question on terminal width, and configuration terminal....

[aclease]

I am using 3.4.0 and I might be missing something.

I have been enjoying the usefulness of the tool, but I am running into an issue where I may be missing something as I am not an advanced python person, but I do understand a lot of various programing languages to at least a mid tier level.

I am running the Cisco_ASA_SSH, and I have wrote a script to validate the SNMPV3 OID for the configuration updates which then schedules an update to be pulled down for the configuration.
The issue is every time I connect using net_connect.asa_login Netmiko goes into Config Terminal and changes the terminal width there by causing the configuration to change, and it starts a repetitious cycle wher4e it never stops updating because the configuration has changed since the last time it was checked. I was looking for a way to disable the terminal width setting, as Allow_Auto_Change is supposed to default to false, which to my belief should stop this behavior. I attempted to set it to true but it errors out.

So I am wondering before I move this to something else if I am missing something, or if there is a little help the I am missing in the discussions threads that may help as to why this setting of the terminal width is required even when it shouldn't be making changes.

Any help is appreciated.

[ktbyers]

@aclease Can you show your code and the error that you are getting.

[ktbyers]

Note, Netmiko does allow_auto_change=True for ASA (as not setting that terminal width breaks too many things).

https://github.com/ktbyers/netmiko/blob/v3.4.0/netmiko/cisco/cisco_asa_ssh.py#L14

You would need to explicitly set allow_auto_change=False in your ConnectHandler arguments to change this default behavior.

[aclease]

Ok then that was why I couldn't understand why it was acting like it was on, but the text said it defaulted to off on the website.

This is where it mentions that it is defaulted to off for Cisco_asa_ssh: https://ktbyers.github.io/netmiko/docs/netmiko/cisco/cisco_asa_ssh.html

for others this might be handy.
i wrote a simple bash script that checks the version of the configuration last updated register in SNMP, then if it has changed it downloads a new configuration back up, and updates the file.

]$ snmpwalk -v3 -l authPriv -u username-snmpv3 -a SHA -A 'password' -x AES -X 'password' 10.0.0.1 .1.3.6.1.4.1.9.9.43.1.1.1 | perl -p00e 's/^.Timeticks: (//g' | perl -p00e 's/).$//g'
847323623
]$ ./more-system-run
castle 10.0.0.1 fp-asa 847322550 -- castle 10.0.0.1 fp-asa 847323623
]$ more test1
castle 10.0.0.1 fp-asa 847323623

My script calls the following python to actually interact with the device. The IP address for the device is pushed as part of the bash script to avoid selection mishaps and add additional processes which I need outside of the python script.

from netmiko import ConnectHandler
import getpass,sys,time
line=sys.argv[1]
device = {
'device_type': 'cisco_asa_ssh',
'username': 'username',
'password': 'password',
'session_log': 'log.txt'
}
device ['username']="USERNAME"
device ['password']="********"
device ['ip']=line.strip("\n")
net_connect = ConnectHandler(**device)
net_connect.asa_login()
result = net_connect.send_command('more system:running-config')
print(result)
net_connect.disconnect()

I will have to add the allow_auto_change=False to correct this behavior. Some fellow engineers may also have change control restrictions that prevent them from entering 'configure terminal' without a preapproved change window, so it is nice to know how to avoid breaking the rules. ;) thinking of you healthcare and government regulated environments ;)

This is the log file that it output when it ran, I am still wondering why it attempted to do three login entries, but the issue is the configure terminal entry forces the configuration update time stamp to update, which creates an endless cycle, so accepting that I need to set the configure terminal to 511 in all the ASA I plan to run this on, is not an issue.

User USERNAME logged in to castle-asa
Logins over the last 91 days: 21. Last login: 15:29:14 UTC Dec 29 2021 from 10.0.0.2
Failed logins since the last login: 0. Last failed login: 12:05:59 UTC Dec 6 2021 from 10.0.0.2
Type help or '?' for a list of available commands.
castle-asa> show curpriv
Username : USERNAME
Current privilege level : 1
Current Mode/s : P_UNPR
castle-asa>
castle-asa> login
Username: USERNAME
Password: ***********
castle-asa# login
^
ERROR: % Invalid input detected at '^' marker.
castle-asa# terminal pager 0
castle-asa#
castle-asa# configure terminal
castle-asa(config)#
castle-asa(config)# terminal width 511
castle-asa(config)#
castle-asa(config)# end
castle-asa#
castle-asa#
castle-asa# login
^
ERROR: % Invalid input detected at '^' marker.
castle-asa#
castle-asa# more system:running-config
: Saved

:
: Serial Number: REMOVED
: Hardware: FPR-2110, 6842 MB RAM, CPU MIPS 1200 MHz, 1 CPU (6 cores)
: Written by USERNAME at 15:38:08.739 UTC Wed Dec 29 2021
!
ASA Version 9.8(3)29
!
terminal width 511
rest of the config redacted for security purposes

[ktbyers]

You don't need this:

net_connect.asa_login()

Netmiko does that automatically. That is one of the extra "login" attempts. I think the other failed login is likely due to a timing issue on the login process (i.e. Netmiko doesn't realize it has fully logged in yet and attempts to send login again, and then Netmiko sees the #).

You can probably fix this, but would probably need to make some adjustments to the asa_login code.