cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3823
Views
0
Helpful
10
Replies

Cisco Prime 3.2 credential issue - SSH

Tinei
Level 1
Level 1

Error: Could not connect to device via CLI (SSH/telnet). Check device credentials and SSH/telnet reach-ability.

Getting error when trying to connect or add devices to Cisco Prime. We have created new credentials profile but prime fails to connect to device. The same credential work when you SSH to the device, can see SNMP traffic, but Prime has error connecting to device. I have attached screenshot of the errors. 

1 Accepted Solution

Accepted Solutions

Tinei
Level 1
Level 1

So the issue was the ip tables on the Linux part it seems service had stopped impacting SSH. Restart of ip tables fixed everything 

View solution in original post

10 Replies 10

marce1000
VIP
VIP

 

-  Remove the particular device from Prime and re-add it again, but press Verify Credentials first before the final add, does that work ?

 M.



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

I have removed device and added it back but it fails to verify credentials so it remains unmanaged.

As shown below adding device fails on credential verification regardless if which connection profile I select. These credentials are the same that I use to SS direct to device. It fails for every device that I have in Prime, this makes believe that its not a credential issue. I have also attached a netflow capture that confirms that SSH on port 22 is communicating between Prime and device during the credential verification. 

I used a profile with incorrect SNMP credentials and you see that Prime complains about the credentials. This confirms that Prime is hitting device but authentication failing. 

 

 - Can you open a shell on Prime , and check if you can SSH from Prime manually and or are able to login to a switch if you ssh from Prime yourself . Same for an snmp-query, you could for instance from the same SHELL, try an snmp get command for a particular OID from a switch with the intended community and verify if that is possible (?)

 M.



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Will do that and advise

SSH is not working on Prime, can reach device on SSH. Connected on shell but cannot SSH to any network device, it times out. I tried Telnet but it times out. Ping confirms reach-ability and also of network switch shows attempt by prime to establish connection, but it still times out. Unfortunately, could not perform snmp-query from prime shell. ncd status shows all services running on prime, when I SSH prime from prime ssh works. I think something is wrong with prime planning to do a restart and see if that changes anything. 

 

V]#sh flow monitor XXXXX cache for table | i 10.X.X.3
Prime<10.X.X.3>  Network Switch<X.X.X.53> 45199 23 TeX/X/3 

 

                       >...Connected on shell but cannot SSH to any network device

 Then you also need to check, if any local-firewalling solutions are blocking sufficient access from Prime to  the switches (e.g.)

 M.

 



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Will check again there is no known internal firewall between Prime and network switch, when I verify credentials I can see the SSH traffic via netflow on destination device and source switch were prime is connected. There are other devices connected to the same VM host, same subnet that can SSH to the said switches. It is a strange that Prime can collect SNMP from the switch, but fail to Telnet/SSH to the same device. 

 

               >....It is a strange that Prime can collect SNMP from the switch, but fail to Telnet/SSH to the same device

  - You shouldn't look at it that way , meaning  if Prime would be deleted completely you would still observe  the same problem when trying to SSH from that host were Prime was running on (as you reported when trying from a SHELL) . Whatever the cause -> that must be resolved first.

 M.

.



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Tinei
Level 1
Level 1

So the issue was the ip tables on the Linux part it seems service had stopped impacting SSH. Restart of ip tables fixed everything 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: