gmane.network.rancid

Re: [rancid] Device into routers.down

Alan McKinnon — 2013-05-25T09:11:38

Most likely you have different versions of utility tools such as expect
and friends.

Start by examining the logs in $RANCIDDIR/var/logs for that device - the
cause of failure is usually there.


You can also check for dumb human mistakes like mistyping :up in
router.db and a typo in GROUPS in rancid.conf [yes indeed, I've made
those mistakes myself - more than once :-) ]

[rancid] Device into routers.down

Gary Douglas — 2013-05-24T13:48:55

We have been running Rancid for a couple of years on our core devices. I am moving it to VM with Unbuntu Server and setting it up for all our network devices. I have it working on our egress groups with no problem. I add the core group and it moves every device to the routers.down file automagically. I run the clogin for the device in question and this logs me in just fine. I have removed then added the devices back into router.db and this does not help. The devices I am trying to connect to are the same type device that is working in the egress group. How can I troubleshoot this problem?

Thank you
Gary Douglas



_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Rancid with A10 networks

2013-05-23T17:16:28

We've got some A10 gear coming online in the next month or so, I'll be 
sure to get it in my RANCID backups ASAP.  :)

On Thu, 23 May 2013, heasley wrote:

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Rancid with A10 networks

heasley — 2013-05-23T17:06:28

Thu, May 23, 2013 at 12:44:00PM -0400, Joe Provo:

i havent seem them, but we dont have A10s either - in which case, to try
to keep our support effort low, we would like to see a few folks use and
confirm that it works, before adding it.
_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Rancid with A10 networks

Joe Provo — 2013-05-23T16:44:00

 
Seems like it could use some optimization - any reason it hasn't been
folded into the main distro? 

Cheers,

Joe

[rancid] timeout in mtlogin

Michael W. Lucas — 2013-05-21T19:04:24

Hi,

I'm migrating my rancid install to a new server.

Previously, I had a problem with timeouts it mtlogin. Heasley was kind
enough to send a patch, which worked, as discussed at:
http://www.gossamer-threads.com/lists/rancid/users/6354

But the new install seems to be disregarding the timeout.

I migrated to the new server by tarring up my rancid user's directory
and extracting it on the new server. New rancid install from tarball,
applying both 2.3.8 patches and the mtlogin patch from the thread
above. Copied rancid.conf from the old server to the new. 

But the timeout kicks in after the usual 90 seconds, despite the
timeout in .cloginrc:

add password router-1 blahblahblah
add timeout router-1 400
add user router-1 admin+ct
add method router-1 ssh
add noenable router-1 {1}

I can run 

$ time mtlogin -t 400 -c "export compact; quit" router-1
...
0.026u 0.047s 3:16.36 0.0%      102+9081k 0+0io 0pf+0w

and the timeout works at the command line, but not during rancid-run.

On a whim, I copied the entire /us

Re: [rancid] Fortigate problem

Gareth Hopkins — 2013-05-20T14:02:59

Hi Charles, 

I had the same issue as per http://www.shrubbery.net/pipermail/rancid-discuss/2012-May/006382.html

The following change in fnrancid should work 

Replace 

} elseif [string match "ssh*" $prog] {
            regexp {ssh(:([^[:space:]]+))*} $prog methcmd suffix port
            set cmd $sshcmd
            if {"$port" == ""} { #BAD!!
                set cmd "$cmd -p $port"
            } 

with 

} elseif [string match "ssh*" $prog] {
            regexp {ssh(:([^[:space:]]+))*} $prog methcmd suffix port
            set cmd $sshcmd
            if {"$port" != ""} {
                set cmd "$cmd -p $port"
            } 

Regards, 
Gareth 

On 20 May 2013, at 12:24 PM, Charles van der Spuy <charlesvds< at >yahoo.com> wrote:


_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

heasley — 2013-05-20T22:48:14

Mon, May 20, 2013 at 07:23:17PM +0000, Skoog, Robert:

Well, I do not have access to one of these.  it shouldnt be hard to add;
there are a few devices with rancid scripts whose pager can not be
disabled.  The PIX for example.  You could look at clogin for pager handling
clues.

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

Skoog, Robert — 2013-05-20T19:23:17

Yes, just handling the paging would be a better option.  Unfortunately I don't think anyone has gotten it working without disabling paging.  I tried for a bit, but then gave up and implemented that hack to determine if vdoms were enabled or not just to get it working for us.

-----Original Message-----
From: heasley [mailto:heas< at >shrubbery.net] 
Sent: Monday, May 20, 2013 1:43 PM
To: Skoog, Robert
Cc: heasley; Charles van der Spuy; rancid-discuss< at >shrubbery.net
Subject: Re: [rancid] Fortigate problem

Mon, May 20, 2013 at 04:43:58PM +0000, Skoog, Robert:

Your match is just as likely to be missed.  what happens is that the data does not necessary arrive all at once or even be read from the socket all at once.  you can't rely on having a complete line unless you force the behavior by using line mode if the device supports it or 
expect {
something
else
the other
-re "^\[^\n\r]*\[\r\n]"{ # stuff we dont care about
  exp_continue
}
}

anyway, I expect that removing that stuff from fnlogin and

Re: [rancid] Fortigate problem

heasley — 2013-05-20T17:43:23

Mon, May 20, 2013 at 04:43:58PM +0000, Skoog, Robert:

Your match is just as likely to be missed.  what happens is that the data
does not necessary arrive all at once or even be read from the socket all
at once.  you can't rely on having a complete line unless you force the
behavior by using line mode if the device supports it or 
expect {
something
else
the other
-re "^\[^\n\r]*\[\r\n]"{ # stuff we dont care about
  exp_continue
}
}

anyway, I expect that removing that stuff from fnlogin and handling the
paging without making config changes would be a better path.

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

Skoog, Robert — 2013-05-20T16:43:58

The command before it gives this output:

Somefortinethost # get system status
Version: FortiWiFi-80CM v4.0,build0637,120817 (MR3 Patch 9)
Virus-DB: 17.00657(2013-05-19 11:39)
Extended DB: 14.00000(2011-08-24 17:09)
IPS-DB: 4.00343(2013-05-16 00:16)
FortiClient application signature package: 4.343(2013-05-20 01:43)
Serial-Number: FW80CM111111111111
BIOS version: 04000004
Log hard disk: Not available
Internal Switch mode: switch
Hostname: SomeHostName
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 2 in NAT mode, 0 in TP mode
Virtual domain configuration: enable
FIPS-CC mode: disable
Current HA mode: standalone
Wifi Chipset: Ralink RT2860
WiFi firmware version: 2.1.3.0
Distribution: International
Branch point: 637
Release Version Information: MR3 Patch 9
System time: Mon May 20 12:36:30 2013

SomeHostname #

That Regex matches for this line:
Virtual domain configuration: enable

I tried some longer regexes, but had problems with the output being chunk

Re: [rancid] Fortigate problem

heasley — 2013-05-20T16:06:28

Mon, May 20, 2013 at 03:41:13PM +0000, Skoog, Robert:

thanks; that had been committed.  I missed the difference when I looked at
2.3.8.


what effect does that have when vdoms are not in use?

what is being matched here:
+        expect {
+               -re "tion: ena" { expect -re $prompt; send "config global\r"}
+               -re "tion: dis" {}
+              }

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

Skoog, Robert — 2013-05-20T15:41:13

Actually you put up a patch to the mailing list previously which resolves this issue:

http://www.gossamer-threads.com/lists/rancid/users/6488

I can't seem to find the post on the shrubbery archives though.  I know the patch resolved my issues when using SSH to connect to fortinets.  I also put up a patch a while ago dealing with devices with and without vdoms.  Devices without vdoms seem not to like having configuration commands sent after the config global command is sent.

http://www.shrubbery.net/pipermail/rancid-discuss/2013-March/006715.html

-----Original Message-----
From: rancid-discuss-bounces< at >shrubbery.net [mailto:rancid-discuss-bounces< at >shrubbery.net] On Behalf Of heasley
Sent: Monday, May 20, 2013 11:25 AM
To: Charles van der Spuy
Cc: rancid-discuss< at >shrubbery.net
Subject: Re: [rancid] Fortigate problem

Mon, May 20, 2013 at 04:43:30PM +0200, Charles van der Spuy:

I do not see the problem with executing ssh.  fnlogin does not set a port or do anything unusual.  you will have to be more specific.

Re: [rancid] Fortigate problem

heasley — 2013-05-20T15:24:59

Mon, May 20, 2013 at 04:43:30PM +0200, Charles van der Spuy:

I do not see the problem with executing ssh.  fnlogin does not set a port
or do anything unusual.  you will have to be more specific.

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

Charles van der Spuy — 2013-05-20T14:43:30

Gentlemen,

Thanks for all the input to my problem.
Gareth, you get the prize. As a quickfix I've changed ssh to ssh:22 in 
.cloginrc and the sun suddenly rose in the east !!
Thanks to Bob and Dean I'd already started the debug process and picked 
up some kind of problem with the port number but I was still a way away 
from fixing it.

Clearly the problem is in fnlogin (not fnrancid Gareth :-) and I feel 
this should be changed in the package so that others don't have the same 
problem.
Any help on what I can do to get this changed in the original package ?
I guess a note to Shrubbery would be a good start.

Again, thanks all and greetings from a sunny Durban, South Africa.

Charles.
_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Fortigate problem

Dean Searle — 2013-05-20T13:48:39

I agree with Bob, more information would be helpful to assist with your problem. What version of software is your Fortigate running? What have you tried to resolve your problem so far? Do want to send you the same steps that you might have already done.

I have Both Fotrigate 300C and 100D in house. I had version 2.3.8 running prior to the Fortigates being installed though. We have FortiGate 5.0.1 (build 147) on the 300C and 5.0.2 (build 179) on our 100D.

From: rancid-discuss-bounces< at >shrubbery.net [mailto:rancid-discuss-bounces< at >shrubbery.net] On Behalf Of bob watson
Sent: Monday, May 20, 2013 7:37 AM
To: Charles van der Spuy
Cc: Rancid
Subject: Re: [rancid] Fortigate problem

Charles,

Key to debugging login errors is to ensure that your environment since upgrade has stayed the same for authentication.

I have no knowledge specific to fortigate, but make sure you make use of the debugging switches to see what happening with the device login.

Expect has wonderful debugging switches on its own, and all outp

Re: [rancid] Fortigate problem

bob watson — 2013-05-20T11:37:29

Charles,

Key to debugging login errors is to ensure that your environment since
upgrade has stayed the same for authentication.

I have no knowledge specific to fortigate, but make sure you make use of
the debugging switches to see what happening with the device login.

Expect has wonderful debugging switches on its own, and all output can be
logged.

Unfortunately you don't list what you have tried, so it makes it hard for
us to give anything but general advice. Granted, that there may be
something peculiar to the device, but this can generally be captured by
using the EXPECT exp_internal switches.

Cheers,




Bob Watson
BAppSci, MACS, CP

<a href="http://au.linkedin.com/in/bobthebaritone">

          <img src="
http://www.linkedin.com/img/webpromo/btn_viewmy_160x33.png" width="160"
height="33" border="0" alt="View Robert Watson's profile on LinkedIn">

    </a>


On 20 May 2013 20:24, Charles van der Spuy <charlesvds< at >yahoo.com> wrote:

_______________________________________________
Rancid-discuss mailin

[rancid] Fortigate problem

Charles van der Spuy — 2013-05-20T10:24:19

I hope someone can assist me.

I have recently upgraded to rancid 2.3.8 and this seems to have broken 
the Fortigate module.
Cisco devices still work and I am able to manually login to Fortigate 
devices using clogin.

When I run the full rancid-run I get the following in the logfile:

*Trying to get all of the configs.**
**ftg1-universal fnlogin error: Error: Couldn't login: ftg1-universal**
**ftg1-universal: missed cmd(s): show full-configuration,get system status**
**0: found end**
**ftg1-universal: End of run not found*
etc.....

I'm getting to the end of my tether on this one and don't want to have 
to degrade to an earlier version.
Has anybody been experiencing the same ?

Charles van der Spuy.
_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] Rancid on CentOS 6.3

MP Netsai — 2013-05-16T10:47:04

have you tried with: 
rancid-user~$ clogin host
also check the logs.
From: Andrew S. Meyer 
Sent: Thursday, May 16, 2013 5:52 AM
Cc: rancid-discuss< at >shrubbery.net 
Subject: Re: [rancid] Rancid on CentOS 6.3

So I’ve gotten Rancid installed and somewhat working.  I was able to follow Brian Gill’s website - http://www.thebriangill.info/2012/12/configuring-rancid-to-backup-your.html .  It is emailing me when it can’t contact the ASA or access point but that’s all its doing..  I’m not sure why it can’t access it, but I’ve tested it through telnet and ssh and it works fine when I do it manually.  Rancid won’t login.   Any ideas?

Thank you,

Andrew

From: Darius Seroka [mailto:dariusjs< at >gmail.com] 
Sent: Wednesday, May 08, 2013 6:01 AM
To: Andrew S. Meyer
Cc: rancid-discuss< at >shrubbery.net
Subject: Re: [rancid] Rancid on CentOS 6.3

I havent deployed RANCID for a while but last time I used this git repo as it seemed to have been quite patched up. https://github.com/dotwaffle/rancid-git The st

Re: [rancid] clogin doesn't send explicitly set new lines

Aliaksei Sheshka — 2013-05-16T17:26:23

Thank you for explanation!

As as side question, I'm using clogin for force10 routers as well and see:
router1#terminal width 132^M
                        ^^M
% Error: Invalid input at "^" marker
it's safe to ignore, only extra lines in logs.
As much as I understand there is no separate f10login ? (not needed I
guess, mostly cisco style cmd there)
_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Re: [rancid] clogin doesn't send explicitly set new lines

heasley — 2013-05-16T15:22:09

Wed, May 15, 2013 at 03:38:13PM -0400, Aliaksei Sheshka:

its looking for stuff that matches the prompt regex it has concocted:
^[^\n\r]*nyy-r14([^#>\r\n]+)?[#>](\([^)\r\n]+\))?.

if you want to embed commands in commands with alternate prompting, they
must be embedded on one line:
show clock
copy blah blah\n\n
show clock

or use the -s option instead and see rancid/share/*.exp.
_______________________________________________
Rancid-discuss mailing list
Rancid-discuss< at >shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss