script to add username password to all Cisco devices

amallia

Hi, 

Please does anyone know if there is a script for the Orion NCM, or any other way it would be possible to configure (on multiple devices within the network) the username password commands used to create your database for local authentication when accessing a device on your network.

ex. "username admin privilege 15 password cisco"

Thank you.

rschroeder

You can use NCM to make bulk password changes to any network device that will accept a change via CLI--it's easy & simple.

First remember that you'll need a different script for any devices that need a different format.  If you're running a lot of different kinds of gear, you'll need to build the right script for each one, and apply it separately.  The nice thing is that you can save each script separately, and you can even run them via the Schedule option so you don't have to be into work. 

It can run your scripts in the middle of the night, or on a weekend--anytime.  And you can come in the next day and see your changes were made without you losing sleep.  As long as your scripted changes are correct.  If they're not, you'll get called in the middle of the night with problems, or you won't like what's waiting for you Monday morning.

After you determine the commands you want to apply, I'd suggest you key it into a text editor like NotePad or WordPad, just so you've got something to look at and review before actually applying it.  I paste the commands into an e-mail and ask my Network Analyst Co-Workers to review and approve them before I apply the changes.

The trick is to include everything in the CLI that you'd enter during the process of modifying the configuration after you connect to the switch or router.  For example, you'll need to include all of this:

write mem (I include this in case the configuration was changed previously, but is a good working config.  If the following commands you build/add via NCM cause a problem, rebooting a Cisco switch or router will load the good "original" saved config and restore your ability to manage the device).

config t

username admin priv 15 password cisco

end

write mem

(The write mem can be optional, in case you've made a mistake and lose the ability to administer the device--a reboot will restore the original configuration)

Once you've completed creating scripted the instructions for the switch or router, connect to the NCM admin console on the NCM server (or you can do this via the NCM Web Console), open up the Node List on the left and select the nodes to which you want to apply the scripted commands.  Hold the Ctrl key down to select multiple Nodes, or use the Shift key and select a group of adjacent devices in the Node List.

Right click on one of them and choose Execute Command Script.  You'll see all your selected nodes in the top window, and you can add or remove devices here also.

In the bottom window, paste in your commands.  Don't forget to put a carriage return after the last command to make it apply to the script.

Review it one last time to make sure it's right, and that you didn't miss something when you copied & pasted it in.

Finally, click on the Execute Command Script button on the lower left side of the bottom window. 

NCM will connect to each device in order, run the script you've built, and then connect to the next device.  If there are problems, it will show the output response or errors.  When it's done, it will show the history of the commands and the response from the devices.  You can scroll through the list and make sure the responses are all as you expect.

If you think your successful script is useful and might be nice to have again without having to completely rebuild it, there's a Save Script button on the bottom right.  Give it an intuitive name so you have it handy the next time you need it.  You can load pre-built scripts using the Load Script button.

I use this process anytime we have an employee change, and need to update passwords, user names, community strings, etc.  It's slick!

I strongly suggest testing first on a non-production box, just to ensure you understand how it works, and to know that your scripted commands aren't going to cause problems.

If you have to test on production equipment, it might not be a bad idea to do something simple first--something that can't hurt--like a "show clock" command, as your first scripted bulk config change test.

Good luck!