topic Re: I'm not seeing backpointers to my service in NSO Developer Hub Discussions

I'm not seeing backpointers to my service

samuel.coome@secunetics.com — Mon, 04 Feb 2019 17:17:19 GMT

After applying my service (shown below), I only get a backpointer to the service for one of the several lines of configuration NSO pushed to the device. I thought each line should have a backpointer to the service that configured it.

admin@Mothership-6(config)# services ssh test-ssh device-name csr

admin@Mothership-6(config)# commit dry-run outformat native
native {
device {
name csr
data ip ssh time-out 60
ip ssh authentication-retries 3
ip ssh rsa keypair-name SSH
ip scp server enable
}
}

admin@Mothership-6(config)# commit

Commit complete.

admin@Mothership-6(config)# show full-configuration devices device csr | display xml | include test-ssh
<enable refcounter="1" backpointer="[ /ncs:services/ssh:ssh[ssh:name='test-ssh'] ]" />

admin@Mothership-6(config)# show full-configuration devices device csr | display xml

...

...

In the above, every line with a refcounter should have a backpointer from my understanding, however only the scp server enable does. Is there a reason that time-out, authentication-retries, and rsa keypair-name do not have backpointers to the service that put that configuration there?

Re: I'm not seeing backpointers to my service

joepak — Mon, 04 Feb 2019 22:32:23 GMT

Have you tried using different values to see if the behavior is consistent?

Re: I'm not seeing backpointers to my service

samuel.coome@secunetics.com — Tue, 05 Feb 2019 14:25:28 GMT

I have tried different values for those above which do not have backpointers, I got the same thing, where there was a refcount, but no backpointer.

Re: I'm not seeing backpointers to my service

joepak — Tue, 05 Feb 2019 21:08:53 GMT

What happens when you try to remove the service?
It could because the device owned the configuration prior to the service which results in no backpointer. What the scp enable something that previously existed on the device? Could you test by configuring a feature that isn't already on the device through the service vs a feature that is already preeexisting?

My assumption is that the scp enable is owned by the service config and not the device config, which leads to the backpointer. While the other two configurations are already owned by the device, hence no backpointer.

Re: I'm not seeing backpointers to my service

Dan.Sullivan — Wed, 06 Feb 2019 00:56:38 GMT

Can you post your service template?

-Dan

Re: I'm not seeing backpointers to my service

samuel.coome@secunetics.com — Wed, 06 Feb 2019 13:00:44 GMT

You can see that the below config was not previous on the device prior, and the backpointer does not show up after the configuration is applied to the device.

admin@ncs(config)# show full-configuration devices device v-csr0 config ios:ip ssh | display xml
...
<ssh>
<pubkey-chain>
  <username>
   <name>vagrant</name>
   <key-hash>
   <key-type>ssh-rsa</key-type>
   <key-name>DD3BB82E850406E9ABFFA80AC0046ED6</key-name>
   </key-hash>
  </username>
</pubkey-chain>
</ssh>
...

admin@ncs(config)# services ssh test device-name v-csr0
admin@ncs(config-ssh-test)# commit dry-run
cli {
local-node {
data devices {
device v-csr0 {
   config {
   ios:ip {
   ssh {
   + time-out 120;
        + authentication-retries 3;
      rsa {
        + keypair-name SSH;
      }
      }
      scp {
      server {
        + enable;
      }
      }
   }
}
}
}
services {
ssh test {
+ device-name [ v-csr0 ];
}
}
}
}

admin@ncs(config)# show full-configuration devices device v-csr0 config ios:ip ssh | display xml
...
<ssh>
<time-out refcounter="1" >120</time-out>
  <authentication-retries refcounter="1" >3</authentication-retries>
  <rsa>
    <keypair-name refcounter="1" >SSH</keypair-name>
  </rsa>
  <pubkey-chain>
   <username>
   <name>vagrant</name>
   <key-hash>
      <key-type>ssh-rsa</key-type>
      <key-name>DD3BB82E850406E9ABFFA80AC0046ED6</key-name>
   </key-hash>
  </username>
  </pubkey-chain>
</ssh>
...

Re: I'm not seeing backpointers to my service

samuel.coome@secunetics.com — Wed, 06 Feb 2019 13:04:50 GMT

<config-template xmlns="http://tail-f.com/ns/config/1.0">
<devices xmlns="http://tail-f.com/ns/ncs">
<?foreach {/device-name}?>
<device>
<name>{.}</name>
   <config>
      <ip xmlns="urn:ios">
       <ssh>
          <time-out>120</time-out>
          <authentication-retries>3</authentication-retries>
          <rsa>
           <keypair-name>SSH</keypair-name>
          </rsa>
       </ssh>
          <scp>
          <server>
           <enable/>
          </server>
        </scp>
      </ip>
    </config>
</device>
<?end?>
</devices>
</config-template>

Re: I'm not seeing backpointers to my service

AlaeddineJebnoun90723 — Wed, 20 Oct 2021 19:06:36 GMT

Hello,

Did you find the reason of such behaviour ? I am facing the exact same issue.

Thank you in adavance.

Re: I'm not seeing backpointers to my service

rogaglia — Wed, 10 Nov 2021 19:11:15 GMT

It is not correct to expect a backpointer for every leaf with a refcount. NSO does not add a backpointer on leafs and leaflists but only on lists and containers. The "enable" node was probably a container with presence.