<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Thanks Ryan. I’m unable to concretely determine a device is an ASA from it’s domain name, unless I populate .cloginrc with every ASA I have. I used to do that, but it became cumbersome and at somepoint it was clear it would no longer
scale. For a while I also went down the path of having a .cloginrc-asa that had the ASA-specific methods and then included .cloginrc, but for similar manageability reasons I had to abandon that approach as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there a way to do that by some other means?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">weylin<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Dan Anderson <dan.w.anderson@gmail.com><br>
<b>Date: </b>Monday, September 11, 2017 at 17:01<br>
<b>To: </b>Weylin Piegorsch <weylin@bu.edu>, Ryan West <rwest@zyedge.com>, "rancid-discuss@shrubbery.net" <rancid-discuss@shrubbery.net><br>
<b>Subject: </b>Re: [rancid] ASA Config for Rancid<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">You can set the method for the ASAs to be {ssh,telnet} in your .cloginrc file. I'm on my phone and don't have the exact syntax handy but it's pretty straightforward.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On Mon, Sep 11, 2017 at 4:56 PM Ryan West <<a href="mailto:rwest@zyedge.com">rwest@zyedge.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-left:.5in">On Mon, Sep 11, 2017 at 16:51:34, Piegorsch, Weylin William wrote:<br>
> Subject: [rancid] ASA Config for Rancid<br>
><br>
> Cisco question, that I’m having a devil of a time getting a Cisco answer to.<br>
><br>
> I have several ASAs – some locally connected, some connected at the far end<br>
> of an IPSec tunnel. In nearly all cases, I can’t get rancid to archive their<br>
> config. For reasons that don’t relate to the ASA (has to do with the larger<br>
> network as a whole), I need telnet to be the first method, with SSH backup.<br>
> But, the ASAs drop the telnet request, they don’t send a TCP RST packet. As<br>
> a consequence, rancid times out and considers it an unreachable device.<br>
><br>
> I’m trying to find a mechanism that doesn’t require specifying custom rancid<br>
> configs for ASAs that are different than anything else.<br>
><br>
<br>
Try to allow telnet access from the remote network as sourced from inside and then use 'management-access inside' and you should be able to telnet to the inside address from across a VPN tunnel.<br>
<br>
-ryan<br>
_______________________________________________<br>
Rancid-discuss mailing list<br>
<a href="mailto:Rancid-discuss@shrubbery.net" target="_blank">Rancid-discuss@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/rancid-discuss" target="_blank">http://www.shrubbery.net/mailman/listinfo/rancid-discuss</a><o:p></o:p></p>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Dan<o:p></o:p></p>
</div>
</div>
</body>
</html>