Paramiko doesnt get any data

[batchenr]

Im using python3 with Paramiko 2.10.3 on a palo alto version 9.1.10

I created this python script:

def connect_SSH():
    ssh_client = paramiko.SSHClient()
    ip='10.x.x.x'
    port=22
    username='someuser'
    password='somepassword'
    ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh_client.connect(ip,port,username,password , look_for_keys=False, allow_agent=False)
    remote_conn = ssh_client.invoke_shell()
    output = remote_conn.recv(1000)
    print(output)
    remote_conn.send("\n")
    remote_conn.send("show system info\n")
    time.sleep(5)
    output = remote_conn.recv(50000)
    print(output)
connect_SSH()

Now I dont get any data from the palo alto, this is what i recive:

b'Last login: Wed Apr  6 16:43:18 2022 from 10.x.x.x\r\r\n'
b'\r\nshow system info\r\n'

It is just repeating the command i did with no data. i have tried more ways to run it even with

stdout = remote_conn.send("show system info\n")

and i get:

b'Last login: Wed Apr  6 16:53:23 2022 from 10.x.x.x\r\r\n'
17
b'show system info\r\n\r\nshow system info\r\n'

What am i missing?

Im using paramiko as lest resort as i havent found any module of ansible to add dhcp relay to subinterface and also didnt find any docs to do it using python panos.

EDIT: also using this gives error:

stdin, stdout, stderr = ssh_client.exec_command('show system info')
time.sleep(5)
print("OUT", stdout.readlines())

b'Last login: Wed Apr  6 17:05:26 2022 from 10.x.x.x\r\r\n'
OUT []
Traceback (most recent call last):
  File "parmiko.py", line 76, in <module>
    connect_SSH()
  File "parmiko.py", line 52, in connect_SSH
    remote_conn.send("\n")
  File "/usr/local/lib/python3.6/dist-packages/paramiko/channel.py", line 801, in send
    return self._send(s, m)
  File "/usr/local/lib/python3.6/dist-packages/paramiko/channel.py", line 1198, in _send
    raise socket.error("Socket is closed")
OSError: Socket is closed

[JimmyHolland · Accepted solution]

Hi @batchenr, trying to fix your problem at source, does this example help for DHCP relay with Ansible?

  tasks:
    - name: Create DHCP relay on interface
      paloaltonetworks.panos.panos_type_cmd:
        provider: "{{ device }}"
        cmd: "set"
        xpath: "/config/devices/entry[@name='localhost.localdomain']/network/dhcp/interface/entry[@name='{{ interface }}']/relay"
        element: "<ip><server><member>{{ relay_ip }}</member></server><enabled>yes</enabled></ip>"

[batchenr]

Thanks!!! used it loke this :

---
- name: DHCP
hosts: localhost
connection: local
vars:
- ansible_python_interpreter: /usr/bin/env python3
roles:
- role: PaloAltoNetworks.paloaltonetworks
gather_facts: False
tasks:
- name: Grab the credentials
include_vars: 'firewall-secrets.yml'
- name: Create DHCP relay on interface
panos_type_cmd:
ip_address: '{{ ip_address }}'
username: '{{ username }}'
password: '{{ password }}'
cmd: "set"
xpath: "/config/devices/entry[@name='localhost.localdomain']/network/dhcp/interface/entry[@name='{{ interface }}']/relay"
element: "<ip><server><member>10.x.x.x1</member></server><enabled>yes</enabled></ip><ip><server><member>10.x.x.x2</member></server><enabled>yes</enabled></ip>"
register: response

- debug:
msg: "{{ response.stdout }}"
msg: "{{ response.stdout_xml }}"

- name: Commit changes
panos_commit:
ip_address: '{{ ip_address }}'
username: '{{ username }}'
password: '{{ password }}'

Couldnt find a way to send a list of dhcp ips so i duplicated the line

[JimmyHolland · Accepted solution]

Hi @batchenr, for multiple IP addresses in a single DHCP relay, your element would look like this ideally:

element: "<ip><server><member>{{ relay_ip_1 }}</member><member>{{ relay_ip_2 }}</member></server><enabled>yes</enabled></ip>"

[batchenr]

Now I have an issue deleting the dhcp relay:

tasks:
- name: delete DHCP relay on interface
panos_type_cmd:
ip_address: '{{ ip_address }}'
username: '{{ username }}'
password: '{{ password }}'
cmd: "delete"
xpath: "/config/devices/entry[@name='localhost.localdomain']/network/dhcp/interface/entry[@name='a5.22']/relay"

Im trying to delete the interface itself using "panos_l3_subinterface" module but it gives errors that i have to delete the dhcp first

what is the correct way ?

also tried with "element" there but nothing seem to work

Thanks!

[JimmyHolland]

Hi @batchenr, yes, PAN-OS maintains referential integrity, meaning you can not delete a layer3 network interface if there are things attached to it like a DHCP relay (or other things like DNS servers, GlobalProtect, etc). So please delete the other items before trying to delete the layer 3 network interface.