Protocol error trying to create a huawei NED with NETCONF NED builder

[larias]

I am trying to create a NED with NETCONF NED builder for Huawei vrp devices (i.e. NE40E-XA series). I have a device and I have done the onboarding in NSO as it is specified in the documentation:

devices device huaweinetconf
address x.x.x.x
port 22
authgroup LAB
device-type netconf ned-id netconf
state admin-state unlocked

I have created the project (netconf-ned-builder project huawei-vrp 8.210 device huaweinetconf vendor huawei max-download-threads 50 local-user nso) but when I try to download the modules I receive a "protocol error":

aa@ncs# netconf-ned-builder project huawei-vrp 8.210 fetch-module-list
Error: Failed to connect to device huaweinetconf: Protocol error

I have checked the ssh algorithms enables, but they seems to work as I can do ssh fetch-host-keys, but if I try to perform a connect to the device I receive the same "protocol Error".

I have tried to connect to netconf console of the device from the shell of the server where NSO is running and I can do it, so it seems that netconf server in the device is up and running:

[root@d79bf137e0f7 ncs]# ssh -s nso@x.x.x.x -p 22 netconf
User Authentication
Enter password:

Warning: Negotiated identity key for server authentication is not safe. It is recommended that you disable the insecure algorithm or upgrade the client.
<?xml version="1.0" encoding="UTF-8"?>
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<capabilities>
<capability>urn:ietf:params:netconf:base:1.0</capability>
<capability>urn:ietf:params:netconf:base:1.1</capability>
<capability>urn:ietf:params:netconf:capability:schema-sets:1.0?list=huawei-yang@2.0.0</capability>
<capability>urn:ietf:params:netconf:capability:writable-running:1.0</capability>
<capability>urn:ietf:params:netconf:capability:candidate:1.0</capability>

... etc.

I have enabled the trace raw of the device in NSO but no message at all is stored in the log. Also the devel.log stores a message that the connect has work!!

<INFO> 19-Sep-2024::17:08:00.653 d79bf137e0f7 ncs[14][<0.17317.0>]: ncs progress usid=98 tid=537 datastore=running context=cli trace-id=c05bcc20-8cf2-4393-8f58-40b9f111ba15 action=/devices/device[name='huaweinetconf']/connect running action
<INFO> 19-Sep-2024::17:08:02.578 d79bf137e0f7 ncs[14][<0.17317.0>]: ncs progress usid=98 tid=537 datastore=running context=cli trace-id=c05bcc20-8cf2-4393-8f58-40b9f111ba15 action=/devices/device[name='huaweinetconf']/connect running action: ok (1.924 s)

Any idea about why NSO reports the protocol error and how to solve it?

[snovello]

Hello,
that warning that you see is in the trace of the SSH connection is probably the isssue. The anwer to your hello message should just be the xml, without warnings. I think you need to first see how to connect via ssh without getting that warning.

Make sure you are using the same port in NSO and in your cli tests default is 830 so you need to set port in NSO to 22 explicitly. I just say because I've made that mistake in past.

[larias]

Hi @snovello, 

Thanks for your reply. I have captured the traffic when I perform the fetch-module-list and the port user by NSO is 22:

16:06:37.583074 IP nso-server.37058 > x.x.x.x.ssh: Flags [S], seq 3595744366, win 29200, options [mss 1460,sackOK,TS val 2122288763 ecr 0,nop,wscale 7], length 0
16:06:37.600785 IP x.x.x.x.ssh > nso-server.37058: Flags [S.], seq 2070896735, ack 3595744367, win 61440, options [mss 1460], length 0
16:06:37.600834 IP nso-server.37058 > x.x.x.x.ssh: Flags [.], ack 1, win 29200, length 0
16:06:37.601091 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 1:25, ack 1, win 29200, length 24
16:06:37.627229 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1:12, ack 25, win 61440, length 11
16:06:37.627289 IP nso-server.37058 > x.x.x.x.ssh: Flags [.], ack 12, win 29189, length 0
16:06:37.627314 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 12:980, ack 25, win 61440, length 968
16:06:37.627591 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 25:721, ack 980, win 29189, length 696
16:06:37.627861 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 721:769, ack 980, win 29189, length 48
16:06:37.647384 IP x.x.x.x.ssh > nso-server.37058: Flags [.], ack 769, win 61440, length 0
16:06:39.378754 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 980:1380, ack 769, win 61440, length 400
16:06:39.378818 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1380:1396, ack 769, win 61440, length 16
16:06:39.378888 IP nso-server.37058 > x.x.x.x.ssh: Flags [.], ack 1396, win 30976, length 0
16:06:39.381810 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 769:785, ack 1396, win 30976, length 16
16:06:39.381905 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 785:837, ack 1396, win 30976, length 52
16:06:39.393860 IP x.x.x.x.ssh > nso-server.37058: Flags [.], ack 837, win 61440, length 0
16:06:39.394096 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1396:1448, ack 837, win 61440, length 52
16:06:39.394291 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 837:905, ack 1448, win 30976, length 68
16:06:39.406439 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1448:1532, ack 905, win 61440, length 84
16:06:39.406669 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 905:989, ack 1532, win 30976, length 84
16:06:39.418835 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1532:1632, ack 989, win 61440, length 100
16:06:39.419005 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 989:1057, ack 1632, win 30976, length 68
16:06:39.559556 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1632:1828, ack 1057, win 61440, length 196
16:06:39.559620 IP x.x.x.x.ssh > nso-server.37058: Flags [P.], seq 1828:1864, ack 1057, win 61440, length 36
16:06:39.559674 IP nso-server.37058 > x.x.x.x.ssh: Flags [.], ack 1864, win 32912, length 0
16:06:39.559854 IP nso-server.37058 > x.x.x.x.ssh: Flags [P.], seq 1057:1109, ack 1864, win 32912, length 52
16:06:39.559936 IP nso-server.37058 > x.x.x.x.ssh: Flags [F.], seq 1109, ack 1864, win 32912, length 0
16:06:39.575951 IP x.x.x.x.ssh > nso-server.37058: Flags [.], ack 1110, win 61440, length 0
16:06:39.575997 IP x.x.x.x.ssh > nso-server.37058: Flags [F.], seq 1864, ack 1110, win 61440, length 0
16:06:39.576028 IP nso-server.37058 > x.x.x.x.ssh: Flags [.], ack 1865, win 32912, length 0

Regarding the warning (I can only see it when I do it by server console), it suggest to "disable the insecure algorithms" but, which of the ones I have are the insecure ones? Is there a list to check them?

Thanks!

[snf · Accepted solution]

Hi @larias,

We've met something very similar on a huawei switch, not the same OS though. The issue was solved by tuning a parameter on the Huawei device ("VRP" OS), to disable keyboard interactive authentication

( 'undo ssh server authentication-type keyboard-interactive enable' on our device).

Don't know if it is applicable to your case but it's worth trying.

[larias]

Hi!

thanks for the suggestion. I have configured this command and now the connectivity works and I have been able to download the modules with "netconf-ned-builder project huawei-vrp 8.210 fetch-module-list".

Now I am finding many errors when I buid the NED but it is a different story that I need to manage

Thanks a lot!

[snf]

You're welcome, I'm glad this helped Maybe it should be documented in a knowledge base shared within the Cisco guys because honnestly, it's a tricky one.