Python script - ssh to ISE / run 'application configure ise' /

[PatrickWelby0086]

Where can I find more information about scripting the following:

1. SSH to ISE 

2. run 'application configure ise'

3. Select <16>

4. Select <0>

Thanks,

John

[bigevilbeard]

What are you trying to achieve here, if i understand the actions of this 16 followed by 0 in the Cisco ISE CLI performs an irreversible factory reset, which is a highly destructive action and thus automating this command is extremely risky and can lead to complete data loss in a production environment.

Is that what you are looking for?

[Stefan Mihajlov]

@PatrickWelby0086 
I ran it through Claudie to use Cisco source and got this:

#!/bin/bash

# ISE SSH Automation Script
# Connects to ISE and executes application configure commands

# Configuration variables
ISE_HOST="your-ise-server.domain.com"
USERNAME="admin"
PASSWORD="your_password"  # Better to use SSH keys instead
LOG_FILE="/tmp/ise_config_$(date +%Y%m%d_%H%M%S).log"

# Function to log messages
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Function to execute ISE commands via SSH
execute_ise_commands() {
    log_message "Starting ISE configuration..."
    
    # Using expect for interactive SSH session
    expect << EOF
set timeout 30
spawn ssh -o StrictHostKeyChecking=no ${USERNAME}@${ISE_HOST}

expect {
    "Password:" {
        send "${PASSWORD}\r"
        exp_continue
    }
    "ise-server/admin#" {
        # We're logged in, proceed with commands
    }
    timeout {
        puts "Connection timeout"
        exit 1
    }
}

# Execute application configure ise
send "application configure ise\r"
expect "Enter your choice:"

# Select option 16
send "16\r"
expect "Enter your choice:"

# Select option 0 (assuming this returns to previous menu or exits)
send "0\r"
expect "ise-server/admin#"

# Exit the session
send "exit\r"
expect eof
EOF

    if [ $? -eq 0 ]; then
        log_message "ISE configuration completed successfully"
    else
        log_message "ERROR: ISE configuration failed"
        return 1
    fi
}

# Alternative function using sshpass (if available)
execute_with_sshpass() {
    log_message "Using sshpass method..."
    
    {
        echo "application configure ise"
        sleep 2
        echo "16"
        sleep 2
        echo "0"
        sleep 2
        echo "exit"
    } | sshpass -p "${PASSWORD}" ssh -o StrictHostKeyChecking=no "${USERNAME}@${ISE_HOST}"
}

# Python alternative for more control
create_python_script() {
    cat > /tmp/ise_automation.py << 'PYTHON_EOF'
#!/usr/bin/env python3
import paramiko
import time
import sys

def connect_and_configure(hostname, username, password):
    try:
        # Create SSH client
        ssh = paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        
        # Connect to ISE
        print(f"Connecting to {hostname}...")
        ssh.connect(hostname, username=username, password=password, timeout=30)
        
        # Create interactive shell
        shell = ssh.invoke_shell()
        time.sleep(2)
        
        # Send commands
        commands = [
            "application configure ise",
            "16",
            "0",
            "exit"
        ]
        
        for cmd in commands:
            print(f"Sending command: {cmd}")
            shell.send(cmd + '\n')
            time.sleep(3)  # Wait for command to process
            
            # Read output
            if shell.recv_ready():
                output = shell.recv(4096).decode('utf-8')
                print(f"Output: {output}")
        
        # Close connection
        ssh.close()
        print("Configuration completed successfully")
        
    except Exception as e:
        print(f"Error: {e}")
        return False
    
    return True

if __name__ == "__main__":
    hostname = "your-ise-server.domain.com"
    username = "admin"
    password = "your_password"
    
    connect_and_configure(hostname, username, password)
PYTHON_EOF

    chmod +x /tmp/ise_automation.py
    log_message "Python script created at /tmp/ise_automation.py"
}

# Main execution
main() {
    log_message "ISE SSH Automation Script Started"
    
    # Check if expect is installed
    if command -v expect >/dev/null 2>&1; then
        log_message "Using expect for automation"
        execute_ise_commands
    elif command -v sshpass >/dev/null 2>&1; then
        log_message "Using sshpass for automation"
        execute_with_sshpass
    else
        log_message "Neither expect nor sshpass found. Creating Python alternative..."
        create_python_script
        echo "Please install paramiko: pip3 install paramiko"
        echo "Then run: python3 /tmp/ise_automation.py"
    fi
}

# Usage information
usage() {
    echo "Usage: $0"
    echo "Make sure to configure ISE_HOST, USERNAME, and PASSWORD variables"
    echo "Required tools: expect or sshpass or python3 with paramiko"
}

# Check if help requested
if [[ "$1" == "-h" || "$1" == "--help" ]]; then
    usage
    exit 0
fi

# Run main function
main

[Torbjørn]

I would probably solve this using paramiko as @Stefan Mihajlovs reply includes. I would however also urge you to proceed with great caution. If you are to implement this you should write all logic yourself(don't rely on LLM code) and make sure you have some failsafes in place - ideally including manual approval by an authorised human. As @bigevilbeard said, automating this is extremely risky.