# Cant get ansible to properly route through bastion host

**URL:** <https://forum.ansible.com/t/cant-get-ansible-to-properly-route-through-bastion-host/32771>\
**Category:** Ansible Project\
**Created:** [April 23, 2020, 7:22pm UTC](https://forum.ansible.com/t/cant-get-ansible-to-properly-route-through-bastion-host/32771 "2020-04-23T19:22:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emil\_Safonov](https://avatars.discourse-cdn.com/v4/letter/e/8e7dd6/32.png) [@Emil\_Safonov](https://forum.ansible.com/u/Emil_Safonov)\
**Post date:** [April 23, 2020, 7:22pm UTC](https://forum.ansible.com/t/cant-get-ansible-to-properly-route-through-bastion-host/32771/1 "2020-04-23T19:22:18Z")

</div>

Hey Everyone,

I’ve been having difficulty getting my ansible playbooks to route through a bastion host (without ssh keys). For testing I have a cisco virl (virtual internet routing lab) simulation up and running with virtualized network devices, and the bastion host should be the server that is running the simulations.

I can confirm that, after defining an ssh.cfg file, I can ssh into the virtualized network device via the command “ssh -F ssh.cfg xxx.xxx.1.xxx -v” just fine, and first input the password for the bastion host and then input the password to the cisco virtualized device. But each time I try and run the playbook I get either a timeout or “ssh protocol banner cant be read”. How can I confirm ansible is trying to connect to the bastion host first? I never see that in the terminal stdout, even with -vvvvvv it never shows it connecting to the bastion host but just to the device defined in hosts.virl.

Command to run playbook: ANSIBLE\_HOST\_KEY\_CHECKING=False ansible-playbook playbook.yml -i hosts.virl -k -vvvvvv

Below are my files (playbook, host, ansible.cfg and ssh.cfg + groupvars/all.yml and groupvars/ios.yml).

playbook.yml

`

---

<div class="post-metadata">

**Author:** ![Venu\_Devannagari1](https://avatars.discourse-cdn.com/v4/letter/v/439d5e/32.png) [@Venu\_Devannagari1](https://forum.ansible.com/u/Venu_Devannagari1)\
**Post date:** [July 27, 2020, 6:06am UTC](https://forum.ansible.com/t/cant-get-ansible-to-properly-route-through-bastion-host/32771/2 "2020-07-27T06:06:38Z")

</div>

Hi @Emil Safonov

Did you resolve the issue??

If yes can you please help me here I am also facing the same issue.

Thanks,  
D.Venu.

---

<div class="post-metadata">

**Author:** ![Emil\_Safonov](https://avatars.discourse-cdn.com/v4/letter/e/8e7dd6/32.png) [@Emil\_Safonov](https://forum.ansible.com/u/Emil_Safonov)\
**Post date:** [July 28, 2020, 7:30pm UTC](https://forum.ansible.com/t/cant-get-ansible-to-properly-route-through-bastion-host/32771/3 "2020-07-28T19:30:37Z")

</div>

Hey Venu,

I was able to resolve the issue using a linux module called sshpass. I’ll show below:

hosts.through\_bastion

[ios]

10._._.1

10._._.2

[ios:vars]

ansible\_user=

ansible\_password=

ansible\_become\_pass=

ansible\_network\_os=ios

network\_os=ios

ansible\_ssh\_common\_args=" -o ProxyCommand="sshpass -p ‘\<password\_to\_bastion\>’ ssh -q -W %h:%p \<bastion\_username\>@\<bastion\_ip\_or\_dns""

So whats happening here is we are using ansible\_ssh\_common\_args=“the above string”. That means ansible will take that aboove string and instead of performing “ssh username@hostname” it will perform “sshpass -p etc.” as its ssh command.

The sshpass module allows you to input a password that will act on the bastion host, then proxy all commands through that instead of just using ssh. This is the only way I could get it to authenticate WITHOUT an ssh key. One problem you might see is exposing your usernames/passwords in these files, however what you can do is use ansible vault to save credentials within your group\_vars/all.yml file, set them to a variable and then use those vaulted credentials during playbook execution.

Hope this helps!