Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Intermediary device support

How does this functionality work?

Product details say that Intermediary device support will allow me to use a terminal server to access devices.

The only configuration option I can see that is related to this in V4 is "Intermediary device support, Allow {yes|no}"

Is it also possible to point to a defined telnet port for a specific node?

Thanks!

-JP

Find more posts tagged with

Accepted answers

All comments

I really hate to bump a topic, but I'm wondering if anyone is able to share experience with this feature. I was looking forward to using it to support configuration archives of devices like catalsyt 1900s with enterprise images.

kbenton

Can someone comment on how this works?

The only reference I can find is enabling/disabling it, but no pointers on how to actually configure it to work. I went through the admin guide and I don't see any documentation beyond enabling it. I would assume that you would need to know the ip of the intermediary device, login creds for the intermediary device, command used to connect to the end device, etc. Would that be done in a device template? If so, what would it look like - how does Cirrus know not to telnet/ssh directly to the end device, but instead to telnet/ssh to the intermediary?

Thanks!

kbenton

Sorry to keep bumping this topic, but can someone from Solarwinds respond? I submitted a support case with the above information and got back a quote from the admin guide (one line verbage on allow/disallow which I had already noted), they said that was the only information they had, and the case was closed. In order for this to actually work:

Cirrus -> device A (intermediary) -> device B (target)

there would have to be a place to specify the IP of device A, login creds of device A, and the command to connect from device A to device B. Where is that? If this isn't completely baked, I just want to know so we aren't going around in circles. Or is that not what this feature what intended to do? (It sounds like it is from the description in the release notes.)

Thanks

chris.lapoint

You're right, the documentation is a bit misleading and we're going to clear this up in doc for the next version (for internal folks this is #237).

An intermediary device is a terminal server. As you know, some configurations require a user to login to a terminal server to connect to a device. This feature will work for configurations where a user enters a username and password into the terminal server, hits enter, and then is connected to the network device where they enter the enable password commands.

To confingure terminal server (intermediary) download support you'll need to take the following steps:

Add new node and set the IP address to the serial line IP address of the terminal server. You can leave the SNMP community string blank since it won't work anyway. You might change the Node Name to something indicating it is via a TS connection (like NY-LAB-2503 via Terminal Server).
Set the Device Template to the Target Device Type (not the Terminal Server type).
Set the Username and Password to the Terminal Server's credentials.
Set the enable level and enable password needed for the Target Device. Once we have access to the Console, we will still need to be in privileged mode to do anything.

NOTE: Nothing special is necessary for Command Scripts, Direct Transfers, or Indirect Transfers

Let me know if this clears up the intended use-case for this feature.

ceclark

Thanks for clearing this up, but I do have one question. I understand that we enter the credentials for the terminal server (that works correctly, I can connect) but what about the second set of crendetials, the login to the console of the router? We require authentication to login to the device via the console port, just like a VTY line. It looks like this feature is setup with authentication only to the terminal server and once that is passed, you are expecting to be connected to the console of the device, already logged in at user exec mode ( > prompt ).

kbenton

Chris - Thank you SO MUCH for the response! This absolutely clears up what this feature is and how to use it. It doesn't work for our use case, but for now we will just manually collect configs for those devices and add the files on to the devices in Cirrus.

In case there are plans to expand this feature in the future (or if we can ask for that) - here's what we would like to be able to do:

Cirrus -> device A -> device B

telnet deviceA IP; login to device A; issue a configurable command to connect to device B, such as telnet ${IP of device B} or possibly connect ${field with async port number defined}; login to device B

Sounds like there are others wanting to do this: telnet ${terminal server IP} ${async port unique to device B mapped to a tcp port on the TS}

With or without a login prompt from the TS in addition to a possible login prompt from the target device.

In this case, the terminal server IP would not be unique (multiple devices using that terminal server), although device B would have a unique IP configured (just not used for connection from Cirrus.)

Understood that snmp will not work to the target device without a direct connection to its IP.

The plan is for more secure portions of the network to only be accessible through something serving as a telnet or ssh proxy/"jumphost", so this is going to become a bigger issue down the road.

Thank you!

chris.lapoint

From 5.5.1 Admin Guide:

Adding Nodes Connected through a Serial Terminal Server

When adding devices connected through a serial terminal server, you need to specify certain information that is specific to the terminal server device and other information that is specific to the device attached to the terminal server to which you want to connect. Complete the following procedure, paying close attention to the credential sections

To add a device connected through a serial terminal server:
1. Click Nodes > Add New Node.
2. Type the IP address of the node assigned through the terminal server. For example, the Cisco terminal server device used in the SolarWinds lab, a Cisco 2500 Access Server, uses ports appended to the end of the loopback IP address to specify different devices. In this case, type 10.10.29.1 2001. Some devices allow you to specify unique IP addresses, in which case, specify the assigned IP address in this field.
3. Ignore the community string information, as it does not apply when connecting through a terminal server device.
4. Select the device template for the connected device, not for the terminal server device.
5. If you want to add the node to a group, type or select a node group from the list. If you do not select a group, your new node is grouped in the Unknown group.
6. Specify the login credentials, enable level, and enable password for the target device. Again, do not specify the password for the terminal server device.
7. Select Yes in the Terminal Server Support field.
8. Click OK. When the Add Device dialog states that the IP address does not respond to SNMP queries, click Yes.