Netmiko: SSH to an ASA from a Jump router

[sdulloo]

I need to ssh to an ASA after ssh into a jump router. I tried to use Connect Handler twice but not sure if that's the right way to do it. Can you please advise Kirk??

[sdulloo]

from netmiko import ConnectHandler
from getpass import getpass
import sys, os

ip_addr = ("10.52..x.x")

user_name = raw_input("Enter your username to SSH:")
print ("#### Enter your password #####")
pwd = getpass()

ssh_device = {
'device_type': 'cisco_ios',
'ip': ip_addr,
'username': user_name,
'password': pwd,
'port': 22,
}

print ("SSH")
net_connect = ConnectHandler(**ssh_device)
print ("SSH prompt: {}".format(net_connect.find_prompt()))

net_connect.send_command("ssh 10.x.x.x" )
print ("SSH prompt: {}".format(net_connect.find_prompt()))
ip_addr1 = ("10.x.x.x")

user_name = raw_input("Enter your username to SSH:")

print ("#### Enter your password #####")

pwd = getpass()
net_connect.enable()

print ("#### Enter password for enable mode ####")

enable = getpass()

ssh_device1 = {
'device_type': 'cisco_asa',
'ip': ip_addr1,
'password': pwd,
'secret': enable,
'port': 22,
}

f1 = open(r'C:\Users\pre-implementation.txt','w')
f2 = open(r'C:\Users\post-implementation.txt','w')

print ("SSH")
net_connect = ConnectHandler(**ssh_device1)
print ("SSH prompt: {}".format(net_connect.find_prompt()))
print ("enable mode:{}".format(net_connect.enable()))
print ("config mode:{}".format(net_connect.config_mode()))
print ("send_command: ")

[ktbyers]

@sdulloo See this article here:

https://pynet.twb-tech.com/blog/automation/netmiko-proxy.html

Note, the format of the SSH-config specifier changed in Netmiko 1.4.0. See the 1.4.0 release notes for new host specifier:

https://github.com/ktbyers/netmiko/releases/tag/v1.4.0

[sdulloo]

Thank you so much for replying!! I already read the entire artlicle. I have netmiko1.4.0 installed. The only thing i dont understand is that i am not using LINUX. I m using windows so where can i find the sshconfig file to edit it??

[sdulloo]

@ktbyers

[ktbyers]

I am sorry I mis-read part of your issue.

So you are trying to SSH into your network by bouncing through one router to another. That is going to be hard.

Let me update my response...give me a minute.

[sdulloo]

I m bouncing from a jump router(IOS) to a cisco ASA. Our environmrnt has a policy that we cant directly access the ASA from wireless which is making things so hard.

[ktbyers]

So I think you will need to try to do something like the following:

import time

...
# SSH Connection to first Device
print ("SSH")
net_connect = ConnectHandler(**ssh_device)
# Make sure SSH connection is working at this point
print ("SSH prompt: {}".format(net_connect.find_prompt()))

# Use raw read/write to SSH into device2
net_connect.write_channel("ssh 10.x.x.x\n" )
time.sleep(1)
output = net_connect.read_channel()
if 'ssword' in output:
    net_connect.write_channel(net_connect.password + '\n')
time.sleep(1)
output += net_connect.read_channel()

# Verify you logged in successfully
print(output)

then, you need to use the redispatch method (to switch the Netmiko class to an ASA)

from netmiko import redispatch

# Dynamically reset the class back to CiscoIosSSH
redispatch(net_connect, device_type='cisco_asa')

Note, you are going to need to debug the login above and get it working reliably (add additional delays...maybe even make it a loop so it will try again if it fails).

[sdulloo]

To make sure the first part of the code which is
print ("SSH")
net_connect = ConnectHandler(**ssh_device)

Make sure SSH connection is working at this point

print ("SSH prompt: {}".format(net_connect.find_prompt()))

This is for SSH into the Jump router right ???

[ktbyers]

No that first part is just a copy of what you had for the SSH into IOS router.

The part starting here is where you start trying to SSH into the ASA

# Use raw read/write to SSH into device2

[ktbyers]

FYI, turning on logging (this will write a file named test.log in your current directory) might also help (i.e. for you to see what is happening).

import logging
logging.basicConfig(filename='test.log', level=logging.DEBUG)
logger = logging.getLogger("netmiko")

[sdulloo]

awesome i'm gonna try doing this... Thank u so much!! this will be awesome :) I will update you if i have issues.. i'm actually driving!! will do as soon as i reach work !!

[sdulloo]

Can you tell me what version of netmiko we need to use for redispatch?? will 1.4.0 work??

[ktbyers]

Yes, it is in Netmiko 1.4.0.

[sdulloo]

• This is a private computing system that is restricted to *
• authorized individuals. Actual or attempted unauthorized *
• use of this computer system will result in criminal and or *
• civil prosecution. We reserve the right to view, monitor *
• and record activity on the system without notice or *
• permission. Any information obtained by monitoring, *
• reviewing or recording is subject to review by law *
• enforcement organizations in connection with the *
• investigation or prosecution of possible criminal activity *
• on the system. If you are not an authorized user of this *
• system or do not consent to continued monitoring, *
• exit the system at this time. *

---

Type help or '?' for a list of available commands.
52n-asa-test>
Traceback (most recent call last):
File "test10.py", line 44, in
redispatch(net_connect, device_type='cisco_asa')
File "build\bdist.win32\egg\netmiko\ssh_dispatcher.py", line 140, in redispatch
File "build\bdist.win32\egg\netmiko\cisco\cisco_asa_ssh.py", line 19, in session_preparation
File "build\bdist.win32\egg\netmiko\base_connection.py", line 590, in disable_paging
File "build\bdist.win32\egg\netmiko\base_connection.py", line 323, in read_until_prompt
File "build\bdist.win32\egg\netmiko\base_connection.py", line 278, in _read_channel_expect
netmiko.ssh_exception.NetMikoTimeoutException: Timed-out reading channel, data not available.

Its reaching all the way to the ASA but how will i get to enable mode from there? Would i have to again use ssh_device from connecthandler after doing redispatch !! @ktbyers

[sdulloo]

I'm all the way into the ASA
52n-asa-test>
AFter this i get a timeout error... not sure how to get to enable mode and then config mode.
@ktbyers

[ktbyers]

After, you redispatch, then you should be able to use the enable method.

net_connect.enable()

For config mode, then you can just use standard Netmiko method:

config_list = ['command1', 'command2', 'command3']
net_connect.send_config_set(config_list)

Let me know if this works.

[sdulloo]

Hmmm that's what I thought but I'm getting a timeout error after getting into asa!!
This is the last I see 52n-test-asa>

[ktbyers]

Okay, let me look at the error you posted (and see if I can see why it is failing).

[sdulloo]

import time
from netmiko import ConnectHandler
from getpass import getpass
import sys, os

ip_addr = ("10.x.x.x ")

user_name = raw_input("Enter your username to SSH:")
print ("#### Enter your password #####")
pwd = getpass()

ssh_device = {
'device_type': 'cisco_ios',
'ip': ip_addr,
'username': user_name,
'password': pwd,
'port': 22,
}

SSH Connection to first Device

print ("SSH")
net_connect = ConnectHandler(**ssh_device)
print ("SSH prompt: {}".format(net_connect.find_prompt()))

Use raw read/write to SSH into device2

net_connect.write_channel("ssh 10.52.15.92\n" )
time.sleep(1)
output = net_connect.read_channel()
if 'ssword' in output:
net_connect.write_channel(net_connect.password + '\n')
time.sleep(1)
output += net_connect.read_channel()

Verify you logged in successfully

print(output)

from netmiko import redispatch

Dynamically reset the class back to CiscoIosSSH

redispatch(net_connect, device_type='cisco_asa')

net_connect.enable()
output = net_connect.find_prompt()
print (output)
output = net_connect.send_command("show run")
print (output)

This is my script Kirk!! WOrked totally fine by adding the read and write channel to get into the ASA through the jump router. BUt then it stops.

[sdulloo]

Type help or '?' for a list of available commands.
52n-asa-test>
Traceback (most recent call last):
File "test10.py", line 45, in
redispatch(net_connect, device_type='cisco_asa')
File "build\bdist.win32\egg\netmiko\ssh_dispatcher.py", line 140, in redispatch
File "build\bdist.win32\egg\netmiko\cisco\cisco_asa_ssh.py", line 19, in session_preparation
File "build\bdist.win32\egg\netmiko\base_connection.py", line 590, in disable_paging
File "build\bdist.win32\egg\netmiko\base_connection.py", line 323, in read_until_prompt
File "build\bdist.win32\egg\netmiko\base_connection.py", line 278, in _read_channel_expect
netmiko.ssh_exception.NetMikoTimeoutException: Timed-out reading channel, data not available.
PS C:\Users\sdulloo\Desktop\Scripts>

This is the error i get!!

[sdulloo]

@ktbyers

[ktbyers]

@sdulloo Do you have a secret set?

ssh_device1 = {
  'device_type': 'cisco_asa',
  'ip': ip_addr1,
  'password': pwd,
  'secret': enable,
  'port': 22,
}

It should be in enable mode at this point and it isn't?

Does the log file show anything?

[sdulloo]

i didnt do the log file test yet!!

So are you saying that i need to have these commands after redispatch??

ssh_device1 = {
'device_type': 'cisco_asa',
'ip': ip_addr1,
'password': pwd,
'secret': enable,
'port': 22,
}

so after redispatch it should go to enable when i give it net.connect.enable() and then issue commands but instead it gives errors. I dont have the secret set for asa!! Not sure where to set it!!

[sdulloo]

@ktbyers

[ktbyers]

@sdulloo No, I am just wondering whether in your original device definition whether you had a secret. The ASA code should have the following:

    def session_preparation(self):
        """Prepare the session after the connection has been established."""
        self._test_channel_read()
        self.set_base_prompt()
        if self.secret:
            self.enable()
        else:
            self.asa_login()
        self.disable_paging(command="terminal pager 0\n")
        self.set_terminal_width(command="terminal width 511\n")

If you have a secret defined, then it should have went into enable mode. But we see it fail right after this (i.e. disable_paging requires us to be in enable mode, and we aren't).

So then I am wondering, why aren't we in enable mode.

[sdulloo]

So in my first device which was a jump router i dont have a secret defined because we dont need that on that jump router...

ip_addr = ("10.x.x.x ")

user_name = raw_input("Enter your username to SSH:")
print ("#### Enter your password #####")
pwd = getpass()

ssh_device = {
'device_type': 'cisco_ios',
'ip': ip_addr,
'username': user_name,
'password': pwd,
'port': 22,
}

SSH Connection to first Device

print ("SSH")
net_connect = ConnectHandler(**ssh_device)
print ("SSH prompt: {}".format(net_connect.find_prompt()))

Maybe this is the reason we couldnt go to enable mode on ASA??? @ktbyers

[ktbyers]

In your code, just before you do the redispatch do the following:

net_connection.secret = 'secret'      # whatever your enable password is

[sdulloo]

I did that !! So now it gave me the prompt for passowrd which is great, but then it says net_connection is not defined.

Type help or '?' for a list of available comman
52n-asa-test>
Password:
Traceback (most recent call last):
File "test10.py", line 47, in
net_connection.secret = 'secret'
NameError: name 'net_connection' is not defined
PS C:\Users\sdulloo\Desktop\Scripts>

[ktbyers]

My bad...net_connect (not net_connection)

net_connect.secret = 'secret'

[sdulloo]

net_connect.secret = 'pwd'
redispatch(net_connect, device_type='cisco_asa')

net_connect.enable()

output = net_connect.find_prompt()

print (output)

output = net_connect.send_command("show run")
print (output)

Did this but still get a timeout error.

Traceback (most recent call last):
File "test10.py", line 48, in
redispatch(net_connect, device_type='cisco_asa')
File "build\bdist.win32\egg\netmiko\ssh_dispatcher.py", line 140, in redispatch
File "build\bdist.win32\egg\netmiko\cisco\cisco_asa_ssh.py", line 16, in session_preparation
File "build\bdist.win32\egg\netmiko\cisco_base_connection.py", line 17, in enable
File "build\bdist.win32\egg\netmiko\base_connection.py", line 866, in enable
File "build\bdist.win32\egg\netmiko\base_connection.py", line 323, in read_until_prompt
File "build\bdist.win32\egg\netmiko\base_connection.py", line 278, in _read_channel_expect
netmiko.ssh_exception.NetMikoTimeoutException: Timed-out reading channel, data not available.
@ktbyers

[ktbyers]

Okay, that is an improvement. It is failing on going into enable mode.

You will probably need to look at the log file and see if there are any clues. It basically says it tried to read data and there wasn't any data.

[sdulloo]

Thank you for telling me to do that !! i checked the logs and looked like that it was taking the secret password as to what i was hardcoding in net_connect.secret = 'xxx'

So i tried the real pwd and hardcoded it in the code and it worked. But i dont want to hardcode it, so i did 'secret' = getpass() befor the net_connect.secret = 'secret' command but it doesnt like that.

is there a way i can get into the ASA without providing the actual password in script.

[sdulloo]

@ktbyers

[ktbyers]

You could probably do something like this:

net_connect.secret = getpass("Enter secret: ")
redispatch(net_connect, device_type='cisco_asa')
net_connect.secret = ''

Basically set it and then un-set it very quickly afterwords.

Ultimately the script would need to have it in one way or another...as the script is what's talking to the router.

[sdulloo]

OMGGGGG I love you !!! This is so sweet @ktbyers i cant tell you how much i was stuck on this jump router deal :):) i was almost abt to give up!! but you are great :) This rocks!!

[S2heeminS2]

I appreciate about this posting! I also tried to bound to cisco device to another, and It perfectly worked for me. Thank you so much, both of you are so sweet to me :-D

[packetlifter]

Found this very useful on my problem today. Thank you very much!

[kxr0623]

This answer is very useful for my project. thank you so much