Authentication issue while trying to fetch status/configuration for a device in Netbox

[raviv0731]

Hello experts,

I just started with Netbox and this is a basic question and i am missing something here.it gives auth error. i passed the below NAPALM arguments in netbox. when i try the url from netbox server it says " Authentication credentials were not provided".

However when i run the debug from VSCODE from Netbox server for "ios"driver, for running config, it fetched the running config for the same credentials though. Kindly suggest where am i going wrong and where all should i post the credentials with examples if possible. thanks for your time.

VSCODE Output:

import napalm
import json
import sys
import os

driver = napalm.get_network_driver ('ios')

device = driver(hostname ='172.20.113.2',username='ravikiran',password='hdhfjsdksdlk3')
device.open()
print(device.get_config(retrieve='running', full=True))
print(device.get_environment())
device.close()

NAPALM Arguments in Netbox (platform settings):

{"NAPALM_ARGS": {"secret": "Pwd"}, "NAPALM_USERNAME": "ravikiran", "NAPALM_PASSSWORD": "pwd"}

Error:
{
"detail": "Error connecting to the device at 172.20.113.2: Authentication to device failed.\n\nCommon causes of this problem are:\n1. Invalid username and password\n2. Incorrect SSH-key file\n3. Connecting to the wrong device\n\nDevice settings: cisco_ios 172.20.113.2:22\n\n\nAuthentication failed."
}

[candlerb]

NAPALM Arguments in Netbox (platform settings):

That won't work. To understand this, look at the code here and the docs here.

When Netbox opens the connection to Napalm:

• The username comes from the global configuration setting "NAPALM_USERNAME", and the password comes from the global configuration setting "NAPALM_PASSWORD". These can be set either in Netbox's configuration.py or in the web interface via Admin > Config Revisions. For API callers, they can be overridden in X-NAPALM-(Username|Password) headers.
• The optional_args (which includes things like 'secret') also come from the configuration file or config revisions, but in addition can be updated from the platform. Any optional_args in the platform override those taken from the config.

Therefore, a valid value for Napalm Arguments in Platform settings would be e.g.

{
    "secret": "Pwd"
}

(any setting which the driver accepts in "optional_args"), but it is not valid to set either "username" or "password" here. They have to be set in the main configuration.

You could argue that if it's allowed to set optional_args at Platform level, that it should be possible to set username, password and timeout here too for consistency. But that would have to be raised as a feature request.

[raviv0731]

Thanks. Yes, i am using docker container. i just edited those credentials from "configuration.py"file. so you suggest me to remove that username/password config from that file and create at "config revisions" from netbox ?

On a separate note, i am just trying to fetch these tabs ( status/lldp nei/configuration for cisco 9200 (iosxr) os. I see two different drivers on the documentation ( iosxr and iosxr_netconf). I have assigned each one to separate devices and i see different errors whle trying to fetch the data. the device with iosxr gives the below error:

Error connecting to the device at 172.20.113.2: Authentication to device failed.\n\nCommon causes of this problem are:\n1. Invalid username and password\n2. Incorrect SSH-key file\n3. Connecting to the wrong device\n\nDevice settings: cisco_ios 172.20.113.2:22\n\n\nAuthentication failed."

The one with iosxr_netconf gives

**Error Fetching Device Status

Error connecting to the device at 172.20.177.2: Could not open socket to 172.20.177.2:830**

[raviv0731]

The Napalm settings under "config revisions" are grayed out for some reason for me. Thought of trying to remove username/password from configuration.py and keep it here. Any more hints to solve this please ?

[markkuleinio]

I think they are gray because you have them configured in configuration.py. Remove the configurations, restart NetBox and try again.

[raviv0731]

Thanks will try. I have query with secrets. Do we need each device to have secrets for generating those tabs(status/lldp/configuration) etc ? i just left that part blank in configuration.py file ? however again i still see the same error. i am able to ssh into this device from the machine where netbox is installed though.

Authentication to device failed.\n\nCommon causes of this problem are:\n1. Invalid username and password\n2. Incorrect SSH-key file\n3. Connecting to the wrong device\n\nDevice settings: cisco_ios 172.20.113.2:22\n\n\nAuthentication failed.

[raviv0731]

The below script works just fine. it pulls the config. However through Netbox we see the above error.

**import napalm
import json
import sys
import os

driver = napalm.get_network_driver ('ios')

device = driver(hostname ='172.20.177.2',username='xxxx',password='xxxxxx')
device.open()
print(device.get_config(retrieve='running', full=True))
print(device.get_environment())
device.close()**

[raviv0731]

i am a newbie started with netbox and Its unfortunate that i didn't get any response or right troubleshooting steps on this, dying had to bring this up with no success.

Using the above script, i see the response as expected. Its just that API not working from the browser when i click on "status" tab. I have created the "admin" account on the netbox and assigned a token. i believe the device credentials and the netbox need not to be same. still the same error.

Authentication to device failed.\n\nCommon causes of this problem are:\n1. Invalid username and password\n2. Incorrect SSH-key file\n3. Connecting to the wrong device\n\nDevice settings: cisco_ios 172.20.113.2:22\n\n\nAuthentication failed.

[raviv0731]

Napalm is able to get the details from cli from the device. I am just trying understand why its throwing authentication error, when clicked the status tab from netbox. Do we have to pass/configure on any authentication token in config.py file?

napalm --vendor ios --user xxxxxxx --password xxxxxx --optional_args 'port=22, config_lock=False' 172.20.x.x call get_facts
{
"uptime": 3533460.0,
"vendor": "Cisco",
"os_version": "Catalyst L3 Switch Software (CAT9K_LITE_IOSXE), Version 17.3.4b, RELEASE SOFTWARE (fc1)",
"serial_number": "xxxxxxxx",
"model": "C9200L-48P-4G",
"hostname": "AMxxxx",
"fqdn": "AMxxxx.not set",
"interface_list": [
"Vlan1",
"Vlan2",
"GigabitEthernet0/0",
"GigabitEthernet1/0/1",
"GigabitEthernet1/0/2",
"GigabitEthernet1/0/3",
"GigabitEthernet1/0/4",
"GigabitEthernet1/0/5",
"GigabitEthernet1/0/6",

[raviv0731]

Can anybody please reply to one basic question? is the ssh-key mandatory along with username and pwd or it's not ? From the error below it looks like mandatory but i didn't see this mentioned specifically or missed reading unfortunately in Official documentation.

Error connecting to the device at 172.20.113.2: Authentication to device failed.\n\nCommon causes of this problem are:\n1. Invalid username and password\n2. Incorrect SSH-key file\n3. Connecting to the wrong device\n\nDevice settings: cisco_ios 172.20.113.2:22\n\n\nAuthentication failed."

[candlerb]

No, ssh keys are not mandatory along with username and password (unless you've configured your device to require ssh key authentication). You've already proved it's not.

Read the message carefully:

Authentication to device failed.
Common causes of this problem are:

1. Invalid username and password
2. Incorrect SSH-key file
3. Connecting to the wrong device

It's just telling you "login failed", and then giving you some common reasons why logins might fail in general. It's not saying that any one of these reasons applies here.

It certainly might be that you're connecting to the wrong device. I note in your postings at least two different IP addresses:

• Error connecting to the device at 172.20.113.2
• Device = driver(hostname ='172.20.177.2',
• 172.20.x.x call get_facts

I've already told you how I would debug this at the Netbox side: insert a print() or a raise() just before the napalm driver instance is created, to see what credentials Netbox is passing. It's also possible to debug this at the Cisco side (e.g. debug aaa authentication) which might give you some more clues, but if it tells you you're presenting the wrong password, then that's probably what you're doing.

It could also be that the source IP address is different from when you run your test in VSCODE versus when it runs on the Netbox server, and the Cisco only accepts connections from certain IPs. It could be that you're using different versions of Napalm with these two tests. There are lots of things you might be doing wrong, and it's down to you to rule these out one by one.

[raviv0731]

thanks for your inputs. I cross checked all other things except print() and raise(). Will work on it. Thanks.

[raviv0731]

Finally this is resolved. I still don't know the root cause why it didn't; work earlier. I just did configure all from scratch and this time not the docker version but regular one and i see the working tabs now. Thanks for all the support and time.