Running SSH scripts on Cisco ASA firewalls

rhiannone1
Kilo Contributor

‎07-13-2016 06:12 AM

Hi,

In a Geneva instance with Domain Separation and Orchestration enabled. We are looking into running SSH scripts on Cisco ASA firewalls from ServiceNow.

ServiceNow allows specifying username and password to logon to the device, however Cisco ASA and other Cisco routers are also requiring "enable" command running after the authentication process for access to elevated configuration prompt.

Can you look into this and provide us with instructions on how to configure enable password, so it is passed into the script and also stored in ServiceNow securely.

Below is the screenshot on how it looks from the SSH prompt (we've removed the IP at line 2):

CiscoPutty.png

We would be grateful for any insight or help.

Thanks

Labels:
Preview file
8 KB
  • 4,130 Views
1 REPLY 1

Antony_Alldis
ServiceNow Employee
ServiceNow Employee

‎07-28-2016 04:40 AM

rhiannone

Hi Rhiannone,



I have been looking into this with one of the Development Team, and currently we don't have the facility to handle this functionality completely Out Of Box.



I would suggest raising an Enhancement Request ServiceNow KB: Requesting ServiceNow product enhancements (KB0547257) to see if the facility to be able to call secondary credentials would be possible in a future release.



However, trawling the net for ways to achieve this, I have found the following example which is using the "expect" utility: https://paulgporter.net/2012/12/08/30/



As you can see from the example, this has been configured in two parts:



1) A bash script that takes the initial SSH password to login to the device, and also gets the "enable" password. This also invokes the expect script.


2) The .exp (expect script) that uses the passwords from 1 above.



If you're using a Linux MID server, this is fairly easy to implement - as SSH will be installed and expect is easily available.



You could then setup an Orchestration Activity to ask/automatically push the expect password (*ssh passwords etc... would be handled by "credentials") - pass the variables through to the expect script which would be installed on the MID server host.



You could also get this to run specific commands by making them variables to the script, which could be selected via a drop-down in the Orchestration Activity.



You can get expect for Windows (http://wiki.tcl.tk/3548)   - so if you're using a Windows MID you could do it there too (but you'll also need to have SSH installed).



Popular scripting languages support expect-like functionality:



Perl has the "Expect" Module (Expect.pm - search.cpan.org)


Python has the "Pexepect" Module (Pexpect - a Pure Python Expect-like module)



* Please note: ServiceNow are not responsible/liable for all external sites referenced above.



I hope the above is of some use.



Best regards,


Tony