Cisco 3850 Config backup issues

We've just added a few 3850's into our network and noticed that Solarwinds can't seem to SSH to these boxes to grab the backup. Despite being allowed to and not being blocked by our ACL. Has anyone else run into this issue?

debug ip ssh client:

Dec 14 14:45:51.695: SSH3: protocol version id is - SSH-2.0-WeOnlyDo 3.0.0.184

Dec 14 14:45:51.697: SSH2 3: Using kex_algo = diffie-hellman-group14-sha1

Dec 14 14:45:51.980: SSH3: Session disconnected - error 0x00

Find more posts tagged with

3850

cisco 3850

Accepted answers

All comments

david.botfield

Seem to remember having a similar issue but it wasn't just Solarwinds that could not access. I believe that we resolved by stopping and restarting the ssh service. enabling telnet temporarily would allow this to be done remotely. Worth checking that the crypto key generation has been done and checking that the routing is available via VRF as the management interface uses a VRF to separate the traffic.

enderaz

I've regen'd the crypto key. What's odd is that I can SSH to it from windows, linux and MAC. Just not from Solarwinds. Even stranger is that if I use the ssh function in the device summary I can SSH to it from there as well. It seems that whatever function its using to SSH for NCM just isn't working.

superfly

How is your connection profile configured? So when you press the Test button, I'm assuming it's failing for you. Once it fails, click on Show credential login details. It will show you what it was trying to do.

It sounds like you just need to tweak the connection profile.

david.botfield

It might be the type of ssh being used. I've found some times you need to set to use ssh V1 or SSH V2 only in order to get the desired effect. Auto will try both but I'm not sure of the order so I'd try V2 only first.

enderaz

Device Template: Cisco IOS-1.3.6.1.4.1.9

Also tried SSH Auto, SSH v1, SSHv2. Same results. Test Failed. Connection Refused. Though non 3850 switches down stream of this device on the same management subnet work just fine. So far I have this issue with all three locations that I have a 3850 acting as a building router.

Jan 4 14:34:10.577: SSH3: starting SSH control process

Jan 4 14:34:10.577: SSH3: sent protocol version id SSH-2.0-Cisco-1.25

Jan 4 14:34:10.578: SSH3: protocol version id is - SSH-2.0-WeOnlyDo 3.0.0.184

Jan 4 14:34:10.579: SSH2 3: kexinit sent: kex algo = diffie-hellman-group14-sha1

Jan 4 14:34:10.579: SSH2 3: Server certificate trustpoint not found. Skipping hostkey algo = x509v3-ssh-rsa

Jan 4 14:34:10.579: SSH2 3: kexinit sent: hostkey algo = ssh-rsa

Jan 4 14:34:10.579: SSH2 3: kexinit sent: encryption algo = aes128-ctr,aes192-ctr,aes256-ctr

Jan 4 14:34:10.579: SSH2 3: kexinit sent: mac algo = hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96

Jan 4 14:34:10.579: SSH2 3: SSH2_MSG_KEXINIT sent

Jan 4 14:34:10.581: SSH2 3: SSH2_MSG_KEXINIT received

Jan 4 14:34:10.581: SSH2 3: kex: client->server enc:aes128-ctr mac:hmac-sha2-256

Jan 4 14:34:10.581: SSH2 3: kex: server->client enc:aes128-ctr mac:hmac-sha2-256

Jan 4 14:34:10.581: SSH2 3: Using hostkey algo = ssh-rsa

Jan 4 14:34:10.582: SSH2 3: Using kex_algo = diffie-hellman-group14-sha1

Jan 4 14:34:10.647: SSH2 3: expecting SSH2_MSG_KEXDH_INIT

Jan 4 14:34:10.647: SSH2 3: SSH2_MSG_KEXDH_INIT received

Jan 4 14:34:10.739: SSH2: kex_derive_keys complete

Jan 4 14:34:10.739: SSH2 3: SSH2_MSG_NEWKEYS sent

Jan 4 14:34:10.739: SSH2 3: waiting for SSH2_MSG_NEWKEYS

Jan 4 14:34:10.749: SSH2 3: SSH2_MSG_NEWKEYS received

Jan 4 14:34:10.750: SSH2 3: Authentications that can continue = publickey,keyboard-interactive,password

Jan 4 14:34:10.751: SSH2 3: Using method = none

Jan 4 14:34:10.751: SSH2 3: Authentications that can continue = publickey,keyboard-interactive,password

Jan 4 14:34:10.753: SSH2 3: Using method = password

Jan 4 14:34:10.855: SSH3: Session disconnected - error 0x00

saby1975

Hi,

I'm also facing same issues in connecting to Nexus 3850 to take NCM backup. Request your help to resolve this problem.

Regards

Sebastian

enderaz

Sorry for not posting a fix action for this when I originally found one. The issue turned out to be a Cisco issue and not a Solarwinds issue. Cisco has a bug on 3850's where passwords over 15 characters fail. The bug only identifies local passwords, but we've found that it also affects remote. The fix action was to make a separate TACACS account just for logging into 3850's with a lower character password.

saby1975

Thank you for the info.This really helps.

One question. Is there any restriction on using special characters in password? I'm using a password with 8 characters but with a spacial charater in it.

Regards

Saby

enderaz

I don't think so. Have you tried logging into it directly with the same credentials. Also try using the SSH window for the device in solarwinds and hit it from their too with the same credentials. I believe this is the bug I was running into Cisco Bug: CSCvh55744 - SSH password length restricted to 25 for avoiding one of the low impact vulnerability.

saby1975

Thank you for quick reply.

I'm able to login to device directly. But from Solarwinds console (node properties) SSH option, it throws 'version mismatch' error while trying to login after entering user name and password. But I'm able to login to other switches from SSH (node properties).

Regards

Sebastian

marnell

I have more than 50 3850 being backed up through SW with ssh setup as auto. When you do a test with the creds do they pass? If yes then you should have no problems.