Discussion:
[rancid] Opengear console servers and RANCID
Toby Smith
2012-06-06 02:32:31 UTC
Permalink
Hi all,

I've been working with doing some stuff with RANCID and the Opengear
range of console servers.

I've got basic device support for monitoring Opengear console servers
themselves from RANCID going, that was pretty straight forward.

However, I was also interested in providing capability for devices
connected to an Opengear via a serial console cable to be monitored via
RANCID. The Opengear exposes the management console of all the serially
connected devices via the network in a bunch of ways (different SSH
ports, different SSH usernames etc).

I've got RANCID support for Ciscos behind an Opengear going at the
moment, but I've had to add a new device type (which I've awkwardly
called cisco-via-opengear).

Ideally I wouldn't have had to do this, but I ran into some differences
between real network device ports and Opengear-exposed serial console
ports. Really it's just a different clogin script, but I had to also add
a different rancid script (c-via-ograncid) to get it to call my
c-via-oglogin.

The simple difficulties I had to work around were:

- Initial connections didn't present a prompt after login until a "\r"
was sent down.
- When connected via an Opengear network-to-serial port, typing "quit"
or "exit" didn't close the connection.

The trickiest thing though was that RANCID had the idea of one router
per IP. When using the Opengear as a console server, you have serveral
different devices available from the one IP, but accessed with different
usernames or ssh ports.

What I've done is use a % symbol as a delimiter in router.db and in
.cloginrc to specify multiple hosts behind an Opengear. E.g.

router.db:
192.168.0.250%ciscoASA:cisco-via-og:up
192.168.0.250%cisco17xx:cisco-via-og:up

.clogin.rc:
add password 192.168.0.250%cisco17xx opengearpassword ciscopassword
add user 192.168.0.250%cisco17xx root:port3
add password 192.168.0.250%ciscoasa opengearpassword ciscopassword
add user 192.168.0.250%ciscoasa root:port2

And then in my c-via-oglogin script, I strip the bit after the % from
the router name before connecting.

This all seems to be working nicely and I've got it monitoring a couple
of cisco devices in my test lab. As I've said though, I've have liked to
not have had to add a new device type for this (to avoid duplicating so
much of the functionality).

I've got patches for all this sitting in my home directory at the
moment, but I thought I'd ask around if anyone else has any experience
with RANCID via console servers or if there's any other interest for
this before I tidy what I've got.

Cheers,
--Toby
Toby Smith
2012-06-13 05:02:18 UTC
Permalink
For those interested, I've managed to get this to work without having to
add a new device type for cisco devices via an opengear console servers.

What I've done for now is add an expect wrapper around ssh (that can be
configured as an "sshcmd" for the devices) that handles the
idiosyncrasies that I ran into before.

This should also open up a door to using an RANCID to monitor a whole
range of devices (not just cisco ones) via an opengear console server.

--Toby
Post by Toby Smith
Hi all,
I've been working with doing some stuff with RANCID and the Opengear
range of console servers.
I've got basic device support for monitoring Opengear console servers
themselves from RANCID going, that was pretty straight forward.
However, I was also interested in providing capability for devices
connected to an Opengear via a serial console cable to be monitored via
RANCID. The Opengear exposes the management console of all the serially
connected devices via the network in a bunch of ways (different SSH
ports, different SSH usernames etc).
I've got RANCID support for Ciscos behind an Opengear going at the
moment, but I've had to add a new device type (which I've awkwardly
called cisco-via-opengear).
Ideally I wouldn't have had to do this, but I ran into some differences
between real network device ports and Opengear-exposed serial console
ports. Really it's just a different clogin script, but I had to also add
a different rancid script (c-via-ograncid) to get it to call my
c-via-oglogin.
- Initial connections didn't present a prompt after login until a "\r"
was sent down.
- When connected via an Opengear network-to-serial port, typing "quit"
or "exit" didn't close the connection.
The trickiest thing though was that RANCID had the idea of one router
per IP. When using the Opengear as a console server, you have serveral
different devices available from the one IP, but accessed with different
usernames or ssh ports.
What I've done is use a % symbol as a delimiter in router.db and in
.cloginrc to specify multiple hosts behind an Opengear. E.g.
192.168.0.250%ciscoASA:cisco-via-og:up
192.168.0.250%cisco17xx:cisco-via-og:up
add password 192.168.0.250%cisco17xx opengearpassword ciscopassword
add user 192.168.0.250%cisco17xx root:port3
add password 192.168.0.250%ciscoasa opengearpassword ciscopassword
add user 192.168.0.250%ciscoasa root:port2
And then in my c-via-oglogin script, I strip the bit after the % from
the router name before connecting.
This all seems to be working nicely and I've got it monitoring a couple
of cisco devices in my test lab. As I've said though, I've have liked to
not have had to add a new device type for this (to avoid duplicating so
much of the functionality).
I've got patches for all this sitting in my home directory at the
moment, but I thought I'd ask around if anyone else has any experience
with RANCID via console servers or if there's any other interest for
this before I tidy what I've got.
Cheers,
--Toby
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss
Toby Smith
2012-06-15 05:03:11 UTC
Permalink
Hi,

Attached to this email are oglogin and ograncid

They are modified clogin and rancid scripts for monitoring the
configuration on Opengear console servers.

They've been tested with telnet and ssh, and with root and admin users
(although you'll only be able to backup and monitor password hashes if
you're logging in as the root user).

The only other modification was to add

'opengear' => 'ograncid',

to %vendortable in rancid-fe and then use "opengear" to describe the
console servers in router.db

If anyone has any feedback I'd love to hear it. We've been using this in
house for monitoring the devices in our test rack and it's been working
fine and has been quite useful already.

--Toby

Loading...