Telnet with new versions of IOS-XE

[mmackay21724]

Hi,

The latest versions of IOS console port login forces a real login v. just the older enable.

Probably because it's a cut and paste of code the device login looks a LOT like the telnet server login. (Username, Password)

In our env the login to terminal server is managed by our AD/TACACS. But the login to device is local, so different.

What I'm seeing is the the initial connection to the TS works fine using the user/password from the connector.

Then the device sends out Username. netmiko see's this, thinks the login did not work so resends the username/password for the terminal server, which gets rejected by the device... And eventually tries out and fails.

You can see this in the logs (some noise deleted for brevity)

Any suggestion would be greatly appreciated.

e.g. Connection flow

Escape character is '^]'.

You are logging into a Terminal Server.  
This login prompt is authenticating your access using Admin Credentials to the server.
After a successful login you'll be connected to your desired device.

Username:<user>
Password:<password>

You are now connected to the console of your device. Press ENTER to interact.

User Access Verification

Username: <device_user>
Password: <password>

myCat9k#

In my script if the terminal-server telnet login fails then it logs into the ts and clears the line, then tries telnet again..

In an ideal world netmiko would understand the new interaction or I could handle the second login manually.

LOGS::

DEBUG:netmiko:read_channel: 
You are logging into a Terminal Server.  
This login prompt is authenticating your access using Sandbox Admin Credentials to the server.
After a successful login you'll be connected to your desired device.

Username:
DEBUG:netmiko:write_channel: <username>\r'
DEBUG:netmiko:read_channel: <username>
Password:
DEBUG:netmiko:write_channel: b'********\r'
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 

You are now connected to the console of your device. Press ENTER to interact.

DEBUG:netmiko:read_channel: 
DEBUG:netmiko:write_channel: b'\r\n'

User Access Verification

Username: 
DEBUG:netmiko:write_channel: <username>\r'
DEBUG:netmiko:read_channel: <username>
Password: 
DEBUG:netmiko:write_channel: b'********\r'
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:write_channel: b'\r\n'
DEBUG:netmiko:read_channel: 


% Authentication failed

Username: 
DEBUG:netmiko:write_channel: <username>\r'
DEBUG:netmiko:read_channel: <username>
Password: 
DEBUG:netmiko:write_channel: b'********\r'

Thanks

Mike

[ktbyers]

@mmackay21724 I would probably try to use device_type generic_termserver_telnet and then write your own code for logging in. Netmiko should not try to login using this device_type.

Note, you might neeed to use redispatch to change the device_type after you have completely logged in. There should be examples of this in the Netmiko examples (or in Netmiko's issues history).

[mmackay21724]

Thanks, that moved me forward.

As an aside, thanks for the work you do here. You are a better person than me dealing with the screen scraping, timing and other things, it's very frustrating :)

Trying to deal with the possible scenarios, after telnet is the device logged in or do I need to do secondary Username/Login, is it enabled, did someone change the password and I need to password recovery etc. It's hard work.

So thanks :)

[mmackay21724]

Got another question, this works to a certain degree, but not behaving as I would expect, all the delays are trial and error.

And this is UGLY :)

I have the telnet login working (the logs look weird, timing issue i think) but I get logged in and I handle failure.

Where I'm having an issue is the next step. If the device is already logged in then I will get either

devnet_sandbox>
or
devnet_sandbox#

and if not logged in then

User Access Verification

Username: cisco
Password: 

Therefore I need to be able to make a decision:
if > Enable and if that fails do password recovery (yuk)
If # then it's all good, so move onto the actual work
if "User Access Verification" then login to the device.

I thought I could take the output of the commands and use them for the above tests, but I don't seem to get anything, and thats probably a misunderstanding on my side.

def connect_to_ts():
	device = {
	'device_type': 'generic_termserver_telnet',
	'host':  	"10.17.252.53",
	'port': 	"2046"
	}
	try:
		# Establish the Telnet connection
		net_connect = ConnectHandler(**device)
		print(net_connect)
		time.sleep(5)
		send_user = net_connect.send_command_timing(os.getenv("SB_USER") )
		print ( f'Send USER {send_user} ')
		time.sleep(5)
		send_pwd = net_connect.send_command_timing(os.getenv("SB_PWD"))
		print (f"Sending Password  {send_pwd} ")
		time.sleep(5)

		print("... logging into device")
		time.sleep(3)
		cmd_output = net_connect.send_command_timing("\n\r")
		time.sleep(3)
		print(f"cmd-output --> {cmd_output}")
		
		return (True, net_connect)

the output from the script::

$python3 factory_reset.py
First connection
<netmiko.terminal_server.terminal_server.TerminalServerTelnet object at 0x1039db0e0>
Send USER 
You are logging into a Terminal Server.  
This login prompt is authenticating your access using Sandbox Admin Credentials to the server.
After a successful login you'll be connected to your desired device.

Username:<username> 
Sending Password  

You are now connected to the console of your device. Press ENTER to interact. 
... logging into device
cmd-output --> 
User Access Verification

Log File::

DEBUG:netmiko:write_channel: b'\r\n'
DEBUG:netmiko:write_channel: b'<username>\r\n'
DEBUG:netmiko:read_channel: 
You are logging into a Terminal Server.  
This login prompt is authenticating your access using Sandbox Admin Credentials to the server.
After a successful login you'll be connected to your desired device.

Username:mmackay
Password:
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:write_channel: b'<password>\r\n'
DEBUG:netmiko:read_channel: 

You are now connected to the console of your device. Press ENTER to interact.

DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:write_channel: b'\r\n'
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 

User Access Verification

Username: 
DEBUG:netmiko:read_channel: 
DEBUG:netmiko:read_channel: 

[ktbyers]

@mmackay21724 Did you work this out?