{"record":{"id":"42c8da27345af54d","repo":"hashicorp/vagrant","slug":"failed-to-bootstrap-cfengine-please-see-the-outpu","errorCode":null,"errorMessage":"Failed to bootstrap CFEngine. Please see the output above to\nsee what went wrong and address the issue.","messagePattern":"Failed to bootstrap CFEngine\\. Please see the output above to\nsee what went wrong and address the issue\\.","errorType":"exception","errorClass":"Vagrant::Errors.CFEngineBootstrapFailed","httpStatus":null,"severity":"error","filePath":"plugins/provisioners/cfengine/provisioner.rb","lineNumber":97,"sourceCode":"      def handle_cfengine_bootstrap\n        @logger.info(\"Bootstrapping CFEngine...\")\n        if !@machine.guest.capability(:cfengine_needs_bootstrap, @config)\n          @machine.ui.info(I18n.t(\"vagrant.cfengine_no_bootstrap\"))\n          return\n        end\n\n        # Needs bootstrap, let's determine the parameters\n        policy_server_address = @config.policy_server_address\n        if !policy_server_address\n          policy_server_address = @machine.guest.capability(:read_ip_address)\n          raise Vagrant::Errors::CFEngineCantAutodetectIP if !policy_server_address\n          @machine.ui.info(I18n.t(\"vagrant.cfengine_detected_ip\", address: policy_server_address))\n        end\n\n        @machine.ui.info(I18n.t(\"vagrant.cfengine_bootstrapping\",\n                                policy_server: policy_server_address))\n        result = cfagent(\"--bootstrap #{policy_server_address}\", error_check: false)\n        raise Vagrant::Errors::CFEngineBootstrapFailed if result != 0\n\n        # Policy hubs need to do additional things before they're ready\n        # to accept agents. Force that run now...\n        if @config.am_policy_hub\n          @machine.ui.info(I18n.t(\"vagrant.cfengine_bootstrapping_policy_hub\"))\n          cfagent(\"-KI -f /var/cfengine/masterfiles/failsafe.cf#{cfagent_classes_args}\")\n          cfagent(\"-KI #{cfagent_classes_args}#{cfagent_extra_args}\")\n        end\n      end\n\n      # This handles verifying the CFEngine installation, installing it\n      # if it was requested, and so on. This method will raise exceptions\n      # if things are wrong.\n      def handle_cfengine_installation\n        if !@machine.guest.capability?(:cfengine_installed)\n          @machine.ui.warn(I18n.t(\"vagrant.cfengine_cant_detect\"))\n          return\n        end","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/provisioners/cfengine/provisioner.rb#L79-L115","documentation":"Raised when `cfagent(\"--bootstrap <policy_server_address>\")` runs with error_check disabled and returns a non-zero exit code. Bootstrap already has an address (from config or auto-detection); the failure is inside the guest: cf-agent could not reach, trust, or register with the policy hub. The real cause is printed in the cf-agent output streamed just above this error.","triggerScenarios":"Calling `vagrant provision` (or first `vagrant up`) with the cfengine provisioner where the policy server is unreachable from the guest (blocked port 5308 TCP/UDP), the address is wrong, hub/agent CFEngine versions are incompatible, or bootstrap keys are rejected.","commonSituations":"Firewall or security group blocks CFEngine's port 5308; policy_server_address points to the wrong interface; NAT address (10.0.2.2) used when the hub runs on another host; cf-agent keys/bootstrapping state already corrupt in the box.","solutions":["Read the cf-agent output printed above the error - it names the exact bootstrap failure","From the guest, verify hub reachability: `nc -vz <policy_server> 5308` (TCP and UDP)","Correct `cfengine.policy_server_address` in the Vagrantfile to the hub's real address as seen from the guest","Check hub and agent CFEngine major versions match and that /var/cfengine/ppkeys on the guest is not in a bad half-bootstrapped state (remove it and re-provision)"],"exampleFix":"# Vagrantfile - before (wrong hub address for this network)\ncfengine.policy_server_address = \"192.168.10.5\"\n\n# Vagrantfile - after (hub reachable on the host-only network)\ncfengine.policy_server_address = \"192.168.33.10\"","handlingStrategy":"try-catch","validationCode":"# Pre-flight from the host before provisioning\nsystem(\"vagrant ssh -c 'nc -z #{hub} 5308 && echo HUB_REACHABLE'\") or abort \"Policy hub #{hub} unreachable\"","typeGuard":null,"tryCatchPattern":"begin\n  Vagrant::Environment.new.cli(%w[provision])\nrescue Vagrant::Errors::CFEngineBootstrapFailed\n  warn \"cf-agent bootstrap failed - check hub reachability (port 5308) and cf-agent output\"\n  exit 1\nend","preventionTips":["Verify port 5308 (TCP+UDP) reachability from guest to hub before provisioning","Keep hub and agent CFEngine major versions aligned","Treat a half-bootstrapped /var/cfengine/ppkeys as suspect: clear and re-provision rather than retrying blindly"],"tags":["cfengine","bootstrap","provisioning","vagrant","exit-code"],"backgroundTag":"agent-bootstrap-failed","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}