Search code examples
ansiblecisco

Ansible ad-hoc commands don't work with Cisco devices

I have newly installed Ubuntu server with Ansible. I try to use Ansible in my network, but it fails for me just from the beginning

10.102.249.3 is a router 

zab@UbuntuSrv:/etc/ansible$ ansible 10.102.249.3 -a "conf t" --ask-pass -vvv       
SSH password: 
<10.102.249.3> ESTABLISH CONNECTION FOR USER: zab
<10.102.249.3> REMOTE_MODULE command conf t
<10.102.249.3> EXEC ['sshpass', '-d6', 'ssh', '-C', '-tt', '-q', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/zab/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'StrictHostKeyChecking=no', '-o', 'Port=22', '-o', 'GSSAPIAuthentication=no', '-o', 'PubkeyAuthentication=no', '-o', 'ConnectTimeout=10', '10.102.249.3', "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && echo $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210'"]
<10.102.249.3> PUT /tmp/tmpZUkRET TO Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && echo $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210'"/command
10.102.249.3 | FAILED => failed to transfer file to Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210 && echo $HOME/.ansible/tmp/ansible-tmp-1412930091.8-230458979934210'"/command:

Connection to 10.102.249.3 closed by remote host.
Connection closed

zab@UbuntuSrv:/etc/ansible$ ansible 10.102.249.3 -m ping  --ask-pass -vvv         
SSH password: 
<10.102.249.3> ESTABLISH CONNECTION FOR USER: zab
<10.102.249.3> REMOTE_MODULE ping
<10.102.249.3> EXEC ['sshpass', '-d6', 'ssh', '-C', '-tt', '-q', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/zab/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'StrictHostKeyChecking=no', '-o', 'Port=22', '-o', 'GSSAPIAuthentication=no', '-o', 'PubkeyAuthentication=no', '-o', 'ConnectTimeout=10', '10.102.249.3', "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && echo $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532'"]
<10.102.249.3> PUT /tmp/tmpOPuOWh TO Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && echo $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532'"/ping
10.102.249.3 | FAILED => failed to transfer file to Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532 && echo $HOME/.ansible/tmp/ansible-tmp-1412930136.7-170302836431532'"/ping:

Connection to 10.102.249.3 closed by remote host.
Connection closed

Update: What is wrong with my playbook? I get ERROR: raw is not a legal parameter at this level in an Ansible Playbook

---
- hosts: testsw
  remote_user: zab
  tasks: 
  - name: copy tftp run
    raw: copy tftp://10.1.78.153/test running-config

Update2: Thanks, now it plays. But it can't connect to switches (cisco 3750, cisco 2960). I can make ssh from this server. Ansible connects to second switch and we can se banner. I remember that Ansible pushes python scripts to remote host. But now I use raw module inside playbook. Does it work in such way?

ansible-playbook test.yml --ask-pass
SSH password: 

PLAY [testsw] ***************************************************************** 

GATHERING FACTS *************************************************************** 
fatal: [10.0.100.61] => failed to transfer file to Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1413965089.88-16456712970308 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1413965089.88-16456712970308 && echo $HOME/.ansible/tmp/ansible-tmp-1413965089.88-16456712970308'"/setup:

Connection to 10.0.100.61 closed by remote host.
Connection closed

fatal: [10.0.100.60] => failed to transfer file to Line has invalid autocommand "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1413965089.85-196216747271106 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1413965089.85-196216747271106 && echo $HOME/.ansible/tmp/ansible-tmp-1413965089.85-196216747271106'"/setup:

C Authorized access only!
 Disconnect IMMEDIATELY if you are not an authorized network administrator!
channel_by_id: 2: bad id: channel free
client_input_channel_req: channel 2: unknown channel
Connection to 10.0.100.60 closed by remote host.
Connection closed


TASK: [copy tftp run] ********************************************************* 
FATAL: no hosts matched or all hosts have already failed -- aborting


PLAY RECAP ******************************************************************** 
           to retry, use: --limit @/home/zab/test.retry

10.0.100.60                : ok=0    changed=0    unreachable=1    failed=0   
10.0.100.61                : ok=0    changed=0    unreachable=1    failed=0
Solution

  • Since you're sending a conf t, I suppose you're trying to talk to a Cisco router. This won't work, since Ansible pushes python scripts that are executed on the remote host.

    The only way to do something is to use the raw module, like so :

    ansible cat -m raw -a 'show clock' --ask-pass -c paramiko
SSH password: 
cat | success | rc=0 >>

11:11:51.676 METDST Fri Oct 10 2014

    I have to use paramiko too for the connection. Don't even think about sending confing this way : each call to module will reopen a ssh connection, so you can not send a config using consecutive ansible commands.

    The best you can do is to copy tftp://.... startup-config, by sending a config file to a tftp server first.

    This is however quite easy to orchestrate with ansible.

    Good luck.