# Can't connect to Cisco router using network\_cli but ssh from raw module works fine **URL:** \ **Category:** Get Help\ **Tags:** cisco, ssh, network\ **Created:** [March 9, 2024, 12:04am UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281 "2024-03-09T00:04:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jneiberger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jneiberger/32/2528_2.png) [@jneiberger](https://forum.ansible.com/u/jneiberger)\ **Post date:** [March 9, 2024, 12:04am UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/1 "2024-03-09T00:04:40Z")
```auto % ansible --version ansible [core 2.16.4] config file = /Users/john/scripts/ansible-testing/ansible.cfg configured module search path = ['/Users/john/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /Users/john/scripts/ansible-testing/ansible-testing/lib/python3.12/site-packages/ansible ansible collection location = /Users/john/.ansible/collections:/usr/share/ansible/collections executable location = /Users/john/scripts/ansible-testing/ansible-testing/bin/ansible python version = 3.12.2 (main, Feb 6 2024, 20:19:44) [Clang 15.0.0 (clang-1500.1.0.2.5)] (/Users/john/scripts/ansible-testing/ansible-testing/bin/python3) jinja version = 3.1.3 libyaml = True % ssh -V OpenSSH_9.4p1, LibreSSL 3.3.6 ``` I’m pulling my hair out over this issue. I’ve spent some time doing the usual Googling and searching on reddit, but can’t quite find the right mix of magic dust to sprinkle on my laptop to get this to work. I’m new to Ansible and currently testing it on my Macbook Pro (Sonoma 14.3.1). I had previously installed Ansible using `brew` but I was running into some issues. I uninstalled it, created a `venv` with one of the two versions of Python on my system, then installed ansible as well as `ansible-pylibssh`. With `ansible_connection=ssh`, I can run adhoc commands against my Cisco IOS XR routers with no problem. When I try to run a command using the `cisco.iosxr.iosxr` module, I get an error that ssh it not a valid connection type, so I switched it to `network_cli`. Once I do that, I run into constant SSH errors/mismatches with the crypto algos. I suspect the problem is that the Cisco routers use older algos than what Ansible is offering. But I can ssh to my devices from my command line with no problem because I added the right algos to my ssh config file. Is there a way to force Ansible to use the `ssh` version configured on my machine rather than…whatever the heck it’s doing. I suspect it’s using paramiko or something and bypassing my host’s ssh config. At the current moment, I have the following in my ansible.cfg: ```auto ansible_network_os=cisco.iosxr.iosxr ansible_connection=ansible.netcommon.network_cli ``` I think this is the relevant portion of the error when I run an adhoc command with a lot of verbosity: ` "msg": "ssh connection failed: ssh connect failed: kex error : no match for method kex algos: server [ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1], client [diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1]"` In case it’s relevant, here is the adhoc command: `ansible my_routers -m cisco.iosxr.iosxr_command -a "commands=['show run formal router isis']"` As I mentioned, if I switch the ansible\_connection to SSH and then use `-m raw` instead, it works just fine. How can I get Ansible to use the right algos? Thanks! ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [March 9, 2024, 4:20am UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/2 "2024-03-09T04:20:43Z")
@jneiberger Hi. Which do you use paramiko or pylibssh? You can confirm it by ansible-playbook command with `-vvvv`. ```auto $ ansible-playbook -i inventory.ini playbook.yml -vvvv ...(omitted)... ssh type is now set to paramiko ...(omitted)... ``` or ```auto ssh type is now set to libssh ``` If both has installed, you can choose one by [`ansible_network_cli_ssh_type`](https://docs.ansible.com/ansible/latest/collections/ansible/netcommon/network_cli_connection.html#parameter-ssh_type). ---
**Author:** ![jneiberger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jneiberger/32/2528_2.png) [@jneiberger](https://forum.ansible.com/u/jneiberger)\ **Post date:** [March 9, 2024, 4:04pm UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/3 "2024-03-09T16:04:37Z")
Looks like the ssh type starts out as auto and then gets set to `libssh`. As I recall, in order to use the `cisco.iosxr.iosxr`, I was forced to switch to `network_cli`, but in order to get that work, I had to install `ansible-pylibssh` as well as `libssh` itself using Homebrew. I added set it to use paramiko in my ansible.cfg file. I didn’t get a crypto error this time. Now I’m getting this: `"msg": "No existing session"` I did a search for “ansible cisco no existing session” and see that it has been a common problem for years and I don’t see a solution yet, although there must be one somewhere. Thanks, John EDIT: It looks like this might be a paramiko problem, not an Ansible problem. I see some people running into this when using paramiko in Python to connect to network devices. For example: [https://stackoverflow.com/questions/6832248/paramiko-no-existing-session-exception](https://stackoverflow.com/questions/6832248/paramiko-no-existing-session-exception) I’m not sure what the solution is, though. Maybe I just need to switch back to `libssh` and then figure out the crypto algo problem. If I can set which crypto algos to use in Ansible, I think that would solve it. ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [March 10, 2024, 1:54pm UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/4 "2024-03-10T13:54:49Z")
In my experience, the error `"msg": "No existing session"` is difficult to identify the cause… I am not too sure, but if you are using paramiko and authenticating by user and password, try the following `ansible.cfg`. ```ini [paramiko_connection] look_for_keys = False ``` ---
**Author:** ![jneiberger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jneiberger/32/2528_2.png) [@jneiberger](https://forum.ansible.com/u/jneiberger)\ **Post date:** [March 11, 2024, 3:12pm UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/5 "2024-03-11T15:12:54Z")
It looks like that worked! I really appreciate the help! I’m still getting used to the layout of the Ansible docs and I didn’t find the options for `[persisistent_connection]` and `[paramiko_connection]` in them anywhere yet. But I tried it and it works, so for that I’m grateful. ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [March 11, 2024, 11:49pm UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/6 "2024-03-11T23:49:11Z")
Good! My My pleasure. That’s configuration item listed in Ansible Configuration Settings. [https://docs.ansible.com/ansible/latest/reference\_appendices/config.html#paramiko-look-for-keys](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#paramiko-look-for-keys) According to my research, by default it seams paramiko searches a default keys (such as `~/.ssh/id_rsa`) even though the `ansible_password` is defined. The paramiko uses `ansible_password` by setting `look_for_keys = False` It is unclear why the error message `"msg": "No existing session"` appears… Could you mark as solution my comment for explicitly state that this topic has been resolved? ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [April 10, 2024, 11:50pm UTC](https://forum.ansible.com/t/cant-connect-to-cisco-router-using-network-cli-but-ssh-from-raw-module-works-fine/4281/7 "2024-04-10T23:50:07Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.