Ansible to run commands via SSH on remote hosts

Question

I am having a problem connecting to some Checkpoint firewalls. They run a Linux, but I cannot install any Ansible.

- name: "Connecting to Checkpoint Firewalls"
  connection: ansible.netcommon.network_cli
  gather_facts: false
  hosts: checkpoint

  tasks:
    - name: Gather facts (asa)
      ansible.netcommon.cli_command:
        command:
          - clish
          - show hostname
          - show version all
          - show asset all
          - show interfaces all
          - show lom ip-address
          - show virtual-system all
      register: checkpoint_vars

    - name: Debug
      debug:
        vars: checkpoint_vars

In my inventory file I have set the network OS to IOS as I assumed that the ssh session would be the same. I have also set the SSH common args to sue a bastion host to get to the target devices.

[checkpoint:vars]
ansible_become=no
#ansible_become_method=enable
ansible_network_os=cisco.ios.ios
ansible_connection=network_cli
ansible_user=device_user
ansible_ssh_pass='whatthefuck'
ansible_ssh_common_args='-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PreferredAuthentications=password -o PubkeyAuthentication=no -o KexAlgorithms=+diffie-hellman-group1-sha1 -o ProxyCommand="ssh -W %h:%p -q name@111.89.11.11"'

Now I get different error messages from the devices like

"msg": "unable to set terminal parameters"

or

"msg": "Error reading SSH protocol banner"

I assume that I should not use the network_cli to connect to a Linux system. But I have not found a way to use the Ansible builtin command to perform the action I need.

The problem is that I need to start a CLIsh shell first, then run multiple commands and capture the output.

UPDATE

So with help of the comments here I got it to work like this:

In the inventory file I use the SSH not Paramiko now:

ansible_connection=ssh

The Task looks like this:

 tasks:
    - name: Gather facts (Checkpoint GAIA)
      shell: |
         clish -c 'show hostname'
         sleep 2
         clish -c 'show version all'
         sleep 2
         clish -c 'show asset all'
      register: checkpoint_vars

Might be related: https://stackoverflow.com/q/9520609/2123530 — β.εηοιτ.βε, Feb 19 '22 at 16:55
hi, I am pretty sure the SSH connection works just fine as I get the "unable to set terminal parameters" for some hosts. And it does work for my other network devices. I think the problem is that "ansible.netcommon.network_cli" is the wrong method for Linux based systems. — Empusas, Feb 19 '22 at 19:54
The error message and the given comment are related to [New LibSSH Connection Plugin for Ansible Network Replaces Paramiko](https://www.ansible.com/blog/new-libssh-connection-plugin-for-ansible-network). — U880D, Feb 20 '22 at 18:10

U880D · Accepted Answer · 2022-02-20T18:06:08.833

1

According Ansible and Check Point and Getting started with Ansible and Check Point there are modules for management (Check_Point.Mgmt) available which seems all to connect over Web Services API.

In your case you could just try with the raw module according Whats the difference between ansible raw, shell and command or with ansible_network_os=vyos or nxos according Ansible Network Examples.

edited Feb 20 '22 at 18:06

answered Feb 20 '22 at 17:55

U880D

8,601
6
24
40

I am using now the "ansible_connection=ssh" and then the Ansible "shell" to execute the commands. That works very well. – Empusas Feb 23 '22 at 09:38

Ansible to run commands via SSH on remote hosts

1 Answers1