Nornir netmiko_send_config cannot enable on IOS-XE

[brownjam]

I know this issue arises in various forums but could anyone offer some guidance on why nornir/netmiko cannot enter enable mode on IOS-XE please?

Does this code attaches the 'secret' in the right place?

nr.inventory.defaults.connection_options['netmiko'] = ConnectionOptions(extras={'secret':dUserInput['password']})
[...]
multires = task.run( task=netmiko_send_config, name='Applying config via NetMiko', config_commands=config, cmd_verify=False )

I didn't pass any commands to enter enable mode, but I thought nornir/netmiko would figure out that it needs to execute the 'enable' command automatically?

The error coming back is:
ValueError: Failed to enter enable mode. Please ensure you pass the 'secret' argument to ConnectHandler.

If I use a username/password which ISE policy sends directly to enable mode, I don't get the above error.

Netmiko: 3.4.0
Nornir version: 3.2.0

[brownjam]

I thought nornir/netmiko would figure out that it needs to execute the 'enable' command automatically?
Yes for 'netmiko_send_config' the enable flag is on by default.
This can be seen in the code here:
https://github.com/ktbyers/nornir_netmiko/blob/master/nornir_netmiko/tasks/netmiko_send_config.py

Does this code attach the 'secret' in the right place?
Not too sure, there is some related documentation here, but it's unclear what would be the appropriate place to set a default enable secret for netmiko:
https://nornir.readthedocs.io/en/develop/api/nornir/core/inventory.html?highlight=ConnectionOptions

=> Most likely situation is that Nornir/Netmiko has the secret but is having trouble recognising the enable prompt, or ISE is too slow to authorise enable mode. Let me see if there's a way to debug this via Netmiko.

[ktbyers]

Which Nornir inventory type are you using?

Have you tested going into Netmiko enable mode outside of Nornir?

[brownjam]

Which Nornir inventory type are you using?
SimpleInventory

Have you tested going into Netmiko enable mode outside of Nornir?
Not yet, but if possible I would like to debug it via Nornir first

[ktbyers]

Can you show your inventory content in a simplified form (reduce it to one or two relevant hosts, groups and then defaults)? Obscure any confidential information.

[brownjam]

Here is an abridged version of the inventory:

# nornir_hosts.yaml:
---
ushcc-d-corsc-00:
    hostname: ushcc-d-corsc-00.net.local
    groups:
        - nxos
uklhr-d-accsc-00:
    hostname: uklhr-d-accsc-00.net.local
    groups:
        - ios-xe

# nornir_groups.yaml
---
global:
    port:22
    data:
        domain: net.local
    connection_options:
        netmiko:
            extras:
                global_delay_factor: 2
nx-os:
    groups:
        - global
    platform: nxos_ssh
    data:
        domain: net.local
    type: network_device
ios-xe:
    groups:
        - global
    platform: ios
    data:
        domain: net.local
    type: network_device

And this is the code initialising nornir and setting some more defaults:

def main( ):
    dUserInput = handle_input()
    # Load inventory, X number of threads,  set defaults:
    nr = initialisenornir (1, False)
    nr.inventory.defaults.username = dUserInput['usr']
    nr.inventory.defaults.password = dUserInput['pass']
    nr.inventory.defaults.connection_options['netmiko'] = ConnectionOptions(extras={'secret':dUserInput['pass']})
    nr.inventory.defaults.connection_options['napalm'] = ConnectionOptions(extras={"optional_args":{'secret':dUserInput['pass']}})

[ktbyers]

If you put connection_options -> netmiko -> extras into groups, then you have to put secret there as well.

Nornir finds the first occurrence of that and uses that (for all of the arguments). Consequently, your defaults setting will never get used.

[brownjam]

If you put connection_options -> netmiko -> extras into groups, then you have to put secret there as well.
Thank you Kirk, I thought the two would supplement each other. Let me test doing everything via nr.inventory.defaults.connection_options['netmiko'] and will report back.

[brownjam]

Deleting the connection_options settings under nornir_groups.yaml and instead attaching the secret as follows has fixed the problem:

    nr.inventory.defaults.connection_options['netmiko'] = ConnectionOptions(extras={'secret':dUserInput['pass']})

Incidentally, is there a way to see which options can be passed to which plugins via ConnectionOptions ? I can see that 'extras' maps to netmiko's 'ConnectHandler', but I can't find a list of what arguments are supported by netmiko.

Thank you very much Kirk for taking the time to look at this.

[brownjam]

The answer is provided by Kirk above (for some reason there's no answer button showing.