Ciscoworks Netconfig/Netshow Response

[jwright]

Is there a way to run commands form a netshow or netconfig job and have the entire session response captured?  For example, I would like to know that all of the telnet and enable passwords for a group of devices are correct.  Can I create a job that will simply login to a device and I can see the output of those commands as if I were at the console... not just told that a job is successful or failed?  There are other instances where I can think this would be helpful but I haven't figured out how to do it yet.

[Joe Clarke]

The actual login process is not captured.  So seeing RME login to a device is not possible.  However, for RME to run a Netshow job successfully, the login and enable credentials must be correct in DCR.  As for viewing show command output, that is certainly possible in Netshow.  After the job completes, you can view the per-device details to see the full output of the commands executed.

But if you just want to validate the login and enable credentials, run a Device Credential Verification job under RME > Devices > Device Management > Device Credential Verification Jobs.  You won't see actual login output, but you will be able to positively determine if the DCR credentials are correct.

[jwright]

Thanks Joe.  If I run a Device Credential Verification and select "Telnet Enable Mode User Name and Password" will it check the fallback telnet and enable passwords I have configured or does it use Tacacs credentials to enter telnet and enable mode?  That's why I'd like to see the output just to be sure of the credentials being used.  We rarely use these fallback credentials so I want to be sure the changes are made correctly.  I just want some sort of feedback after an enable password change that it was completed correctly.

If I run a test with access to tacacs enabled it reports "Successful" and "Ok(Primary Successful)" under "Enable by Telnet".  However, if I disable tacacs server access (by temporarily shutting the port) it reports "Successful" but "Did Not Try" under "Enable by Telnet".  I'm confused by these messages.

[Joe Clarke · Accepted solution]

In order for RME to use secondary credentials, make sure you have the "Fallback to Secondary Credentials" checked under RME > Admin > System Preferences > RME Secondary Credentials.

[jwright]

You have me on the right track now.  I've enabled fallback to secondary credentials within RME and configured the secondary credentials in Common Services.  Now I get "Enable username credential missing" when there is no fallback "username" to configure.  Ideas?  Also, why would it tell me the job is successful prior to me telling Ciscoworks to use secondary credentials when ACS was disabled.  That is bothering me.  I would expect a failure.

[jwright]

This is a CATOS device.

[Joe Clarke]

What do you mean there is no "username?"  There is a Username field available when configuring secondary credentials in DCR.  If you get a Username: prompt when connect to the device when the AAA server is disabled, then you need to fill in that credential in DCR.  If any of the tested credentials fail, the job itself will fail.  I've confirmed that is working properly in RME 4.3.1.

[jwright]

This is a CATOS device that when tacacs is unavailable it immediately prompts for the telnet password without asking for a username.

[jwright]

Nevermind Joe.  I can just configure a local username on all of the CATOS devices.  Thanks again for the help!