Intermittent config download problems

We are backing up 50 or so Cisco routers and about 20 Dell switches using Cirrus. We're using ssh2 for the Cisco stuff and telnet for the Dell's. We have cirrus scheduled to check the running configs on all devices every hour. Almost every single time it runs we are seeing at least one device failing to have its config downloaded. Which device it is seems to be random, and normally the next time it runs, the one that previously failed works, and a different one fails. Occasionally we get a clean check where nothing fails. The error we see is this:

ERROR: Cannot download Running config : Possible connectivity issues are stopping Cirrus from receiving a properly formatted device configuration file

Does anyone have any ideas? I've tried adjusting maximum number of threads to transfer configs, but it doesn't seem to matter. I currently have it set for 5.

Find more posts tagged with

asa_5510_5500_commands_ncm_cirrus_support_slow

asa

asa_8.2(2)

cisco

cirrus_configuration

the_credentials_do_not_have_right_access_to_the_device

Accepted answers

colin.mcewen1

I had the same error message

"ERROR: Cannot download Running config : Possible connectivity issues are stopping Cirrus from receiving a properly formatted device configuration file"

when downloading configs from a Cisco ASA with IOS 8.0.2.

First of all I confirmed we could communicate using secure shell directly from the server command line using putty as the SSH client to the offending Cisco ASA. This was successful and I could also login to enable mode so there were no issues with SSH. I confirmed this for SSHv1 and SSHv2 using putty.

We found the cause to be with the Cirrus object properties for our ASA. I opened the properties of the offending object. There is a section in the object properties called 'Login Information'. In here our settings were as follows:

User Name: <username>

password: <password>

Enable Level: enable15

Enable password: <password>

I changed the enable level from 'Enable15' to 'enable' using the drop down list. This resolved the issue for the ASA and the scheduled job runs consistently overnight now.

For further info the 'Communication' section in the object properties for the ASA are set as follows.

Execute Scripts Using: SSH2

REquest Configs Using SSH2

Transfer Configs Using SSH2

All comments

mark_wiggans

is it the SSH that is failing or Telnet?

FormerMember

It seems to only be the SSH devices.

Haley

I recommend opening a case with support at https://forms.netsuite.com/app/site/crm/externalcasepage.nl?compid=638609&formid=12&h=3d0552f20b2e9bd6580b. Support can work with you to ensure we have the appropriate files and information to troubleshoot your issue.

tgoyette

I am seeing the same issue but with telnet. I have opened a case with support but have not heard back from them. Did you ever get an answer from support?

Haley

I was unable to locate your open ticket. Can you please provide your open ticket number related to telnet issues? This will help us to identify the issue you are seeing.

colin.mcewen1

I had the same error message

"ERROR: Cannot download Running config : Possible connectivity issues are stopping Cirrus from receiving a properly formatted device configuration file"

when downloading configs from a Cisco ASA with IOS 8.0.2.

User Name: <username>

password: <password>

Enable Level: enable15

Enable password: <password>

I changed the enable level from 'Enable15' to 'enable' using the drop down list. This resolved the issue for the ASA and the scheduled job runs consistently overnight now.

For further info the 'Communication' section in the object properties for the ASA are set as follows.

Execute Scripts Using: SSH2

REquest Configs Using SSH2

Transfer Configs Using SSH2

StealthNet

Colin, thanks for the answer. I had the same problem wherein the firewall would give an "Internal Error 000".

I set NCM to "enable" rather than "enable 15", and chose SSH2 only for all methods, and boom it worked.

Thanks guys

DuaneMNDPS

Thanks Colin. Changing the Enable Level to 'enable' from enable15 worked for my problem also. Couldn't connect to ASA running 8.0.5. Putty ssh client from server worked but NCM failed to login at enable prompt.

NetEng33

BAM!!! You are the man, I am running 8.2(2) and same issue. As soon as I changed all methods to SSH2 and the "enable" instead of "enable 15" it worked right away. Thanks for the contribution....this is what makes this forum so valuable.

Peace