NCM not able to backup Cisco 9000 series switches anymore

Hi.

I have noticed that more and more of oure Cisco Catalyst switchen in the 9000 series fails the nightly backup.

When checking the logs, I see messages like this:

%SSH-3-NO_MATCH: No matching mac found: client hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,none server hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com

If not resoleved, this will be a growing problem as more and more switches are replaced with Catalyst 9000-switches and firmware updated.

What can be done to resolve this?

Find more posts tagged with

backup

network_configuration_manager

cisco

Accepted answers

maciej.sandecki

Please see this post: thwack.solarwinds.com/.../313593

All comments

sja

Hi Dal

I have no problem backing up Cisco 9300 IOS 17.9 with the normal Cisco profile.

Did it ever work with that device before or it stop working ?

Dal

Thanks for answering.

Yes, it used to work before.

You have set it up to use SSH?

sja

Only SSH

jm_sysadmin

I have the Enable Level set to enable, but otherwise we are the same and successfully backing them up.

maciej.sandecki

Please see this post: thwack.solarwinds.com/.../313593

Dal

Thanks, that was actually helpful.

But who has the "blame" here? Is it Solarwinds for not having the right algorithms in NCM, or is it Cisco ?

Either way, it needs to be fixed permanently

maciej.sandecki

The implementation of SSH used by Solarwinds does not have support for some new algorithms, so this needs to be fixed by Solarwinds.

Recently we came across another switch (Cisco CBS220) that supports only ssh-ed25519 and ecdsa-sha2-nistp256 for server host key algorithms and these two are not supported by Solarwinds at all, so no way to get it to work with NCM right now.

See this support article for details: support.solarwinds.com/.../Supported-algorithms-and-cipher-for-NPM-and-NCM

sja

Try to run other crypto

ip ssh ver 2 crypto key generate rsa modulus 2048

maciej.sandecki

That's the trick here, only ssh-ed25519 and ecdsa-sha2-nistp256 are supported by this switch.

stuartd

[quote userid="2230" url="~/products/network-configuration-manager-ncm/f/forum/100928/ncm-not-able-to-backup-cisco-9000-series-switches-anymore/316568"]But who has the "blame" here? [/quote]

Neither I'd say... just SolarWinds are slow (or slower at least) in playing catch-up with the ever evolving world of security improvements/fixes.

magarcias00

Currently I'm having the same issue updated to 17.12 from 17.09, 17.09 had no problems with NCM(backing up configs), now with 17.12 im having issues related to connection refused. Anyone got a sense of direction ? before submitting a ticket with SolarWinds.

stuartd

Based on your post [thwack.solarwinds.com/.../326264] in another thread it sounds like you need to update your version of Solarwinds.

magarcias00

We are in the process of updating SolarWinds as well. Thank you for the assistance !