[rancid] ASA Config for Rancid

[Piegorsch, Weylin William]

Cisco question, that I’m having a devil of a time getting a Cisco answer to.

I have several ASAs – some locally connected, some connected at the far end of an IPSec tunnel. In nearly all cases, I can’t get rancid to archive their config. For reasons that don’t relate to the ASA (has to do with the larger network as a whole), I need telnet to be the first method, with SSH backup. But, the ASAs drop the telnet request, they don’t send a TCP RST packet. As a consequence, rancid times out and considers it an unreachable device.

I’m trying to find a mechanism that doesn’t require specifying custom rancid configs for ASAs that are different than anything else.

Has anyone run into this problem?

weylin

[Ryan West]

Subject: [rancid] ASA Config for Rancid
Cisco question, that I’m having a devil of a time getting a Cisco answer to.
I have several ASAs – some locally connected, some connected at the far end
of an IPSec tunnel. In nearly all cases, I can’t get rancid to archive their
config. For reasons that don’t relate to the ASA (has to do with the larger
network as a whole), I need telnet to be the first method, with SSH backup.
But, the ASAs drop the telnet request, they don’t send a TCP RST packet. As
a consequence, rancid times out and considers it an unreachable device.
I’m trying to find a mechanism that doesn’t require specifying custom rancid
configs for ASAs that are different than anything else.

Try to allow telnet access from the remote network as sourced from inside and then use 'management-access inside' and you should be able to telnet to the inside address from across a VPN tunnel.

-ryan

[Dan Anderson]

You can set the method for the ASAs to be {ssh,telnet} in your .cloginrc
file. I'm on my phone and don't have the exact syntax handy but it's pretty
straightforward.

Post by Piegorsch, Weylin William

Subject: [rancid] ASA Config for Rancid
Cisco question, that I’m having a devil of a time getting a Cisco answer

to.

I have several ASAs – some locally connected, some connected at the far

end

of an IPSec tunnel. In nearly all cases, I can’t get rancid to archive

their

config. For reasons that don’t relate to the ASA (has to do with the

larger

network as a whole), I need telnet to be the first method, with SSH

backup.

But, the ASAs drop the telnet request, they don’t send a TCP RST

packet. As

a consequence, rancid times out and considers it an unreachable device.
I’m trying to find a mechanism that doesn’t require specifying custom

rancid

configs for ASAs that are different than anything else.

Try to allow telnet access from the remote network as sourced from inside
and then use 'management-access inside' and you should be able to telnet to
the inside address from across a VPN tunnel.
-ryan
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss

[Ryan West]

Thanks Ryan. I’m unable to concretely determine a device is an ASA from it’s
domain name, unless I populate .cloginrc with every ASA I have. I used to do
that, but it became cumbersome and at somepoint it was clear it would no
longer scale. For a while I also went down the path of having a .cloginrc-asa
that had the ASA-specific methods and then included .cloginrc, but for similar
manageability reasons I had to abandon that approach as well.
Is there a way to do that by some other means?

Not sure how many devices you're supporting, but I leverage an internal only DNS view that has a location and device type with number, then you can have a catch all in your .cloginrc that identifies them -

## Firewalls connect this way
add user *fw* {username}
add password *fw* {password} {en_password}
add method *fw* ssh telnet
add autoenable *fw* 0

-ryan

[Piegorsch, Weylin William]

Thanks Ryan. We used to do exactly that, but it got to the point that ASAs were doing far more than merely firewall – to name a few:

VPN
... well ok these are just ASAs

Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a CheckPoint somewhere we haven’t yet replaced

NAT
ASA, ASR1k, Catalyst6k, 7301, 3825

Routing
Oh let me count the ways....

BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA

Since the devices performing a function are so varied, the naming standard cannot take model into account, merely function. It got to the point where I was essentially starting to list every ASA by specific name; after a few of these it became clear this approach wouldn’t scale.

And to answer the other question – somewhere around 20,000 devices; 11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of everything else (though largely only that last are needed in rancid).

weylin

-----Original Message-----
From: Ryan West <***@zyedge.com>
Date: Tuesday, September 12, 2017 at 15:17
To: Weylin Piegorsch <***@bu.edu>, Dan Anderson <***@gmail.com>, "rancid-***@shrubbery.net" <rancid-***@shrubbery.net>
Subject: RE: [rancid] ASA Config for Rancid

Thanks Ryan. I’m unable to concretely determine a device is an ASA from it’s
domain name, unless I populate .cloginrc with every ASA I have. I used to do
that, but it became cumbersome and at somepoint it was clear it would no
longer scale. For a while I also went down the path of having a .cloginrc-asa
that had the ASA-specific methods and then included .cloginrc, but for similar
manageability reasons I had to abandon that approach as well.
Is there a way to do that by some other means?

Not sure how many devices you're supporting, but I leverage an internal only DNS view that has a location and device type with number, then you can have a catch all in your .cloginrc that identifies them -

## Firewalls connect this way
add user *fw* {username}
add password *fw* {password} {en_password}
add method *fw* ssh telnet
add autoenable *fw* 0

-ryan

[Ryan West]

Post by Piegorsch, Weylin William
Thanks Ryan. We used to do exactly that, but it got to the point that ASAs
VPN
... well ok these are just ASAs
Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a
CheckPoint somewhere we haven’t yet replaced
NAT
ASA, ASR1k, Catalyst6k, 7301, 3825
Routing
Oh let me count the ways....
BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA
Since the devices performing a function are so varied, the naming standard
cannot take model into account, merely function. It got to the point where I
was essentially starting to list every ASA by specific name; after a few of
these it became clear this approach wouldn’t scale.
And to answer the other question – somewhere around 20,000 devices;
11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of everything
else (though largely only that last are needed in rancid).

Sounds like a fun problem to have. There are some open source NMS products out there that integrate with RANCID and can probably write out the file for you, otherwise you would need to modify how RANCID works and have it switch to the type of device after login with a show ver command or something similar. Let us know if you come up with anything though, I like the idea of having the device login decide the type, or at least a discovery mechanism for RANCID that would write out the proper lines to .cloginrc.

-ryan

[Gauthier, Chris]

Zenoss is a tool that has RANCiD integration/pluin connectivity.



Chris GauthierSenior Network Engineer | comScore, Inc.
o +1 503-331-***@comscore.com
317 SW Alder St, Suite 500 | Portland | OR97204
............................................................................................................................................................................................................................

Post by Piegorsch, Weylin William
Thanks Ryan. We used to do exactly that, but it got to the point that ASAs
VPN
... well ok these are just ASAs
Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a
CheckPoint somewhere we haven’t yet replaced
NAT
ASA, ASR1k, Catalyst6k, 7301, 3825
Routing
Oh let me count the ways....
BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA
Since the devices performing a function are so varied, the naming standard
cannot take model into account, merely function. It got to the point where I
was essentially starting to list every ASA by specific name; after a few of
these it became clear this approach wouldn’t scale.
And to answer the other question – somewhere around 20,000 devices;
11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of everything
else (though largely only that last are needed in rancid).

Sounds like a fun problem to have. There are some open source NMS products out there that integrate with RANCID and can probably write out the file for you, otherwise you would need to modify how RANCID works and have it switch to the type of device after login with a show ver command or something similar. Let us know if you come up with anything though, I like the idea of having the device login decide the type, or at least a discovery mechanism for RANCID that would write out the proper lines to .cloginrc.

-ryan

_______________________________________________
Rancid-discuss mailing list
Rancid-***@shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss

[Piegorsch, Weylin William]

Hmm...
https://www.zenoss.com/product/zenpacks/rancid-integration-community

We are in fact using ZenOSS for monitoring/alerting (free version, we can’t afford the licensed version). Now THAT is something interesting to evaluate. I’ll ask someone on my team to evaluate that. Allowing telnet <shudder> is another possibility. We had also considered shifting everything into PRIME Insfrastructure (which we will anyway for other reasons than config backups - we did get enough licensing for that at least), but RANCiD has some capabilities that I like that PRIME doesn’t do so well - consider all the hijinks you can do in Linux, like aggregating certain parameters occurs across a subset of devices by doing something like... I don’t know if I have the syntax right, this is just quickly off the top of my head “echo $[`for $(find –name <pattern> –exec egrep –L <chassis_model> \{} \; ) do grep <another_regex> | awk ‘{print $3}’ ; done | tr ‘\n’ ‘+’ | sed ‘s/+$//’`]” . We haven’t yet found a good way to do that in PRIME.

Thanks everyone for the help!

weylin

From: "Gauthier, Chris" <***@comscore.com>
Date: Tuesday, September 12, 2017 at 17:23
To: Ryan West <***@zyedge.com>, Weylin Piegorsch <***@bu.edu>, Dan Anderson <***@gmail.com>, "rancid-***@shrubbery.net" <rancid-***@shrubbery.net>
Subject: Re: [rancid] ASA Config for Rancid

Zenoss is a tool that has RANCiD integration/pluin connectivity.


Chris Gauthier



Senior Network Engineer

|

comScore, Inc.


o +1

503-331-2704<tel:[phone]>



***@comscore.com<mailto:***@comscore.com>


317 SW Alder St, Suite 500 | Portland | OR 97204


............................................................................................................................................................................................................................

Thanks Ryan. We used to do exactly that, but it got to the point that ASAs
VPN
... well ok these are just ASAs
Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a
CheckPoint somewhere we haven’t yet replaced
NAT
ASA, ASR1k, Catalyst6k, 7301, 3825
Routing
Oh let me count the ways....
BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA
Since the devices performing a function are so varied, the naming standard
cannot take model into account, merely function. It got to the point where I
was essentially starting to list every ASA by specific name; after a few of
these it became clear this approach wouldn’t scale.
And to answer the other question – somewhere around 20,000 devices;
11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of everything
else (though largely only that last are needed in rancid).

Sounds like a fun problem to have. There are some open source NMS products out there that integrate with RANCID and can probably write out the file for you, otherwise you would need to modify how RANCID works and have it switch to the type of device after login with a show ver command or something similar. Let us know if you come up with anything though, I like the idea of having the device login decide the type, or at least a discovery mechanism for RANCID that would write out the proper lines to .cloginrc.

-ryan

_______________________________________________
Rancid-discuss mailing list
Rancid-***@shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss

[Gauthier, Chris]

I just read the info page and am actually not impressed. It’s not upgradable. It does not run a “standard” installation of RANCiD—it compiles its own binaries and installs itself customized for Zenoss. It only works with SVN, so no CVS or GitHub support. Since the version is from 2015, I expect it’s probably on RANCiD 2.3.2 or some old version like that.

--Chris


Chris GauthierSenior Network Engineer | comScore, Inc.
o +1 503-331-***@comscore.com
317 SW Alder St, Suite 500 | Portland | OR97204
............................................................................................................................................................................................................................

From: "Piegorsch, Weylin William" <***@bu.edu>
Date: Thursday, September 14, 2017 at 4:53 AM
To: "Gauthier, Chris" <***@comscore.com>, Ryan West <***@zyedge.com>, Dan Anderson <***@gmail.com>, "rancid-***@shrubbery.net" <rancid-***@shrubbery.net>
Subject: Re: [rancid] ASA Config for Rancid

Hmm...
https://www.zenoss.com/product/zenpacks/rancid-integration-community

We are in fact using ZenOSS for monitoring/alerting (free version, we can’t afford the licensed version). Now THAT is something interesting to evaluate. I’ll ask someone on my team to evaluate that. Allowing telnet <shudder> is another possibility. We had also considered shifting everything into PRIME Insfrastructure (which we will anyway for other reasons than config backups - we did get enough licensing for that at least), but RANCiD has some capabilities that I like that PRIME doesn’t do so well - consider all the hijinks you can do in Linux, like aggregating certain parameters occurs across a subset of devices by doing something like... I don’t know if I have the syntax right, this is just quickly off the top of my head “echo $[`for $(find –name <pattern> –exec egrep –L <chassis_model> \{} \; ) do grep <another_regex> | awk ‘{print $3}’ ; done | tr ‘\n’ ‘+’ | sed ‘s/+$//’`]” . We haven’t yet found a good way to do that in PRIME.

Thanks everyone for the help!

weylin

From: "Gauthier, Chris" <***@comscore.com>
Date: Tuesday, September 12, 2017 at 17:23
To: Ryan West <***@zyedge.com>, Weylin Piegorsch <***@bu.edu>, Dan Anderson <***@gmail.com>, "rancid-***@shrubbery.net" <rancid-***@shrubbery.net>
Subject: Re: [rancid] ASA Config for Rancid

Zenoss is a tool that has RANCiD integration/pluin connectivity.



Chris Gauthier



Senior Network Engineer

|

comScore, Inc.


o +1

503-331-2704<tel:[phone]>



***@comscore.com<mailto:***@comscore.com>


317 SW Alder St, Suite 500 | Portland | OR 97204


............................................................................................................................................................................................................................

Thanks Ryan. We used to do exactly that, but it got to the point that ASAs
VPN
... well ok these are just ASAs
Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a
CheckPoint somewhere we haven’t yet replaced
NAT
ASA, ASR1k, Catalyst6k, 7301, 3825
Routing
Oh let me count the ways....
BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA
Since the devices performing a function are so varied, the naming standard
cannot take model into account, merely function. It got to the point where I
was essentially starting to list every ASA by specific name; after a few of
these it became clear this approach wouldn’t scale.
And to answer the other question – somewhere around 20,000 devices;
11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of everything
else (though largely only that last are needed in rancid).

Sounds like a fun problem to have. There are some open source NMS products out there that integrate with RANCID and can probably write out the file for you, otherwise you would need to modify how RANCID works and have it switch to the type of device after login with a show ver command or something similar. Let us know if you come up with anything though, I like the idea of having the device login decide the type, or at least a discovery mechanism for RANCID that would write out the proper lines to .cloginrc.

-ryan

[Piegorsch, Weylin William]

This post might be inappropriate. Click to display it.

[Doug Hughes]

Nice summary. thanks!

I finally got it working for ASA post-8.3.  I thought I’d share my
findings.
 
For refresher, I historically had an ASA-specific .cloginrc that
overrode the “method” field and then called the primary .cloginrc. 
This was for rancid-1.x - we started with rancid sometime around 2001
or 2002 - where I just copied clogin and rancid as clogin-asa and
rancid-asa and change the one line from “rancid” to “rancid –f
cloginrc-asa” (a few other small tweaks, but you get the point).  When
the 15yr-old-server finally died, we moved to a VM running
rancid-v3.x; rather than try to figure out how to make it work, I just
set about trying to figure out how to make ASAs work the way they’re
supposed to.
 
The kicker? I need telnet as the first method to support my bulk
deployment of really old Cisco Catalysts that don’t support SSH and
cause rancid to timeout on that, but that was causing timeout errors
for ASAs.  Yes, I could have fixed the SSH problem instead, or even
raised RANCiD’s timeout, but I’m trying to avoid server-side
customizations - since I head a network shop that only uses servers
where I need to, Cisco configs are easier to manage policy and
compliance rules than server configs.
 
 
1. Apply the global config “service resetoutside”
This tells the ASA to send a TCP RST packet if a connection request is
denied, but only when the IP destination is the ASA itself.  By
default, the ASA silently discards the TCP SYN when the connection is
denied.  Without the RST, telnet times out before returning control
back to the shell.  Unfortunately, the telnet timeout was longer than
rancid’s timeout.
 
2. Do not apply the global configs “service resetinbout” or “service
resetoutbound”
I never figured out why this was necessary, but under some conditions
the three commands together weren’t playing nice with each
other.  Feel free to play with this if you need it.
 
3. Do not allow telnet to the least-secure interface from anywhere.
if telnet is allowed to the least-secure interface, AKA the interface
with the lowest security-level (check with packet-tracer, you’ll see
it at the end despite all the “ALLOW” results), and if your telnet
connection attempt is trying to connect to that interface, the ASA
silently drops the connection request despite the resetoutside
command.  Personally I think it’s a bug to override the “resetoutside”
command, though I never confirmed it.  I also didn’t experiment with
any interface except the least-secure interface.
 
weylin
 
*Date: *Thursday, September 14, 2017 at 07:53
*Subject: *Re: [rancid] ASA Config for Rancid
 
Hmm...
https://www.zenoss.com/product/zenpacks/rancid-integration-community
 
We are in fact using ZenOSS for monitoring/alerting (free version, we
can’t afford the licensed version).  Now THAT is something interesting
to evaluate.  I’ll ask someone on my team to evaluate that.  Allowing
telnet <shudder> is another possibility.  We had also considered
shifting everything into PRIME Insfrastructure (which we will anyway
for other reasons than config backups - we did get enough licensing
for that at least), but RANCiD has some capabilities that I like that
PRIME doesn’t do so well - consider all the hijinks you can do in
Linux, like aggregating certain parameters occurs across a subset of
devices by doing something like... I don’t know if I have the syntax
right, this is just quickly off the top of my head “echo $[`for $(find
–name <pattern> –exec egrep –L <chassis_model> \{} \; ) do  grep
<another_regex>   |   awk ‘{print $3}’   ;   done  |   tr ‘\n’ ‘+’ |
sed ‘s/+$//’`]” . We haven’t yet found a good way to do that in PRIME.
 
Thanks everyone for the help!
 
weylin
 
*Date: *Tuesday, September 12, 2017 at 17:23
*Subject: *Re: [rancid] ASA Config for Rancid
 
Zenoss is a tool that has RANCiD integration/pluin connectivity.
 
*Chris Gauthier*
  
Senior Network Engineer
 | 
comScore, Inc.
o +1 
*503-331-2704* <tel:[phone]>
  
317 SW Alder St, Suite 500 | Portland | OR 97204
............................................................................................................................................................................................................................
 
On 9/12/17, 1:42 PM, "Rancid-discuss on behalf of Ryan West"

Thanks Ryan. We used to do exactly that, but it got to the point

that ASAs

VPN
... well ok these are just ASAs
Firewall
PIX, ASA, PaloAlto 3k, PaloAlto 7k, PaloAlto 500, and I think there’s a
CheckPoint somewhere we haven’t yet replaced
NAT
ASA, ASR1k, Catalyst6k, 7301, 3825
Routing
Oh let me count the ways....
BGP Service Advertisement
Nexus7k, ASR9k, ASR1k, 7301, ASA
Since the devices performing a function are so varied, the naming

standard

cannot take model into account, merely function. It got to the point

where I

was essentially starting to list every ASA by specific name; after a

few of

these it became clear this approach wouldn’t scale.
And to answer the other question – somewhere around 20,000 devices;
11,000+ VoIP handsets, 6,000–7,000 access points, and 3,000+ of

everything

else (though largely only that last are needed in rancid).

Sounds like a fun problem to have. There are some open source NMS
products out there that integrate with RANCID and can probably write
out the file for you, otherwise you would need to modify how RANCID
works and have it switch to the type of device after login with a show
ver command or something similar. Let us know if you come up with
anything though, I like the idea of having the device login decide the
type, or at least a discovery mechanism for RANCID that would write
out the proper lines to .cloginrc.
-ryan
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo/rancid-discuss

[Ryan West]

Thanks Ryan. I hadn’t considered that; largely I’m trying to get away from
telnet but it’s an approach that might actually work.
I’ve tried going down the path of “reset outside” on the ASA, but that’s not
working as I expect it to :-(
Something I was poking around at. I did a packet capture, and noted that
telnet send a SYN, 3sec later another SYN, and so forth at 3, 6, 12, 24, and 48
seconds, before finally timing out at 95 seconds or so. Rancid times out at 90
seconds; is there a way to increase this timeout to perhaps 100sec? Is that
something what can be done in .cloginrc, or perhaps types.conf? I found
some reference to bin/rancid and bin/clogin, but I’m trying to avoid
modifying those (or anything in bin).

I'm only aware of the bin/clogin modification, mine is set to 45 seconds.

-ryan