TID is no longer behind this GNE. Re-collect the GNE so discovery reconciles it. If it is genuinely gone, the RNE is flagged missing and can be removed.

An RNE fails when its GNE is down

An RNE is only reachable through its gateway. A gateway outage marks every RNE behind it config-failed. Restore the GNE, then re-collect.

Troubleshooting TL1 collection