limweichiang/arubaos-tools

Aruba Networks ArubaOS 8 tools. This is not an official repository.

arubaos-tools's Issues

Cluster Health Check - Check clusters for inconsistent connectivity

Description: Controller clusters must be able to exchange cluster heartbeat across non-excluded VLANs. If heartbeats are not received correctly on non-excluded VLANs, the cluster degrades to L3 state, meaning there is not client state/seamless failover.

Requested Enhancement: Check if cluster is operating on L3 state (show lc-cluster group-membership) and VLANs with issues (show lc-cluster vlan-probe status)

Exception handling required when REST call hits untrusted SSL certificate

As in title, current unhandled exception looks like this if the "--insecure" or "-i" option is not used.

arubaos-tools % python3 cluster-healthcheck.py -m 192.168.1.30 -u USER
Password for USER: 
Traceback (most recent call last):
  File "/Library/Python/3.7/site-packages/urllib3/connectionpool.py", line 672, in urlopen
    chunked=chunked,
  File "/Library/Python/3.7/site-packages/urllib3/connectionpool.py", line 376, in _make_request
    self._validate_conn(conn)
  File "/Library/Python/3.7/site-packages/urllib3/connectionpool.py", line 994, in _validate_conn
    conn.connect()
  File "/Library/Python/3.7/site-packages/urllib3/connection.py", line 394, in connect
    ssl_context=context,
  File "/Library/Python/3.7/site-packages/urllib3/util/ssl_.py", line 383, in ssl_wrap_socket
    return context.wrap_socket(sock)
  File "/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/lib/python3.7/ssl.py", line 412, in wrap_socket
    session=session
  File "/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/lib/python3.7/ssl.py", line 853, in _create
    self.do_handshake()
  File "/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/lib/python3.7/ssl.py", line 1117, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Library/Python/3.7/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/Library/Python/3.7/site-packages/urllib3/connectionpool.py", line 720, in urlopen
    method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
  File "/Library/Python/3.7/site-packages/urllib3/util/retry.py", line 436, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='192.168.1.30', port=4343): Max retries exceeded with url: /v1/api/login?username=USER&password=PASSWORDSTR (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "cluster-healthcheck.py", line 209, in <module>
    mm_login_response = http_session.get(mm_login_url, params={'username': mm_user, 'password': mm_passwd})
  File "/Library/Python/3.7/site-packages/requests/sessions.py", line 546, in get
    return self.request('GET', url, **kwargs)
  File "/Library/Python/3.7/site-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/Library/Python/3.7/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Python/3.7/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='192.168.1.30', port=4343): Max retries exceeded with url: /v1/api/login?username=USER&password=PASSWORDSTR (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))

Cluster Health Check - Check controllers for CCM sync issues

Description: CCM sync issues occur between MM and controllers. This could prevent accurate configuration sync, and may require "ccm-debug full-config-sync" to resolve. Such issues are not obvious from MM "show switches".

Recommendation: SSH into controllers to verify for such errors, using "show configuration failure", and display issues if found.

Cluster Health Check - Check controllers for profile-errors

Description: Invalid configuration can prevent controller from sync'ing configuration from the MM correctly.

Recommendation: SSH into controllers to verify for such errors, using "show profile-errors", and display issues if found.

Standardize "--insecure" option result

"--insecure" option should skip security checks on MM HTTPS SSL cert and against SSH CLI keys against mobility controllers. No further user action to confirm this should be required, other than an initial warning when option is first checked. Current behavior is inconsistent, since a confirmation prompt will still appear when SSH checks begin.

For mobility controller SSH checks, without using "--insecure", a warning should indicate that the SSH checks will skip the controller.