Cisco Prime 3.2 credential issue - SSH

[Tinei]

Error: Could not connect to device via CLI (SSH/telnet). Check device credentials and SSH/telnet reach-ability.

Getting error when trying to connect or add devices to Cisco Prime. We have created new credentials profile but prime fails to connect to device. The same credential work when you SSH to the device, can see SNMP traffic, but Prime has error connecting to device. I have attached screenshot of the errors. 

[marce1000]

-  Remove the particular device from Prime and re-add it again, but press Verify Credentials first before the final add, does that work ?

 M.

[Tinei]

I have removed device and added it back but it fails to verify credentials so it remains unmanaged.

[Tinei]

As shown below adding device fails on credential verification regardless if which connection profile I select. These credentials are the same that I use to SS direct to device. It fails for every device that I have in Prime, this makes believe that its not a credential issue. I have also attached a netflow capture that confirms that SSH on port 22 is communicating between Prime and device during the credential verification. 

I used a profile with incorrect SNMP credentials and you see that Prime complains about the credentials. This confirms that Prime is hitting device but authentication failing. 

[marce1000]

 - Can you open a shell on Prime , and check if you can SSH from Prime manually and or are able to login to a switch if you ssh from Prime yourself . Same for an snmp-query, you could for instance from the same SHELL, try an snmp get command for a particular OID from a switch with the intended community and verify if that is possible (?)

 M.

[Tinei]

Will do that and advise

[Tinei]

SSH is not working on Prime, can reach device on SSH. Connected on shell but cannot SSH to any network device, it times out. I tried Telnet but it times out. Ping confirms reach-ability and also of network switch shows attempt by prime to establish connection, but it still times out. Unfortunately, could not perform snmp-query from prime shell. ncd status shows all services running on prime, when I SSH prime from prime ssh works. I think something is wrong with prime planning to do a restart and see if that changes anything. 

V]#sh flow monitor XXXXX cache for table | i 10.X.X.3
Prime<10.X.X.3>  Network Switch<X.X.X.53> 45199 23 TeX/X/3 

[marce1000]

                       >...Connected on shell but cannot SSH to any network device

 Then you also need to check, if any local-firewalling solutions are blocking sufficient access from Prime to  the switches (e.g.)

 M.

[Tinei]

Will check again there is no known internal firewall between Prime and network switch, when I verify credentials I can see the SSH traffic via netflow on destination device and source switch were prime is connected. There are other devices connected to the same VM host, same subnet that can SSH to the said switches. It is a strange that Prime can collect SNMP from the switch, but fail to Telnet/SSH to the same device. 

[marce1000]

               >....It is a strange that Prime can collect SNMP from the switch, but fail to Telnet/SSH to the same device

  - You shouldn't look at it that way , meaning  if Prime would be deleted completely you would still observe  the same problem when trying to SSH from that host were Prime was running on (as you reported when trying from a SHELL) . Whatever the cause -> that must be resolved first.

 M.

.

[Tinei · Accepted solution]

So the issue was the ip tables on the Linux part it seems service had stopped impacting SSH. Restart of ip tables fixed everything