aoscx_config create a failed ssh connection

[NimaHITC]

When using the aoscx_config module ansible create an failed ssh connection before connecting succesfully

Event|5210|LOG_ERR|AMM|1/1|User xxx login from x.x.x.x for SSH session failed during password based authentication.

Here are parts of my playbook where the error occurs

collections:
- arubanetworks.aoscx
vars:
ansible_connection: arubanetworks.aoscx.aoscx
ansible_httpapi_validate_certs: False
ansible_httpapi_use_ssl: True
ansible_acx_no_proxy: True
ansible_aoscx_validate_certs: False
ansible_network_cli_ssh_type: libssh

    - name: Create reboot job
      vars:
        ansible_connection: network_cli
      aoscx_config:
        parents:
          - job Reboot
        lines:
          - description reboot to image
          - 10 cli config
          - 15 cli allow-unsafe-updates 60
          - 20 cli boot system {{ target_partition }}
        save_when: always

[TimB87]

I can see the same over here working on CX6300 hardware.

edit: and 6200F.

@tchiapuziowong Do you have any hint where to look? This problem might trigger blocking the ansible-host in a network (e.g. threat prevention detection for a false brute force), which is very unfortunate.

edit2: It might be that a tacacs server (e.g. like CPPM) reports:

Tacacs server	Invalid Sequence number

Edit2:
Setting

ip source-interface tacacs <<MGMT IP HERE>>

as suggested here https://community.arubanetworks.com/discussion/arubaos-cx-tacacs-authentication does not help it.

[tchiapuziowong]

Hi @TimB87 I believe this might be something having to do with how we deal with default/zeroized devices : https://github.com/aruba/aoscx-ansible-collection/blob/master/plugins/module_utils/aoscx_ztp.py

Although it seems like it should only attempt the default username/password on a FAILED login - is this happening on ALL your devices or only on default/zeroized ones

[TimB87]

@tchiapuziowong Thank you very much for getting back to us! It's very appreciated.

We are looking at the code and yes, it seems like this could be what we are seeing.
https://github.com/aruba/aoscx-ansible-collection/blob/master/plugins/module_utils/aoscx.py#L346
Since we have already configured a admin password, always having _DEVICE_ZTP set to True is what we want to try next

Edit: Wow, this makes all the difference! We set https://github.com/aruba/aoscx-ansible-collection/blob/master/plugins/module_utils/aoscx.py#L45 to True and there are no more failed login attempts.
It also decreased our runtime of the playbook from roughly 12 minutes to 1:30.

The next question is how we can make this work without the hack of statically setting it to True.

[tchiapuziowong]

Great to hear @TimB87 ! I'll work with development on troubleshooting and see if we can get this fixed in the code itself - thank you so much for your efforts!