Command timeout triggered on Cisco 2960X (ios_commands)

qL555 · April 29, 2025, 8:51am

Im trying to configure a Cisco 2960X with Ansible. I did this with several other models before but this time I run into weird issues.

Setup

ubuntu 22.04
ansible 8.3.0
ansible core 2.15.3
python 3.10.12
cisco 2960X - IOS 15.2(7)E11
ansible galaxy (cisco.ios) - just updated

Ansible-Playbook

---
- hosts: test-switch
  connection: network_cli
  gather_facts: no
  tasks:

  - name: gather facts
    cisco.ios.ios_command:
      commands:
        - show clock
    register: output_config

  - name: print facts
    debug:
      msg: "{{ output_config }}"

Inventory

---
  ios:
    hosts:
      test-switch:
        ansible_host: x.x.x.x
        ansible_network_os: ios
        ansible_ssh_args: "-o KexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1"

Playbook Execution

ansible-playbook -i ../inventory.yml test.yml --user "xxx" --ask-pass

Issue

Error Message

fatal: [test-switch]: FAILED! => {"changed": false, "msg": "command timeout triggered, timeout value is 30 secs.\nSee the timeout setting options in the Network Debug and Troubleshooting Guide."}

Thinks that work

ssh connection from Ubuntu Server to Switch
I see a running ssh session on the switch while the playbook is running:

Connection Version Mode  Encryption  Hmac          State                
0          2.0     IN   aes256-ctr  hmac-sha2-256 Session started

What I tried

Setting timeout to a higher value (doesn´t make sense because the switch is localy connected via a firewall)
trying to set some ssh cipher args to maybe solve the issue
enabled ansible debug and checked -vvvv and ~/ansible.log for any other error messages
Used the same playbook to run on a Cisco 9300, worked fine
Tried other cisco moduls (facts/command/config)
Checked firewall logs (no blocks or anything suspicious)

Debug Log

TASK [gather facts] **************************************************************************************************
1272990 1745916503.71992: sending task start callback
1272990 1745916503.71995: entering _queue_task() for test-switch/cisco.ios.ios_command
1272990 1745916503.71997: Creating lock for cisco.ios.ios_command
1272990 1745916503.72220: worker is 1 (out of 1 available)
1272990 1745916503.72254: exiting _queue_task() for test-switch/cisco.ios.ios_command
1272990 1745916503.72320: done queuing things up, now waiting for results queue to drain
1272990 1745916503.72326: waiting for pending results...
1272995 1745916503.72517: running TaskExecutor() for test-switch/TASK: Gather only the interfaces resource facts and no legacy facts
1272995 1745916503.72663: in run() - task 3966bda4-269e-a9ef-2c3e-000000000010
1272995 1745916503.72706: variable 'ansible_search_path' from source: unknown
1272995 1745916503.72725: calling self._execute()
1272995 1745916503.72784: variable 'ansible_host' from source: host vars for 'test-switch'
1272995 1745916503.72787: variable 'ansible_user' from source: host vars for 'test-switch'
1272995 1745916503.72787: variable 'ansible_password' from source: host vars for 'test-switch'
1272995 1745916503.72797: variable 'ansible_network_os' from source: host vars for 'test-switch'
1272995 1745916503.72799: variable 'ansible_become' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.72800: variable 'ansible_become_method' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.72805: variable 'omit' from source: magic vars
1272995 1745916503.72890: variable 'omit' from source: magic vars
1272995 1745916503.72915: variable 'omit' from source: magic vars
1272995 1745916503.72938: variable 'omit' from source: magic vars
1272995 1745916503.73005: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection
1272995 1745916503.73054: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/__pycache__
1272995 1745916503.75237: Loading ModuleDocFragment 'ansible_collections.ansible.netcommon.plugins.doc_fragments.connection_persistent' from /home/ansible/.ansible/collections/ansible_collections/ansible/netcommon/plugins/doc_fragments/connection_persistent.py
1272995 1745916503.75313: Loaded config def from plugin (connection/ansible_collections.ansible.netcommon.plugins.connection.network_cli)
1272995 1745916503.75318: Loading Connection 'ansible_collections.ansible.netcommon.plugins.connection.network_cli' from /home/ansible/.ansible/collections/ansible_collections/ansible/netcommon/plugins/connection/network_cli.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/__pycache__)
1272995 1745916503.75333: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell
1272995 1745916503.75362: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.75371: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.75376: Loading Connection 'local' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/local.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/__pycache__) (found_in_cache=True, class_only=False)
1272995 1745916503.75389: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.75391: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.75412: Loading Connection 'ssh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/ssh.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/__pycache__) (found_in_cache=True, class_only=True)
1272995 1745916503.75591: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/terminal
1272995 1745916503.75601: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/terminal/__pycache__
1272995 1745916503.75868: Loading TerminalModule 'ansible_collections.cisco.ios.plugins.terminal.ios' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible_collections/cisco/ios/plugins/terminal/ios.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/terminal:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/terminal/__pycache__)
1272995 1745916503.75952: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/cliconf
1272995 1745916503.75966: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/cliconf/__pycache__
1272995 1745916503.76790: Loaded config def from plugin (cliconf/ansible_collections.cisco.ios.plugins.cliconf.ios)
1272995 1745916503.76796: Loading Cliconf 'ansible_collections.cisco.ios.plugins.cliconf.ios' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible_collections/cisco/ios/plugins/cliconf/ios.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/cliconf/__pycache__:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/cliconf)
1272995 1745916503.76801: variable 'ansible_become' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.76802: variable 'ansible_become' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.76803: variable 'ansible_become_method' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.76804: variable 'ansible_become_method' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.76814: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/become
1272995 1745916503.76934: trying /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/become/__pycache__
1272995 1745916503.77047: Loaded config def from plugin (become/ansible_collections.ansible.netcommon.plugins.become.enable)
1272995 1745916503.77050: Loading BecomeModule 'ansible_collections.ansible.netcommon.plugins.become.enable' from /home/ansible/.ansible/collections/ansible_collections/ansible/netcommon/plugins/become/enable.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/become/__pycache__:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/become)
1272995 1745916503.77059: variable 'inventory_hostname' from source: host vars for 'test-switch'
1272995 1745916503.77060: variable 'ansible_host' from source: host vars for 'test-switch'
1272995 1745916503.77062: variable 'ansible_network_os' from source: host vars for 'test-switch'
1272995 1745916503.77062: variable 'ansible_user' from source: host vars for 'test-switch'
1272995 1745916503.77063: variable 'ansible_password' from source: host vars for 'test-switch'
1272995 1745916503.77064: variable 'ansible_become' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.77065: variable 'ansible_become_method' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.77066: variable 'ansible_network_cli_ssh_type' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.77273: Loaded config def from plugin (connection/ansible_collections.ansible.netcommon.plugins.connection.libssh)
1272995 1745916503.77276: Loading Connection 'ansible_collections.ansible.netcommon.plugins.connection.libssh' from /home/ansible/.ansible/collections/ansible_collections/ansible/netcommon/plugins/connection/libssh.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/connection/__pycache__)
1272995 1745916503.77281: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.77284: Loading ShellModule 'sh' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/shell/sh.py (found_in_cache=True, class_only=False)
1272995 1745916503.77328: variable 'inventory_hostname' from source: host vars for 'test-switch'
1272995 1745916503.77330: variable 'ansible_host' from source: host vars for 'test-switch'
1272995 1745916503.77331: variable 'ansible_user' from source: host vars for 'test-switch'
1272995 1745916503.77331: variable 'ansible_password' from source: host vars for 'test-switch'
1272995 1745916503.77341: Set connection var ansible_connection to ansible_collections.ansible.netcommon.plugins.connection.network_cli
1272995 1745916503.77346: Set connection var ansible_timeout to 10
1272995 1745916503.77346: Set connection var ansible_shell_type to sh
1272995 1745916503.77348: Set connection var ansible_module_compression to ZIP_DEFLATED
1272995 1745916503.77350: Set connection var ansible_pipelining to False
1272995 1745916503.77354: Set connection var ansible_shell_executable to /bin/sh
1272995 1745916503.77356: Set connection var ansible_port to 22
1272995 1745916503.77378: variable 'ansible_shell_executable' from source: unknown
1272995 1745916503.77379: variable 'ansible_connection' from source: unknown
1272995 1745916503.77380: variable 'ansible_module_compression' from source: unknown
1272995 1745916503.77382: variable 'ansible_shell_type' from source: unknown
1272995 1745916503.77383: variable 'ansible_shell_executable' from source: unknown
1272995 1745916503.77383: variable 'ansible_host' from source: host vars for 'test-switch'
1272995 1745916503.77384: variable 'ansible_user' from source: host vars for 'test-switch'
1272995 1745916503.77385: variable 'ansible_password' from source: host vars for 'test-switch'
1272995 1745916503.77385: variable 'ansible_port' from source: unknown
1272995 1745916503.77386: variable 'ansible_pipelining' from source: unknown
1272995 1745916503.77387: variable 'ansible_timeout' from source: unknown
1272995 1745916503.77388: variable 'ansible_network_os' from source: host vars for 'test-switch'
1272995 1745916503.77389: variable 'ansible_become' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916503.77391: variable 'ansible_become_method' from source: group vars, precedence entry 'groups_inventory'
1272995 1745916504.30240: Loading ActionModule 'ansible_collections.cisco.ios.plugins.action.ios' from /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible_collections/cisco/ios/plugins/action/ios.py (searched paths: /opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/action/__pycache__:/opt/python_virtualenv/cisco_mgmt/lib/python3.10/site-packages/ansible/plugins/action) (found_in_cache=True, class_only=False)
1272995 1745916504.30249: variable 'omit' from source: magic vars
1272995 1745916504.30251: starting attempt loop
1272995 1745916504.30252: running the handler
1272995 1745916504.30255: variable 'ansible_host' from source: host vars for 'test-switch'
1272995 1745916534.31751: handler run complete
1272995 1745916534.31780: attempt loop complete, returning result
1272995 1745916534.31781: _execute() done
1272995 1745916534.31782: dumping result to json
1272995 1745916534.31784: done dumping result, returning
1272995 1745916534.31787: done running TaskExecutor() for test-switch/TASK: Gather only the interfaces resource facts and no legacy facts [3966bda4-269e-a9ef-2c3e-000000000010]
1272995 1745916534.31790: sending task result for task 3966bda4-269e-a9ef-2c3e-000000000010
1272995 1745916534.31801: done sending task result for task 3966bda4-269e-a9ef-2c3e-000000000010
1272995 1745916534.31802: WORKER PROCESS EXITING
1272990 1745916534.31928: marking test-switch as failed
1272990 1745916534.31941: marking host test-switch failed, current state: HOST STATE: block=2, task=1, rescue=0, always=0, handlers=0, run_state=IteratingStates.TASKS, fail_state=FailedStates.NONE, pre_flushing_run_state=IteratingStates.TASKS, update_handlers=True, pending_setup=False, tasks child state? (None), rescue child state? (None), always child state? (None), did rescue? False, did start at task? False
1272990 1745916534.31949: ^ failed state is now: HOST STATE: block=2, task=1, rescue=0, always=0, handlers=0, run_state=IteratingStates.COMPLETE, fail_state=FailedStates.TASKS, pre_flushing_run_state=IteratingStates.TASKS, update_handlers=True, pending_setup=False, tasks child state? (None), rescue child state? (None), always child state? (None), did rescue? False, did start at task? False
1272990 1745916534.31952: getting the next task for host test-switch
1272990 1745916534.31954: host test-switch is done iterating, returning
An exception occurred during task execution. To see the full traceback, use -vvv. The error was:     raise ConnectionError(to_text(msg, errors='surrogate_then_replace'), code=code)
fatal: [test-switch]: FAILED! => {"changed": false, "msg": "command timeout triggered, timeout value is 30 secs.\nSee the timeout setting options in the Network Debug and Troubleshooting Guide."}
1272990 1745916534.32044: no more pending results, returning what we have
1272990 1745916534.32048: results queue empty
1272990 1745916534.32050: checking for any_errors_fatal
1272990 1745916534.32052: done checking for any_errors_fatal
1272990 1745916534.32053: checking for max_fail_percentage
1272990 1745916534.32056: done checking for max_fail_percentage
1272990 1745916534.32057: checking to see if all hosts have failed and the running result is not ok
1272990 1745916534.32059: done checking to see if all hosts have failed
1272990 1745916534.32061: getting the remaining hosts for this loop
1272990 1745916534.32063: done getting the remaining hosts for this loop
1272990 1745916534.32068: getting the next task for host test-switch
1272990 1745916534.32071: host test-switch is done iterating, returning
1272990 1745916534.32074: done queuing things up, now waiting for results queue to drain
1272990 1745916534.32075: results queue empty
1272990 1745916534.32077: checking for any_errors_fatal
1272990 1745916534.32079: done checking for any_errors_fatal
1272990 1745916534.32080: checking for max_fail_percentage
1272990 1745916534.32083: done checking for max_fail_percentage
1272990 1745916534.32085: checking to see if all hosts have failed and the running result is not ok
1272990 1745916534.32087: done checking to see if all hosts have failed
1272990 1745916534.32089: getting the next task for host test-switch
1272990 1745916534.32092: host test-switch is done iterating, returning

Does anyone have an idea what can cause this issues ?

motorbass · April 30, 2025, 2:06pm

Hi ! Here’s some ideas :

First of all I’d advise to update your ansible installation as 8.X is quite old.
are you able to connect to the same switch using the same ssh key ?
Also, why are you setting gather_facts to no ? you should give it a try with yes then relaunch your playbook, just to double check if cisco ios modules isn’t waiting for some already gathered information.

Gael

wayt · April 30, 2025, 10:52pm

For what it’s worth, I have a few slightly older switches than you, Cisco 2960S running 15.2(2)E9. In the example below I use ansible-navigator to run the playbook in an execution environment so I can be sure it is portable. I use the system-wide crypto feature to selectively re-enable SHA1 support for libssh because I’m using the ssh_type = auto and it picks libssh by default. I also put the bits to add diffie-hellman-group14-sha1 into the global client configuration for OpenSSH clients if you choose to install them in the EE for debugging. The system-wide crypto feature doesn’t want to override host specific values in config files so they don’t allow specifying the ssh-rsa as acceptable for HostKeyAlgorithms and PubKeyAlgorithms though so it’s of minor use for our old Cisco gear. The default policy modifier of SHA1 enables a few more things and more consistently across other back-ends so you may find that better in the EE context.

I can confirm the following works for me:

Example directory layout

$ tree -L 1
.
├── CRUSTY.pmod
├── ansible-navigator.yml
├── execution-environment.yml
├── hosts
└── playbook.yml

CRUSTY.pmod

group@libssh = FFDHE-2048+
hash@libssh = SHA1+
sign@libssh = RSA-SHA1+

group@openssh-client = FFDHE-2048+
hash@openssh-client = SHA1+

__openssl_block_sha1_signatures = 0

execution-environment.yml

---
additional_build_files:
  - src: CRUSTY.pmod
    dest: crypto-policies

additional_build_steps:
  append_final:
    - COPY _build/crypto-policies /etc/crypto-policies/policies/modules
    - RUN update-crypto-policies --set DEFAULT:CRUSTY
  prepend_base:
    - |-
      RUN dnf install --assumeyes ansible-core crypto-policies-scripts \
          iputils python3-ansible-pylibssh ansible-runner && \
        dnf clean all

dependencies:
  galaxy: |
    ---
    collections:
      - name: cisco.ios
        version: 10.0.0

images:
  base_image:
    name: registry.fedoraproject.org/fedora:42

version: 3

ansible-navigator.yml

---
ansible-navigator:
  execution-environment:
    image: localhost/ql555:1
  mode: stdout
  playbook-artifact:
    enable: false

hosts

[cisco]
lab2960s1 ansible_host=fdec:cafe:a843:1:5abc:27ff:fed9:5dc0

[cisco:vars]
ansible_connection = ansible.netcommon.network_cli
ansible_network_os = cisco.ios.ios

playbook.yml

---
- hosts: all

  tasks:
    - name: Ensure a command runs
      cisco.ios.ios_command:
        commands:
          - show clock

Build the EE via:

ansible-navigator builder build --tag ql555:1 --verbosity 3

Run via:

ansible-navigator run playbook.yml --ask-pass --inventory hosts --user timw -v

Results in:

Using /etc/ansible/ansible.cfg as config file
SSH password: 

PLAY [all] ***********************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************************************************************************
ok: [lab2960s1]

TASK [Ensure a command runs] *****************************************************************************************************************************************************************************************************************
ok: [lab2960s1] => {"changed": false, "stdout": ["22:47:23.308 UTC Wed Apr 30 2025"], "stdout_lines": [["22:47:23.308 UTC Wed Apr 30 2025"]]}

PLAY RECAP ***********************************************************************************************************************************************************************************************************************************
lab2960s1                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Topic		Replies	Views
Ansible Automation Platform Air Gapped Trial- Cisco Modules Timing Out Get Help rhel , cisco	5	179	September 25, 2024
Ios_config and iosxr_config for very long configs (+50k lines) Get Help ubuntu , network , cisco	1	33	March 5, 2025
Ansible - Authentication timeout error Ansible Developer	0	22	July 15, 2021
command timeout triggered, timeout value is 60 secs - Mikrotik Ansible Project	2	34	February 7, 2024
Problems with ios_command and prompt '[y/n]' Ansible Project	4	22	February 4, 2020