Re: [rancid] Palo Alto (Panorama) configuration
You can use "show config merged" to see the local device's config merged with the templates from Panorama. On Thu, Jul 11, 2019 at 02:19:00PM +, Gauthier, Chris wrote: > I have run into the issues seen below, as we migrated to a fully-managed > Panorama ecosystem in recent months. The output of the “show configuration > running” (or whatever it is) is more limited on the managed device because (I > believe) what is being shown is only the locally-managed configuration. I > haven’t looked yet to see if there is a workaround. > > --Chris > > > Chris Gauthier Senior Network Engineer | Comscore > t +1 (503) 331-2704 | > cgauth...@comscore.com > comscore.com > This e-mail (including any attachments) may contain information that is > private, confidential, or protected by attorney-client or other privilege. If > you received this e-mail in error, please delete it from your system and > notify sender. > From: Rancid-discuss on behalf of > annie lee > Date: Wednesday, July 10, 2019 at 6:02 PM > To: john heasley > Cc: "rancid-discuss@shrubbery.net" > Subject: Re: [rancid] Palo Alto (Panorama) configuration > > i tried to grab the configs from the panorama and it's what i wanted :-) > apology, im pretty new to the paloalto and panorama device/setup. > > thanks and glad i can backup the palo/panorama configs without any tweaking. > > On Thu, Jul 11, 2019 at 9:23 AM annie lee > mailto:lsy.an...@gmail.com>> wrote: > Hi John, > > Thanks for your reply and apology for the typo on the paloalto type. > (1.1.1.1;paloalto;up) > Below are the sample config for one of the firewall configs (removed all the > ip addresses). > Basically there are heaps more configs (routing, policy, NAT, virtual router > and etc...) i can see from the Panorama. > Not sure its similar to F5 tweak that we need to add the partition to grab > the full configs. > > Rgds > > On Thu, Jul 11, 2019 at 7:42 AM john heasley > mailto:h...@shrubbery.net>> wrote: > Wed, Jul 10, 2019 at 11:53:42AM +1000, annie lee: > > Hi All, > > > > Another question, just added a new PaloAlto to rancid (3.9) but not much > > configurations being backup (not even interfaces addresses) > > Anything need to be changed/added to backup the entire configuration ? > > > > 1.1.1.1;palo-alto;up > > Please use the built-in type for PAN: paloalto. if that is still lacking, > please be more specific about what commands are missing. it collects > > show system info;show chassis inventory;show config running ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] Rancid running numerous times for each group? Getting ~40 config fetcher email alerts for same group in a night
On Fri, May 24, 2019 at 04:44:23PM +, Ni Ne wrote: > >> Running ranicd 3.8 on CentOS 6.10, using git as the repo type. > >> > >> It appears rancid is running numerous times against the same group in a > >> given night - at least if config fetches fail. > >> > >> For instance, I have one group with some problematic devices, and I got 39 > >> "config fetcher" emails for that same group. Looking at logs, it appears > >> rancid is parsing every group approximately the same number of times. > >> > >> There is only one cronjob that kicks off rancid on the entire system: > >> > >> * 0 * * * /usr/local/rancid/bin/rancid-run > > > man 5 crontab > > > min hr dom mon dow cmd > > That looks right to me. Should kick off every night at midnight. Which it's > doing. An entire run takes about 4 hours or so. All logs/emails from a > nightly run arrive within that time-frame - 12am - 4am. No, it says to run: * - every minute 0 - of the 0 hour * - of every day of month * - of every month * - of every day of week So I'd expect 60 copies to be run at midnight every night. ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] issues with mail and aliases
After editing /etc/aliases, you must run "newaliases". I maintain the Centos 7 EPEL package for rancid. It is updated to 3.9--you should get the update in the next update batch (whenever that happens I'm not sure), or you can get it now from epel-testing. On Wed, Mar 20, 2019 at 08:37:16AM -0500, N. Max Pierson wrote: > Hi List, > > I have a new install on Centos 7 (supplied rpm rancid 3.2) and I am having > issues with the regular emails that go out when rancid is run. I have > installed sendmail and couldn't get it to work nor is postfix working. When > I tail the maillog it shows the messages going to rancid-@ > mydomain.com and it seems as though the aliases that I have entered isn't > being resolved. I'm ignorant when it comes to email so can anyone point me > in the right direction that has seen this before? > > Regards, > Max ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
[rancid] [PATCH] Ciena Waveserver wavesvros.pm: fix filtering user passwords
The attached patch for Ciena Waveserver devices fixes the filter for user
passwords to also filter the "user set" command not just "user create" and also
fixes the spacing before the secret.
Result:
- !user create user rancid access-level limited secret
- user set user su access-level super secret
$6$XXX
+ !user create user rancid access-level limited secret
+ !user set user su access-level super secret
--- wavesvros.pm.filter-secrets 2019-02-06 02:03:28.0 -0500
+++ wavesvros.pm2019-02-20 11:59:03.572506777 -0500
@@ -262,7 +262,7 @@
# ProcessHistory("","","","#$1$'");
# next;
# }
- if (/(user create user \S+ access-level \S+ secret) / &&
+ if (/(user (create|set) user \S+ access-level \S+ secret )/ &&
$filter_pwds >= 1) {
ProcessHistory("","","","!$1\n");
next;
___
Rancid-discuss mailing list
Rancid-discuss@shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
My example below WAS from an EX2200. We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure? I have also seen N/A in 2016, but not lately. What software version are you running? We are running 12.3R12-S2 on this particular outdoor EX2200. I can try to find out what version we were running in 2016 when we last saw N/A. I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0. On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote: > Ironically, we rely on RANCID to tell us when our cabinets get too cold on > such devices. > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed > source!), so it never occurred to me to submit a patch for this. > > However, some devices (namely, EX2200's) don't understand zero, or sub-zero > degrees and report it as N/A. > I've attached a patch to cover this circumstance. > > # Class Item Status > # Power FPC 0 Power Supply 0 OK > # Temp FPC 0 GEPHY1 OK > - # FPC 0 GEPHY2 OK N/A > + # FPC 0 GEPHY2 OK > # FPC 0 GEPHY3 OK > # FPC 0 GEPHY4 OK > # > > -Original Message- > From: Rancid-discuss [mailto:rancid-discuss-boun...@shrubbery.net] On Behalf > Of Anderson, Charles R > Sent: Tuesday, February 19, 2019 6:50 AM > To: rancid-discuss@shrubbery.net > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in > ShowChassisEnvironment > > One of our switches is in an outdoor cabinet. It gets below 0 sometimes so > we see output like this: > > # Temp FPC 0 GEPHY1 OK > # FPC 0 GEPHY2 OK > # FPC 0 GEPHY3 OK > - # FPC 0 GEPHY4 OK -5 degrees C / 23 degrees > F > + # FPC 0 GEPHY4 OK > # > > The attached patch fixes ShowChassisEnvironment so it matches the - sign. ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
[rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
One of our switches is in an outdoor cabinet. It gets below 0 sometimes so we
see output like this:
# Temp FPC 0 GEPHY1 OK
# FPC 0 GEPHY2 OK
# FPC 0 GEPHY3 OK
- # FPC 0 GEPHY4 OK -5 degrees C / 23 degrees F
+ # FPC 0 GEPHY4 OK
#
The attached patch fixes ShowChassisEnvironment so it matches the - sign.
--- junos.pm.negative-temp 2019-02-12 21:16:55.165617409 -0500
+++ junos.pm2019-02-19 09:39:52.374354729 -0500
@@ -206,7 +206,7 @@
/ backplane temperature/ && next;
/(\s*Power supply.*), temperature/ &&
ProcessHistory("","","","# $1\n") && next;
- /(\s*.+) +\d+ degrees C.*$/ &&
+ /(\s*.+) +-?\d+ degrees C.*$/ &&
ProcessHistory("","","","# $1\n") && next;
/(^.*\S)\s+ Spinning at .*$/ &&
ProcessHistory("","","","# $1\n") && next;
___
Rancid-discuss mailing list
Rancid-discuss@shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss
[rancid] [PATCH] escape double quotes in command string
I'd like to add some custom Junos commands in rancid.types.conf such as:
wpi-juniper;command;junos::ShowChassisHardware;show lldp neighbors | match
"^Local | ae[0-9]+ "
wpi-juniper;command;junos::ShowChassisHardware;show system commit | except
^rescue | trim 4 | except "by apipush via"
These are rather WPI-specific, filtering output based on local conventions, so
they are not suitable for distribution with upstream
RANCID (although the "show system commit | except ^rescue | trim 4" part could
be worthy of upstream inclusion--it shows the commit messages people gave when
they changed the config--but the rollback numbers rotate and need to be trimmed
out, hence the "| trim 4" part). By doing filtering in the Junos CLI, it
allows local customizations without the need to write a new RANCID module to
filter the output. This works fine except for the " double quote characters,
which mess up when passed to system() and open() calls. The attached patch
escapes these double quotes before passing the command to the system() or
open(). The \" escaping cannot be done in rancid.types.conf because it will
cause problems with the command name not matching the CLI output.
--- rancid.orig 2019-02-06 02:03:28.0 -0500
+++ rancid 2019-02-13 13:32:04.103689467 -0500
@@ -116,12 +116,14 @@
print(STDERR "opening file $host\n") if ($debug || $log);
open(INPUT,"<$host") || die "open failed for $host: $!\n";
} else {
-print(STDERR "executing $lscript -t $timeo -c\"$commandstr\" $host\n") if
($debug || $log);
+my $cstr = $commandstr;
+$cstr =~ s/\"/\\\"/g;
+print(STDERR "executing $lscript -t $timeo -c\"$cstr\" $host\n") if
($debug || $log);
if (defined($ENV{NOPIPE}) && $ENV{NOPIPE} =~ /^YES/i) {
- system "$lscript -t $timeo -c \"$commandstr\" $host
$host.raw 2>&1" || die "clogin failed for $host: $!\n";
+ system "$lscript -t $timeo -c \"$cstr\" $host $host.raw
2>&1" || die "clogin failed for $host: $!\n";
open(INPUT, "< $host.raw") || die "clogin failed for $host: $!\n";
} else {
- open(INPUT,"$lscript -t $timeo -c \"$commandstr\" $host ___
Rancid-discuss mailing list
Rancid-discuss@shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] Device PacketShaper
Let's please keep the discussion on-list so that others may participate. Thanks. I believe Blue Coat packetshapers were an acquisition from Packeteer. I do not think RANCID supports them out of the box, but you may have luck searching for "rancid packeteer" instead of "rancid bluecoat" to see if someone else has gotten them to work. https://www.google.com/search?client=firefox-b-1-d=rancid+packeteer http://www.shrubbery.net/rancid/search.cgi It seems there was discussion on this very list in 2004 and 2007: http://www.shrubbery.net/pipermail/rancid-discuss/2004-May/000783.html - Forwarded message from Umar Farooq - Date: Mon, 18 Feb 2019 09:25:23 -0500 From: Umar Farooq To: "Anderson, Charles R" Subject: Re: [rancid] Device PacketShaper Return-Path: ufaro186...@gmail.com Hello Charles R, Blue Coat On Sun, Feb 17, 2019 at 5:04 PM Anderson, Charles R wrote: > Who manufactured your packetshaper? > > On Fri, Feb 15, 2019 at 10:14:39AM -0500, Umar Farooq wrote: > > Hello, > > > > I am trying to add my device packetshaper in rancid router.db. I am not > > sure which device name should I use for it. > > > > For example if it is a cisco device then > > Router01.example.com;cisco;up > > works fine but with packetshaper I tried > > Router02.example.com;packetshaper;up > > However, this does not work. > > > > Please if you could guide me I would truly appreciate it. > > > > Thank you ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] Device PacketShaper
Who manufactured your packetshaper? On Fri, Feb 15, 2019 at 10:14:39AM -0500, Umar Farooq wrote: > Hello, > > I am trying to add my device packetshaper in rancid router.db. I am not > sure which device name should I use for it. > > For example if it is a cisco device then > Router01.example.com;cisco;up > works fine but with packetshaper I tried > Router02.example.com;packetshaper;up > However, this does not work. > > Please if you could guide me I would truly appreciate it. > > Thank you ___ Rancid-discuss mailing list Rancid-discuss@shrubbery.net http://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: [rancid] Juniper SRX cluster {primary:nodeX}, {secondary:nodeX} filtering
The ShowSystemCoreDumps function was missing this filter. I updated the patch
to add this.
On Tue, Feb 12, 2019 at 11:56:31PM +, Anderson, Charles R wrote:
> I'm using the "juniper" type on RANCID 3.9 collecting from Juniper EX/QFX/MX
> devices and SRX clusters. On the EX/QFX/MX devices the {master:N} and
> {backup:N} first line of the prompt (related to RE redundancy) is filtered
> out. But on the SRX clusters, they use a different type of clustering
> compared with MX/EX, and the first line of the prompt there has
> {primary:node0}, {secondary:node1} etc. Additionlly, it is possible for
> {linecard:X) to appear there for non-RE members of a EX/QFX Virtual Chassis.
> For many years we've been using a local change to RANCID that filters out
> these with code such as:
>
>next if (/^\{(master|backup|primary|secondary)/);
>
> I'd like to get this changed upstream so we no longer have to use our local
> customizations. Would you consider a patch similar to below (applied
> everywhere master|backup is already filtered):
>
> - next if (/^\{(master|backup)(:\d+)?\}/);
> + next if
> (/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
>
> I've attached the entire patch against 3.9 which I've tested with all my
> EX/QFX/MX/SRX devices. Thanks.
--- junos.pm.orig 2019-02-06 02:03:28.0 -0500
+++ junos.pm2019-02-12 21:16:55.165617409 -0500
@@ -150,7 +150,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -194,7 +194,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -231,7 +231,7 @@
last if (/^$prompt/);
return(1) if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
return(0) if ($junos::ShowChassisFirmware);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
@@ -259,7 +259,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -288,7 +288,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -314,7 +314,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -348,7 +348,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
return(0) if ($junos::ShowChassisSCB);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
@@ -382,7 +382,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/Unrecognized command/ && return(1);
/command is not valid/ && return(1);
@@ -405,7 +405,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{
[rancid] Juniper SRX cluster {primary:nodeX}, {secondary:nodeX} filtering
I'm using the "juniper" type on RANCID 3.9 collecting from Juniper EX/QFX/MX
devices and SRX clusters. On the EX/QFX/MX devices the {master:N} and
{backup:N} first line of the prompt (related to RE redundancy) is filtered out.
But on the SRX clusters, they use a different type of clustering compared with
MX/EX, and the first line of the prompt there has {primary:node0},
{secondary:node1} etc. Additionlly, it is possible for {linecard:X) to appear
there for non-RE members of a EX/QFX Virtual Chassis. For many years we've
been using a local change to RANCID that filters out these with code such as:
next if (/^\{(master|backup|primary|secondary)/);
I'd like to get this changed upstream so we no longer have to use our local
customizations. Would you consider a patch similar to below (applied
everywhere master|backup is already filtered):
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
I've attached the entire patch against 3.9 which I've tested with all my
EX/QFX/MX/SRX devices. Thanks.
--- junos.pm.orig 2019-02-06 02:03:28.0 -0500
+++ junos.pm2019-02-12 18:52:19.073192943 -0500
@@ -150,7 +150,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -194,7 +194,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -231,7 +231,7 @@
last if (/^$prompt/);
return(1) if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
return(0) if ($junos::ShowChassisFirmware);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
@@ -259,7 +259,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -288,7 +288,7 @@
last if (/^$prompt/);
return 1 if (/^aborted!/i);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -314,7 +314,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
/Couldn\'t initiate connection/ && return(-1);
@@ -348,7 +348,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
return(0) if ($junos::ShowChassisSCB);
/error: the chassis(-control)? subsystem is not r/ && return(-1);
@@ -382,7 +382,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/Unrecognized command/ && return(1);
/command is not valid/ && return(1);
@@ -405,7 +405,7 @@
tr/\015//d;
last if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if (/^\{(master|backup)(:\d+)?\}/);
+ next if
(/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
/Unrecognized command/ && return(1);
/command is not valid/ && return(1);
@@ -431,7 +431,7 @@
tr/\015//d;
($found_end = 1, last) if (/^$prompt/);
next if (/^system (shutdown message from|going down )/i);
- next if
