LMS 3.2 and RME 4.3.1 telnet with tacacs+ fails

[tomeq82]

Hi everyone,

I'm having issue with credentials verification for telnet with TACACS+ enabled. Verification job fails with "Telnet: Incorrect" and an exception to daemons.log:

om.cisco.nm.lib.cmdsvc.CmdSvcException: com.cisco.nm.lib.cmdsvc.telnet.TelnetException: Unable to read from socket

        at com.cisco.nm.lib.cmdsvc.TelnetSession.connect(TelnetSession.java:89)

        at com.cisco.nm.lib.cmdsvc.Session.connect(Session.java:152)

        at com.cisco.nm.lib.cmdsvc.AuthHandler.connect(AuthHandler.java:254)

        at com.cisco.nm.lib.cmdsvc.OpConnect.invoke(OpConnect.java:56)

        at com.cisco.nm.lib.cmdsvc.SessionContext.invoke(SessionContext.java:299)

        at com.cisco.nm.lib.cmdsvc.Engine.process(Engine.java:57)

        at com.cisco.nm.lib.cmdsvc.LocalProxy.process(LocalProxy.java:22)

        at com.cisco.nm.lib.cmdsvc.CmdSvc.connect(CmdSvc.java:190)

        at com.cisco.nm.lib.cmdsvc.CmdSvc.connect(CmdSvc.java:166)

        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.CliOperator.<init>(CliOperator.java:214)

        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.IOSCliOperator.<init>(IOSCliOperator.java:116)

        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.CatIOSSwitchCliOperator.<init>(CatIOSSwitchCliOperator.java:56)

        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.Cat6kIOSCliOperator.<init>(Cat6kIOSCliOperator.java:32)

        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.Cat6kIOSConfigOperator.getOperator(Cat6kIOSConfigOperator.java:35)

        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.OperatorCacheManager.getOperatorForDevice(OperatorCacheManager.java:50)

        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.ConfigOperation.doConfigOperation(ConfigOperation.java:99)

        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.IOSConfigOperator.fetchConfig(IOSConfigOperator.java:73)

        at com.cisco.nm.rmeng.dcma.configmanager.ConfigManager.updateArchiveForDevice(ConfigManager.java:658)

        at com.cisco.nm.rmeng.dcma.configmanager.ConfigManager.performCollection(ConfigManager.java:1646)

        at com.cisco.nm.rmeng.dcma.configmanager.CfgUpdateThread.run(CfgUpdateThread.java:27)

I've tried to edit TacacsPrompts.ini also with suggestion to enter "," after last space character

I'm using only TACACS so all prompts are the same. I'm using MOTD also.

TACACS prompt looks like this example : "TEST username: ,TEST password: " so this looks obvious.

The issue started to appear after some patching done to RME and CiscoView, but I'm not sure that this is connected anyhow.

Thanks for all the help

[tomeq82]

Hi!

They gave me the solution like this:

line vty

timeout login response 90

Ofcourse it helped but this it still inproper behavior from LMS side. It sends the username char by char for more than a minute! Guess the scenario with thousands of devices.... It will take ages to telnet to them. And network performance has nothing to do with that - i'm running the LMS on a powerful Sun and the network is mostly gigabit connected.

Setting timeout login response is a workaround but does not fix the problem.

Still waiting fot some fix to LMS not for fairly acceptable workarounds.

This is NOT case with TACACS enabled on a router. The box responds within moment when telneted using commandline or other NMS software. This is a problem with LMS telnet login mechanism and prompt parsing (TacacsPrompts.ini doesn't seem to work at all, I could type there anything and it has no effect on the login proces).

Besides this SSH to the same box wit TACACS works flawlessly. But then it parses only password prompt not the username - this is sent by ssh.

[Rodrigo Gurriti]

I got the problem solved on my case... It was the TacacsPrompts.ini, it was blank. After I added the information it worked

Why was it blank I dont know, I was working before.

[Satya Siba Sundar Mishra]

Thanks gaganjeet.. My problem resolved with this post.