Cisco Call Connector Setup: The entered executive password is not correct.

[Brook Powers]

When installing and setting up the Cisco Call Connector Server 1.6.0.58, we receive the error;

The entered executive password is not correct. Please change executive password and try again.

On the MANAGE CISCO ROUTERS | ROUTER LIST | DOWNLOAD ROUTER INFO tab.

Tried all mannor of various TELNET USERNAMEs, TELNET PASSWORDs and TELNET EXECUTIVE USERNAMEs. Reset all passwords. Created new users and passwords. Deleted users and passwords... Still getting the same error when attempting to download the router info.

Call the STAC, ticket gets escalated, TAC calls us back work on it for a while...

The "solution" is to use a <space> (i.e. " ") in the Telent Executive Password input field.

Yea, that makes sense :|

[Steven DiStefano]

I may have once seen this error, but in my case it was because I didnt have VTY 0 4 defined and level 15 access defined for my user.

[Dave Lewis]

Hello,

I'm having the same issue but the 'space' trick hasn't worked for me, still getting 'the entered executive password is not correct'.

I've also tried creating new users, disabling enable authentication etc. but with no luck.

If I put nothing in the executive password field within CallConnector and run a wireshark capture it shows some http access and then stops, doesn't even attempt telnet access so I'm not sure why it thinks it needs an executive password.

If I put a space or the actual enable password in and run a wireshark it shows the telnet traffic completing succesfully:

1. Banner is received by CallConnector

2. CallConnector sends username

3. CallConnector sends password

4. CallConnector types 'enable'

5. CallConnector sends the executive password as per field.

6. Router enters enable mode

7. CallConnector sends 'configure terminal'

8. Router enters configuration mode

9. CallConnector sends 'end'.

10. Router returns to the enable prompt

11. CallConnector displays 'the entered exceutive password is not correct' error message.

This is bizarre, the executive password is correct and every command it sends succeeds so why would it say it's not working? It doesn't attempt any commands that fail so I'm not sure why it thinks there's a problem.

I'm now 5 days into the trial and haven't even got the connection working yet. Oh, I've also followed the steps in the manual to double check:

1. configure terminal
2. ip http server
3. ip http authentication local
4. ip http timeout-policy idle 60 life 86400 requests 86400
5. username username privilege 15 password 0 password
6. end

Any ideas?

Thanks in advance,

Dave

** Edit: Solution found **

After much head scratching I thought I'd try to connect to a different CME and it worked so I started looking for differences. Would you believe it, CallConnector will fail if I have my banner motd in the config!

So, if you too are having this issue try the following:

1. Put a space in the 'executive password' field if you're not using enable authentication. Otherwise put the proper enable password. Be aware that it's using telnet and http rather than ssh/https so your password is in plaint text.

2. Make a backup of the banner section of your config (sh run | beg banner motd)

3. Conf t, no banner motd

4. Download router config from CallConnector.

5. Paste your banner back in.

I'm guessing it's the ^C characters or maybe the length of the banner that's causing it a problem. Working now anyway.

Thanks,

Dave

Message was edited by: Dave Lewis Reason: Solution found.

[shtalukd]

Hi Dave:

We would like to recreate this issue. Could you please email us (cs-callconnector@external.cisco.com)  the following for the failure case:

1. Router config file (show run, with the banner)

2. CMEconfigurator.log (In the SCC Server->Trace Log folder)

3. All the files in the SCC Server->Log folder

Responses to the specific steps that you went through:

1. If I put nothing in the executive password field within CallConnector and run a wireshark capture it shows some http access and then stops, doesn't even attempt telnet access so I'm not sure why it thinks it needs an executive password. WHEN THERE IS NOT EXEC PASSWORD ENTERED, IT VERIFIES THIS CONFIG SETTING BY DOWNLOADING THE RUNNING CONFIG (USING HTTP) AND CHECKING FOR THE PRIVILEDGE LEVEL 15 SETTING UNDER LINE VTY 0 -9. IF THAT SETTING IS NOT THERE IT WILL NOT PROCEED BECAUSE IT WILL NOT HAVE THE REQUIRED WRITE PERMISSION.

2. If I put a space or the actual enable password in and run a wireshark it shows the telnet traffic completing succesfully:IT INTERPRETS THE SPACE CHARACTER AS A ENTERED PASSWORD VALUE AND THEN PROCEEDS TO LOG IN WITH THE ENTERED EXEC PASSWORD. SINCE THIS IS INVALID, IT FAILS TO LOGIN

QUESTION: Does your telnet session, after you have entered the username and password to log in, pormpt for enable password?

The possible cause for this issue may be the absence of  Priviledge Level 15 setting under  VTY 0-9. We are not sure why the presence/absence of banner would have an effect on the login sequence.

Thank you,

CallConnector Team

[Dave Lewis]

Hello,

I just tried emailing you these files (total size 1.2MB) but it appears your mailbox is over it's quota!

hho_at*_callcomm.com

"550 5.2.2 STOREDRV.Deliver: mailbox full. The following information should help identify the cause: "MapiExceptionShutoffQuotaExceeded:"

I don't really want to attach them on this forum, could you clear your mailbox out and let me know when to resend!

Thanks,

Dave