Please assist on a daily SFTP backup using phyton on Cisco Nexus 9K

[TsadikuBahiru78025]

I want to take a daily configuration backup of a nexus 9k switch using a phyton script to an SFTP server. Please assist with the configuration.

[M02@rt37]

Hello @TsadikuBahiru78025 

Do you have tested/written first your own script ?

Do you check on Cisco Devnet or Github some examples ?

[TsadikuBahiru78025]

Hello,

Yes I got this script example and it doesn't work. Nexus doesn't know paramiko it says.

import paramiko
import datetime
import os

# SFTP server details
sftp_host = '192.168.10.1'
sftp_port = 22
sftp_username = 'bbb'
sftp_password = 'sss'
sftp_directory = '/DD/sw/2/'

# Local backup file path
hostname = os.popen('show hostname').read().strip()
backup_filename = f"/bootflash/backup-{hostname}-{datetime.datetime.now().strftime('%Y%m%d-%H%M')}.cfg"

# Generate the backup
os.system(f"copy running-config {backup_filename}")

# Upload to SFTP server
try:
transport = paramiko.Transport((sftp_host, sftp_port))
transport.connect(username=sftp_username, password=sftp_password)
sftp = paramiko.SFTPClient.from_transport(transport)
sftp.put(backup_filename, sftp_directory + os.path.basename(backup_filename))
sftp.close()
transport.close()
print(f"Backup {backup_filename} uploaded successfully to {sftp_directory}")
except Exception as e:
print(f"Error uploading backup: {str(e)}")

[bigevilbeard]

How are looking to do this, are you looking for an onbox script within Guestshell (or EEM could do this), or a remote script such as event driven to logging on daily basis to?

[TsadikuBahiru78025]

Hello,

I am looking for an onbox script on which EEM to do this

[bigevilbeard]

@TsadikuBahiru78025 thanks for confirming as you know Python onbox is ran via Guestshell, and you mentioned Python, but then EEM. For the EEM script you can use something like, (replace the example placeholders with your actual values) 

event timer cron name daily-backup
cron entry "0 3 * * *"  
# This will trigger the backup at 3:00 AM every day 
action 1.0 cli command "terminal dont-ask"  
action 1.1 cli command "enable" 
action 1.2 cli command "copy running-config scp://<username>:<password>@<sftp_server_ip>/<backup_directory>/nexus9k_config_$(date +%Y-%m-%d).txt vrf management"  
action 1.3 syslog msg "Daily configuration backup complete."

 In regards to your onbox Python script, had you installed Paramiko on the devices in the guestshell? 

nxos# guestshell
[admin@guestshell ~]$ pip install paramiko

[TsadikuBahiru78025]

Hello @bigevilbeard 

Thanks for the reply let me check the configuration and then I will notify you the result.

Does installing paramiko on a production switch has an impact. In that case I can only test the eem

[bigevilbeard]

@TsadikuBahiru78025 i am not aware that installing Python library Paramiko has impact, from a security side, adding any software to a production switch introduces a potential attack surface and poorly written scripts or insecure authentication methods could expose the switch to unauthorized access.

[TsadikuBahiru78025]

Hello @bigevilbeard 

I run the eem script and the nexus switch doesn't support the timer event. It only has the below options:

cli
counter
fanabsent
fanbad
fib
gold
internal-link-flap
memory
module
module-failure
neighbor-discovery
oir
policy-default
poweroverbudget
snmp
storm-control
syslog
sysmgr
tag
temperature
test
track

[TsadikuBahiru78025]

NXOS: version 9.3(10)

[bigevilbeard]

@TsadikuBahiru78025 not sure if this is version issue, but you can change this and use a combo of EEM and feature schedule.

event manager applet DAILY_CONFIG_BACKUP
  event cli match "backup_config"
  action 1.0 cli command "copy running-config sftp://username@server/path/nx9k_config_$(SWITCHNAME)_$(timestamp).txt vrf management"
  action 2.0 syslog priority notifications msg Configuration backup completed

feature scheduler
scheduler job name BACKUP_JOB
  cli var name backup_config 1

scheduler schedule name DAILY_BACKUP
  job name BACKUP_JOB
  time daily 00:00

[TsadikuBahiru78025]

@bigevilbeard let me check and I will notify you.