topic Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read in DevNet Sandbox

ncclient.transport.errors.SSHError: Negotiation failed: Error reading

yinglu69 — Wed, 08 Dec 2021 07:44:05 GMT

Hi,

I took the Programming fundamentals (Module 2 of Learn network programmability basics)--Python Part 3. Tried to run the example provided by the course. api_ncclient_examply.py. It always gave me the below error:

(py3-venv) [devnet@localhost python_part_3]$ python api_ncclient_example.py
Exception: Error reading SSH protocol banner[Errno 104] Connection reset by peer
Traceback (most recent call last):
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2211, in _check_banner
buf = self.packetizer.readline(timeout)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/packet.py", line 380, in readline
buf += self._read_timeout(timeout)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/packet.py", line 607, in _read_timeout
x = self.__socket.recv(128)
ConnectionResetError: [Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2039, in run
self._check_banner()
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2216, in _check_banner
"Error reading SSH protocol banner" + str(e)
paramiko.ssh_exception.SSHException: Error reading SSH protocol banner[Errno 104] Connection reset by peer

Traceback (most recent call last):
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2211, in _check_banner
buf = self.packetizer.readline(timeout)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/packet.py", line 380, in readline
buf += self._read_timeout(timeout)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/packet.py", line 607, in _read_timeout
x = self.__socket.recv(128)
ConnectionResetError: [Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/devnet/py3-venv/lib/python3.6/site-packages/ncclient/transport/ssh.py", line 328, in connect
self._transport.start_client()
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 660, in start_client
raise e
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2039, in run
self._check_banner()
File "/home/devnet/py3-venv/lib/python3.6/site-packages/paramiko/transport.py", line 2216, in _check_banner
"Error reading SSH protocol banner" + str(e)
paramiko.ssh_exception.SSHException: Error reading SSH protocol banner[Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "api_ncclient_example.py", line 38, in <module>
hostkey_verify=False)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/ncclient/manager.py", line 176, in connect
return connect_ssh(*args, **kwds)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/ncclient/manager.py", line 143, in connect_ssh
session.connect(*args, **kwds)
File "/home/devnet/py3-venv/lib/python3.6/site-packages/ncclient/transport/ssh.py", line 330, in connect
raise SSHError('Negotiation failed: %s' % e)
ncclient.transport.errors.SSHError: Negotiation failed: Error reading SSH protocol banner[Errno 104] Connection reset by peer

As the READ.md suggested, I used the sandbox as the below:

CSR1000V Host: sandbox-iosxe-recomm-1.cisco.com
SSH Port: 22
NETCONF Port: 830
RESTCONF Ports: 443 (HTTPS)
Username: developer
Password: C1sco12345

Regards

Ying

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

bigevilbeard — Wed, 08 Dec 2021 09:53:31 GMT

@yinglu69 the ENG team are looking into an issue with both XE sandbox - as you can see there is an issue with the connection. Please standby whilst the team fixes this. Hope this helps

(venv) $ ssh developer@sandbox-iosxe-recomm-1.cisco.com
kex_exchange_identification: read: Connection reset by peer
(venv) $ ssh developer@sandbox-iosxe-latest-1.cisco.com
kex_exchange_identification: read: Connection reset by peer

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

yinglu69 — Wed, 08 Dec 2021 13:54:28 GMT

@bigevilbeardThanks for the quick response. BTW, I had seen the issue for a couple of weeks...

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

bigevilbeard — Wed, 08 Dec 2021 14:15:59 GMT

@yinglu69 one of the always-on XE sandboxes has a known issue (related to the code train) and give a funky reply to netconf/restconf. When both are back online test the code against both devices and check your results. I can't recall if the issue is the latest or recommend code train.

However, this said, the XE always-on device get a lot of abuse and it could just random bad luck when you ran your code.

Hope this helps.

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

foa771 — Sat, 09 Apr 2022 19:44:48 GMT

@yinglu69 were you able to resolve the issue? I am having he same problem.

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

yinglu69 — Mon, 11 Apr 2022 01:36:06 GMT

I had never been able to resolve the issue and gave up. Suspected that there is something related to China Internet if the US can access it fine.

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

foa771 — Tue, 12 Apr 2022 03:43:52 GMT

I'm in the US and I'm having issues accessing it. Not sure what's wrong. Anyway, thanks for your response!

Re: ncclient.transport.errors.SSHError: Negotiation failed: Error read

davehouser1 — Thu, 15 Jun 2023 22:04:06 GMT

I ran into this same issue. The problem was I was trying to connect to the Cisco IOSXR repeatedly, too quickly. I think the Cisco IOSXR has rate limiting built into it to stop someone connecting so fast.

I would have to see your code, but you maybe running into the same issue I was. The problem was I would do a get_config on the Cisco IOSXR with ncclient, and use the payload I got back to make decisions to craft my payload (example checking which ace's are in an acl, and building my payload to find an available ace number to send back in). Well, right after my get_config was run, my code would turn around and send to manager.connect with ncclient again. Even though I was properly closing the the first connection, the router slapped my wrist. The rrror you see is basically saying "You cant connect because the router is not letting you".

Workaround: I put at time.sleep(.5) in my code right before ncclient manager.connect ran. This way I rate limited my code. It sucks because its slower but its the only solution I found.