Changelog

v25.1.27 (2025-01-27)

Features

  • nscli maint failover (pa): Added support for palo alto devices failover. (by Ramya Doddi) (NSCLI-434)

  • nscli ssh: Added logic to identify device type as ‘ASA’ & then connect to the Public IP. (by Hrishikesh Kapse) (NSCLI-456) (NSCLI-456)

  • nscli palo group: Added new plugin to allow users to get/create/update/delete HA ID data for PA devices (by Mithun Kumar Singh and DJ) (NSCLI-513)

  • Homebrew formula: Update formula for NSCLI to install pip within venv during bottle build. (by DJ) (NSCLI-527)

  • nscli credentials, nscli tokens: Updated ‘set’ functionality to allow manual & automatic reset for core & identity tokens. (by Hrishikesh Kapse) (NSCLI-531)

  • nscli maint palo base: Updating base templates for primary and secondary used on base config script with updated device group and template names. (by Jim Burhans) (NSCLI-533)

  • nscli maint qc: Revision of ASA/f5/Generic QC sheets. New checks for LDAP SSL, cabling, password encryption, plus typo fixes (by Jason Wright) (NSCLI-534)

  • nscli info: Repurposed & updated existing ‘-t’ functionality to show data in tabular format and added ‘-ip’, ‘-D’, ‘-sv’ options. (by Hrishikesh Kapse) (NSCLI-538)

  • Updated certificate generation command for nscli maint palo_alto base_config (by Hrishikesh Kapse) (NSCLI-544)

  • nscli ssh: Added logic to identify device type as ‘Palo Alto Vsys’ & then connect to the DRAC IP of its parent device. (by Hrishikesh Kapse) (NSCLI-545) (NSCLI-545)

Bugfixes

  • nscli maint nd_auto_parallel: Fixes to handle errors in output (switch configuration, maintenance plan) due to interface mapping. (by DJ) (NSCLI-532)

  • nscli maint minor (adc): Fixes to get correct build names from FACTS. (by Hrishikesh Kapse) (NSCLI-535)

  • nscli maint parallel: Added ‘show interface status’ to the maintenance plan template for ‘Automated Maintenance Prep - Parallel Migration ASA’. (by Hrishikesh Kapse) (NSCLI-541)

  • nscli maint minor PaloAlto: Updated ‘show session’ commands in automated maintenance plan for paloalto code upgrade. (by Hrishikesh Kapse) (NSCLI-547)

  • nscli maint port-audit: Fixes to handle General NSCLI Exception: ‘Port-channel999’ by ignoring remote hostname if ‘leaf’. (by Hrishikesh Kapse) (NSCLI-548)

v24.6.13 (2024-06-13)

Features

  • Implemented identity token as primary authentication method, fallback to SSO cred. (by Ajay Kumar Yadav) (NSCLI-321)

  • nscli maint port-audit: Added flag -y to filter port-type. Added flag -l to display the logs for relevant ports. (by Gabriel Martin del Campo and DJ) (NSCLI-361)

  • nscli maint qc f5: Added assisted QC plugin for f5 parallel migrations (by Ramya Doddi and DJ) (NSCLI-425)

  • nscli maint parallel: More checks related to IDS, covering verifications of consistency-related aspects. (by Ajay Kumar Yadav) (NSCLI-441)

  • nscli maint parallel: Extension to support for PA to PA maintenance. (by Ramya Doddi and DJ) (NSCLI-447)

  • nscli maint updates: Updated core queue and category for ticket post plugin execution. (by DJ) (NSCLI-448)

  • nscli maint cabling-audit (f5): Updates to record F5 interface details, link-state (during audit) and make better use of caching. (by Ramya Doddi and DJ) (NSCLI-451)

  • nscli maint palo base_config: Added DNS IPs for new DCs. Added option -A to skip aggr/Mac-ID review for HA groups. (by DJ) (NSCLI-459)

  • nscli maint cabling-audit: Reconfigure DRAC at the end and check parking VLAN status for all switches. (by Ajay Kumar Yadav) (NSCLI-463)

  • nscli facts version: Updates for nscli facts version f5 to display hotfix information and luno volume ID if any. (by Ramya Doddi) (NSCLI-464)

  • nscli maint minor (f5): Added source version check for v16 upgrade (by DJ) (NSCLI-466)

  • nscli maint failover (f5): Plugin presents a summarized table of VLAN FAILSAFE settings, instead of a repeated prompt. (by Ramya Doddi) (NSCLI-469)

  • nscli pa qcip: nscli provisioning info qcip for paloalto now made available as nscli pa qcip. (by Ramya Doddi) (NSCLI-471)

  • nscli asa qcip: nscli asa qcip added support for Firepower chasis. (by Ramya Doddi) (NSCLI-472)

  • nscli facts version (f5): Update to ensure version number displayed accounts for Hotfix, if any. (by DJ) (NSCLI-478)

  • nscli maint asa + asa recovery: Update RSA key size for ASA v9.16+ from 1024 to 2048. (by Ajay Kumar Yadav) (NSCLI-480)

  • nscli info: Simplify -t output format to remove device status and power on status. (by DJ) (NSCLI-485)

  • nscli maint palo base_config: Changes to code upgrade steps to alternate download and installation. (by Ajay Kumar Yadav and DJ) (NSCLI-486)

  • nscli maint palo base_config: Support for build 1400 series devices. (by Ajay Kumar Yadav) (NSCLI-493)

  • nscli maint nd_auto_parallel: Adds option to specify timeout for Unipede API calls. Changes default timeout from 120 to 300 sec. (by DJ) (NSCLI-495)

  • nscli maint minor (PA): Making Panorama sync step optional during upgrade. Adjustments to handle new hardware platform/software versions (by DJ) (NSCLI-509)

  • nscli maint freeze: Added wiki link for reference. (by DJ) (NSCLI-510)

  • nscli maint cabling-audit (asa): Update to parse ‘show interface’ output on 9.18 code. (by DJ) (NSCLI-520)

  • nscli settings: Disable NLA validation by default. Added “proxy_regions” and “signal disable” setting. Added –details option for nscli settings. (by DJ) (NSCLI-521)

  • nscli maint palo base_config: Updated to use new local admin credentials and fallback to old one, if needs be. (by DJ) (NSCLI-522)

  • nscli zsp: Updated SSH login logic to classify Panorama devices hosted in Cloud to use managed cloud credential. (by DJ) (NSCLI-523)

  • nscli maint palo base_config: Updates to config command if PA prompt has PA-RESET/PA-AUTOMATED (by Ajay Kumar Yadav) (NSCLI-524)

  • nscli maint qc, prep, times: Review and update of ASA/f5/Generic QC sheets, overhaul of maint prep output, additions to maint times. (by Jason Wright) (NSMAINT-913)

Bugfixes

  • nscli maint palo base_config: Skipping ‘RPCV4-AGGR-TRANS’ zone for ‘ALLOW-CLIENTVPN’ security policy. (by Ajay Kumar Yadav) (NSCLI-435)

  • nscli maint minor (pa): Minor updates in prep steps for “download” of dynamic updates and global-protect activation command (by DJ) (NSCLI-440)

  • Converting SSO credentials to UTF-8 encoding. (by Ajay Kumar Yadav) (NSCLI-442)

  • nscli maint port_migrate2: Adjustment of switch interface commands (speed, duplex) for Arista Switches. (by Ajay Kumar Yadav) (NSCLI-445)

  • nscli maint minor (adc): Added stepped upgrades for NetScalers and updated jinja templates with few HA related commands. (by Ajay Kumar Yadav) (NSCLI-446)

  • nscli maint cabling-audit (f5): Resolved timeout for the secondary device connection. (by Ajay Kumar Yadav) (NSCLI-449)

  • nscli maint migrate-ucs: Adjustments to better detect device missing from ACS (by DJ) (NSCLI-452)

  • Minor cleanup / documentation updates for nscli luno_ng, nscli maint cyclade_asa_upgrade and nscli maint cabling-audit (by DJ) (NSCLI-453)

  • Update the installation steps for adding the keyring file to trusted.gpg.d for Ubuntu versions 2204 and newer. (by Ajay Kumar Yadav) (NSCLI-454)

  • nscli maint migrate-ucs: Bugfix to resolve false positive password failures due to command output contents (by DJ) (NSCLI-455)

  • nscli maint minor (pa): Fixed incorrect lower version being suggested on rollback steps. (by DJ) (NSCLI-460)

  • nscli maint cabling-audit (pa): Added timer for connection check with few modification to the logs. (by Ajay Kumar Yadav) (NSCLI-461)

  • nscli maint palo base_config: Updates to URL filtering command template if target version > 10.2. (by Ajay Kumar Yadav) (NSCLI-462)

  • nscli maint minor (f5): Fixed hotfix file name in download instructions. (by DJ) (NSCLI-466)

  • nscli maint minor (f5): Fix to allow plugin to run if current code is >= 16.x. (by DJ) (NSCLI-473)

  • nscli maint cyclade_asa_upgrade: Added ‘FRA’ datacenter to maint cyclade upgrade for asa. (by Ajay Kumar Yadav) (NSCLI-481)

  • nscli maint palo base_config: Skipping ‘SDDC-HYP-INFRA’ zone for ‘ALLOW-CLIENTVPN’ security policy. (by Ajay Kumar Yadav) (NSCLI-490)

  • nscli provisioning info qcip (pa): Fix for -u option for custom user not working as expected. (by DJ) (NSCLI-494)

  • nscli maint minor (Firepower in platform mode ASA): Bugfix for crash because of ASA version string parsing (in Python packaging module). (by DJ) (NSCLI-499)

  • nscli maint updates: Better error handling for DB reporting. (by Ajay Kumar Yadav) (NSCLI-500)

  • nscli maint updates: Removing functionality of status reporting to DB due to server inconsistency. (by Ajay Kumar Yadav) (NSCLI-501)

  • nscli facts: Updated FACTS API FQDN to new endpoint. (by Rich Gale) (NSCLI-507)

  • nscli maint palo base_config: Fixes to handle/display new code and GlobalProtect version/files. (by DJ) (NSCLI-512)

v23.7.27 (2023-07-27)

Features

  • Update maintenance plans to include “maint sweep”, “ip routes” or “ip ping” for connectivity check using store/compare flags. (by Gabriel Martin del Campo) (NSCLI-283)

  • nscli ssh: Adds –dc parameter to allows proxying SSH connection via Balabit/gateway from region closest to chosen DC (instead of default region) without changing settings. (by Gabriel Martin del Campo) (NSCLI-327)

  • nscli maint cyclade_asa_upgrade: Update to allow running against Firepower chassis running ASA code (by DJ) (NSCLI-426)

  • nscli maint palo parse_asa: Added ‘-u’ flag to use custom login for devices which don’t work on TACACS. (by Ajay Kumar Yadav) (NSCLI-427)

  • nscli maint nd_auto_parallel: Increased wait time to allow for sync to finish between HA firewalls, in case auto configuration (push) is used. (by DJ) (NSCLI-428)

  • nscli ssh: Extending capability of ‘–active’ flag to support Palo Alto device. (by Ajay Kumar Yadav) (NSCLI-433)

Bugfixes

  • nscli maint palo base_config: Typo fix in the configuration template (by DJ) (NSCLI-410)

  • nscli maint port-migrate: Fixes to make –no_drac and –vlan_mapping options work as expected. Update to show full neighbor changes (trunking) with relevant remarks (by DJ) (NSCLI-413)

  • nscli f5 ssl_audit: Increased command timeout to handle larger configuration size. (by DJ) (NSCLI-414)

  • nscli info: -t/td flags: Update IP Assignments table. (by Ramya Doddi) (NSCLI-416)

  • nscli asa recovery: Fix for failing to find ‘password-encryption’ key from PasswordSafe, added ‘wr mem’ to prevent re-work (by DJ) (NSCLI-417)

  • nscli maint minor (asa): Bugfix to prevent crash due to version parsing error for current ASA version (by DJ) (NSCLI-418)

  • nscli maint migrate-ucs: Bugfixes to recover from bastion connection timeout, typo in command to set route (by DJ and Ajay Kumar Yadav) (NSCLI-419)

  • Dockerfile update for Debian image path on mirror for builds on Jenkins (by DJ) (NSCLI-421)

  • nscli maint port-migrate: Bug-fix for failing to find migration ports on device (by DJ) (NSCLI-423)

  • nscli maint minor (pa): Adjustments to account for FACTS ‘upgradepath’ behavior change (by DJ) (NSCLI-424)

  • nscli maint cabling-audit: Use of correct Unipede API call to fetch vlan status. (by Ajay Kumar Yadav) (NSCLI-430)

  • nscli maint palo base_config: Skipping ‘SDDC-REPLICA’ zone for ‘ALLOW-CLIENTVPN’ security policy. (by Ajay Kumar Yadav) (NSCLI-431)

v23.5.18 (2023-05-18)

Features

  • nscli info: Added -t and -td flags to display IP Assignments and Switch Port-Vlans Summary in table format . (by Ramya Doddi) (NSCLI-309)

  • nscli maint minor (pa): Updated maintenance plan with ‘Device-Group and Template’ verification step. (by DJ) (NSCLI-319)

  • nscli maint cabling-audit (pa): Generate hostname and configure on PA device using XML API. (by Ajay Kumar Yadav) (NSCLI-331)

  • nscli maint port-migrate: Added ‘–exclude’ option to allow user to skip over chosen port-types for migration (by DJ) (NSCLI-351)

  • nscli maint cabling-audit (pa): Verification of DRAC port along with its VLAN status. (by Ajay Kumar Yadav) (NSCLI-354)

  • nscli maint palo base_config: Skip DRAC config print if already present on devices else generating. (by Ajay Kumar Yadav) (NSCLI-359)

  • nscli maint palo base_config: Alerting user to skip AGGR_MAC check if taking longer time than usual. (by Ajay Kumar Yadav) (NSCLI-376)

  • nscli ip: Added -s/–store and –m/compare options to facilitate before/after comparison (by Gabriel Martin del Campo) (NSCLI-381)

  • nscli maint cabling-audit: Added drac port status validation for f5 and ping validation for both f5 and palo (by Ramya Doddi) (NSCLI-386)

  • nscli info plugin: Added VM status if device is Virtual Machine. (by Ramya Doddi) (NSCLI-395)

Bugfixes

  • nscli maint qc asa: Bugfix for crash if current ASA version => 9.14(1) for newer device. (by Ajay Kumar Yadav) (NSCLI-282)

  • Warning user regarding invalid SSO ID and suggesting to execute ‘nscli –doctor’ (by Ajay Kumar Yadav) (NSCLI-337)

  • Bugfixes for nscli ssh, nscli maint minor (PA) and nscli maint palo plugins. Resolves crash / failures for PAs that use Public DRAC IP. (by Ajay Kumar Yadav) (NSCLI-347)

  • nscli maint port-migrate: Bugfix to allow for single to multiple device port mapping with manual option. (by DJ) (NSCLI-351)

  • nscli maint palo post_exp: Renaming service config from non-standard PORT-PROTOCOL config into standard format of PROTOCOL-PORT (by Ajay Kumar Yadav) (NSCLI-358)

  • nscli maint palo base_config: Skipping ‘HYP-INFRA’ and ‘VMREPL-ZERTO’ zone for ‘ALLOW-CLIENTVPN’ security policy. (by Ajay Kumar Yadav) (NSCLI-374)

  • correct activate code for virtual evnvironment : Bugfix for correct activate code for virtual environment. (by Gabriel Martin del Campo) (NSCLI-375)

  • nscli maint asa and nscli maint nd_auto_parallel: Bugfix for crash because of ASA version string parsing (in Python packaging module). (by DJ) (NSCLI-378)

  • nscli maint minor(f5): Bugfix for NDAPI related crashes on devices with custom credentials by adding F5iControl API as a fallback. (by Ajay Kumar Yadav) (NSCLI-379)

  • nscli maint palo base_config: Resolved issue with obtaining correct credentials due to recent changes to PWSafe, to login PA device. (by Ajay Kumar Yadav) (NSCLI-383)

  • nscli maint minor (asa): Bugfix for crash because of ASA version string parsing (in Python packaging module). (by DJ) (NSCLI-385)

  • nscli maint minor adc: Fixed a critical bug that caused Standalone Netscaler devices to crash. (by Ajay Kumar Yadav) (NSCLI-387)

  • nscli maint palo base_config: Updated Jinja templates to accommodate new credentials for Panorama, fix overflow issues, and add the missing ‘template’ command. (by Jum Burhans) (NSCLI-388)

  • nscli maint palo base_config: Added a warning for GlobalProtect security rule verification. (by DJ) (NSCLI-389)

  • nscli maint cabling-audit (PA): Bugfix for crash because of SFP interface details. (by DJ) (NSCLI-390)

  • nscli maint cabling-audit: Prevent crash for DCX job status check in cache mode. (by Ajay Kumar Yadav) (NSCLI-391)

  • nscli provisioning info qcip (PA): Bugfix for crash due to metric comparison causing inconsistent instances. (by Ajay Kumar Yadav) (NSCLI-392)

  • nscli maint palo base_config: Added panw-torexit-ip-list to rules in palo_alto_kir_common jinja template. (by Gabriel Martin del Campo) (NSCLI-397)

  • nscli ssh: Bugfix for -u option being ignored for ‘managed cloud’ device type. (by DJ) (NSCLI-398)

  • nscli maint cabling-audit (asa): Display device number during prompt for cyclade information. (by Ajay Kumar Yadav) (NSCLI-401)

  • nscli ssh: bugfix for ssh -g failing to connect to public DRAC (by Gabriel Martin del Campo) (NSCLI-402)

v23.2.28 (2023-02-28)

Features

  • nscli maint cabling-audit (asa): ASA cabling audit re-written with process and feature updates. (by DJ) (NSCLI-297)

  • nscli maint minor : Added ‘-u’ flag to use custom login for devices which don’t work on TACACS. (by Ajay Kumar Yadav) (NSCLI-300)

  • nscli maint palo base_config: new features

    • Added Virtual Palo Alto support

    • Improved speed for slow data-gathering functions like Aggr MAC gathering, ACS checks

    • Brought better visibility for interface config mapping errors for migrations

    • Added ‘–skip_code_upgrade’ option, so “minor” call can be manually skipped if needed.

    - by DJ and Ajay Kumar Yadav (NSCLI-308)

  • Added exception handling to prompt for SSO password reset when plugins return an uncaught 401/405. Added a validate method to Token class that can be called in plugins to validate stored credentials Added nscli --doctor to have NSCLI review known misconfigurations(future feature) and validate credentials (only checks SSO for now). (by James Wathen) (NSCLI-323)

  • nscli maint palo base_config: Added step to configure “AUTH” code if PA running on 10.1.x or above (by Ajay Kumar Yadav) (NSCLI-328)

  • For development setup: Updated Makefile to warn about active VENV and stop VENV creation if in use (by DJ and James Wathen) (NSCLI-330)

  • nscli maint cabling-audit: Added logic to put switch-port back (in DCX parking VLAN), in case a custom VLAN was used for audit. (by Ajay Kumar Yadav) (NSCLI-333)

  • nscli maint cabling-audit: Added logic to detect active VLAN status for VLAN used during audit. (by Ajay Kumar Yadav) (NSCLI-334)

  • [NSCLI-335] nscli ssh : Adding flags to SSH

    • Added ‘-n’ flag to show connected network devices and connect it through SSH.

    • EM is considered as Source of Truth.

    • Added ‘-e’ flag to connect directly to edge device.

    - by Ajay Kumar Yadav (NSCLI-335)

  • nscli provisioning configure nats: Added PaloAlto support for command (beta) (by DJ) (NSCLI-344)

  • nscli provisioning info qcip: Added PaloAlto support for command (beta) (by DJ) (NSCLI-345)

  • [NSCLI-348] Add RCG platform SKUs for rcg info plugin

    • Added SKUs for:

      • RackConnect RegionLink

      • RackConnect Global - Solution

      • RackConnect Global - Z-End Last Mile Required

    • Improved RCG SKU list with in-line comments of platform names

    • Upgraded to version 1.2

    - by Peter Gilani (NSCLI-348)

  • nscli maint cabling-audit: Added status checks for device switch-port enable and disable DCX calls. (by Ajay Kumar Yadav) (NSCLI-353)

  • nscli cloudflare: Update to support Cloud Support Rackers (with separate PasswordSafe project) (by DJ) (NSCLI-356)

  • Updated “palo alto” connector class (maintenance shared code) to attempt connection re-establishment in case it times out. (by Ajay Kumar Yadav) (NSCLI-357)

Bugfixes

  • nscli maint cabling-audit (asa): Bugfix to increase timeout for parsing Firewall Serial number from Firepower/ASA. (by DJ) (NSCLI-276)

  • nscli maint nd_auto_parallel: Bugfix for missing switch-port configuration due to interface names matching. (by DJ) (NSCLI-298)

  • nscli maint palo parse_asa: Bugfix to prevent crash if NATs are missing in source ASA configuration (by DJ) (NSCLI-307)

  • Updated release documentation and improved homebrew steps. (by James Wathen) (NSCLI-315)

  • nscli maint palo base_config: Bugfix to prevent crash for single PA migrations (by DJ) (NSCLI-318)

  • Fixed ssh failures with –debug due to logs in newer OpenSSH versions (by James Wathen) (NSCLI-320)

  • nscli maint palo post_exp: Bugfix to prevent crash if security rule is missing a tag (by DJ) (NSCLI-325)

  • Increased Finder timeout and added logic to prevent crashes based on user location/latency. (by James Wathen) (NSCLI-326)

  • nscli maint palo base_config: Changes done on jinja templates for hip profiles and replaced it with “source” and “destination” (by Glory Mead) (NSCLI-332)

  • Fixed dev script for sending emails to users running old versions of NSCLI. (by James Wathen) (NSCLI-336)

  • nscli maint minor (pa, adc): Typo fix (‘upgarde’ to upgrade) in a couple of maintenance templates (by Glory Mead) (NSCLI-343)

  • nscli maint cabling-audit (pa): Bugfix to prevent crash due to not being able to delete default zones (by DJ) (NSCLI-349)

  • nscli maint cabling-audit: Removed ‘Received Contract’ from existing status check function to alert user (by Ajay Kumar Yadav) (NSCLI-352)

  • nscli cloudflare: Bugfix for “add members” function to work with -a option (when only Cloudflare Account ID is specified) (by DJ) (NSCLI-356)

  • nscli maint palo parse_asa: Bugfix for object name replacement missed in ACLs (by DJ) (NSCLI-363)

  • Changed use of NetworkDefence@rackspace.com to GTS-Network-Defense@rackspace.com (by Ramya Doddi) (NSCLI-364)

  • Bugfix for build error because of dockerfile/jenkinsfile failing to directly modify /etc/hosts (by DJ) (NSCLI-365)

v22.11.2 (2022-11-02)

Features

  • nscli maint cabling-audit: Added support for Palo Alto FWs for cabling audit (by DJ) (NSCLI-243)

  • nscli maint minor (palo): Updates to include fetching GP version pulled from FACTS, CLI commands for failover and some formatting fixes (by DJ) (NSCLI-262)

  • nscli maint palo parse_asa: Added warnings in modified config if ‘PUB’ groups (new groups added to map public IPs) are empty (by DJ) (NSCLI-264)

  • nscli maint palo base_config: Updates to commands in Zerto configuration template (by DJ) (NSCLI-269)

  • nscli maint palo base_config: Zerto configuration was moved to separate output file. (by DJ) (NSCLI-270)

  • maint sweep: Default fallback to “ip block” scan, if NATs cannot be found. New ‘blocks_only’ option added. (by Ajay Kumar Yadav) (NSCLI-275)

  • nscli maint palo base_config and nscli maint minor (pa) updates

    • Changes to show actual/specific code update steps per device, rather than generic template

    • palo_connector.py - minor change to retry connection (for API login)

    - by DJ (NSCLI-277)

  • nscli maint palo base_config: Changes to show GlobalProtect version per FACTS, rather than placeholder variables (by DJ) (NSCLI-278)

  • nscli runner: New Plugin to allow periodic command execution against Network devices (by Ajay Kumar Yadav) (NSCLI-284)

  • nscli maint minor (pa): Update to validation steps for Panorama sync (by DJ) (NSCLI-285)

  • nscli maint palo base_config: Added new DCs (SIN3, SJC3) for Zerto configuration (by DJ) (NSCLI-289)

  • nscli __main__.py: Option for disabling Newrelic and Appstats reporting of NSCLI usage (by Ajay Kumar Yadav) (NSCLI-291)

  • nscli maint palo base_config: PA device(s) EM validation and separate configuration file for GP and system route

    • Added functionality to check if PA device(s) exist in Environment manager

    • Separate file for Global Protect and System route related configuration

    - (by Ajay Kumar Yadav) (NSCLI-293)

  • Update release process with pyproject.toml and PDM (by James Wathen) (NSCLI-295)

  • nscli maint cabling-audit: Added support to use staging endpoint via NSCLI settings and minor updates for Voyage (bulk ARIC task execution) (by Philip Eatherington) (NSCLI-311)

Bugfixes

  • Improved MAC homebrew build process to utilize .whl packages whenever possible. (by James Wathen) (NSCLI-259)

  • nscli maint nd_auto_parallel: Fixes for ASA HTTPS connection failures, missing KIR VLAN changes (by DJ) (NSCLI-261)

  • nscli maint palo base_config: Updating jinja template for initial setup for better flow and to match current standards (by Jim Burhans) (NSCLI-263)

  • nscli maint palo parse_asa: Bugfixes for ACL 101 ‘PUB’ IP / group replacements failures and missing PA NATs for auto NATs with objects for destination (by DJ) (NSCLI-264)

  • nscli maint palo base_config: Bugfixes to prevent crash if IP is tied to the FW in EM without VLAN (by DJ) (NSCLI-267)

  • nscli maint parallel: Template updates for IDS steps because of changes in AlertLogic portal (by Alan Lakey-White and DJ) (NSCLI-268)

  • nscli maint port-audit: Bugfix for incorrect rcv2 port + SKU check warnings for standby FW/LB (by DJ) (NSCLI-271)

  • Modified Makefile to create a symbolic link for compatibility with changed importlib.distribution command. (by David Patino) (NSCLI-273)

  • maint parallel and shared code (SharedMaint.get_data_switches()) bugfixes

    • Added retry logic for SharedMaint.get_data_switches() for timeout handling

    • Bugfix for get_device_interfaces() in ‘maint parallel’ to prevent loop on input

    - by DJ (NSCLI-274)

  • maint sweep: Updates for Palo Alto, SRX platform identification. (by Ajay Kumar Yadav) (NSCLI-275)

  • nscli maint palo base_config: Fix for missing DC for DNS lookup (by DJ) (NSCLI-286)

  • Improve New Relic logging of Linux/WSL OS version. (by James Wathen) (NSCLI-287)

  • maint switch: Improved Error Handling

    • Added logic to validate if response from DCX API returns empty string for queried device

    • Educating user to provide valid device number

    - (by Ajay Kumar Yadav) (NSCLI-290)

  • version.py: Changed timeout value of GET Request for Artifacts to 1.0 which resolved nscli upgrade failed check (by Ajay Kumar Yadav) (NSCLI-296)

  • nscli maint cabling-audit: Updates / fixes for PA for cabling audit post SME testing

    • Added granular caching

    • Added ‘commit’ config , default config cleanup’ at start (if needed), and ‘load previous config’ at the end

    • Error handling, fallback for SDK interface change commands

    • Fixed logic for checking for unsaved PA config

    (by DJ) (NSCLI-299)

  • Improved NewRelic reporting with full names of users. (by James Wathen) (NSCLI-303)

  • settings.ini data now has capitalization respected when accessed. (by James Wathen) (NSCLI-304)

  • No longer prompts user for email, will gather data from FinderAPI. (by James Wathen) (NSCLI-305)

  • Changed use of GTSNetSecMaint@rackspace.com to nscli@rackspace.com (by James Wathen) (NSCLI-310)

v22.7.13 (2022-07-13)

Features

  • nscli maint palo base_config: Updates to include base configuration like KIR (base / interfaces / NATs / Global Protect / AD etc) (by Roy Papageorge and DJ) (NSCLI-228)

  • nscli maint palo base_config: Added security policy rule rename logic from SME scripts (by Roy Papageorge and DJ) (NSCLI-230)

  • maint palo parse_asa: Added logic to replace service name with port numbers (by DJ) (NSCLI-232)

  • maint palo parse_asa: Added offline mode, duplicate object cleanup (by DJ) (NSCLI-236)

  • maint palo post_exp: Updates to map new PEER ID name for crypto profiles. Code refactoring. (by DJ) (NSCLI-239)

  • maint minor: Added support for PaloAlto FWs for code upgrade maintenance prep (based on templates from PA SMEs) (by DJ) (NSCLI-244)

  • nscli facts version: Update to show GlobalProtect files for ‘nscli facts version paloalto’ (by DJ) (NSCLI-255)

  • nscli maint palo: miscellaneous updates

    • Separate cache location for each “maint palo” sub-script

    • Formatting / typo fixes in command templates

    • Changes to allow use of REST API via PaloConnector class

    • maint palo base_config:

      • Switch-port VLAN mapping logic updated for new builds (vs migration)

      • Added logic for route commands for non-connected networks

    • maint palo parse_asa:

      • Added warning if backup / secondary VPN peer is present

    – by DJ (NSCLI-256)

Bugfixes

  • Updated shared plugin ‘CertProcessor’ to handle missing certificate data (by DJ) (NSCLI-229)

  • Remove “NetSec Maintenance Team” references where applicable (by DJ) (NSCLI-231)

  • Fix version checking. (by James Wathen) (NSCLI-237)

  • Fix blowfish deprecation warning. (by James Wathen) (NSCLI-246)

  • Fixed sso password not being used when ssh key is not set in identity. (by James Wathen) (NSCLI-247)

  • Stops email prompt on nscli reset. (by James Wathen) (NSCLI-250)

  • maint nd_auto_parallel: Added –rcg option, so “cabling audit” module calls do not fail (by DJ) (NSCLI-251)

  • maint freeze: Updated device identification logic and changes to skip HA checks for non ASA devices (by DJ) (NSCLI-253)

  • nscli maint palo: miscellaneous bug-fixes

    • Formatting / typo fixes in command templates

    • maint palo base_config:

      • Fix for librack network type missing (port vlan mapping logic)

      • Bug-fix for missing default static route

      • Update to include commit, to save pending commits

    • maint palo post_exp:

      • Bug-fix for tunnel ID replacement loop

    – by DJ (NSCLI-256)

  • nscli facts version: Bug-fix for ‘nscli facts version ftd’ crash (by DJ) (NSCLI-257)

  • nscli switch: Updated cipher options in SSH string to fix login failures for some older switches (by DJ) (#2848)

Improved Documentation

Misc

  • NI-2575, NSCLI-248

v22.2.17 (2022-02-17)

Features

  • Synced plugins / code from NetSec maintenance NSCLI fork

    nscli maint asa_to_afm:

    Convert ASA ACL’s to AFM (originally developed by Sergio Pereira and Justin Drew)

    nscli maint cabling-audit:

    Updates to support cabling-audit for F5 LTMs (originally developed by Sergio Pereira and Justin Drew)

    nscli maint cyclade_asa_upgrade:

    Plugin to assist with code upgrade of ASAs on cyclade (no public IP) (ASA and FP21 K series only)

    nscli maint decomm:
    Plugin to assist with cleanup of decommissioning automation tickets with failures.
    DOES NOT apply to general decomm. work
    nscli maint ftd diff_asa:

    Diff FTD vs ASA config for migration prep / QC

    nscli maint fw_convert:

    Convert firewall rules between ASA and F5 platforms (originally developed by Justin Drew)

    nscli maint nd_auto_parallel:

    Plugin to streamlines parallel migration process (for ASA code only)

    Author:

    DJ (NSCLI-220)

  • nscli maint minor: Initial draft template for ASA on Firepower 41K and 93K series (by DJ) (NSCLIMAINT-908)

  • nscli maint palo post_exp: New plugin to assists with correcting configuration given by Expedition (ASA -> PA migration) (by DJ and Jim Burhans) (NSCLIMAINT-910)

Bugfixes

  • nscli ssh (palo): Bug fix for PA CLI login failures for subset of PAs (by DJ) (NSCLI-224)

  • nscli maint palo base_config: Command template updated to use secondary device serial. Updates for user warnings and better readability. (by Jim Burhans) (NSCLIMAINT-891)

  • nscli maint palo base_config: Bug fixes for single device migration, HA group verification steps (by Jim Burhans) (NSCLIMAINT-901)

  • nscli maint cyclade_asa_upgrade: Fixed incorrect caching logic for ASA console output function (by DJ) (NSCLIMAINT-911)

  • nscli cloudflare usage_report: Bug fix for the CSV report file formatting (by DJ) (#2824)

  • nscli maint palo parse_asa: Bug fix for crash because of missing files in package (by DJ) (#2841)

v22.1.19 (2022-01-19)

Features

  • New DCX Bridge plugin

    Purpose

    Created to simplify Bridge Service APIS This plugin will list/create/delete/update dcx bridge/containers and configured vlans for RackConnect v3 (Type 1) or for Network Security (Type 2)

    RackConnect Usage

    Using the information from a RackConnect v3 configuration, especifically the vlan details such as in Cloud Account: rctestdfw03 (746453), you can find out the bridge id, bridge name, zone name, and vlan number. Using that information, you can lookup information about the bridge configuration.

    For example:

    nscli dcx_bridge list_container -n RC-746453-3378 -e
    [
    {
    container_type: 1,
    endpoints: [
    {
    configured_vlan_id: 333519,
    status: 1,
    type: 1,
    vlan_details: {
    aggr_names: [
    aggr171a-8.dfw3,
    aggr171b-8.dfw3
    ],
    id: 333519,
    vlan: 1905,
    zone_name: DFW3:PublicNet:zone171-8
    }
    },
    {
    configured_vlan_id: 419251,
    status: 1,
    type: 1,
    vlan_details: {
    aggr_names: [
    aggr172a-11s.dfw3,
    aggr172b-11s.dfw3
    ],
    id: 419251,
    vlan: 241,
    zone_name: DFW3:RackConnect-v3:AGGR172-11S
    }
    }
    ],
    id: 4346,
    name: RC-746453-3378
    }
    ]

    NetSec Usage

    The anticipated usage for Network Security is for them to be able to create a bridge for a customer without having to send the ticket over to the DCX team. Network Security can lookup the vlan information and create the bridge.

    For example:

    A ticket like this one: 211006-01676 could be completed by using this plugin.

    nscli dcx_bridge new_bridge DFW3:PublicNet:zone172-6 492 DFW3:PublicNet:zone172-1 2217 2 -n 5034104-211006-01676-migration

    Author:

    Jorge Perez mailto:jorge.perez@rackspace.com (NSCLI-219)

  • nscli asa customer_config: New plugin - extract customer ASA configuration (by DJ) (NSCLIMAINT-885)

  • nscli maint parallel: Updates to handle ASA to PaloAlto maintenances (Jim) (NSCLIMAINT-888)

  • maint palo parse_asa: New plugin - ASA to PA migration assistant (by DJ and Jim) (NSCLIMAINT-890)

  • maint palo base_config: New plugin to assist with basing PaloAlto FWs (by DJ and Jim) (NSCLIMAINT-891)

  • New shared module to get command outputs from PaloAlto FWs via SSH or XML API (by Denny S and DJ) (NSCLIMAINT-894)

  • nscli maint cabling-audit (asa): Added “–rcg” flag to support RCG connection (by DJ) (NSCLIMAINT-900)

  • nscli maint migrate-ucs: Add route for TORQ to ensure script re-runs don’t fail. (by DJ) (NSCLIMAINT-903)

  • nscli cloudflare read_access: Command to get read-access to Managed Cloudflare accounts (by DJ) (#2820)

  • nscli cloudflare usage_report: Get report on parameters that affect Cloudflare billing for given period (by DJ) (#2824)

Bugfixes

  • nscli maint minor (asa): Updated maintenance execution time for HA case to 2 hours (by DJ) (NSCLIMAINT-868)

  • nscli maint prep and f5 minor: Updates to generic prep and F5 minor show commands, contributed by Edwin Adan (by Duane Herman) (NSCLIMAINT-896)

  • nscli maint migrate-ucs: F5 LTM v12 -> v14 upgrade SNMP configuration fixes and other improvements (by DJ) (NSCLIMAINT-899)

  • nscli projects: Fix for crash if EXP date is missing for “waiting scheduling” tickets (by DJ) (NSCLIMAINT-902)

  • nscli maint parallel: Allow bypassing unexpected IDS core status during device checks (by DJ) (NSCLIMAINT-905)

  • Fix to support title formatting change in Towncrier (by James Wathen) (#2808)

  • Fixes SSH connection options for compatibility with legacy hardware as SSH libraries update (by DJ) (#2815)

  • Removed pytest-runner package flagged in build safety check (by DJ) (#2826)

Misc

  • NSCLI-218

v21.9.29 (2021-09-29)

Features

  • nscli maint qc: Updates to lb decom and generic QC sheets to account for NAT rebuild maintenances (by Duane Herman) (NSCLIMAINT-887)

  • nscli maint parallel: Updates to parallel to handle ASA to PaloAlto maintenances (by Jim Burhans) (NSCLIMAINT-888)

  • nscli cloudflare logs: New command to check / enable HTTP traffic loggig. Also, zone provisioning now enables logging at Cloudflare (by DJ) (#2742)

  • nscli cloudflare: Multi-account commands - ‘add_members’ (works on multiple accounts) and ‘list accounts’ (new command) and (by DJ) (#2768)

  • nscli cloudflare zsp: Backup ZSP function to gain access to customer Cloudflare account(s) (by DJ) (#2796)

  • nscli cloudflare: Misc changes to ‘nscli tokens’, ‘nscli reset’ and ‘nscli settings’ relevant to Cloudflare credentials (by DJ) (#2800)

Bugfixes

v21.8.5 (2021-08-05)

Features

  • nscli ip: Improved table appearance. Added ticket and ping count feature for ping. (by Alex Hayward) (NSCLI-216)

  • nscli maint minor: Updates to SNMP remove/re-apply steps for active/active bug (FP Appliance HA) (by DJ Joshi) (NSCLIMAINT-865)

  • nscli maint lb_convert: Added parsing and accounting for ‘port-policy’ based monitor (by DJ) (NSCLIMAINT-875)

  • nscli maint prep: Update to prep template to account for FTD, PA and Netscaler. Colin Barton contributor (by Duane Herman) (NSCLIMAINT-876)

  • nscli maint lb_convert: Added parsing and accounting for ‘use-alias-port-state’ (by DJ) (NSCLIMAINT-879)

  • nscli maint jinja: Added wiki and rollback verbiage to all jinjas that contained maintenance templates (by Duane Herman) nscli maint prep: Added wiki and rollback verbiage to all plugins with maintenance templates (by Duane Herman) nscli maint prep: Changed static versioning to coded versioning on generic prep jinja (by Duane Herman) nscli maint prep: Updated generic prep template with new Citrix show commands (by Jim Burhans) (NSCLIMAINT-880)

  • nscli ssh core-id: For FTD this will connect to FTD instead of FXOS (by Prabin) (#2763)

Bugfixes

  • nscli maint minor (asa): Updates to maintenance plan steps updated to remove/re-apply SNMP configuration for Firepower appliance mode ASAs going up to code 9.14(2) - 9.14(2)13 (by DJ) (NSCLIMAINT-865)

  • nscli maint lb_convert: Bug-fixes for parsing higher ports (like 80XX), default port, “disable” keyword etc (by DJ) (NSCLIMAINT-879)

  • nscli ssh: Added new SKUs for third party cloud login logic for SSH plugin (by DJ) (#2779)

  • nscli zsp status: Fixed logic to prevent the crash because of timestamp parsing failure (by DJ) (#2781)

  • nscli zsp unlock: Removed [ and ] from allowed special characters for ‘managed cloud password’ to prevent ‘zsp unlock’ process failure (by DJ) (#2782)

  • Coverage dependency updated to resolve build lint (by James Wathen) (#2787)

Misc

v21.5.27 (2021-05-27)

Features

  • Now uses internal Identity authentication token when logging Newrelic data through the gatekeeper API (by Herb Jackson) (NSCLI-136)

  • nscli maint times: Refreshed output format. Added new timings for code upgrades. Added new a timing for generic maintenances (by Jason Wright) (NSCLIMAINT-811)

  • nscli maint: Set up Net-bastion access via Balabits (Network Gateways) for maintenance plugins that make switch connections (by DJ) (NSCLIMAINT-844)

  • nscli maint updates: Added new update for snat warning for adx to f5 conversions and modified qc sheets accordingly (by Duane Herman) (NSCLIMAINT-845)

  • nscli maint minor (f5): Added ‘Registration key’ validation / update step before licence re-activation (by DJ) (NSCLIMAINT-848)

  • nscli maint minor (f5): updates (by DJ)

    • Allowed users to bypass API calls for code upload / install

    • Added link to Etherpad page for visibility on changes (NSCLIMAINT-849)

  • nscli maint asa: Inserts new timezone command, specific to FP vs ASA chassis, which sets timezone to UTC (by DJ) (NSCLIMAINT-851)

  • nscli maint minor: New maintenance template for ASA on Firepower chassis for “active/active on reboot” bug (by DJ) (NSCLIMAINT-853)

  • nscli maint minor: Added Jinja template for ASA minor maintenance steps (by DJ) (NSCLIMAINT-854)

  • nscli maint lb_convert: Now errors with proper error message if ADX connection fails (by DJ) (NSCLIMAINT-857)

  • nscli projects: Changes for STRAT team re-org to identify/omit RED TEAM (Premium T2) tickets. Code was refactored for other changes like ‘Strat Dallas / Castle’ no longer being a factor. (by DJ) (NSCLIMAINT-860)

  • nscli maint (console SSH - shared module): Update for Netbastion access via Balabit (by DJ) (NSCLIMAINT-861)

  • nscli maint cabling-audit (asa): Additional logic for interface map identification (by DJ) (NSCLIMAINT-862)

  • nscli projects: Updates to isolate maintenance preps that are or about to expire (by DJ) (NSCLIMAINT-863)

  • nscli maint minor (asa): Maintenance plan steps updated to remove/re-apply SNMP configuration for Firepower appliance mode ASAs going up to code 9.14(2) - 9.14(2)13 (by DJ) (NSCLIMAINT-865)

  • nscli maint qc generic: Updates to generic QC sheet to account for saved configurations and rollback validation (by Duane Herman) (NSCLIMAINT-866)

  • asa_shared.py: Updated to suppress banners from bastion servers (by DJ) (NSCLIMAINT-870)

  • nscli maint asa: Updated to cache result of ASA configuration pull (by DJ) (NSCLIMAINT-871)

  • nscli cloudflare: Updates to zone / account feature provisioning. Addition of code generated e-mail for Cloudlfare to provision necessary features (by DJ) (#2717)

  • nscli imperva snmp_check $device(s): Check whether snmp is running on the WAFs registered to a given Imperva MX (by James Wathen) (#2721)

  • nscli ssh: SSH update to use appropriate credentials for third party cloud FWs (by DJ) (#2732)

  • nscli netbast: Updated host selection and implemented VIP as default (similar to cbasts) (by James Wathen) (#2737)

  • nscli settings: Added -db option to force local config.db to update from FACTS (by James Wathen) (#2738)

Bugfixes

  • nscli maint qc asa: Fix for crash on missing template for HA -> Single migration (by DJ) (NSCLIMAINT-856)

  • nscli maint asa: Bug-fix for interface speed/duplex misconfiguration for ‘failover’ nic for ASA -> Firepower and for ASA 5525/45 to Firepower 21k migration (by DJ) (NSCLIMAINT-859)

  • nscli projects: Updates to handle tickets with “null” account number. (by DJ) (NSCLIMAINT-867)

  • nscli maint parallel: Bug-fix for for parallel missing standby device’s IP in the ASA -> FTD prep (by Jim) (NSCLIMAINT-872)

  • nscli maint lb_convert: Changes to prevent code crash due to port policy based monitor configuration and other minor changes. Some port policy based monitors are still NOT being processed and this will be fixed soon. (by DJ) (NSCLIMAINT-875)

  • nscli ssh: Device identification logic updated for FTD device NOT backed by FMC (by Jim Burhans and DJ) (#2724)

v21.3.31 (2021-03-31)

Features

  • nscli maint qc: Updated jinja templates to include one-connect profile check and health check verification (by Duane Herman) (NSCLIMAINT-827)

  • nscli netbast and nscli switch : updated connecting through Balabit/GW instead of direct connection to netbast (by DJ)

    • switch connections are proxied through ‘network’ support gateway

    • ssh_lib.py - class OpenSshBalabitNetBast was added to handle switches that could not be connected straight from Balabit GWs (#2702)

Bugfixes

  • nscli maint minor (adc): Bug-fix for local username being used for CBAST proxy connection (by Jason Wright, DJ) (NSCLIMAINT-846)

  • Fixing issue with logging level globally set to WARNING inadvertently (by James Wathen) (#2700)

  • Fixes issue where nscli ip routes returns a maximum of 10 static routes. (by Alex Hayward) (#2706)

Improved Documentation

v21.3.23 (2021-03-23)

Features

  • maint qc: QC addition plus JINJA template tidy up (by Jason Wright) (NSCLIMAINT-773)

  • maint minor: updated for Citrix VPX/ADC code upgrades (by Colin and DJ) (NSCLIMAINT-782)

  • maint minor (asa) - changes in light of recent SKU changes (by DJ)

    • Script should now recognize new “Platform/Appliance” mode SKUs for FPs (NSCLIMAINT-783)

  • maint parallel: ASA to FTD migration prep template added (by Frank Allotta) (NSCLIMAINT-792)

  • maint parallel: Added custom caching support where possible (by DJ) (NSCLIMAINT-800)

  • maint updates: added scheduling templates (by Duane H) (NSCLIMAINT-802)

  • maint asa: Update to catch/fix DH default group behavior change post 9.13(1) (by DJ) (NSCLIMAINT-803)

  • maint lb_convert: LTM conversion - add OneConnect-32 profile for VIPs using L7 policies (by DJ) (NSCLIMAINT-807)

  • ‘maint migrate-ucs’ was updated to account for newer platforms (by DJ)

    • Updated ‘up interface’ check with a manual prompt

    • Changed reference to hardcoded interfaces

    • Added waiting prompt for UCS to finish loading (NSCLIMAINT-809)

  • ‘maint migrate-ucs’ updates for password changes on newer BigIP codes (by DJ)

    • Command was added to set ‘admin’ password

    • A user reminder was added for ‘root’ password change (NSCLIMAINT-813)

  • maint minor - asa code upgrade changes (by DJ)

    • DH group checks added for ASA code (ASA and Firepower chassis)

    • Minor changes to commands in fp_platform_mode.jinja2

    • Code refactoring, enabled caching for testing / troubleshooting (NSCLIMAINT-814)

  • maint lb_convert: LTM conversion - add SNAT automap to mimic ADX behavior (by DJ)

    • A new option (–ltm_no_snat_automap) added to allow to use “SNAT POOL” configuration (NSCLIMAINT-819)

  • maint lb_convert: user requested new features (by DJ)

    • ADC conversion - Option (–adc_server_name_update) to convert ‘server name’ to match wiki std. (- replaced by _)

    • Enforce 2 returns (rnrn) at the end of the “HTTP” monitor send string, else health-check fails (NSCLIMAINT-820)

  • nscli projects: updates and improvements (by DJ)

    • Parallelized Core queries for speedup

    • Added caching to facilitate testing

    • Option for adding AM names to the output

    • Added retry logic for librack calls

    • Separated “slow” core calls under a separate command option (NSCLIMAINT-835)

  • nscli projects: Added ATAT tier lookup (by DJ) (NSCLIMAINT-836)

  • maint minor - user warnings and f5 upgrade change (by DJ)

    • Added user warning for “script update” review

    • F5 minor code upgrade

      • Updated function checking for port preserve bug

      • Added warning about “delete volume” (NSCLIMAINT-840)

  • nscli cloudflare - new plugin for Cloudflare related tasks (by Edwin Adan and DJ) (#2671)

  • nscli ip: qc-ip like command for nscli (by Alex Hayward)

    • Runs ping, traceroute, public aggr and route checks.

    • ‘nscli ip routes’ in particular is very useful for finding potentially free IPs in public blocks routed to a customer environment when you need to create new NATs or VIPs. (#2686)

  • nscli cloudflare - better input/error handling for zone creation (by DJ) (#2692)

Bugfixes

  • maint port-migrate: core-helper function crashes (by DJ) (NSCLIMAINT-707)

  • maint parallel: Device platform identification logic was updated to account for newer platforms like FTD (by DJ) (NSCLIMAINT-792)

  • maint parallel: Bugfix for wrong interface names in prep steps for ASA on FP chassis (by DJ) (NSCLIMAINT-801)

  • asa cabling-audit: check2 (public port missing) now errors gracefully with proper error message (by DJ) (NSCLIMAINT-816)

  • maint parallel: Added error message for code crash on wrong IDS status (by DJ) (NSCLIMAINT-817)

  • maint lb_convert: user reported bug-fixes (by DJ)

    • ADC conversion - “add ipset”, “bind ipsec” and “add netProfile” commands should not be repeated

    • ADC conversion - Bug-fix for inconsistent name reference for PRIMARY / BACKUP vservers (NSCLIMAINT-820)

  • maint minor (F5): bug-fix for active volume being chosen for new code installation (by DJ) (NSCLIMAINT-824)

  • maint shared module bug-fixes (by DJ)
    • unipede_helper.py

      • fix for occasional crashes during mac info update attempt

    • device_switch_data.py

      • copy_caller_data() did not work as expected

      • Added cache bypass logic for build_data()

      • Ensured self.devices was set as list

    • debug_helpers.py

      • Updated CacheInfo.update_ref() logic to stop override (NSCLIMAINT-825)

  • nscli projects: Updated “account team” list based on GTS Wiki (by DJ) (NSCLIMAINT-833)

  • maint port-migrate: minor bug-fixes and updates (by DJ)
    • Bug-fix for source port-channel evaluation

      • Interface’s port channel name cannot be same as self (interface name)

    • Added warning for “unsafe change” review

    • Native vlan on access port is set to 1

    • Added a check so MTU is not set to 0 (NSCLIMAINT-838)

  • maint port-audit: Bug-fix for port-audit crash while evaluating ‘allowed_down’ (by DJ) (NSCLIMAINT-841)

  • nscli pt: fixed the exception when the plugin is run with -D (Detail) argument. (by Pedro Ortale) (#2661)

  • nscli f5 ssl_audit: Fixed the issue where certain profiles were missed from the report. (by Pedro Ortale) (#2666)

  • nscli type validation Fixed an issue where the user uses a short switch name without specifying the DC. (by Pedro Ortale) (#2672)

  • maint port-audit: bug-fix for interface status always showing down/down (by DJ) (#2676)

  • ftd import: bug-fix for failure to import nested network object-groups (by DJ) (#2679)

v21.1.14 (2021-01-14)

Bugfixes

  • maint port-migrate - bug-fix for VLAN DB check always showing VLAN change as UNSAFE (by DJ) (NSCLIMAINT-796)

  • maint lb_convert - bug-fixs for ADX config parsing (by DJ)

    • Parse CSW policy when protocol and port are not specified.

    • Parse ADX real port property, when extra spaces separate keywords - ‘ port ftp backup’ (NSCLIMAINT-797)

  • maint lb_convert - bug-fixs for cert/key name/extensions (by DJ)

    • Wrong (truncated) CA cert name used in create cert command

    • Extension .crt/.key missing from file path in ‘install cert key’ command

    • Short certKey names for ADC platform missing in changes (NSCLIMAINT-798)

v20.12.16 (2020-12-16)

Features

  • maint qc adx_f5_qc - Added QC Templates for ADX to F5 migrations (by Duane H) (NSCLIMAINT-521)

  • maint lb_convert - updates to parse/translate more configuration elements (by DJ) - Added ‘server port’ and ‘port-policy’ translation - Added ‘healthck’ translation (basic) - sticky-age translation (on VIP) - Xref data now shows ‘healthck’ and and ‘port-policy’ (NSCLIMAINT-778)

Bugfixes

  • maint lb_convert - bug-fix for priority-group output typo in LTM TMSH command output (by DJ) (NSCLIMAINT-760)

  • maint lb_convert - minor bug fixes (by DJ) - Removed trailing .crt/.key from LTM output - Passed platform tag to CertProcessor from ADX parser to make naming adjustments for Citrix translation, if needed - ‘no-tlsv1.3’ option added for LTM output - Expanded service name to port number mapping to more ports - ‘Unknown config’ elements tied ONLY to ADX config (eliminated duplicates) (NSCLIMAINT-778)

  • maint freeze verbiage update to match GTS standards (by Duane H) (NSCLIMAINT-786)

  • maint lb_convert - added warning if ADX use SNAT ACL as it is ignored in translation (by DJ) (NSCLIMAINT-788)

  • maint minor (F5) - NSCLIMAINT-790: bug-fix + minor changes (by DJ)

    • Fix for upload verification commands failing on secondary LTM

    • User messaging / prompt updates (NSCLIMAINT-790)

  • maint lb_convert - Updated logic so monitors are created with appropriate protocol (by DJ) (NSCLIMAINT-791)

v20.11.17 (2020-11-17)

Features

  • maint minor (f5) updated to install code on new volume on v14+ (by DJ) (NSCLIMAINT-752)

  • maint minor (f5) bug-fixes / updates (by DJ)

  • maint minor (asa) updated to support FP chassis in appliance mode (by DJ) (NSCLIMAINT-776)

  • maint minor (asa) updates (by DJ)

    • Added caching calls to facilitate debugging / troubleshooting

    • Added -u option tp allow specifying custom username/password for console log-in.

    • Added -c option to allow providing console information at start

    • Updated interface ID logic, user feedback messages. (NSCLIMAINT-777)

  • Adds a defaults_from field and supporting code to the configuration database. This lets NSCLI support new data centers faster. (by Micah Culpepper) (#2637)

Bugfixes

  • switch runner (dependency for some maintenance functions) bug-fix (by DJ) - Adjusted ‘timeout’ values for switch connections to accommodate delays. (NSCLIMAINT-784)

  • Fixes a race condition where the nscli settings file might be corrupted when multiple nscli processes run simultaneously (by Micah Culpepper) (#2633)

v20.10.20 (2020-10-20)

Bugfixes

  • Fixed a bug where users were being prompted for their keyring password on each invocation of NSCLI. (by Micah Culpepper) (#2620)

  • Adjusted remove command in certificates prep device update templates (by DJ) (#2621)

v20.10.19 (2020-10-19)

Features

  • Revamped maint port-migrate plugin (by DJ)
    • Added shared functions from ‘maintenance fork’ needed for ‘port-migrate’

      • unipede_helper.py - Wrapper around UnipedeAPI, to get switch information via Unipede

      • device_switch_data.py: Builds models of device-switch / switch-switch connections and VLAN associations by analyzing switch info

        • This helps in preparing switch / neighbor switch port / VLAN changes

      • safety_checks.py: Updated error handling for ‘switchports_down’ validations function

      • sw_feapi_reader.py: Wrapper around FireEngine Switch API, to get VLAN / interface information from switch

      • switch_runner.py: New function added to simplify getting live output from switch

      • user_input.py: Added function to get port mappings from user

      • dcx_helpers.py: Wrapper around DCXAPI client, to get environment manager data.

      • net_helpers.py: New functions added to manipulate VLAN lists

    • Relevant unit tests were added

    • Renamed existing ‘port-migrate’ as ‘port-migrate-old’

    • New code was added for ‘port-migrate’, along with a basic unit test with mocked/cached data (NSCLIMAINT-768)

  • Adds support for Python 3.9 and upgrades the homebrew package to use 3.9. (by Micah Culpepper) (#2603)

  • Improvements for certificates prep plugin (by DJ)

    • Added –cleanup option

    • Added QC commands in output templates

    • Added LTM profile commands in template

    • Code attempts to adjust ADC CertKey Name to below 31 chars (#2609)

Bugfixes

  • Bug-fixes / updates for maintenance plugins:

    • NSCLIMAINT-765: update for maint cabling-audit (ftd) (by DJ)

    • NSCLIMAINT-762: maint qc asa –ticket - minor changes (by DJ)

    • NSCLIMAINT-715: Prep / QC / Template updates for GTS Qality standards (by Duane) (NSCLIMAINT-770)

  • Adjusted connection timeout for switch_runner.py to avoid switch timeouts (by DJ) (NSCLIMAINT-771)

  • Updated the appstats logging client to use the new v3 stepladder API endpoint (by Micah Culpepper) (#2531)

  • Bug-fix for certificates prep crash for some inputs (by DJ)

    • SSL Tool could not recognize ‘internal’ CAs, causing code to fail on response parsing.

    • OpenSSL.crypto.Error formatting inconsistency caused failure (#2604)

  • Changing the Packet Tracer plugin in order to use Pandora’s new endpoint (by Pedro Ortale) (#2607)

  • Bug-fix for certificates prep failing to process tickets with only non-zip attachments (by DJ) (#2609)

v20.9.24 (2020-09-24)

Bugfixes

  • Bug-fixes for maint minor / major (adx) (by DJ) - Updated older maintenance templates to have correct ‘maint updates’ commands (NSCLIMAINT-759)

v20.9.18 (2020-09-18)

Bugfixes

  • Bug-fixes for maint lb_convert (by DJ)

    • Added missing Jinja template files in setup.cfg, so those are packaged properly

    • Fixed path on LTM template to have /var/tmp instead of /shared/tmp

    • Fixed wrong certificate location showing up in user instructions (NSCLIMAINT-749)

  • Cleaned up user instructions for certificates prep plugin (by DJ) (NSCLIMAINT-750)

  • Updated maint migrate-ucs for 14 code changes (by DJ)

    • Code failed to update root password because of changes v14+ and crashed. (NSCLIMAINT-758)

v20.9.15 (2020-09-15)

Features

  • Added nscli waf cert_list to gather a list of SSL Certificates installed to an Imperva WAF (by James Wathen) (NSCLI-181)

  • Added nscli imperva mx_update to manually gather gateways registered to an mx and update the DB with those relationships. (by James Wathen) (NSCLI-197)

  • Added nscli ids cert_uploader to upload SSL Certificates to Alert Logic accounts (by James Wathen) (NSCLI-198)

  • Added nscli ids cert_list to pull a list of SSL Certificates installed on an IDS/Alert Logic account (by James Wathen) (NSCLI-202)

  • Added nscli waf violations to pull a list of violations matching criteria defined in command (by James Wathen) (NSCLI-203)

  • Added nscli maint lb_convert to assist ADX -> LTM / ADC conversion (by DJ) (NSCLIMAINT-729)

  • Added nscli certificates prep to facilitate batch certificate parsing (by DJ) (NSCLIMAINT-750)

  • Mac/Nscli integration

    Mac is a tool to run arbitrary maintenances on netsec devices, this integration allows for netsec engineers to track and follow these maintenances (by John Dowling) (#2516)

  • Updated nscli info to include a –portcompare script that is easily readable for bulk comparisons (by Chris Hollar) (#2576)

Bugfixes

  • maint cabling-audit and maint qc asa updated for librack2 changes (by DJ)

    • librack2 changes: ‘parts_by_sku_number’ replaced by ‘parts_by_sku_id’ (NSCLIMAINT-721)

  • maint module updates / bug fixes (by DJ)

    • NSCLIMAINT-741: (+other JIRAs) maint minor (F5) updates - new checks, caching and Jinja template

    • NSCLIMAINT-744: maint migrate-ucs: Bug-fix for send_commands function - fixes UCS mismatch key issue

    • NSCLIMAINT-745: maint minor (fp) - Bug-fix for get_device_platform function

    • NSCLIMAINT-746: maint mino (adx) - Bug-fixes and improvements. Hard-coded FO NIC, FO VLAN lookup updated. (NSCLIMAINT-754)

  • maint asa bug-fix to retry/fall-back on TORQ if connection to ASA crashes/times out (by DJ) (NSCLIMAINT-756)

  • Updated the unit tests for the nscli trunking autotrunk script and modified it’s functions to be portable to other scripts (by Chris Hollar) (#2576)

  • This fixes a token issue within nscli virt rpcv-acl and some issues when unexpected devices like switches are present on the ticket (by James Finnegan) (#2579)

v20.8.3 (2020-08-03)

Features

  • Updated cabling audit for ASA on FP Appliance mode (by Sergio Pereira) (NSCLIMAINT-667)

  • maint cabling-audit updates for FP appliance mode + bug-fixes (by DJ)

    • FP Platform name match bug fix

    • Allowed DRAC port to be in up status during audit

    • Added -c argument for console information

    • Fixed ungraceful exit on ASA check1

    • Added some caching code for future use (NSCLIMAINT-693)

  • maint shared ticketupdates for ASA running on FP (by DJ)

    • Updates to read cabling audit for ASA running on Firepower chassis (NSCLIMAINT-698)

  • maint qc asacatch ASA -> FTD migrations (by DJ)

    • qc asa will highlight / flag and STOP QC if it is a ASA -> FTD migration. (NSCLIMAINT-706)

  • nscli maint minor (asa) updates (by DJ)

    • Updated to use FACTs instead of TORQ

    • Allow users to choose custom (non-FACTs) code version for ASAs

    • Some cleanup / typo fixes

    • Please report all issues to the NSCLI Developers via email <mailto:nscli@rackspace.com>` (NSCLIMAINT-713)

  • nscli maint minor (f5) updates / bug fixes (by DJ)

    • migrate_ucs.py - ssh_f5.send_command updated to handle timeouts better

    • lb_minor.py - verify_sfp() updated to account for patched version / platform

    • lb_minor.py - print_maintenance_steps() updated to print bug warning if applicable

    • SNMP check updated to be more verbose

    • Added external / Non-API validation to the code upload / install steps

    • Manual change commands printing in case API fails

    • Cleanup / cosmetic updates for visibility

    • Please report all issues to the NSCLI Developers via email <mailto:nscli@rackspace.com>` (NSCLIMAINT-724)

  • The nscli ssh plugin has been rewritten and updated to accomplish many tasks (by Joe Wesch)
    • The plugin has certain default rules it will now follow
      • All devices will default to use DRAC if it exists and public otherwise

        • You can override this functionality with the -p, --public argument

      • All unknown device types will attempt to connect automatically (-a, --attemptssh has been deprecated) with the following defaults

        • Proxy through balabit

        • Uses DRAC if it exists, otherwise public

        • Uses TACACS credentials

        • GUI (--gui) opens a connection to TCP 443

        • SCP (--scp) will attempt to copy the file to the root folder

      • Arguments are included to override many default behaviors

    • Many new device types have been properly identified and have been tested to work correctly

    • WAF and RSA no longer need to specified with arguments and will be automatically detected

    • Added the ability to proxy your SSH connection through the cbast with --proxy

      • Certain device types that have higher (balabit incompatible) SSH cipher settings will default to this behavior

    • Cloud network device (Vyatta, Fortinet) functionality has been added by using the UUID or IP of the device

    • If you need to access the original ssh plugin, it has been moved to old_ssh for future deprecation

    • Please report all issues to the NSCLI devs in the #nscli slack channel or via email (#1490)

Bugfixes

  • Parallel migrations bug-fix for IDS check (by DJ)

    • Added “online/complete” core status for IDS check which caused parallel to miss it and crash (NSCLIMAINT-664)

  • maint qc asa bug-fix for AnyConnect SKU check (by Frank Allota)

    • Updated check to match all AnyConnect SKUs instead of hard-coded 5508-X AnyConnect SKU. (NSCLIMAINT-673)

  • maint qc asa bug-fix + update for check_rapid_deployment (by DJ)

    • Updated property lookup to match librack2 changes + minor changes (NSCLIMAINT-676)

  • LB decommission QC sheet update: Check for non-VIP IPs (by Frank Allota)

    • Added check in QC sheet for NAT and ARP IPs out of front side segment that do not belong to load-balancer (NSCLIMAINT-730)

  • ASA parallel migrations QC sheet update (by Frank Allota)

    • Added check for MACs in WAF VLANs in all ASA migration QC sheets (NSCLIMAINT-733)

  • maint minor (adx) crahsing for some devices (by DJ)

  • Fixed a bug that was stopping the auto backup function when exiting devices (by Joe Wesch) (#2556)

  • nscli asa codeupload has been changed to pull the current standard code version from Facts (by Joe Wesch) (#2558)

  • Updated the autotrunking command to recognize certain nexus switches that don’t match the current regex. (by Chris Hollar) (#2562)

v20.7.17 (2020-07-17)

Features

Bugfixes

Misc

  • #2094, #2536

v20.6.15 (2020-06-15)

Features

Bugfixes

v20.5.26 (2020-05-26)

Bugfixes

  • FTDClient (by Aaron Hackney) - bugfix where network is not accessible at the time of threat intelligence download (NSFIRE-44)

v20.5.20 (2020-05-20)

Features

  • nscli maint parallel (by Sergio Pereira)

    • Added Support for FirePower appliance mode

    • Allows manual input for gathering new device interface information

    • Parallel migration prep Version bump to 4.0 (NSCLIMAINT-654)

  • FTD Plugin (by Aaron Hackney)

    • only 1 import option now: import

    • can re-run kick without error to pick up anywhere the plugin may have failed

    • can supply a config file with your own config

    • if no config supplied, a full kick from firekick will attempt to be applied

    • no proxy info is required

    • no ip address is required (will use DRAC in core)

    • can override core ip address with a -a

    • can override the default proxy with a -n to connect direct

    • plugin now can configure outside interface ssh and http admin access

    • added reporting option for exporting access control policy

    • added url threat intel configuration

    • plugin will honor the license entitlement from core and activate the evaluation license for those entitlements

    • plugin will configure HA

    • plugin will configure only what is required for an HA secondary device (NSFIRE-40)

  • Added many Palo Alto device name variants for nscli ssh (by Joe Wesch) (#2473)

Bugfixes

  • nscli migrations <any> (by NetSec DC Migrations <mailto:netsec_dc_migrations@rackspace.com>)

    • With the Migration database being migrated to MongoDB 3, this fix updates DB queries to reference the correct data types. (GM-621)

  • nscli maint failover [f5] (by Sergio Pereira)

    • VLAN Fail Safe must be enabled in dedicated segments when there are more than two ARPS with different OUI. Therefore, the script give the option to continue when VLAN failsafe is not enabled.

    • Replaced sys.exit with raise ValueError

    • Version bump to 2.1 (NSCLIMAINT-658)

  • nscli maint minor [firepower] (by Sergio Pereira)
  • nscli maint minor [F5] (by Sergio Pereira)

  • Resolving an issue with librack and the CoreServer properties being updated. This should now pull the correct properties. This also cleans up some extra information provided for palo alto’s that aren’t needed thanks to Panorama. (by James Finnegan) (#2467)

  • nscli bandwidth once again gets the list of billable devices based on the end date provided (by Joe Wesch) (#2481)

v20.4.23 (2020-04-23)

Features

  • Cable audit parsing functions updated to account for new Firepower audit format (by DJ) (NSCLIMAINT-627)

  • nscli maint sweep (by Sergio Pereira)

    • If ticket provided, the script will use ticket number instead of device id to store and compare results.

    • Now it is possible to compare cached results with either active or standby device.

    • Version bump to 2.1 (NSCLIMAINT-651)

Bugfixes

  • NSCLI Provisioning (by Matthew Manning)

    • Fix rollback for double NAT is missing objects (IMPLDEV-1117)

  • BugFix for librack2 invalid get_server methods within nscli maint plugins (by Sergio Pereira)

    • nscli maint minor

    • nscli maint parallel

    • nscli maint migrate-ucs

    • nscli maint qc asa (NSCLIMAINT-640)

  • BugFix for nscli maint parallel ADX to F5 (by Sergio Pereira)

    • Wrong Steps while enabling/disabling device interfaces for new devices

    • Jinja template version bump to 1.2 (NSCLIMAINT-644)

  • BugFix for nscli maint parallel when new device number is lower than old device number (by Sergio Pereira)

    • librack2 get_server returns a dictionary where keys are in order from lower to higher device numbers

    • Version bump to 3.0 (NSCLIMAINT-645)

  • Carry forward bug fixes for ‘maintenance.shared’ functions from maint/dev -> NSI main release (by DJ)

    • core_helper.DummyToken.core_token_to_dict updated to ‘deep copy’ core token attributes to help with multi-threaded calls

    • asa.run_show_commands_on_cyclade_asa updated to make a clean ‘console login’ attempt, in case of failure (NSCLIMAINT-646)

  • Fixes ASA & FP2k ssh to drac (by Joe Wesch) (#2452)

  • Fixes nscli bandwidth to use new https endpoints (by Joe Wesch) (#2457)

v20.4.16 (2020-04-16)

Features

  • Migrations (by Josh Silvas) (GM-581)

    • Removed unused migrations plugins, mostly the audit plugin as it’s being ran elsewhere.

    • Added an option to the TORQ plugin to exclude/include a device from backups.

    • Cleanup migrations_tests

    • Fix migrations trace IP logic to search for mac-addresses from the partner aggr if not found on the first one.

    • Update_waf changes to figure out route changes dynamically rather that assume the MX IP block.

  • NSCLI Provisioning
  • Upgraded nscli’s dependency on librack to librack2. (by Micah Culpepper) (NSCLI-185)

    • Lots of under-the-hood changes to make this happen, especially to Token.librack_auth.

  • Refactored nscli maint parallel

    • Jinja templates for firewall and loadbalancer parallel migrations were added (by Shani Munir)

    • Refactored parallel migrations in order to inject required data to jinja templates. (by Sergio Pereira)

    • Moved parallel migration script under maintenance folder (NSCLIMAINT-263)

  • nscli maint qc direct swap jinja templates added (by Duane Herman)

    • nscli maint qc asa -directswap_single

    • nscli maint qc asa -directswap_ha (NSCLIMAINT-612)

  • Updated ftd plugin in order to automatically build a HTTPS tunnel via Cbast (by Sergio Pereira)

    • Function _get_https_proxy has been added to ftd plugin (NSCLIMAINT-625)

  • Added nscli maint sw status plugin in order to show/enable/disable switch ports (by Sergio Pereira)

  • Add the capability to generate firekicks for a given device (-d deviceid) for all of the FTD templates and save the file to the users home directory by default. (by Aaron Hackney) (NSFIRE-22)

  • FTD 6.6+ introduces VRF to the platform. As a result, we need to handle CRUD operations on routes differently based on the code version (API version). We need to add the API version as an attribute to the base plugin so that we can give nspylib some clue as to which API endpoint to hit (6.6+ route endpoint or pre-6.6 endpoint). (by Aaron Hackney) (NSFIRE-23)

Bugfixes

  • NSCLI Provisioning
  • NSCLI Provisioning (by Matthew Manning)

    • Change NSCLI Provisioning to use the NSPyLib provisioning back-end

    • fix broken tests (IMPLDEV-1102)

  • nscli maint failover [F5] bugfix. (by Sergio Pereira)

    • Removed additional interface identifier command from maintenance prep that leads to invalid syntax.

    • Updated nscli maint sweep commands

    • Version bump to 2.0 (NSCLIMAINT-620)

  • Fixes unicode issue related to OpenSSH 8.2. Users may now upgrade their OpenSSH installations. (by Micah Culpepper) (#2363)

Deprecations and Removals

v20.3.27 (2020-03-27)

Bugfixes

  • NSCLI Provisioning - fixed nscli provisioning configure nats truncates the config if its longer than 80 characters (by Matthew Manning) (IMPLDEV-1071)

  • NSCLI Provisioning - fixed nscli provisioning info qcip failure when connecting to ASA that has TCP PAT config (by Matthew Manning) (IMPLDEV-1073)

v20.3.17 (2020-03-17)

Features

  • Refactored nscli.provisioning.configure.nats (by Matthew Manning)

    • Functionality is the same, testing is the same

    • Added comments and cleaned up code

    • Broke apart the console interaction significantly, so the code can be ported into FE Lambda easier (IMPLDEV-1021)

  • nscli settings -c: Added this command so folks can install the Rackspace CA certs on their system in preparation for the NSI team switching to an internally-signed certificate this week. (by Micah Culpepper) (NSCLI-186)

  • Created to handle bulk import API calls to an FDM Managed FTD. (by Aaron Hackney)

    • NAT mondule will bulk create the network objects reqiured for a NAT and then the NAT itself.

    • Flexconfig module will bulk create the needed network, port, and secret objects needed for a flexconfig policy and then create the policy itself.

    • Objects module will bilk create network objects, port objects, network groups, and port groups

    • Network moduule will configure the interfaces, sub-interfaces, network objects needed for static routes, and static routes

    • Secpol module will configure security zones with interfaces, access-control policies, and http/ssh management access on both a public interface and a mangement interface.

    • Platform module will configure common platform level settings such as NTP, DNS, updating schedules, backup sechedules, etc. (NSCLI-187)

  • Created maintenance.shared.user_input to handle various user input tasks (by DJ)

    • Porting functions form maintenance fork (to be) used by maintenance modules

    • Unit test setup

    • Docstring updates and code cleanup (NSCLIMAINT-580)

  • Refactored nscli maint migrate-ucs in order to disable network interfaces (by Sergio Pereira) The script disables network interfaces in order to avoid outages. During the maintenance prep F5 interfaces must be enabled (NSCLIMAINT-582)

  • Updates for maintenance.shared.ticket functions (by DJ)

    • Improved logic to better handle error conditions

    • Improved unit tests (NSCLIMAINT-589)

  • Updated nscli maint minor -d [F5] (by Sergio Pereira)

    • Updated maintenance steps to be compatible with 14.x Software Version.

    • If devices are in SYNC, there is no sync available options in the GUI as previous versions.

    • Maintenance template version bump to 4.0 (NSCLIMAINT-590)

  • Minor code improvements and optimization to unit tests for a few maintenance.shared plugins (by DJ) (NSCLIMAINT-594)

  • f5sdk function has been added under nscli/shared (by Sergio Pereira)

    • f5sdk function establishes a proxy

    • f5sdk connects using F5 proprietary SDK to a Big-IP device given a core device number (NSCLIMAINT-600)

  • SwitchRunner now creates a custom ssh config file (by Sergio Pereira)

    • There is not need to modify ~/.ssh/config anymore

    • Script will use a custom ssh config file

    • Added UnitTests

    • Moved script under nscli/plugins/maintenance/switchrunner/ (NSCLIMAINT-603)

  • Added function to extract failover interface from cabling audit results (by DJ)

    • Function parse_failover_interface_from_cabling_audit added in maintenance.shared.ticket.

    • Updated existing functions to accept audit_validated flag to avoid re-checking audit

    • Added unit tests for new code.

    • ‘ASA QC’ plugin updated to use failover interface function (NSCLIMAINT-605)

  • nscli maint sweep refactored (by Sergio Pereira) Instead of performing multiple calls to dcx to obtain device number given an IP, now it obtains all devices, IP addresses given an environment number. Making ping sweep faster and less likely to receive timeouts (NSCLIMAINT-606)

  • NetdeviceSSH.get_response method has a timeout hard coded. I have updated this method to allow users to specify timeout (by Sergio Pereira) (NSCLIMAINT-609)

  • Updated nscli maint qc [F5] jinja templates (by Sergio Pereira)

    • Updated Jinja templates to confirm maintenance plan has a step to set avr.stats.internal.maxentitiespertable db value if required

    • Version bump to v2.0 (NSCLIMAINT-612)

  • Updated nscli maint minor -d [F5] (by Sergio Pereira)

    • Added function to verify avr.stats.internal.maxentitiespertable db value

    • Added additional maintenance steps to update avr.stats.internal.maxentitiespertable db value if required - Version bump to v5.0

    • Added function to verify if F5 platforms 2000 and 4000 are using SFP ports due to interface flapping

    • Updated plugin in order to obtain device configuration directly from the devices via SSH (NSCLIMAINT-613)

  • Experimental centralized tracing system (Sentry) (by Pedro Ortale) (#2357)

  • Added logic to nscli ssh to detect Firepower 2k devices running ASA in appliance mode (by Joe Wesch) (#2366)

  • Included option to enable Sentry while running a development version of NSCLI (by Pedro Ortale) (#2387)

  • nscli f5 ssl_audit changes (by Pedro Ortale)

    • now is showing the domain names (CN/SAN) for the SSL profiles.

    • option to run the report to the entire account (-a) or over a single device (-d). (#2394)

Bugfixes

  • Fixes nscli maint qc asa -t [Ticket] as wrong arguments were being passed to nscli maint sweep (by Sergio Pereira) (NSCLIMAINT-587)

  • Changed name to IP substitution in nscli maint asa to counteract names nested within other names (by Joe Wesch) (NSCLIMAINT-611)

  • Fixes problems raised by OpenSSH version 8.2 whereby Diffie-Hellman-Group14-SHA1 is no longer a default KEX. Adds the string diffie-hellman-group14-sha1 to KEX definitions in two files, and migrates to modern Append method, utilizing + for declaring Cipher or KEX algorithms, as outlined in the release notes for OpenSSH 7.0p1 (2015-08-11). (by Brett Lykins) (#2363)

  • Fixes a TypeError on nscli info when searching for IP addresses (by Joe Wesch) (#2394)

  • Adds the Firewall - Cisco platform definition for nscli ssh --scp (by Joe Wesch) (#2396)

Misc

  • #2375, #2385

v20.2.17 (2020-02-17)

Features

  • Added Upgrade Package for nscli facts version ftd printouts (by Joe Wesch) (NI-2167)

  • nscli monitoring [-d] [-c] [-t TARGET_DEVICE] device plugin added (by Sergio Pereira)

    • Prints checks, alarms and suppression information given a device

    • Copies checks, alarms to target device (NSCLIMAINT-362)

  • nscli maint asa now gathers public IPs automatically and suggests all other standby IP addresses if going from single to HA (by Joe Wesch) (NSCLIMAINT-509)

  • nscli maint minor -d [F5] script now verifies if save harbor software version is already installed. (by Sergio Pereira) (NSCLIMAINT-550)

  • Added into nscli tokens an additional optional argument to print customer impersonation token (by Sergio Pereira)
  • Added an additional check into to nscli maint minor -d [F5] to verify invalid SNMPv2 configuration (by Sergio Pereira)

    • Invalid SNMPv2 configuration will not prevent loading existing configuration in 14.X software version (NSCLIMAINT-568)

  • ‘maintenance.shared.debug_helpers’ updates (by DJ)

    • Improvements to ‘debug_dump’ and ‘cache’ function

    • Addition of ‘dump_load’ function to read data dumped on disk (NSCLIMAINT-570)

  • ‘maintenance.shared.debug_helpers’ updates (by DJ)

    • Updates to make cache file name determination more robust/stable

    • Added options to skip args and/or kwargs for cache file name

    • Updated/added unit tests

    • Removing plugin level code for folder creation (NSCLIMAINT-571)

  • ‘nscli maint sweep’ updates (by Sergio Pereira)

    • Addition of -s, –store and -c, –compare optional arguments in order to compare pre and post maintenance results (NSCLIMAINT-573)

  • nscli maint qc generic added feature to check for maintenance db commands (by Duane Herman) (NSCLIMAINT-579)

  • Create ‘maintenance.shared.ticket’ module for maintenance plugins (by DJ) (NSCLIMAINT-581)

  • adding plugins for RackConnect Global “nscli rcg <> “(by Prabin Gautam) (#2323)

  • Updated NSCLI trunking autotrunk to detect if a port is shut or downed. It will now prep a no shutdown command or give an indication that the port is down. This update also includes some code tidying up, along with a fix for vlan detection. (by Chris Hollar) (#2324)

  • Implemented impersonation tokens on the Token class. To get an impersonation token, access token.impersonation_tokens[account] where “account” is the Core account number as an int or str. The object returned is of the nscli.auth.ns_auth.NSCLICredential class, so you may want to access the .secret attribute. Impersonation tokens are stored the same way as other NSCLI credentials. (by Micah Culpepper) (#2328)

  • Implementing Palo rule generation as a part of ‘nscli virt rpcv-acl’. This adds a new option and flag that can be use to generate rules for Palo’s. (by James Finnegan) (#2335)

  • Expand pretty_text features and control (by Matthew Manning)

    • can now modify your settings under “replace.color” to change one color to another (where supported) (#2349)

Bugfixes

  • Bug fix for CTK returning NULL values for some switch information (‘ports.switch.symbol’) (by DJ)

    • Used in nscli.plugins.maintenance.shared.core_helper.get_device_core_info (NSCLIMAINT-533)

  • nscli maint updates -mrt bug fix for user input for maintenance time (by Rich Edwards) (NSCLIMAINT-549)

  • Fixed a bug in port-audit when child devices have numerically lower device numbers than their parent (by Joe Wesch) (NSCLIMAINT-551)

  • Bug fix: get_data_switches method now requires user confirmation when migration ports are detected (by Sergio Pereira)

    • Migration ports on parallel migrations and RackConnect maintenance scripts are not required. (NSCLIMAINT-564)

  • Fixed a bug in nscli maint port-audit where it would crash when just firepower child devices are present and not the parent(s) (by Joe Wesch) (NSCLIMAINT-574)

  • Bug fix: nscli maint minor -d [F5] When F5 ndapi returns None, script will use raw ssh in order to obtain software version (by Sergio Pereira)

  • nscli luno_ng fixed issue while pulling device facts (by Pedro Ortale) (#2259)

Misc

  • #2321

v20.1.16 (2020-01-16)

Features

  • Physical serial Number has been added to nscli maint cabling-audit output (by Sergio Pereira) (NSCLIMAINT-520)

  • nscli.apilibs.ns_apilibs.PasswordSafe from con_ssh.py script has been replaced with nspylib.clients.PWSafeAPI (by Sergio Pereira) (NSCLIMAINT-538)

  • nscli maint updates -ownprep|-ownqc|-qcsched non-service impacting verbiage has been updated (by Sergio Pereira) (NSCLIMAINT-541)

  • Update nscli maint minor [f5] script in order to reference know issues and fixes one Rackspace wiki link (by Sergio Pereira) (NSCLIMAINT-542)

  • nscli maint qc [ASA] added additional step to verify firewall interfaces are being monitored (by Sergio Pereira) (NSCLIMAINT-543)

  • nscli rc info <account number> Filter servers in an account based on SKU; by default it will filter by RCG SKU (by Prabin Gautam) (#2299)

Bugfixes

  • nscli maint asa now moves routes to the bottom of the output for static routes to VTI’s (by Joe Wesch) (NSCLIMAINT-516)

  • nscli maint asa now prints monitor-interface commands at the end of the output to combat new ASA standard config (by Joe Wesch) (NSCLIMAINT-544)

  • nscli maint minor [Firepower] (by Sergio Pereira) (NSCLIMAINT-548)

    • Updated if statement to match 2120 platforms

    • Updated typos

  • Fixed a regex bug in nscli f5 adduser for 14.x code (by Joe Wesch) (#2287)

  • Palo alto now prints any post-login motd and last login info (by Joe Wesch) (#2305)

  • A couple bugs with the nscli autotrunk feature have been corrected. The first issue was with input validation, while the second was with detecting and generating commands for aggregation switches. (by Chris Hollar) (#2315)

v19.12.17 (2019-12-17)

Features

  • Added Palo Alto support to nscli facts version (by Joe Wesch) (NI-2112)

  • Added SwitchRunner class in order to push commands to switches (by Sergio Pereira) (NSCLIMAINT-444)

  • nscli maint cabling-audit now supports Firepower devices (by Sergio Pereira) (NSCLIMAINT-474)

  • nscli asa version_check plugin added to do audits for Code and/or AnyConnect version(s) on given ASA(s) (live or consoled) against FACTS API. (by DJ) (NSCLIMAINT-506)

  • Added additional checks to scrub checklist to nscli maint updates -mrt (by Shani Munir)

    • Perform cabling audit during scrub (if parallel migration)

    • Reserve IDS SPAN session during scrub (if IDS cab migration) (NSCLIMAINT-517)

  • Updated nscli maint migrate-ucs script for hardware upgrades to iSeries running 14.X software version (by Sergio Pereira) (NSCLIMAINT-526)

  • ConsoleSSH (maint.shared) class is updated to support newer platforms and has a few new methods. Bringing code in from MAINT DEV. (by Sergio Pereira) (NSCLIMAINT-530)

  • Modified format of the generic qc template to include proper indentation and spacing. (by Frank Allota) (NSCLIMAINT-537)

  • Added nscli mirror search to quickly find the path for a file on the mirror (by Joe Wesch) (#2094)

  • nscli asa dedos now pulls data using HTTP, and uses SSH as fallback method. (by Pedro Ortale) (#2231)

  • Adding new feature so that we can trunk/audit vlans to all hypervisors in a cluster. (by Prabin Gautam) (#2246)

  • nscli add devices to the ticket now bulk add/remove in as single CTK call. (by Pedro Ortale) (#2278)

  • nscli f5 adduser chmod’s response has been updated to be compatible with 14 code (by Joe Wesch) (#2287)

Bugfixes

  • nscli maint minor -d [FTD device] updates

  • Fixed the nscli luno_ng f5_status call. (by Pedro Ortale) (#2285)

  • Fixed a bug that would cause nscli info to crash on newer devices whose switches were not populated in CTKAPI. (by Micah Culpepper) (#2289)

Deprecations and Removals

  • Removed nscli/plugins/maintenance/maint_qc/auto_asa_qc.py script which is not being used. (by Sergio Pereira) (NSCLIMAINT-536)

  • nscli mirrorupload has been decommissioned as it no longer worked (by Joe Wesch) (#2094)

Misc

  • #2274, #2280

v19.12.5 (2019-12-05)

Features

Bugfixes

  • Fixed a bug in nscli maint port-audit that was reporting a parent was migrating to a child (by Joe Wesch) (NSCLIMAINT-525)

  • nscli luno_ng now pulls the F5 software version from NDAPI (by Pedro Ortale) (#2263)

  • Fixed nscli f5 adduser to upload to /var/tmp/ and move afterward as we can no longer scp directly to /etc/ (by Joe Wesch) (#2266)

v19.11.27 (2019-11-27)

Bugfixes

  • Fix failing qcip detailed and configure nats for srx platform. (by Donald Tanner) (IMPLDEV-189)

  • Updated Luno_ng to support DC selection local to the F5 (by Rich Gale) (LUNO-282)

  • Changes ribbon to use standout colors in an attempt to contrast the text with the background (by Joe Wesch) (#1278)

  • nscli ssh now prompts for both username and password when using -u for FXOS/FTD devices (by Joe Wesch) (#2230)

  • nscli maint port-audit no longer assumes a child devices’s parent has switch ports (by Joe Wesch) (#2249)

v19.11.15 (2019-11-15)

Bugfixes

  • nscli maint port-audit will now assume the switch is in the same DC as the device if CTX doesn’t know (by Joe Wesch) (#2235)

  • Fixed the references to the object fields, since it was changed in the ASA API (by Pedro Ortale) (#2237)

v19.11.14 (2019-11-14)

Features

  • nscli maint cyclade requires ticket number in order to record this event in netsec maintenance database (by Sergio Pereira) (NSCLIMAINT-147)

  • nscli maint qc f5 jinja templates updated in order to account checkusers.py script (by Sergio Pereira) (NSCLIMAINT-368)

  • nscli maint prep format and ordering of steps has been updated (by Jim Burhans) (NSCLIMAINT-470)

  • nscli maint minor now works with firepower devices running ASA code on platforms 21XX (by Sergio Pereira) (NSCLIMAINT-476)

  • nscli token plugin has been moved under nscli/plugins/tokens (by Sergio Pereira) (NSCLIMAINT-498)

  • nscli maint asa now warns you when there is a question mark in plain text keys that need to be pasted in (by Joe Wesch) (NSCLIMAINT-501)

  • nscli maint sweep now works with Firepower devices running FTD code (by Sergio Pereira) (NSCLIMAINT-504)

  • nscli projects now sorts ‘Waiting Scheduling’ tickets by their QC expiration date instead of original DUE date (by Joe Wesch) (NSCLIMAINT-507)

  • nscli facts version now detects a child device and prints the software for the parent chassis (by Joe Wesch) (#2213)

  • Improves our .deb releases by providing more-specific releases for different OS versions. We now publish releases for Debian 10 and Ubuntu 18.04, 19.04, and 19.10. See the Installation document for a list of currently-supported OS versions. (by Micah Culpepper) (#2221)

  • Added support for Python3.8 (by Micah Culpepper) (#2224)

Bugfixes

Deprecations and Removals

Misc

  • #1391, #2199, #2231

v19.10.15 (2019-10-15)

Features

  • Show if an IP is not in a directly connected network in QCIP simple mode (by Donald Tanner) (IMPLDEV-753)

  • nscli maint port-audit now attempts to deal with non-existent switches instead of crashing (by Joe Wesch) (NSCLIMAINT-480)

  • nscli maint minor has been refactored in order to use facts api. Moreover, it has been moved under maintenance plugin (by Sergio Pereira) (NSCLIMAINT-481)

  • nscli maint port-audit will now try and detect when an IDS monitored device is moving cabs and then if the IDS is missing migration ports (by Joe Wesch) (#2113)

  • nscli maint port-audit now warns when there is not an aggr within 2 hops of a switch (by Joe Wesch) (#2141)

  • Added netsec_files to nscli facts for MD5/SHA512 of files (by Joe Wesch) (#2193)

Bugfixes

  • nscli maint port-audit was crashing when comparing child device cab numbers when it didn’t have switch ports (by Joe Wesch) (NSCLIMAINT-479)

  • nscli maint asa now updates standby IP and ISE key when migrating to new zone (by Joe Wesch) (#2180)

  • Fixes auto backup on device logout (by Joe Wesch) (#2189)

Misc

  • #2187

v19.9.16 (2019-09-16)

Features

  • Added an option to specify a ping timeout value in qcip for ASA and ADX devices (by Drew Cody) (IMPLDEV-752)

  • Added new ssh profiles for Firepower devices/services (by Joe Wesch)

    • FTD/FXOS/SFR ssh profiles added

    • FTD/SFR gui profile will attempt to gather the URL from the FMC name in CORE and open in your default gui browser, if unsuccessful it will parse OneWiki for the corresponding FMC URL

    • (NSCLI-92)

  • Added scrub framework to nscli maint updates -mrt to remind user of necessary scrub tasks (by Shani Munir) (NSCLIMAINT-384)

  • nscli maint updates -mrt updates (by DJ) - Added Jinja template and rendering function for scrub checklist - Removed the prompt from call flow which used to allow users bypass scrub checklist during MRT (NSCLIMAINT-438)

  • nscli maint asa now requires confirmation if the vlan number you are providing is not in the ENV (by Joe Wesch) (NSCLIMAINT-453)

  • nscli maint projects updated to include ‘Strat Dallas’, ‘Team D10’ and ‘ENTW-1WIN’ (by Sergio Pereira) (NSCLIMAINT-465)

  • Added nscli settings --bash and nscli settings --zsh to produce a static tab completion file (by Joe Wesch)

    • The static file will be based on your currently non-hidden plugins

    • (#450)

  • nscli info now prints the parent, child and FMC device numbers (if applicable) (by Joe Wesch) (#2134)

  • nscli fleet_tools naas is now available to all Rackers. It uses the Racker’s TACACs credentials to execute arbitrary

    sets of commands or configurations on a provided list of Netsec devices. ZSP and other command Auth functions are still applied by the end device. (by Brett Lykins) (#2143)

  • Increase logging verbosity in nscli.__main__ when using --debug or if debug = True in Settings.ini.

    This will allow us to better manage/monitor initial NSCLI execution process. (by Brett Lykins) (#2148)

  • nscli pt is now able to use account numbers on top of the existing device number. With this option, multiple instances of packet tracers will be run, according with the network logical path between the source and destination IP address specified for the test. (by Pedro Ortale) (#2157)

  • nscli maint asa now detects crypto map pfs group1 which is now fully deprecated and stops the script as it needs to be fixed prior to migration (by Joe Wesch) (#2160)

  • nscli maint asa now detects a primary IP on the new device and will replace the IP and gateway in the config (by Joe Wesch) (#2161)

Bugfixes

  • nscli maint qc asa QC templates updates for re-route section (by Duane Herman) (NSCLIMAINT-420)

  • Fixed a bug on nscli maint port-audit where it wouldn’t print the neighbors when there are no/all VLANs trunked (by Joe Wesch) (NSCLIMAINT-443)

  • Fixed a false positive bug in a nscli maint port-audit RCv2 migration check (by Joe Wesch) (#2116)

  • Fixed a bug where certain commands were no longer exempt from logging (by Joe Wesch) (#2122)

  • nscli asa findnetworks no longer crashes when it cannot parse a rule (by Joe Wesch) (#2123)

  • nscli ssh --failover no longer logs into the primary after logging into the failover device (by Joe Wesch) (#2139)

  • nspylib logs now print/log in nscli (by Brett Lykins) (#2145)

  • Fixes issues around corrupt settings files. We now have a lockfile so that only one NSCLI process can write to the config file at a time. We also rename the settings file to “settings.ini.old” and create a new settings file if we are unable to parse it. (by Micah Culpepper) (#2167)

  • Moves the RSA prompt for CORE tokens back up to the front of the NSCLI run. No more RSA prompts while logging out. (by Micah Culpepper) (#2168)

Deprecations and Removals

Misc

  • #2169

v19.8.15 (2019-08-15)

Features

  • Created a new command: nscli provisioning assign ip (by Matthew Manning) (IMPLDEV-525)

  • Updated nscli provisioning configure nats (by Matthew Manning)

    • updated F5 static NAT config due to vulnerability identified.

    • fixed according to OneWiki

    • (IMPLDEV-771)

  • nscli maint updates -qcpass now adds expiration date for QC in ticket subject (by DJ) (NSCLIMAINT-372)

  • nscli maint updates output describes maintenance impact per decided verbiage (by Sergio Pereira) (NSCLIMAINT-392)

  • nscli maint port-audit now ignores neighbors across a mgmt interface (by Joe Wesch) (NSCLIMAINT-399)

  • Added a new audit to nscli maint port-audit that checks for inconsistent RackConnect SKUs on migration devices (by Joe Wesch) (#2057)

  • Automatically changes Palo Alto CLI config mode to show ‘set’ commands instead of xml (by Joe Wesch) (#2068)

  • Adds Panorama ssh profile (by Joe Wesch) (#2071)

  • Adds a warning when logging into HA ADX devices that are still running 12.4 to remind users to manually sync the config (by Joe Wesch) (#2076)

  • Added SHA512 checksums to nscli facts version <platform> output (by Joe Wesch) (#2078)

  • Added the nscli torq refresh-device command, so you can refresh torq easily (for example, if you’ve just re-IP’d a device and you need Torq to catch on so it can do a new backup). (by Micah Culpepper) (#2083)

  • Updated nscli virt rpcv-acl to support F5’s on the edge. It will now respond with the configuration changes necessary for an Edge F5 in regards to an RPCV Build (by James Finnegan) (#2087)

  • nscli now reports the exit status to appstats/newrelic after running for detailed error reporting (by Joe Wesch) (#2089)

  • If the NSCLI settings option SSH -> Paramiko is set to True, ssh interactions will attempt to use Paramiko instead of OpenSSH. This behavior is disabled by default at this time, as this feature is still in Beta status. (by Brett Lykins) (#2099)

  • nscli maint port-audit now sends a refresh command to Unipede with a listing of switches before asking for fresh data so everything gets queued up more efficiently (by Joe Wesch) (#2104)

  • Added an IP check to nscli virt rpcv-acl to ensure all necessary devices have IP’s during build (by James Finnegan) (#2111)

Bugfixes

  • nscli maint qc rcv2_rcv3 - template reflects correct maintenance length. (by Sergio Pereira) (NSCLIMAINT-353)

  • nscli maint updates [-waitprep|-ownprep] Improvements to existing ETD functions - force update existing date(s), strips spaces if needed. (by DJ) (NSCLIMAINT-395)

  • Removed the manual gateway replacement for users using DFW Issue #2007, and fixed an issue related to imports (by Pedro Ortale) (#1073)

  • Added the NAMES parsing in order to avoid netaddr conversion errors #2007 (by Pedro Ortale) (#2007)

  • Removed storage of SSH Known Host Keys, by dropping them into /dev/null, to resolve issues where host key changes and user is unable to log in. (by Brett Lykins) (#2020)

  • Fixed a bug in nscli maint asa where it would inadvertently trim port-channels (and possibly other) interfaces when converting to a Firepower chassis (by Joe Wesch) (#2073)

  • No longer crashes when Siphon doesn’t return the latest watchlist (by Joe Wesch) (#2080)

  • Fixed nscli switch behavior to properly provide SSO password to SSH Proxy connections. (by Brett Lykins) (#2101)

Misc

  • #2042

v19.7.22 (2019-07-22)

Features

Bugfixes

Improved Documentation

v19.7.16

  1. nscli core (by Micah Culpepper)

    • Fixed the bug “Parent instance is not bound to a Session”, #2037. Most noticeably affected nscli ssh.

v19.7.15

  1. nscli maint asa (by Joe Wesch)

    • Added logic to ask for IPv6 standby IP’s when moving from standalone to HA

    • Now fails interface conversion when it detects extra interfaces

    • No longer tries to look at interfaces that don’t exist #2030

  2. nscli core (by Joe Wesch)

    • Added a new option in the settings.ini file to exclude plugins (or subplugins) from nscli #1596

  3. nscli permissions (by Joe Wesch)

    • Fixed a bug where we tried to print contact info for invalid contacts #2021

  4. nscli juniper pt (by Pedro Ortale)

    • Clean-up for unnecessary module (future) being in use.

    • Fixed the issue with the dport argument. #2025

  5. nscli zsp unlock (by Joe Wesch)

    • Prints an error when a change control SKU is detected on a device #483

  6. nscli facts version (by Joe Wesch)

    • Added ftd as a new platform

  7. nscli zsp unlock (by Joe Wesch)

    • Now also logs output to a log file #1684

v19.6.17

  1. nscli maint asa / nscli asa recovery (by Joe Wesch)

    • Added zabbix SNMPv3 user to list of known credentials to pull from PasswordSafe #1980

    • Added logic to deal with the 5510 with the extra 4x1G interface module NSCLIMAINT-324

    • Changed the RCv2 detection method to limit false positives NSCLIMAINT-329

  2. Netsec Maintenance Updates
  3. nscli ssh (by Joe Wesch)

    • Added the logic for logging into ASA child devices. #1964

    • If a Firepower parent device is provided, it will error and provide the child device number(s) if exist.

  4. nscli maint port-audit (by Joe Wesch)

    • Changes from multi-processing to multi-threading for all requests #1996

    • Added an audit for IDS that are not part of a span session destination. Also reports currently configured number of sessions NSCLIMAINT-348

    • Added port channel interface labels to table output if the interface is in one

  5. nscli rc RackConnect (by Pedro Ortale)

    • Fixed the certificate issue #1999.

  6. nscli facts version (by Joe Wesch)

    • New plugin to interface with the NetSec Facts API to get the current standard version

    • nscli facts version $DEVICE

      • Prints the current standard code version for the specified device

    • nscli facts version (asa/f5/adx/srx/netscaler) [--model $MODEL]

      • Prints the standard for the specified platform (and optional model number)

  7. nscli maint port-migrate

    • Updated to use proper UnipedeAPI module

    • This resolves an issue with this timing out on MAC’s

  8. nscli switch (by Micah Culpepper)

    • When connecting to a switch in a region for which no network bastion is defined in NSCLI’s infrastructure database, NSCLI will now choose the user’s default region for proxying instead of crashing. #2004

  9. nscli core (by Micah Culpepper)

    • Fixed a bug in holiday detection that caused NSCLI to behave in an excessively jovial manner on the day after Memorial Day. #1997

v19.5.17

  1. nscli core (by Micah Culpepper)

    • Additional fix for former-Datapipe users related to #1933

v19.5.15

  1. nscli maint asa (by Joe Wesch)

    • Added tunnel group titles to the exemption list for ‘name’ replacements

    • Added logic to convert legacy ssl settings to latest standards NSCLIMAINT-278

    • Added interface conversions from ASA to Firepower 21xx (running ASA code)

    • Function re-factoring to facilitate calling ‘maint asa’ from other modules. NSCLIMAINT-302 (by DJ)

    • Now pulls the standard boot image and anyconnect packages from FactsAPI #1952

    • No longer asks if you want to use the standard interface for failover

    • Added argument --failover_interface for injecting non-standard interface

  2. nscli maint port-audit (by Joe Wesch)

    • Added neighbor names to table when no/all VLANs are trunked

    • No longer crashes when Unipede returns None for a timestamp #1948

    • No longer crashes when Parent/Child SKU is present without a device listed - prints audit fail instead #1966

    • Added check for Firepower devices with missing DRAC port #1930

    • No longer warns about DRAC ports being inconsistent when moving to SFR or Firepower

  3. external logging update (by Joe Wesch)

    • Changes the functionid that is reported to appstats to be the path of the plugin that is called Plugin path names that exceed 50 characters (excluding nscli.plugins.) are not allowed. #1836

    • Adds nscli.plugin with plugin path to New Relic logging

  4. nscli trunking autotrunk (by Chris Hollar)

    • Added plugin

  5. Netsec Maintenance Updates
  6. nscli maint rpcv-acl (by James Finnegan)

    • Updated logic to be able to handle the new v3 process

    • Added –v2 command for any remaining v2 builds in progress (will be removed in the future)

  7. nscli core (by Micah Culpepper)

    • Added a new function, nscli.shared.helpers.get_servers, which behaves like librack.server.get_servers, but also gets SKUs when loading server data, which results in fewer CTK calls. #1962

  8. nscli maint fw_convert (by Justin Drew)

    • Added function to standardize F5 names and avoid invalid characters #NSCLIMAINT-322

    • Fixed rule-list name creation and some syntax issues #NSCLIMAINT-321 & #NSCLIMAINT-310

    • Cleaned up output and streamlined user interactions

    • Enabled parsing, storing, and retrieval of multiple ACLs

    • Added support to pull from local file

v19.4.24

  1. nscli core (by Micah Culpepper)

    • Fixed a bug that prevented former-Datapipe Rackers from using nscli info and nscli ssh on devices in admin.mydatapipe due to the fact that their Datapipe and Rackspace SSO usernames differed. #1933

    • NSCLI will now prompt you for your Datapipe SSO when needed. For users that have the same SSO across Rackspace and Datapipe, you can press Enter to use your Rackspace SSO for both systems. This value will be saved in NSCLI’s settings file.

v19.4.17

  1. nscli <asa/adx/f5/juniper/netscaler> sanitize input (by Joe Wesch)

    • Added logic to automatically split a config if it’s too large for the input API

  2. nscli maint port-audit (by Joe Wesch)

    • Added logic to ignore dcpe switches that show up as neighbors

    • Lengthened timeout for Unipede access switch call from 2 minutes to 5; neighbors remain at 10 minutes. If Unipede doesn’t respond in time it will now stop instead of trying to continue with partial data. It also will now print a list of switches that failed to return information. #1900

    • Added an audit for parent/child firewall relationships NSCLIMAINT-275

  3. nscli f5 afmrulegen (by Zach Brooks)

    • Added plugin

  4. auto-backups (by Micah Culpepper)

    • Improved error-silencing. You shouldn’t see any more stack traces from failed auto-backups.

    • Added parent-context detection, so now when you log out of a context ASA, we will back up the parent device in CORE (since we don’t back up children individually). This depends on the parent device ID being set correctly in CORE…

  5. Netsec Maintenance Updates
  6. dedos ports (by Micah Culpepper)

    • Replaced 1MB spreadsheet with 121KB Python file

    • Added a script to grab new port numbers from IANA when needed

  7. nscli core (by Micah Culpepper)

    • NSCLI’s config database no longer uses an intermediate infrastructure.json file.

    • Closes #1819 and #1921

v19.3.26

  1. nscli core (by Joe Wesch)

    • Changes where nscli retrieves user SSH keys to improve performance of nscli initialization

v19.3.25

  1. nscli pt (by Pedro Ortale)

    • Generic Packet Tracer wrapper. It identifies the device platform a runs the appropriate Packet Tracer Plugin.

  2. nscli maint port-audit (by Joe Wesch)

    • Added warnings when migration net device service levels (COLO vs Managed) don’t match #1874

  3. nscli asa recovery (by Joe Wesch)

    • Fixed a bug where it always assumed the self-signed TP would be first

  4. Netsec Provisioning Updates
    • nscli provisioning batch get_ip (by Matthew Manning)

      • IMPLDEV-598

      • Generates a CSV in the Batch IP format based on the existing environment data

    • nscli provisioning batch get_vlan (by Matthew Manning)

      • IMPLDEV-599

      • Generates a CSV in the Batch VLAN format based on the existing environment data

    • nscli step5 (by Matthew Manning)
    • Changed the DCX API endpoint for env lookup (by Matt Vitale)

      • it’s a cheaper call to make ᕕ(ᐛ)ᕗ

  5. nscli asa codeupload (by Joe Wesch)

    • Now uploads to both devices in an HA pair starting with the standby #1863

  6. nscli maint freeze -r (by Joe Wesch)

    • Fixed a bug so it now works #1885

  7. nscli ssh –asdm (by Joe Wesch)

    • Added a flag to proxy an ASDM link to Java Web Start (only tested on Mac) #784

  8. Netsec Maintenance Updates
    • maintenance parsers #NSCLIMAINT-269 (by Sergio Pereira)

      • Refactored maintenance parsers in order to be able to log nscli maint usage correctly into appstats

  9. nscli ssh (by Micah Culpepper)

    • Restored functionality of nscli ssh $ip #1871

    • Fixed all of the backslashes that were showing up in DMGs

  10. automatic backups (by Micah Culpepper)

    • #1876

    • NSCLI will now trigger a Torq backup every time you log out of a device. This is done in a background process so as not to slow you down.

    • Logging is suppressed, so you won’t see any messages in your terminal about the success or failure of the backup. NSCLI will create a file in your logs directory containing the output from the backup job, so you can check there if you’re interested. As always, there are also event logs in Torq itself.

    • If the device is an ASA and it exists in admin.mydatapipe.com, then nscli will also upload a copy of the backup to admin.mydatapipe.com, to update the policy. If the device only lives in admin.mydatapipe.com and not CORE, then the Torq backup won’t work and neither will the policy update. For devices in this state, you should update the policy using fastpix.

v19.3.8

  1. nscli virt gendns (by James Finnegan)

    • Fixed an issue with attempting to sort a dictionary

    • Corrected output of cname entries

  2. nscli maint
  3. nscli maint migrate-ucs (by Bob Gustwick)
  4. nscli maint asa (by Joe Wesch)

    • Fixed a bug that was dropping IPv6 address on the outside interface from 5505 source devices #NSCLIMAINT-240

    • Moved SNMP settings to after failover (if HA) #NSCLIMAINT-246

  5. nscli ssh bug fix (by Joe Wesch)

    • Fixed a false positive regex match triggered by certain banner text

  6. nscli.info.ns_info.find_edge_device (by Micah Culpepper)

    • Added function to determine a device’s edge device. This works by searching Unipede for the static route with the best match to the given IP, and then returning the ID of the device that is assigned the next-hop IP of that route.

  7. nscli switch bug fixes (by Joe Wesch)

    • Fixed a bug where we didn’t check if the Unipede API call worked before attempting to gather info from it #1784

    • Fixed a bug where Arista switches were causing the terminal to try and send an erroneous escape sequence after login #1794

  8. nscli juniper pt (by Pedro Ortale)

    • Fixed bug triggered when a zone is associated to multiple interfaces.

    • Fixed the tests - Mocking FD’s.

    • Moved the plugin to the appropriate folder (plugins/juniper).

    • Minor visual enhancements.

  9. nscli maint updates qcpass (by Justin Drew)
  10. nscli ssh (by Micah Culpepper)

    • Added support for Palo Altos

    • NSCLI will try to use the DRAC IP in CORE to connect

  11. nscli maint port-audit (by Joe Wesch)

    • Now prints error messages about VLAN trunking issues

    • Added a check to verify the VLAN is not shut down on the switch #1791

    • Added -u, --update-switch option to request Unipede to update a single switch/aggr instead of everything Example: nscli maint port-audit -u a1-2-1.dfw3

    • Now checks if the SFR DRAC port is not on an ExNet switch #1840

  12. nscli virt cdp-update (by James Finnegan)

    • Tool that generates necessary commands to disable/enable cdp on hyp switchports for cable checking

  13. nscli maint qc f5 (by Jonathan Padovano)
  14. nscli maint projects fix (by Justin Drew)
  15. maint updates -waitprep (by DJ)

    • Added function to prepend DUE DATE to the ticket subject #NSCLIMAINT-248)

  16. nscli info (by Pedro Ortale)

    • Added IPv6 support

  17. nscli fleet_tools naas (by Brett Lykins)

    • Fixed bug with handling more than 500 devices

  18. nscli core (by Joe Wesch)

    • Added an option to the settings.ini file to enable tracebacks on errors without requiring --debug

  19. nscli bandwidth (by Joe Wesch)

    • New plugin that automates retrieving and combining billable device bandwidth for an account for a specified date range #1637

  20. nscli ssh -a -g (by Joe Wesch)

    • Adds the ability to attempt to connect to a gui connection for unknown connection types

    • Defaults to attempting DRAC, can be used with the -p flag to attempt to connect to the public IP #1802

  21. nscli asa pt (by Pedro Ortale)

    • Simplifies the Packet Tracer execution on ASA devices.

    • There is no need to identity the ingres interface for the source.

    • Uses TCP as default protocol and 1024 as source port.

    • Example usage: “nscli asa pt 884366 172.20.8.208 8.8.8.8 443”

  22. nscli f5 pt (by Pedro Ortale)

    • Simplifies the Packet Tracer execution on F5 AFM devices.

    • There is no need to identity the ingres interface for the source.

    • Uses TCP as default protocol and 1024 as source port.

    • Example usage: “nscli f5 pt 885445 192.168.10.2 2.2.2.2 23”

  23. nscli ssh (by Micah Culpepper)

    • Added support for devices that live in admin.mydatapipe.com instead of CORE.

    • To tell NSCLI you want to SSH to a Datapipe device or IP, prefix it with dp-, so dp-86926 or DP-206.55.127.120.

    • For these devices, nscli will use the user’s credentials to pull a shared username and password from the admin.mydatapipe API, and use those shared credentials to log into the device.

    • Due to a hilarious miscommunication, when NSCLI prompts you for your credentials, it might ask for a “Dell Defender token + PIN”. If you do not have such a thing, just enter your PIN + RSA like normal. This messaging will be clarified in the next release.

    • At the time of this writing, few Datapipe devices allow connections from the balabits, so you’ll get “connection refused” if you try to use NSCLI to log into them. This should be remedied in the next few days.

  24. nscli info (by Micah Culpepper)

    • Added support for devices that live in admin.mydatapipe.com instead of CORE.

    • To tell NSCLI you want info about a Datapipe device or IP, prefix it with dp-, so dp-86926 or DP-206.55.127.120.

    • For these devices, nscli will use the user’s credentials to pull data from the admin.mydatapipe API

    • Due to a hilarious miscommunication, when NSCLI prompts you for your credentials, it might ask for a “Dell Defender token + PIN”. If you do not have such a thing, just enter your PIN + RSA like normal. This messaging will be clarified in the next release.

    • Since admin.mydatapipe doesn’t contain all the same types of information as CORE, the output fields do not match the fields shown for CORE devices. It is valid to ask NSCLI for info on multiple devices in one command, and to have those devices come from different systems. Grep safely.

  25. nscli asa vpnpeers #NSCLIMAINT-262 (by Sergio Pereira)

    • Moved under asa plugin folder

v19.1.15 (released 2019-01-15)

  1. nscli ssh -g enhancement (by Joe Wesch)

    • Added options to the settings.ini file to allow for opening the GUI links in a different browser than your system default Options are either a supported browser name or an unsupported browser path with optional arguments Please see the docs for links to supported browser names along with an example on using path #1706

  2. nscli zsp status (by Joe Wesch)

    • Check the current status of an event_id

  3. nscli qcip (by Micah Culpepper)
    • Deleted command. Please use these commands instead:
      • For ASA:

        • nscli asa qcip

        • nscli asa static_nats

      • For F5:

        • nscli f5 qcip

        • nscli f5 static_nats

      • For Juniper:

        • nscli juniper qcip

        • nscli juniper static_nats

  4. nscli maint prep (by Shani Munir)

    • Updated LB testing steps

    • Various placeholder steps added for easier maintenance preps #NSCLIMAINT-215

  5. nscli virt rpcv-acl (by James Finnegan)

    • Fixing some output to clean up the ACL’s as well as fix object-group names

  6. nscli maint port-migrate (by James Finnegan)

    • Fixed a bug with l2dp causing a loop

    • updated logic for –para

    • changed -d, -t and –manual to be in a mutually exclusive group

  7. nscli maint QC (by Duane Herman) #NSCLIMAINT-219

    • Updated all QC sheets with new verbiage to clearly document interface to switchport configuration

    • Updated sheet for RCv2 to RCv3 with ACL check (by Shani Munir) #NSCLIMAINT-225

  8. nscli rc (by Pedro Ortale)

    • Fixed bug while handling the local cache

  9. nscli projects (by Sergio Pereira) #NSCLIMAINT-220

    • Updated nscli projects to also print ‘unsolved’ tickets

  10. nscli maint (by Sergio Pereira)
    • nscli maint rcv3 #NSCLIMAINT-221

      • Moved rcv3 under maintenance folder

      • Udpated maintenance steps

      • Replaced sys.exit with raise ValueError

    • nscli maint times #NSCLIMAINT-221

      • added Rcv2 to Rcv3 upgrade maintenance standard times

    • nscli maint prep #NSCLIMAINT-226

      • Moved plugin under maintenance folder

    • nscli maint protected_ips #NSCLIMAINT-227

      • Moved plugin under maintenance folder

    • nscli maint cabling-audit #NSCLIMAINT-210

      • Added Device information to display to the user the device number that the plugin is working on

    • nscli maint failover #NSCLIMAINT-231

      • Fixed bug with collapsed ExNet switches

    • nscli maint updates -mrt #NSCLIMAINT-232

      • Changed ticket status from New to Waiting MRT.

      • when option -nd, ticket queue is changed to Global NetDef Maintenance

  11. nscli asa shun (by Micah Culpepper)

    • Fixed a long-standing bug where shun would crash on some firewalls if failover data was too long.

  12. nscli tshoot_access (by Micah Culpepper)

    • This command has moved. It is now nscli asa tshoot_access, since it has only ever worked with ASAs.

    • If we add support for other platforms, we’ll add their commands under the appropriate trees.

  13. nscli f5 rebuildha (by Micah Culpepper)

    • This plugin has been decommissioned. #1745

  14. nscli f5 haconfig (by Micah Culpepper)

    • This plugin has been decommissioned. #1744

  15. nscli core (by Micah Culpepper)

    • NSCLI no longer supports Python 2. We currently support Python 3.5, 3.6, and 3.7.

    • The installer script has been updated accordingly, so new installations/upgrades will use Python 3, installing it if necessary.

  16. nscli upgrade (by Micah Culpepper)

    • The nscli upgrade command is gone.

    • NSCLI will continue to check for updates and notify when they are available.

    • Users are encouraged to install and manage nscli using a package manager for their platform. See our documentation on installing.

  17. nscli swip (by James Finnegan)

    • Fixing an encoding bug that broke this in python3

v3.10.0 (released 2018-12-17)

  1. nscli settings (by Micah Culpepper)

    • Fixed bug where nscli settings would crash on Mac due to a space in the settings filename.

  2. nscli maint port-audit (by Joe Wesch)

    • Increased the age multiplier for Unipede retry calls

    • Moved [WARN] and [FAIL] to individual audit lines for more granular results

    • Added output showing the “freshness” of the data according to Unipede

    • Fixed a bug where the migration ports were getting sorted too soon

  3. nscli maint updates (by Duane Herman)

    • nscli maint updates -waitprep: Removed all verbiage of 14 day turn around on.

    • nscli maint updates -mrt: Updated jinja template with examples of customer checks #NSCLIMAINT-174

    • nscli maint updates -maint qc decom –lb: Updated jinja template for change freeze removal prior to zsp unlock #NSCLIMAINT-193

  4. nscli maint plugin updates (by Sergio Pereira)

    • Updated nscli maint qc asa –auto -t to solve snmp engineID bug #NSCLIMAINT-189

    • Fixed nscli maint cabling-audit

      • asa bug with ASA 5515 platform #NSCLIMAINT-189

      • Fixed bug of misleading results when device has more than 1 ExNet port due to a counter

      • Version bump to 1.0 #NSCLIMAINT-211

    • nscli maint cabling-audit shuts down switch ports after making all tests on each device #NSCLIMAINT-197

    • nscli maint times #NSCLIMAINT-194

      • Plugin has been moved under maintenance folder

      • Updated maintenance times

    • nscli maint qc asa auto #NSCLIMAINT-196

      • Updated ASA safe harbor version

      • Fixed parser description

      • Added 5545 ASA platform #NSCLIMAINT-199

    • nscli maint parallel now detects alert logic cloud defender IDS #NSCLIMAINT-198

    • nscli maint sweep now supports FirePower with ASA Standard Module #NSCLIMAINT-200

    • nscli maint parallel
    • nscli maint protected_ips #NSCLIMAINT-205

      • Response from F5 /config/ltm/pool ndpi changed. Plugin has been updated

      • Replaced sys.exit with raise ValueError

    • nscli projects #NSCLIMAINT-200

      • Added In Progress status

    • nscli maint updates #NSCLIMAINT-217

      • Added option to update ticket with network defense signature

      • Removed nscli maint mrt

      • Updates commands.rst

  5. nscli maint qc f5 (by Jason Wright)

    • –ha-ha - QC steps for f5 ha to ha parallel migrations #NSCLIMAINT-97

    • –single - QC check added for F5 v11 server-ssl profiles being applied to VIPs #NSCLIMAINT-213

    • –single-ha - QC check added for F5 v11 server-ssl profiles being applied to VIPs #NSCLIMAINT-213

    • –ha-ha - QC check added for F5 v11 server-ssl profiles being applied to VIPs #NSCLIMAINT-213

  6. nscli settings (by Micah Culpepper)
    • added new options to nscli settings

      • nscli settings -s <sso> lets you update your SSO username in your nscli settings file.

      • nscli settings -t <tacacs> lets you update your TACACS username in your nscli settings file.

  7. nscli reset (by Micah Culpepper)

    • nscli reset will now delete your SSO username and TACACS username from your settings file. NSCLI will prompt you for these again the next time it needs them.

    • Previously, nscli reset would delete any saved passwords, but not the associated saved usernames. This meant that some users encountering authentication failures would attempt an nscli reset, but it would not solve their problem.

  8. nscli ssh_lib (by Brett Lykins)
    • nscli ssh library now has Paramiko support (Disabled by default as this feature is EXPERIMENTAL).
      • Paramiko is a Python native implementation of the SSH protocol, and this change is designed to:

        • Reduce OS package dependencies and/or errors because of OpenSSH version compatibility problems

        • Provide a faster interface as we are no longer calling a separate OS process

        • Reduce complexity in code, as there will be no more reliance on Pexpect

      • To enable, set the paramiko value to True in your settings.ini file.

    • Refactored classes to have separate Paramiko and OpenSSH base classes.

    • Fixed a bug where Balabit GW attempts would fail, even if password was correct.

    • Fixed a bug where super(self.__class__, self) recursion ate all the things because of MRO confusion.

    • Added much better connection success/fail logic and handling, allowing users to re-attempt password login.

    • Prepended r on Regex strings, as they must be marked as “raw” strings in newer Pythons.

  9. nscli netbast (by Brett Lykins)

    • nscli netbast will now utilize Paramiko for its connection if the user has enabled it in their settings file.

  10. nscli virt port-check (by James Finnegan)

    • Performs cable audit of Hyps

  11. nscli asa ol (by Pedro Ortale)

    • Added support to any CORE device status. Previously was pulling only Online/Complete.

  12. nscli virt rpcv-acl (by James Finnegan)

    • Generates RPC-V acl’s that are required for RPC-V

  13. nscli asa dedos (by Pedro Ortale)

    • Added IPv6 Support

v3.9.0 (released 2018-11-26)

  1. nscli maint plugin updates (by Sergio Pereira)

    • Updated suppression manager url #NSCLIMAINT-186

    • nscli maint failover has been moved under maintenance folder

    • nscli maint cabling-audit: added additional safety checks:

      • Target platform must be ASA-X series

      • Target device must be in segment configuration core status

      • Switchports links of target device must be initially down #NSCLIMAINT-154

    • nscli maint cabling-audit additional step added to shutdown switchports after cabling audit #NSCLIMAINT-154

    • Updated suppression manager url #NSCLIMAINT-186

    • nscli maint failover has been mover under maintenance folder

    • nscli projects: Removed status ‘Solved’ from resulting output #NSCLIMAINT-188

  2. nscli maint port-audit (by Joe Wesch)

    • Now catches timeouts on Unipede calls and tries again

    • Fixed a bug where Unipede had leading zeros in vlan names

  3. debian packaging (by Micah Culpepper)

    • NSCLI releases are now accompanied by .deb files, so you can install NSCLI with apt-get.

    • This feature is currently experimental.

    • The files can be downloaded from https://intra.mirror.rackspace.com/netsec.devops/nscli/debian/ - this location will move once the .deb releases are considered production-quality.

v3.8.1 (released 2018-11-16)

  1. Concurrent Futures on Python2 (by Brett Lykins)

    • Added a dependency on the “futures” package for Python2 users to fix an ImportError

v3.8.0 (released 2018-11-15)

  1. nscli core (by Brett Lykins)
    • Added new SSH library nscli.ssh.ssh_lib. This was done for several reasons:

      • To better use modern code re-use and inheritance models.

      • To make the SSH methods more easy to use/implement.

      • To make the SSH methods more robust (added tests) and easier to understand (added much documentation).

  2. nscli netdevice (by Brett Lykins)

    • Re-written to utilize new SSH Library (Direct connection)

  3. nscli cfgstation (by Brett Lykins)

    • Re-written to utilize new SSH Library (Proxy via Support Balabit GW in that region)

  4. nscli cbast (by Brett Lykins)

    • Re-written to utilize new SSH Library (Direct connection)

    • Removed deprecated options -1 and -2 as TES Linux has disabled direct access to specific bastion node

  5. nscli switch (by Brett Lykins)

    • Re-written to utilize new SSH Library (Proxy via Network Bastion in that region)

    • Removed deprecated Cyclade option

    • Removed deprecated Wildcard Audit option

    • nscli switch --run now accepts/executes multiple commands

      • Example: nscli switch abc123-1.xyz1 --run 'show version' 'show cdp neighbors'

  6. nscli permissions (by Joe Wesch)

    • Now prints an error if there are no devices on the ticket instead of crashing

  7. nscli fleet_tools (by Brett Lykins)

    • Adds some NSI specific tooling to NSCLI to help with any fleet level actions

  8. nscli core (by Brett Lykins)

    • Added process Exit Code handling for plugin execution,

    • All plugins can now return an exit code to be handled by __main__, if none returned NSCLI exits with a 0

  9. nscli maint port-audit (by Joe Wesch)

    • Now sorts Migration ports to the bottom in the output

    • Added logic to detect SFR SKU

    • Added logic to detect HA devices in the same cab as well as not in sister cabs

    • Added logic to detect different LB DRAC VLANs

  10. nscli ssh (by Zach Brooks)

    • added module used to call facts api for netsec runbook.

    • Modified print_login_ribbon method of NetdeviceSSH class in ns_ssh.py

    • Call to facts api for runbook will be made and user will be prompted to open in browser

    • Added option to settings.ini file to disable this, will print a warning that it has been disabled

  11. nscli zsp unlock (by Joe Wesch)

    • Returns error if the ticket is closed

  12. nscli maint plugin updates (by Sergio Pereira)

    • nscli maint cabling-audit #NSCLIMAINT-154

    • jinja templates updated: SFR sku check, removed reverse-path and IP verify path checks

    • nscli maint parallel: Fixed public comment bug #NSCLIMAINT-179

    • nscli maint qc asa –auto: Checks for SFR sku #NSCLIMAINT-179

    • nscli projects

      Added tier information

    • nscli maint migrate-ucs

      Bug fix with sed and too many slashes: #NSCLIMAINT-180 Increased prompt time out

    • nscli maint parallel: IDS regex bug

      Updated regex to find IDS migration ports #NSCLIMAINT-182

  13. nscli virt (by James Finnegan)

    • port-audit (re-call of port-audit under the virt section to make it easier to find)

    • gendns (generates rpcv dns requirements for a ticket or device list)

    • genmon (checks/creates monitoring entries for rpcv devices)

  14. nscli info bug fix (by Joe Wesch)

    • Fixed -e, --edge to work again #1203

  15. nscli ticket –contacts (by Micah Culpepper)

    • If you try to add invalid contacts to a ticket, nscli now tells you which ones were invalid instead of just dying.

    • Thanks to Erik Seime for the suggestion!

  16. Homebrew (by Micah Culpepper)
  17. User Files (by Micah Culpepper)

    • User config files, logs, and cached data have moved so that we can better respect OS conventions.

    • nscli --version will continue to show the locations of these files

    • There is no plan to automatically delete the old files or to move them to the new location. Users should delete or migrate their files as desired.

  18. Password Expiration (by Micah Culpepper)

    • NSCLI now considers SSO and ACS passwords to be expired after 90 days.

    • This may help prevent users from getting locked out of their accounts under certain circumstances.

  19. nscli rlookup (by Zach Brooks)

    • Added a simple module that can be used to perform a runbook lookup against the facts api

v3.7.1 (released 2018-10-24)

  1. nscli maint port-audit (by Joe Wesch)

    • Added a check for missing IDS ports when going from single to HA #NSCLIMAINT-134

  2. nscli nla (by Brett Lykins)
  3. nscli finder (by Joe Wesch)

    • Fixed a bug where Manager names were no longer printing #1587

  4. nscli info –macinfo (by Joe Wesch)

    • Fixed nscli info --macinfo to work again #1562

  5. nscli maint asa / nscli asa recovery (by Joe Wesch)

    • Moved snmp-server output to a more logical place #1584

  6. nscli ssh for RSA (by Joe Wesch)

    • Fixed a bug where pre-8.1 RSA devices wouldn’t log in #1586

  7. nscli permissions (by Joe Wesch)

    • Refactored to use consolidated CTK API calls instead of 1 per device

    • Moved Valkyrie calls to multiprocessing for much faster device permission turn around

v3.7.0 (released 2018-10-15)

  1. nscli ssh -r bug fix (by Joe Wesch)

    • Fixed ssh to RSA devices #1452

  2. nscli upgrade bug fix (by Joe Wesch)

    • nscli upgrade once again takes arguments #1476

  3. nscli maint port-migrate bug fix (by James Finnegan)

    • Fixed an issue with auto detection for migration ports not generating config

    • Table issues for auto detection fixed

    • Auto Detection is now much faster than before

    • Other minor output formatting fixed

  4. nscli maint migrate-ucs (by Sergio Pereira)
  5. nscli maint qc f5 –single-ha (by Jason Wright)

    • qc steps for f5 single to ha parallel migrations

  6. nscli maint asa (by Joe Wesch)

    • Added a printout of VLANs attached to the current firewall (from EM) for easy reference #1536

  7. nscli passgen (by Joe Wesch)

    • Uses the secrets module for Python 3.6+ users for stronger passwords #1539

  8. Refactor of nscli maint updates (by Sergio Pereira)

    • Uses librack to add ticket comments

    • Fixes the following Bug #NSCLIMAINT-139

    • Moved plugin under maintenance folder

  9. nscli maint qc decom –lb (by Shani Munir)

    • qc steps for decommission loadbalancers

  10. nscli ssh ribbon update (by Zach Brooks)

    • Prints a warning to the screen with devices with the change control sku, similar to freeze sku

  11. nscli swip (by James Finnegan)

    • Can create/modify/remove/lookup arin swip information.

    • It utilizes the ARIN Rest API to update arin information

    • Can use simple flags for prompted swip information

    • ‘–simple’ can be used to paste one or more ARIN Simple forms to mass update ARIN information

  12. nscli f5 ssl_audit (by Pedro Ortale)

    • Updated the Mongo-NDAPI query to consider both Online/Complete and Migration Server

  13. nscli finder (by Joe Wesch)

    • Rewritten to use the new identity finder to replace the deprecated Hozer’s #1565

v3.6.0 (released 2018-09-17)

  1. nscli maint port-audit (by Joe Wesch)

    • Span session audit now detects matching VLAN sources from the provided devices

    • Added –full flag which will show speed/duplex and native vlan (update by James Finnegan)_

  2. nscli add_devices_to_ticket (by Joe Wesch)

    • Will automatically add HA peers as well #1478

  3. nscli passgen (by Joe Wesch)

    • Added -n ##, --number ## argument for multiple passwords with the same settings

    • Added -p, --phonetic argument for printing the phonetic translation of the password (for reading over the phone) #1485

  4. nscli asa portalcomments (by Sergio Pereira)

    • Copy ASA Portal Firewall Comments

  5. nscli maint updates (by Sergio Pereira)

    • nscli maint sweep has been updated to use fping instead of sudo nmap #1508

  6. nscli switch bug fixes (by Joe Wesch)

    • Moved pexpect spawns to unicode encoding for python2/3 uniformity

    • Fixed a bug that caused subsequent switch spawns during a switch walk to fail to connect #1318

  7. nscli maint port-migrate (by James Finnegan)

    • Will print migration ports for devices

    • Can provide a manual port-map or provide device/ticket and let it auto-detect migration ports

    • You can also override vlans in case vlans are changing as well

    • Several options present, please review -h for more information

  8. nscli upgrade (by Micah Culpepper)

    • There was a bug in the version-checking logic in previous versions. If you consistently get the error message: “Upgrade check failed. The nscli code mirror may not be reachable.” then nscli upgrade won’t work for you, and you’ll need to do a clean install to fix the error.

  9. homebrew (by Micah Culpepper)

    • There is now a homebrew formula for nscli

    • This is still in an experiemental state and doesn’t fully work yet.

    • Mac users will be able to install nscli by running:

    • This is related to our efforts to use system-native package managers wherever possible instead of relying on our home-brewed install.sh script.

v3.5.1 (released 2018-08-17)

  1. nscli maint port-audit addition (by Joe Wesch)

    • Now prints a warning if any new firewalls or load balancers have FastEthernet ports (excluding DRAC)

  2. nscli core (by Micah Culpepper and Pedro Ortale)

    • Fixed a bug that made nscli reset always crash

    • Fixed a bug that made nscli add_devices_to_ticket always crash

    • Made progress on a bug that caused nscli upgrade to fail for some users, although further investigations are still pending.

v3.5.0 (released 2018-08-15)

  1. nscli <asa/adx/f5/juniper/netscaler> sanitize (by Joe Wesch)

    • You can now request a sanitized config in nscli instead of having to go through the customer portal

    • Using the pull <device_id> option will pull the current config

    • The module also supports sanitizing a raw config using the input flag

    • Input can be paste into terminal or with a file with -i <path_to_file>

    • Both options support output to file or desktop via the -o <path_to_folder> and -d flags respectively #729

  2. nscli maint escalation (by Sergio Pereira)

    • Adds a private comment to ticket with approver SSO and reason of escalation

    • Moves ticket queue to Global NetSec Maintenance

    • Updates ticket subject: Appends !!![DUE: YYYY.MMDD] at the beginning of subject

  3. nscli core (by Joe Wesch)

    • Added different colored output for each type of nscli log messages

    • New settings options have been added for users to choose a color for each level of logging

    • Colors can be disabled completely by changing the use_color setting to False #1403

  4. Enhancements to nscli maint sweep (by Joe Wesch)

    • Added the -n flag to also print out any available NATs #655

    • Added the -t flag to also print the table as a private comment on a ticket

  5. Enhancements to nscli maint port-audit (by Joe Wesch)

    • Added an audit for Newton devices that have a bridging vlan #1418

    • Added the -pt flag to print audit results as a private comment on a ticket

  6. DEDOS port (by Pedro Ortale)

    • Originally writen by Alejandro Ortuno, DEDOS is a tool that allows a better visualization from the ASA connection table.

    • This tool is active in the bastions but for convenience, now ported to NSCLI (Issue # 747)

      • Top offenders by Source IP, Destination IP, Destination Port

      • Top Talkers

      • Top connections - Idle Timer

      • Top connection flags

    • It is possible to extract live data by specifying -d `` (device id) or read the conn table from a text file ``-f.

  7. nscli core (by Micah Culpepper)

    • NSCLI’s LDAP queries now point to ldaps://ad.auth.rackspace.com instead of ldaps://auth.edir.rackspace.com

    • The LDAP query strings have been updated for the new AD model

  8. nscli core (by John Dowling and Pedro Ortale)

    • All plugins were migrated to the new structure.

    • The majority of the imports were changed to provide cleaner namespace.

    • Plugins parsers are now sorted alphabetically.

  9. Generic Parallel Runner Wrapper (by Pedro Ortale)

    • Shared class to used in plugins that requires parallelism.

  10. nscli zenoss-download (by Miroslaw Pabian)

v3.4.0 (released 2018-07-16)

  1. nscli maint freeze additions (by Sergio Pereira)

    • Added an option to post private comment instead of default public ticket update

  2. nscli permissions (by Joe Wesch)

    • Fixed bug where not all account contact names were retrieved resulting in missing permissions #1369

  3. nscli maint bugs (by GTS Maintenance Team)

    • nscli maint sweep: Fixed bug for API call for edge F5 devices.

    • nscli maint cab_prep: fixed bug to reference correct jinja template path

  4. nscli maint (by Duane Herman)

    • Cyclade request template.

  5. nscli releases (by Micah Culpepper)

    • mirror.nsi.rackspace.com is being decommissioned. Here’s what’s happening to the nscli files that were hosted there:

      nscli-<version>.tar.gz

      These files have been on artifactory since v2.9.0. We now redirect clients to artifactory.

      install.sh

      This file has been moved to intra.mirror.rackspace.com, and we now redirect clients there.

      versions/nscli

      This file has been moved to intra.mirror.rackspace.com, and we now redirect clients there. Also, the existence of this file is no longer necessary as of nscli v3.3.0, and only exists to allow legacy clients to upgrade automatically. It will be taken down at a future date to be determined.

    • nscli upgrade should still work as intended with these changes, for clients as old as v2.2.0 (although clients that old may fail to upgrade for other, existing, reasons). The process involves Python and curl components, both of which have been tested with the new redirects.

    • We have updated the official docs to refer to the new URL. If you have any notes or wiki pages that reference mirror.nsi.rackspace.com, please correct them.

    • intra.mirror.rackspace.com is only accessible from Rackspace 10. IPs. mirror.nsi.rackspace.com had similar rules in place. If you cannot access the intra mirror, please make sure you are plugged in to an office network and/or connected to an offqqice VPN (AnyConnect or AppGate), and try again.

  6. nscli core (by Micah Culpepper)

    • We now log the name of the user’s shell program to NewRelic. This will help drive the development of new features.

    • Added notes to the Bugs and Installation documents: users on Python 2 should run nscli via an alias in order to avoid encoding-related errors.

  7. nscli maint qc f5 (by GTS Maintenance Team)

    • F5 single to single parallel migration qc template

  8. nscli core (by Joe Wesch)

    • Removed core_token_max_age_seconds and identity_token_expiration_offset as user configurable settings. These settings are now hardcoded to have a 10 hour shelf life for CORE tokens and 1 hour before expiration for identity tokens. #1356

    • Added preferred_browsers to settings file. You can now change the order or remove browsers to check for a CORE token. Currently supported browsers are firefox and chrome. #1351

  9. nscli core (by Joe Wesch)

    • Changed region prompt to only show regions that contain a balabit of the type the user has specified in their settings #1292

  10. nscli ssh (by Joe Wesch)

    • Added BIG-IP to the list of acceptable platforms for the F5 ssh profile #1380

  11. nscli upgrade (by Micah Culpepper)

    • nscli upgrade now accepts arguments. You can specify the version you want to upgrade (or downgrade) to.

    • See the command-line help and man page for details.

v3.3.2 (released 2018-06-21)

  1. nscli core (by Micah Culpepper)

    • nscli reset and nscli settings no longer check for upgrades

    • Fixed a bug where NLA login timestamps were not stored properly, causing this message to appear: “ERROR - Could not parse timestamp from keyring. Assuming it is expired”

    • Fix a bug where timestamps on secrets were not properly set, which caused NSCLI to always believe that identity tokens were expired, and to re-obtain them each time they were needed.

    • The install script will now install Xcode Command Line Tools for Mac users who are missing it, prior to installing Homebrew.

    • Fixed a bug where failure to symlink a man page would cause the installation script to report failure before attempting workarounds.

v3.3.1 (released 2018-06-20)

  1. nscli core (by Joe Wesch)

    • Moved all log messages about gathering CORE token from browsers to debug unless it was unsuccessful

  2. nscli add_devices_to_ticket (by Micah Culpepper)

    • Fixed bug that caused the plugin to crash on Python 3 #1346

  3. nscli core (by Micah Culpepper)

    • Fixed credential-storage bug that made nscli re-prompt for credentials when existing credentials were still valid #1348

  4. nscli juniper pt (by Pedro Ortale)

    • Fixed a bug that caused nscli juniper pt (and potentially other plugins) to crash when invoked. #1343

  5. nscli cfgstation (by Micah Culpepper)

    • Fixed a bug that caused nscli cfgstation (and some other plugins) to crash when invoked. #1344

v3.3.0 (released 2018-06-15)

  1. nscli ssh (by Joe Wesch)

    • Prints watchlist information when logging into a network device of an account with an active Siphon watchlist

  2. nscli info (by Joe Wesch)

    • You can now enter any combination of device numbers, ip addresses or ticket numbers

    • You can now filter to show only specific port info from switch api (public, exnet or drac). Using -p still retrieves all ports

    • Fulfills enhancement request #702

  3. Log file change (by Joe Wesch)

    • nscli now by default only logs lines that are sent back from a remote ssh session (instead of every character sent and received). Only text that is echoed will be logged this way; this should eliminate logging credentials entered at silent prompts.

    • This should also make log files much easier to read as they will only contain the commands that you actually entered and not characters you backspaced over.

    • Note: Credentials sent in clear text as part of commands will still be logged as the command is echoed

    • Using nscli --debug will change logging back to the original method for troubleshooting if necessary

  4. ADX ssh python 3 bug fix (by Joe Wesch)

    • No longer crashes when trying to log into ADX when using python 3

    • Fixes #1281

  5. nscli ssh -s bug fix (by Joe Wesch)

    • Fixed the prompt when using SCP. It now accepts in-progress transfers of large files and echo’s the SCP progress back to the terminal

    • Fixes #363

  6. SSH & SCP debug messages added (by Joe Wesch)

    • Using --debug now adds -vvv for nscli ssh, nscli ssh -s and nscli switch to assist troubleshooting

    • Fulfills enhancement request #455

  7. Provisioning Tools (by Matthew Manning)

    • NAT is configured but no translation is showing in nscli qcip output IMPLDEV-119

    • netdevice.adx not parsing routes correctly on some devices fixed IMPLDEV-143

    • Fixed error detection in provisioning.api.dcx.switchports IMPLDEV-152

    • Fixed error where certain Stand alone Brocades were detected as standby IMPLDEV-155

  8. Identity Token expiration change (by Joe Wesch)

    • nscli now uses the expiration date & time from the identity token API response instead of just 1 hour from creation

    • A typical key expires in ~17 hours

    • nscli will request a new key 1 hour before expiration to eliminate any race conditions

  9. nscli zsp unlock (by Joe Wesch)

    • nscli now prints a warning when you have requested a ZSP unlock for a device that has the change freeze sku

  10. nscli core (by Joe Wesch)

    • Suppressed error messages when retrieving CORE token from browser cookies unless both fail to produce the token

    • Fulfills enhancement request #1312

  11. nscli core (by Joe Wesch)

    • nscli now uses Rackspace Artifactory to report version upgrades

  12. nscli core (by Micah Culpepper)

    • Appstats logging will now report “Netsec” as the OS.

    • Updated ATL61 region to default to DFW bastions, gateways, etc.

    • Fixed a minor bug where nscli reset would prompt you for your SSO username.

    • nscli reset will now delete nscli’s config.db, meaning it can now fix a few edge-case crashes.

    • Added a --pkg flag to install.sh, so it is possible to tell the install script which version of NSCLI you would like (or pass other instructions to pip).

    • Token.troubleshoot_fire_engine_auth - updated help message to let users know their account might be locked.

    • Fixed a bug with Token.ldap_rolecache where NSCLI would save an incomplete list of group names if any group name contained non-ascii characters.

    • Added documentation for the nscli settings file. See man 5 nscli_settings.

    • Reorganized plugin code locations - moved as much business logic as possible out of nscli.__main__

    • Fixed missing graph. Interested parties can run make requirement_check to view a graph of NSCLI’s dependencies.

    • Added documentation on nscli’s interaction with ssh-agent. See https://pages.github.rackspace.com/nsi/nscli/Installation.html#ssh-keys

    • Added command-line help for nscli’s Makefile

  13. nscli core (by Pedro Ortale)

    • Custom Bastion Gateway support for netdevices SSH (Balabit).

    • NSCLI will now automatically use the metrobank balabit instead of the support balabit if you’re logging into a metrobank device.

  14. SRX packet tracer (by Pedro Ortale)

    • Fixed the unicode issue when using python 3. Issue #1298

  15. nscli ssh -s (by James Finnegan)

    • Added new optional parameters

    • ‘–scp_method’ specify local to remote (1) remote to local (2)

    • ‘–src_file’ specify source file

    • ‘–dest_file’ specify destination file

  16. nscli ssh (by James Kerr)

    • Upon login to a brocade, we now automatically run “show ip vrrp-extended brief”

v3.2.1 (released 2018-05-25)

  1. nscli provisioning (by Micah Culpepper)

    • Fixed ssl error: updated the hostname on DCX API calls to refer to the new environment with good SSL certs.

  2. nscli cfgstation (by Micah Culpepper)

    • Fixed encoding crash

v3.2.0 (released 2018-05-24)

  1. nscli ssh (by Joe Wesch)

    • Fixed a bug when trying to reconnect to an SRX while a commit was waiting for confirmation

    • fixes #432

  2. nscli maint asa bug fix (by Joe Wesch)

    • Fixed an off-by-one error when converting access ports to trunks

  3. nscli mirrorupload

    • Removed logic for multiple file uploads since it was not working right

  4. Provisioning Tools (by Matthew Manning)

    • Crash fix when banner is in the wrong type IMPLDEV-142

  5. DCX API HTTPS verification re-enabled (by Joe Wesch)

    • Re-enabled https verification for various calls to dcx.api.rackspace.com in nscli as they are now using a public CA

  6. nscli maint freeze additions (by Sergio Pereira)

    • Checks if config freeze sku is configured

    • Removes config freeze from DMGs

    • If ASA, removes config freeze from motd-banner

  7. Maintenance Team (by Sergio Pereira)
  8. nscli ssh NetScaler profile (by Stephen Shambeau)

    • added support for NetScalers to nscli ssh command

  9. nscli maint port-audit (by Joe Wesch)

    • Added logic to detect switchport variances between migration devices and their assumed replacements

v3.1.1 (released 2018-05-16)

  1. nscli –version (by Micah Culpepper)

    • Fixed a cosmetic bug that flagged acceptable versions of Python 3 as unacceptable.

  2. nscli.auth.ns_auth.Token (by Stephen Shambeau)

    • Fixed a bug where attempting to gather a CORE token from Chrome on Python 3 would cause a crash.

  3. nscli acs search (by Micah Culpepper)

    • Moved the ACS log cache directory under the nscli cache directory

  4. nscli acs search (by Stephen Shambeau)

    • Added an example to the cli help and improved parsing

  5. nscli maint port-audit (by Joe Wesch)

    • Prints partial table instead of crashing when it is missing information

v3.1.0 (released 2018-05-15)

  1. nscli ssh (by Stephen Shambeau)

    • Bugfix for #375. Fixed ssh to ASA devices not checking ‘-d’ flag. Will now attempt to connect to DRAC IP on ASAs if flag is set and ASA has DRAC IP assigned.

  2. Provisioning Tools (by Matthew Manning)

    • Orange Sticker ASAs now work with QC scripts! #1054 IMPLDEV-61

    • Brocade ADX Support added for QCIP IMPLDEV-37

    • Reorganized nscli adx to nscli adx scripts. Added nscli adx qcip IMPLDEV-66

    • Configure NATs now shows banner messages before asking to perform configuration changes IMPLDEV-65

    • Use config_db module to obtain balabit info for netdevice modules IMPLDEV-63

    • Fixed bug in add environment command that prevents the DCX API call from functioning correctly IMPLDEV-73

    • NDPQC (Network Device Provisioning Quality Check) Initial code release - This tool requires access to FireKick - IMPLDEV-88 - IMPLDEV-114

  3. Refactor nscli maint protected_ips (by Sergio Pereira)

    • Pxssh replaced by ndapi

  4. Refactor parallel_asa_single_ha.jinja2 (by Sergio Pereira)

    • Renamed paralleL_asa_single_ha.jinja2 to parallel_asa_single_ha.jinja2. Linux is case sensitive

  5. nscli tokens (by Sergio Pereira)

    • Print identity or core Tokens

  6. nscli projects (by Sergio Pereira)

    • Added support team

  7. nscli maint mrt (by Sergio Pereira)

    • Updated methods plugin to use core.set_queue and core.set_status

  8. nscli maint parallel (by GTS Maintenance Team)

    • Updated RCv2 instructions to use an RFC 5737 IP address.

  9. nscli maint updates (by Sergio Pereira)

    • Converted maintenance plugins to the new plugin structure

    • Created maintenance python folder in order to re arrange nscli plugins structure. Refer to nscli issue 1166

  10. nscli mirrorupload (by Zach Brooks)

    • Created plugin to simplify file uploads to the netsec mirrors

  11. nscli maint freeze (by Sergio Pereira)

    • nscli maint banner has been changed to nscli maint freeze

    • Updated plugin in order to add/remove config freeze sku

  12. nscli asa console (by Joe Wesch)

    • Deprecated and split into separate modules (see below)

  13. nscli asa recover (by Joe Wesch)

    • Refactored from ‘nscli asa console -down’

    • Dedicated module for printing out a config for recovering firewalls

    • Detects HA and can replicate failover settings if both need replaced

    • SNMP user is now at bottom of output

  14. nscli maint asa (by Joe Wesch)

    • Refactored from ‘nscli asa console -c -n’

    • Dedicated module for ASA platform migrations

    • Added single to HA detection and logic

    • SNMP user is now at bottom of output

  15. nscli f5 certuploader (by Nick Roberts)

    • Change the way I’m validating if the cert/key pair is available for use. This should speed of the check, and avoid pexpect timeout failures.

  16. Update for devices with 7 digits (by Joe Wesch)

    • Searched nscli for all places where we were validating device number lengths and changed them all to 3-7 digits

  17. nscli ssh (by Joe Wesch)

    • Added –active option to always log into the active unit of an HA pair (currently supports ASA, F5 & ADX)

  18. Python 3 (by Micah Culpepper)

    • We support Python 3 version 3.5+. The majority of our users are on Mac, and over 90% of the remaining users are on Ubuntu 16. Version 3.5 was chosen for compatibility with Ubuntu 16.04.

    • Updated package metadata, docs, and the installer script accordingly.

    • nscli upgrade should now work for Python 3 users.

    • These are the priorities the installer script uses for picking a Python interpreter on your system:

      1. Re-use the existing interpreter, if upgrading from a previous version of nscli and the interpreter is still acceptable.

      2. Use any acceptable version of Python already installed on your system (the order of which is determined by their order in your $PATH).

      3. Install Python 3.

  19. nscli ssh (by Micah Culpepper)

    • Bugfix: re-enabled local logging of interactive ssh sessions under Python 3

    • Add: A status ribbon is now displayed on login to help you keep track of which device you’re on.

v3.0.2 (release 2018-04-26)

  1. keyring (by Micah Culpepper) - Updated keyring version dependency to overcome a bug in keyring - See https://github.rackspace.com/NSI/nscli/issues/1185 and https://github.com/jaraco/keyring/pull/322

v3.0.1 (release 2018-04-25)

  1. secretstorage (by Micah Culpepper) - Updated keyring version dependency to overcome a dependency conflict on Linux

  2. unicode (by Micah Culpepper) - Fixed a bug in ns_ssh that caused an improper crash when encountering unexpected symbols on a net device.

v3.0.0 (release 2018-04-16)

  1. Python 3 (by Micah Culpepper, with help from lots of folks)

    • nscli is now compatible with Python 3.

    • Python 3 offers many enhancements over Python 2, both in terms of performance and new features. With the official end of life for Python 2 fast approaching, many third-party libraries that nscli uses have already begun to stop updating their Python 2 code. Additionally, some folks inside Rackspace have expressed interest in contributing to nscli, but only work in Python 3, and have been held back by our use of Python 2. For these reasons and more, the time has come to make the switch.

    • nscli still supports Python 2, and will be compatible with both 2 and 3 for the rest of 2018, to allow for a graceful transition period. We are planning to cease Python 2 support in January 2019, a year before the official end of life date for Python 2.

    • To support this change, many internal code changes have been made. The goal of these changes is to cause our code to behave the same under both versions of Python. This is a somewhat major change in terms of number of lines changed, but the changes were mostly done with automation following recommended best practices for Py2/3 compatibility. Any behavioral differences between Python 2 nscli and Python 3 nscli are bugs.

    • While nscli under Python 3 is officially supported, it is still quite new, and there are bound to be unforeseen problems. If any arise, please reach out to the nscli developers for support (see Contact).

    • Local logging of interactive ssh sessions is currently disabled under Python 3 due to an outstanding bug.

    • The nscli install/upgrade script still installs a Python 2 virtual environment. We will modify this script to prefer Python 3 at a future date to be determined, pending the remediation of the above bug and any other bugs (to be discovered) that affect core nscli functionality. This means that most users will continue to run nscli under a Python 2 interpreter for now.

  2. nscli asa console (by Joe Wesch)

    • Pulls known SNMPv3 user auth/priv from PasswordSafe.

  3. nscli maint qc asa -single (by GTS Maintenance Team)

    • Prints qc steps for single to single ASA parallel migrations

  4. nscli maint qc asa -single-ha (by GTS Maintenance Team)

    • Prints qc steps for single to HA ASA parallel migrations

  5. Provisioning Tools (by Matthew Manning)

    • Bug fix for incorrect traffic-group being used on F5 NAT creation IMPLDEV-49

    • Created the Assign command structure IMPLDEV-24

    • Moved nscli provisioning add vlan_to_devices to nscli provisioning assign vlan IMPLDEV-10

    • Created the Unassign command structure IMPLDEV-25

    • Created API wrapper to call DCX API devices/<device>/unassign_exnet_vlan IMPLDEV-53

    • Created new command nscli provisioning unassign vlans IMPLDEV-52

    • Bug fix for error message parsing on adding a new environment IMPLDEV-55

    • nscli provisioning assign vlan is now nscli provisioning assign vlans as it now accepts a range of VLANs instead of a single one IMPLDEV-56

    • nscli provisioning assign vlans now accepts --switch and --port IMPLDEV-56

    • Bug fix for creating new VLANs in EM due to DCX API 2.0 IMPLDEV-60

  6. F5 SSL Cert Expiration reports (by Pedro Ortale)

    • nscli f5 ssl_audit #ACCOUNT_NUMBER

    • Audit F5 SSL certificates from the terminal

    • Parse the output using CSV, JSON or PrettyTable (Default)

    • Display SSL profiles not associated to virtual services

    • Include profile association per virtual services

  7. nscli f5 certuploader (by Nick Roberts)

    • Bug fix - Removed coloring from ProgressBar during SCP Phase of script, started crashing script due to a new issue with ProgressBar package I’m assuming. - Thanks to Caleb Delbrugge and Joe Wesch for bug submission

    • Bug fix - Removed indexing from SSLTool API output, looks like the return data was modified slightly when was causing an IndexError to crash the script

  8. MAC Address Info Tool (by Matthew Manning)

    • Fixed url encoding of odd Unipede parameters causing failure

  9. Migration tooling (by NetSec DC Migrations)
    • nscli migrations validate <db> <device_list>

      Validate source destination switchport configs

    • nscli migrations finalize_migration <device>

      Finalize migration switchport configs

    • nscli migrations finalize_current <device>

      Finalize current switchport configs

    • nscli migrations startup <device>

      Prep startup configs for DC migration shutdowns

    • nscli migrations update_waf <device>

      Re-IP ServiceNet IP/Gateways for WAF using migration IPs

    • nscli migrations f5_trust <device>

      Rebuild device trust between two F5s +v11

    • nscli migrations info <device>

      Detailed information from the migrations DB about a given device

    • nscli migrations reserve_ip <device>

      Reserve a migration IP address in DCX tools (sets reserve flag)

    • nscli migrations refresh <type> <account or device>

      Refresh data in the Migrations Database

    • nscli migrations status <device>

      Get current port status and reachablility for a device

    • nscli migrations mirror_ports <device>

      Gather span-sessions for a given device/account/move-group

    • nscli migrations zones <device or ENV>

      Lookup zones relationships of all migration up-links

  10. nscli maint times (by GTS Maintenance Team)

    • Prints standard maintenance times

    • Maintenance times updated in scripts

  11. nscli maint port-audit improvement (by Sergio Pereira)

    • Prints a warning message if FastEthernet port has been assigned to an ASA X series firewall

  12. nscli nla (by Micah Culpepper)

    • Updated LON3 vpn range to include 212.64.133.96/29; these IPs are assumed to not need NLA auth.

  13. infrastructure.json (by Micah Culpepper)

    • Defined infrastructure facts for DEN60 and ATL61

    • Updated LON3 vpn range to include 212.64.133.96/29; these IPs are assumed to not need NLA auth.

  14. nscli info & nscli switch (by Joe Wesch)

    • No longer assumes switchports are in the same data center as the device

  15. nscli maint minor/major f5 (by Sergio Pereira)

    • Obtains the latest F5 Rackspace oficial safe harbor version and hotfix from torq

  16. nscli core (by Micah Culpepper)

    • When debugging is on (i.e. nscli --debug <command>), nscli will now report any errors that occur while attempting to log usage to appstats or newrelic.

  17. nscli maint parallel (by Sergio Pereira)

    • Bug Fix: Missing a space in interface command for NetDef network devices.

    • Removed extra returns

  18. nscli maint port-audit (by Joe Wesch)

    • Major refactor using multiprocessing to reduce run time by ~65%

  19. nscli goast (fix by Matthew Manning)

    • Corrected detection of successful AutoQC request

v2.10.3 (release 2018-03-29)

  1. NSPYLIB and TLS

    • NSPYLIB uses the urllib2 library to make API calls. An unfortunate implementation detail means that if nspylib needs to downgrade a connection to TLS 1.0, then it will continue to only support TLS 1.0 as long as it’s in memory. This resulted in an elusive bug where direct API calls would succeed, but API calls to an endpoint that does not support TLS 1.0 made after a call to an endpoint that only supports 1.0 would cause the second call to fail. Also, the determination of which endpoints accept TLS 1.0 was hard-coded, not negotiated.

    • The above bug, which has been in nspylib for a long time, began to cause trouble when we disabled TLS 1.0 and 1.1 support on the *.nsi.rackspace.com VIPs. This caused some nscli maint plugins to fail.

    • This release doesn’t change any nscli code, but changes nscli’s dependencies to use a patched version of nspylib.

    • NSPYLIB itself has undergone a major re-write, and we plan to upgrade to the new major version in the next regularly-scheduled release.

v2.10.2 (release 2018-03-21)

  1. Provisioning Tools (by Matthew Manning)

    • Errors on joining devices to ExNet VLANs causes error on reading the error IMPLDEV-48

  2. Unicode (by Micah Culpepper)

    • Fixes #1029: Can’t log into devices with unicode in the DMGs

    • nscli now supports unicode, as a policy

    • nscli will no longer hide unicode encoding errors from the user

    • updated the docs to add guidance for users on how to configure their terminal to support unicode

    • added a warning so that users will know if their terminal is misconfigured prior to seeing a unicode error

  3. Setuptools (by Micah Culpepper)

    • Fixed a bug where nscli would not run if it was installed after March 17th 2018

  4. nscli upgrade (by Micah Culpepper)

    • nscli upgrade no longer tries to talk you out of upgrading

v2.10.1 (release 2018-03-16)

  1. nscli permissions (by Joe Wesch)

    • Added color coded platform models and device names to output

  2. nscli asa console (by Joe Wesch)

    • Bug fix for FINDME string creation function

v2.10.0 (released 2018-03-15)

  1. Provisioning Tools (by Matthew Manning)

    • Standalone SRX without HA config now reports as primary/standalone device IMPLDEV-15

    • Now forces settings.ini to be updated with correct defaul Balabit type and Region DC IMPLDEV-42

    • Updated GET/POST/PUT request inputs for DCX IMPLDEV-43 (DCX API 2.0 Prep)

    • Fixed mutable default args IMPLDEV-34 (Python 3 Prep)

    • Comparing Administrative Distance is now correct IMPLDEV-44

    • EIGRP dynamic routes now understood on network devices IMPLDEV-41

    • OSPF dynamic routes now understood on network devices IMPLDEV-45

    • Corrected spacing in kir_validate IMPLDEV-46

  2. nscli projects update (by Sergio Pereira)

    • Global NetDef Maintenance queue added into nscli projects

  3. nscli maint mrt update (by Sergio Pereira)

    • Added additional flags for Global NetDef Maintenance and Global NetSec Maintenance queues compatibility

  4. nscli maint protected_ips (by Sergio Pereira)

    • Get pool members from an F5, using a list of private IPs, helpful to move WAF behind LB

  5. nscli maint cab_prep (by Duane Herman)

    • Cab Prep Template

  6. nscli core (by Micah Culpepper)

    • Added support for SYD30

    • The nscli webpage is now built on the master branch and pushed up to the gh-pages branch via make webpage_upload. This makes re-deploying the website easier, and it also provides a preview here.

    • Unset executable bit on files that should not be directly executed. The only file that should be directly executable is nscli/__main__.py, and even then, I’d recommend running python -m nscli or the nscli console script instead of ./__main__.py.

    • Deleted nscli/plugins/chri6215/shared/core_token.py. Use the nscli token object to get a CORE token.

    • Un-vendored pick. It is now listed as a dependency.

  7. Python 3 compatibility progress (by Micah Culpepper)

    • All new code now required to work under Python 2.7 and Python 3.6.

    • Replaced urllib2 uses with requests.

    • Implemented many changes to begin making the code forwards-compatible with Python 3. These changes should not affect the code’s behavior in any noticeable way. We do not support Python 3 installations yet, but we are planning to do so starting with the April release.

  8. nscli history (by Micah Culpepper)

    • Seems like it was broken before? Anyway, it’s working now. Also, if you run nscli history without any username, it now defaults to your username.

  9. TLS 1.2 (by Micah Culpepper)

    • CORE (and other systems) will be switching to TLS 1.2 soon, and if nscli’s Python interpreter can’t handle TLS 1.2 connections, the nscli installation will be useless.

    • There does not appear to be a way to upgrade a Python interpreter’s SSL capabilities, so a new Python installation will be needed if the current one doesn’t support TLS 1.2. We want to identify these issues during nscli installation, as that is the best time to also upgrade Python.

    • The nscli installer script now tests connectivity to https://ssltool.rackspace.com, which only uses TLS 1.2. If this check fails, then the interpreter will be passed over, just as if its Python version was insufficient. This will prompt the user to install/upgrade Python, and on our most commonly-supported platforms, it will also perform the upgrade/installation for the user.

v2.9.0 (released 2018-02-15)

  1. Provisioning Tools (by Matthew Manning)
  2. nscli maint prep (by GTS Maintenance Team)

    • Prints generic maintenance prep template

  3. nscli permissions (by Joe Wesch)

    • Fixed call to find ALL account admins

  4. nscli asa/f5 md5 (by Joe Wesch)

    • Added logic to verify against known NetSec files in TORQ

  5. nscli f5 certuploader (by Nick Roberts)

    • Correct a typo in the creation of clientssl-secure-waf-pre-v11.5 to clientssl-secure-waf-pre-v11-5

    • Thanks to Caleb Delbrugge for the bug submission!

  6. nscli core (by Micah Culpepper)

    • nscli releases are now published on artifacts.rackspace.net. The installation documents and install script have been updated. install.sh now points virtual environments’ pip indices to artifacts.rackspace.net.

    • because nspylib has moved to artifactory too, --process-dependency-links is no longer needed when pip installing nscli

    • Deprecated “dataCenter” attribute on nscli info responses. Use “dc” instead.

    • nscli settings should now more reliably open your settings file intead of complaining

    • Added librack as a dependency, see https://github.rackspace.com/IAW/iawl/tree/master/librack and added a token sub-attribute to use for librack auth.

    • Added ACS servers to config_db

    • Added netbast/cbast/acs definitions for ATL region

    • Thanks to Jeremy Church for pointing out a race condition in the Firefox token-gathering code. It has been fixed.

    • Solved “AttributeError: ‘Token’ object has no attribute ‘get_tacacs’” #858

    • When nscli starts up, it generates an ssh key if you don’t have one. Fixed a bug where it would sometimes overwrite private keys if a public key did not already exist.

    • Fixed timestamp formatting on switch logs to match our new standard. Thanks, Caleb Delbrugge for finding this bug!

  7. nscli tshoot_access (by Micah Culpepper)

    • This plugin helps you troubleshoot ASAs that the NSI APIs can’t reach.

  8. nscli info -p (by Brett Lykins)

    • Fixed “spped” error

v2.8.3 (released 2018-01-18)

  1. nscli maint qc generic (by GTS Maintenance Team)

    • Prints generic QC template

  2. NSCLI core functionality (by Micah Culpepper)

    • If there is an NSCLI upgrade available, NSCLI asks if you want to upgrade now. Now, if you answer “no”, you will not be asked again for at least twelve hours. You will still be reminded that a new version is available on each run.

    • Bugfix for “nscli –version” always showing “✗” next to the version number.

  3. nscli maint f5_major (by Sergio Pereira)

    • Checks platform and installs safe version 12.1.3 with the exception of the F5 1600 and F5 3600

  4. nscli maint f5_minor (by Sergio Pereira)

    • Checks platform and installs safe version 12.1.3 with the exception of the F5 1600 and F5 3600

  5. Provisioning Tools (by Matthew Manning)
    • provisioning.info.qcip

      • fixed support for public IPs

v2.8.2 (released 2018-01-16)

  1. nscli torq backup (by Micah Culpepper)

    • Removed fake progress bar. Sorry kids, there is no Santa. Please wait patiently for your backups to complete.

    • Solves #537

  2. nscli nla (by Brett Lykins)

    • Added validation to determine if you’re on the Rackspace office VPN, and if you are, we don’t attempt NLA.

    • NLA is not needed to reach the Balabit, CBAST, DTS, or RDP Gateways if you’re on the office VPN.

    • It will still default to NLA if you’re on the wired office network, or we can’t determine your public IP address.

    • Rewrote some existing logic to use NLASession.validate instead of NLASession.check_status_from_gateway, which will improve performance, and in some cases, reduce the frequency of RSA token prompts.

  3. nscli netcraft (by Micah Culpepper)

    • --scantype is now a required argument.

    • Helps with #752

  4. nscli info (by Micah Culpepper)

    • Removed broken commands from the CLI options: --routes, --config, and --ipfinder

  5. nscli switch (by Micah Culpepper)

    • Removed broken commands from the CLI options: --wildcard and --netmask

    • Defined SYD3 as a datacenter, so you can now get to SYD3 office switches

  6. nscli logs (by Micah Culpepper)

    • Changed filename timestamp format to ISO8601 basic, eliminating the special characters that are disallowed on Windows. This means you can now back up your nscli logs to your Rackspace OneDrive account if desired.

    • Solves #330

  7. nscli version (by Micah Culpepper)

    • nscli --version now shows you more information about your nscli installation, which may be helpful in troubleshooting. Example:

      $ nscli --version
✓ nscli version:       2.8.2
✓ nspylib version:     1.31.4
✓ python version:      2.7.14
✓ config file:         /Users/mica7786/nscli/.config/nscli/settings.ini -> /Users/mica7786/.config/nscli/nscli/settings.ini
✓ log directory:       /Users/mica7786/nscli/.config/nscli/nscli-logs -> /Users/mica7786/.config/nscli/nscli/nscli-logs
✓ code location:       /Users/mica7786/nscli/lib/python2.7/site-packages/nscli
✓ python interpreter:  /Users/mica7786/nscli/bin/python2.7
✓ master interpreter:  /usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/bin/python2.7

    • if any lines in this output show “✗” instead of “✓”, it could indicate a problem with your nscli installation.

  8. nscli ssltool (by Brett Lykins)

    • Fixed to Identity Token instead of Core Token, Solves #538

    • Migrated SSLTool plugin to utilize the shiny new Plugin Architecture

    • Greatly simplified the code to utilize argparse rather than custom functions for defaults

    • Added pretty-printed output of SSLTool spew. Use -r or –raw for legacy behavior.

  9. NSCLI core functionality (by Brett Lykins)

    • Created a shared library/module to contain common reusable code pieces

    • Added pretty-text formatting functions into shared library - pretty_text.py. Example:

      # Import the module from nscli.shared, give it a meaningful name.
from nscli.shared import pretty_text as t

# Use it on strings alone:
t.info("This text is swanky!")

# Use it inside other functions such as print or with "{0}".format(blah)
plain_text = "BORING!"
print(t.heading("Bland text is now FANCY! This text too: {0}").format(plain_text))

# It even works in strings being fed to the logging library!
err_msg = "BAD_THINGS.gif"
logger.error(t.failure("OH NOES! %s took a dump!"), err_msg)
    • Moved colorization logic method from info into pretty_text.py in shared.
      • color_state() takes three arguments and based on the content of two lists of strings, it will colorize as follows:

        • A string you wish to inspect/colorize

        • A list of strings that are “successful”, and will be colorized with SUCCESSFUL (green)

        • A list of strings that are “warning”, and will be colorized with WARNING (yellow)

      • Any unmatched strings (not in either list) are colorized as FAILURE (red).

      • Example:

        # Import the pretty_text lib:
from nscli.shared import pretty_text as t

# Use it!
print("Results: {0}".format(t.color_state(port["duplex"], ["full", "auto"], [])))

    • Moved JSON printing to shared library

    • Added millisecond resolution to debug logs

  10. nscli switch (by Brett Lykins)

    • Added colorized text output to nscli info output.

  11. nscli info (by Brett Lykins)

    • Added colorized text output to nscli switch output.

  12. Provisioning Tools (by Matthew Manning)
    • provisioning.netdevice.f5/provisioning.info.qcip/provisioning.configure.nats

      • Route domains now supported!

      • MCPD output sync issue detection

  13. NSCLI core functionality (by Micah Culpepper)

    • User LDAP roles (groupMembership) are now available via nscli.ns_auth.Token().ldap_roles. This attribute will obtain roles from the identity API (and an identity token while it’s at it), or from eDir. Roles are cached in a flat file inside the nscli cache directory with permissions set to 600. NSCLI does not expire this file, since LDAP roles don’t change often. You can force NSCLI to re-acquire roles by deleting the file manually or via nscli reset. At this time, the roles aren’t used for anything in particular, but may be used by future code. For example, if you try to use an nscli plugin that calls an API that requires certain permissions in LDAP, the plugin author could first check your LDAP roles to see if you might be authorized before attempting the API call.

    • Added a “use_color” setting to the config file, which defaults to True. Change it to false to disable colorized output. Note: there may be some parts of NSCLI that do not yet respect this setting.

    • Improved LDAP bind error handling in nscli.auth.appstats_client. Some users were seeing mysterious messages about failed LDAP binding, but then NSCLI would move on to do what they asked. This is usually caused by a bad password, and NSCLI will now tell you so.

    • Work has begun on a Jenkins CI/CD pipeline, so there are new supporting files under nscli/scripts/. This does not affect end users at this time.

    • Switched install.sh interpreter back to /bin/sh from /bin/bash; see #591. The invocations in nscli upgrade and the installation docs still refer to bash, so we’ll need to migrate those at some point.

    • Deprecated the ssh config-file generation that runs on NSCLI startup, as those files are not used by any code.

    • Added some documentation about IDE config for contributors.

v2.8.1 (released 2017-12-19)

  1. nscli iaw_api (by UK IAW)

    • Fix for f5 validation on single device where peer is not required.

v2.8.0 (released 2017-12-14)

  1. nscli f5 certuploader (by Nick Roberts)

    • Fixed CA Bundle name problem that would occur when apostrophes were present in the CN. We are now removing punctation from the CN to avoid this problem (Thanks to Joe Wesch for the submission of the bug)

    • Updated logic around providing a CA Bundle seperate from what the SSL Tool Provided. You can now specify another CA Bundle file existing on the f5, or paste in your own.

    • Updated syntax for fetching PEM CA bundle, this should resolve the problem of failed validation when names overlap and the correct bundle was already present

    • Fixed issue with 10code syntax for savings changes (Thanks to Joe Wesch for the submission of the bug)

    • Updated logic for f5s running 10code. We are now checking for HA properties in CORE prior to running config-sync. (Thanks to Joe Wesch for the submission of the bug)

    • Running clientssl profile validation from bash instead of TMSH to avoid terminal pager prompt. The pager prompt was throwing off the validation of the clientssl profile. (Thanks to Joe Wesch for the submission of the bug)

    • Updated wording on prompt when the user needs to provide a CA loaded on the f5

  2. nscli maint port-audit (by Joe Wesch)

    • Major rewrite using Unipede for speed

    • Added more audit checks

    • Added table printout

  3. nscli maint banner [DEVICE] (by Sergio Pereira)

    • Also updates DMGs to the Standby unit

  4. nscli maint parallel (by Sergio Pereira)

    • Removed QC section as steps are no longer valid

    • Interface range is not a valid command on newer switches. Updated script to use individual interfaces instead.

    • Fixed bug when going from single to HA with IDS and no cabinet move

  5. nscli asa ol (by Pedro Ortale)

    • Cisco ASA Object Lookup: Matches the given IPv4/IPv6 to the objects and object-group in all devices for the provided account.

    • You can use -p (–prefix) to match to a network block.

    • Specify -r (–report) to show all configured object/object-groups

  6. nscli permissions (by Joe Wesch)

    • Major rewrite using Valkyrie for speed

    • Fixed bug to ignore users no longer on the account but who still have device level permissions

  7. nscli maint minor [f5] (by Sergio Pereira)

    • Minor code upgrade from system version 12.1 HF1 to 12.1 HF2

  8. nscli maint mrt (by Sergio Pereira)

    • Fixed bug to change the status of ticket to “Waiting MRT”

  9. Provisioning Tools (by Matthew Manning)
    • provisioning.netdevice.srx/provisioning.configure.nats bug fix

      • Now checks if the NAT rule name exists, changed the way NAT rules are named

    • provisioning.netdevice.f5 bug fixes

      • Translations check now doesn’t fail if there are not both SNAT and NAT translations

      • Running-config search updated to use [:space:] instead of s due to grep version support

    • provisioning.netdevice.netdevice bug fix

      • Using a local user on required the _get_creds function, but was attempting to call _set_creds, fixed

    • provisioning.info.qcip bug fixes

      • Output was saying there is a translation configured twice, now says it only once

      • Now prevents doing a separate QC of each IP of a public/private IP pair, does only a single QC for both IPs

  10. nscli maint updates (by James Finnegan)

    • Generates maintenance prefabs and updates ticket

  11. nscli conkill (by James Finnegan)
  12. NSCLI Core (by Micah Culpepper)

    • requirements-dev.txt is gone; developers should now install nscli with the dev extra to get the same effect. make devenv will take care of this for you.

    • NSCLI handles CORE token expiration more intelligently now, meaning you should not have to enter your RSA token as frequently.

    • We’re logging to AppStats again. Like NewRelic logging, this is done in a separate process, so it shouldn’t slow down NSCLI too much. There are some new values in the config file used for AppStats logging. NSCLI will populate these values if they don’t exist.

    • There’s now an nscli cache folder that developers can use for storing any sort of temporary files. Just import cache_dir from nscli.config.

    • NSCLI now checks for upgrades every other day instead of on each run.

  13. nscli maint minor [ADX] (by Sergio Pereira)

    • Removed server source-port-hash command of maintenance plan.

  14. nscli credentials (by Micah Culpepper)

    • Added a simple CLI utility to interact with NSCLI’s credential store. Get, set, and delete individual credentials.

    • When getting a credential, the credential itself is returned on stdout, and the timestamp at which the credential was set is returned on stderr.

v2.7.1 (released 2017-11-17)

  1. NSCLI bugfixes (by Micah Culpepper)

    • Fixed AttributeError: 'Token' object has no attribute 'home' on nscli ssh -s

    • Fixed AttributeError: 'Token' object has no attribute 'get_tacacs' during nscli ssh when the user’s password is wrong the first time.

    • Fixed bug where nscli reset never reset anything.

v2.7.0 (released 2017-11-16)

  1. nscli maint banner [DEVICE] (by Sergio Pereira)

    • Appends config freeze banner to ASA Firewalls.

    • Updates Device Management Guidelines

  2. Provisioning Tools (by Matthew Manning)

    • Style changes (fancy stuff)

    • provisioning.info.devices expanded with verbosity flags

    • provisioning.batch.ip now properly handles no nat situations

    • provisioning.configure.nats and provisioning.info.qcip added SRM support

      • Only completely working when interfaces are disabled on the ASA

    • provisioning.configure.nats now adds a description to NATs it prepares

  3. NSCLI SSH Netdevice APIs (by Matthew Manning)
    • bug fixes in SRX

      • identifing security zones when a functional zone exists now works

      • expanded routing methods, fixed route lookup

    • added version gathering

    • added support for SRM builds (only fully working on ASAs by looking up disabled interfaces)

  4. NSCLI maint port-audit (beta) (by Joe Wesch)

    • Scans list of devices (or devices on a ticket) for use in span sessions

  5. nscli f5 certuploader (by Nick Roberts)

    • Fixed an parsing problem with initial login prompt causing the printed output to contain “Last Login…”

    • Declared apply_ca variable within __init__ to avoid errors

    • Fixed typo when selecting the IDS/WAF client-ssl profile clientssl-secure_ids_wafv11_5_only

  6. nscli f5 sip (by Pedro Ortale)

    • SIP (Search in Pool) is a simple tool to search for IP address in all F5 pools for all devices in the account.

    • The idea is to test the new plugin: Steward: Multi-threading helper for NDAPI.

    • It makes easier to develop further plugins that relies on NDAPI. Refer to nscli/plugins/pedr7260/steward/README.md

  7. nscli maint qc -adxmajor (by Sergio Pereira)

    • Standard QC steps for adx major code upgrades

  8. Major rewrite of nscli.auth.ns_auth.Token (by Micah Culpepper)
    • This solves or obsoletes the following issues:

      • Token management #245

      • option to update pwsafe after manually entering pw #301

      • passwordsafe crash #378

      • nscli breaks wehn SS0 password is reset #447

      • Respect passwordsafe setting #464

      • Stop ^C while keyring is open #526

      • Stop tracking legacy TACACS credentials #545

      • settings.ini usepasswordsafe = False ignored #629

    • Passwords and tokens are now @property attributes. Basically, instead of token.acs_password (et al.) always containing a real password, it contains the promise of a password. If and when a token consumer needs that password, the token will get it. Deferring this step saves some time, but most importantly, it helps NSCLI to not get hung up and crash trying to obtain credentials that are irrelevant to the current task.

    • Tokens are no longer integrated with passwordsafe; credentials are stored in the local keyring only. Feel free to delete your NSCLI passwordsafe project. The corresponding option has been removed from the config file.

    • NSCLI keyring credential names now begin with the prefix com.rackspace.nscli. Feel free to delete any existing com.nscli credentials.

    • Credentials stored in the keyring under com.rackspace.nscli have a new format. If you had an external tool that was accessing NSCLI secrets directly from the keyring, you’ll need to update its parsing (although a better solution might be to just import Token from nscli and use it to access your credentials.)

    • NSCLI no longer has a concept of “do all the things once per day because stuff is expired”; now, each credential has its own expiration timer and will be re-acquired when needed. These timers only apply to ephemeral values like tokens; passwords that don’t often change will no longer artificially expire.

    • An unfortunate side-effect of the previous point is that some functions that ran once per day, like checking for available upgrades and ensuring the presence of certain config files, now happen on each NSCLI run. We should look in to mimicking some of the old behavior in the next release.

    • Introduced the new nscli.auth.ns_auth.NSCLICredential class for storing credentials in the keyring. All sensitive credentials that NSCLI stores should be of this type. Token uses this class for credential storage now, as does nscli.auth.cisco_nla.NLASession.

    • Because of the previous point, all keyring interactions happen in a centralized place, so I was finally able to fix issue #526; interrupting NSCLI with ^C will now wait until the keyring is closed before aborting, thus preventing keyring file corruption.

    • Token objects no longer have validate_token or validate_identity_token methods. Tokens are obtained when needed, and expired according to a configurable timer (default 1 hour). In the event that you really need to validate the token manually, you can simply get a token and set it as the relevant attribute. Example:

      from nscli.auth.ns_auth import Token
token = Token()
token.core_token = token.get_core_token()
token.identity_token = token.get_identity_token()

    • Token expiration times are now in settings.ini, so you can make your Core and Identity tokens expire more or less often than the default of one hour if you want.

    • nscli reset now only deletes your cached passwords, without the other weird side effects.

    • The nscli.__main__.auth function is now gone. Creating a Token object will get you the same result.

    • Implemented a Jinja template for generating SSH config files used in proxying

  9. NSCLI core (by Micah Culpepper)

    • Fixed some error silencing logic, so now you’re less likely to see a pair of stack traces when you hit ^C right after running NSCLI.

    • Changed packaging format; using setup.cfg now for most settings. This means installation now requires setuptools version 30.3 or higher. The install script has been adjusted to account for this.

    • Moved settings, SettingsParser, and friends to a new module, nscli.config. This frees up nscli.__init__, which now does little more than configure the logger. This means we can import the version number from here again instead of having to maintain it in two places.

    • Lots of minor fixes

    • Removed bastions.json once and for all. Use nscli.config_db to obtain infrastructure facts.

  10. Documentation updates (by Micah Culpepper)
  11. Housekeeping (by Brett Lykins)

    • Got rid of legacy Core xmlrpc calls

    • Implemented types and input checking in argument parsing

    • Created parent parsers to allow for easier argument parser creation

    • Implemented standard formatting/style guide for argument parsing

v2.6.2 (released 2017-10-19)

  1. nscli maint minor ADX (updates by Sergio Pereira)
    • ADX 12.4 to 12.5 bug fixes

      • Updated steps to use SSH intead of TFTP

      • qc-ip replaced by nscli maint sweep

  2. nscli projects (by Micah Culpepper)

    • Fixed functionality broken by the 2.6.0 release.

  3. NSCLI core (by Micah Culpepper)

v2.6.1 (released 2017-10-13)

  1. NSCLI SSH Netdevice APIs (by Matthew Manning)
    • netdevice.asa bug fixes

      • IPv6 in objects was breaking object parsing, fixed

      • running config search was finding unrelated objects, fixed

  2. nscli ssh -g (by Micah Culpepper)

    • Fixed functionality broken by the last release.

v2.6.0 (released 2017-10-13)

  1. F5 certuploader (by Nick Roberts)

    • Corrected an error that would generate when user opted not to upload the CA Bundle provided by the SSL TOOL

    • Corrected error received when attempting to upload a certificate to 12code f5

      (thanks to Caleb Delbrugge for reporting bug!)

    • Corrected error received when attempting to upload a cert/key pair that SSLTOOL can’t pull a CA Bundle for

      (thanks to Ronnie Ralston for reporting bug!)

  2. Provisioning Tools (by Matthew Manning)

    • bug fixes

    • organized provisioning.batch.ip and provisioning.config.nats code

    • provisioning.add.gateways and provisioning.remove.gateways fixed device tracking issue

    • provisioning.batch.ip updated command flags!

    • provisioning.config.nats and provisioning.info.qcip now call in a similar fashion.

    • provisioning.config.nats now configures DNS doctoring by default, updated command flags!

    • provisioning.config.nats bug fix for duplicating nat prep

    • provisioning.configure.nats now supports Juniper SRX

    • provisioning.info.qcip now has a more robust output updated command flags!

    • provisioning.info.qcip now supports Juniper SRX

  3. MAC Address Info Tool (by Matthew Manning)

    • updated code organization

    • changed output to return all switches mac address is found on

    • script now always returns its finding pythonically to be used in other scripts

  4. QCIP Deprecated (still works for now) (by Matthew Manning)
    • Replacement Tools:

      • nscli asa qcip -h

      • nscli asa static_nats -h

      • nscli f5 qcip -h

      • nscli f5 static_nats -h

      • nscli juniper qcip -h

      • nscli juniper static_nats -h

  5. NSCLI core (by Micah Culpepper)

    • Updated nspylib requirement to new version

    • nscli cbast lon5 now works. It did before, but now it does, too.

    • nscli cfgstation now uses hostnames instead of IPs to log in. It still prints IPs in the banner, though.

    • nscli zsp unlock now uses identity tokens for auth instead of core tokens.

    • Fixed duplicate log messages

    • Deleted my switchcraft plugin. It hasn’t been working for some time.

    • nscli switch and nscli netbast now chooses a network bastion based on the infrastructure.json config file. This means that most (all?) Rackspace DCs and offices are now supported, and you can add support for new/custom locations by editing your config file.

    • nscli switch now passes the hostname _and_ domain name to the netbast. So you can reach, e.g., sin80 switches from the hkg bastion. It also auto-corrects domain names (regions are converted to DCs), so if you try to log in to a .dfw switch, it will correct it to .dfw1 before sshing to it.

    • fixed an old bug where nscli ticket <ticket> info would cause nscli to crash. The correct command is nscli ticket <ticket>, and nscli will now tell you so.

    • Upgraded keyring dependency to latest version. This should help us avoid the dreaded ERROR - Unable to open keyring.

    • Fixed help for nscli ndapi - now includes a reference to the api docs

    • Added a Views class to the nscli config_db, making it easier to use the db without knowing SQL or SQLAlchemy

  6. NSCLI SSH Netdevice APIs (by Matthew Manning)

    • netdevice.f5 fixed grep bug

    • netdevice.srx created! This is a new framework for working with Juniper SRXes

    • netdevice.asa now finds all nesting of object-groups on ASAs

  7. NSCLI PERMISSIONS (by Joe Wesch)

    • Updated to include finding Account Admins

    • Fixed bug that overwrote duplicate names

    • Display by default network devices of a given ticket. Updated sub-commands and oprtinal arguments as follows: nscli permissions t [TICKET NUMBER] —> will show user permissions network devices attached to the ticket nscli permissions t [TICKET NUMBER] -a —> will show user permissions of all devices attached to the ticket nscli permissions t [DEVICE1 DEVICE2] —> will show user permissions of the devices(s)

v2.5.1 (released 2017-09-20)

  1. F5 certuploader (by **Nick Roberts**)

    • Examples:

  2. NSCLI core (by **Micah Culpepper**)

    • Updated nspylib requirement to new version

v2.5.0 (released 2017-09-19)

  1. SRX minor code upgrade (by **Sergio Pereira**)

    • nscli maint minor -d [DEVICE] compatibility with SRX

  2. SRX snmpv3 (by **Sergio Pereira**)

    • configures snmpv33 given a list of devices

  3. maint sweep (by **Sergio Pereira**)

    • added SRX compatibility

  4. Provisioning plugins (by **Matthew Manning**)

    • info_qcip support for ASA port-channels

    • Alpha API frameworks created for Virt, CTK, SwitchAPI, and Unipede

    • bug fixes

    • organizing code into sub folders and simplfying specific scripts

  5. NSCLI core (by **Micah Culpepper**)

    • added support for Tricore Balabit Gateways

    • Updated LON config station IP post-move

    • install.sh should now work in dash. Default execution is still in bash for the moment.

    • Bugfix for #590 which was causing “ERROR - Unable to open keyring.” on new installs

    • Bugfix for nscli build process - files should now have the correct timestamps applied

    • Admin script: gh2jira creates Jira issues from GitHub issues

  6. RackConnect Search & Report (by **Pedro Ortale**)

    • nscli rc report & nscli rc finder

    • search RackConnect instances by a given keyword in the fields: Instance name, Public/Private IP’s, API_ID

    • show account reports for all associated DDI’s

v2.4.0 (released 2017-08-29)

  1. F5 certuploader (by **Nick Roberts**)
    • Examples:

      nscli f5 certuploader [DEVICE] -c <—-Create a new SSL profile and allow automatic installation nscli f5 certuploader [DEVICE] -u <—-Update existing SSL Profile and allow automatic installation nscli f5 certuploader [DEVICE] -c -p <— Create a new SSL Profile, only prep changes nscli f5 certuploader [DEVICE] -u -p <— Update existing SSL Profile, only prep changes nscli f5 certuploader [DEVICE] <—- displays menu

    • User must provide Public Cert and Key, the rest is mostly automated

    • Automatic Name checks for cert/key pair names, new SSL Profiles

    • Nearly all functions should fall back to manual input methods should any API be unreachable

    • Automatically SCP Files to the f5

    • Automatic Pre and Post SSL Tests leveraging SSL TOOL API

    • Script logs directly into the F5 to check configurations

    • Automatic installation of config and rollback if required using the user’s TACACS credentials

    • Checks for best practices regarding SSL Parent Profiles

    • Display statistics for currently used Parent Profiles

    • Can update the ticket with changes made/prepped changes and post rollback via a private comment

  2. nscli nla bugfix (by **Micah Culpepper**)

    • nscli should once again check NLA login status every 30 minutes, instead of once per day.

  3. install.sh (by **Micah Culpepper**)

    • now runs in bash instead of sh (for Windows compatibility)

    • fixed argument parsing, allowing for custom installation location or specific Python interpreter

  4. F5 Major (by **Sergio Pereira**)

    • Manual Steps for manual Sofware Upgrade 11 to 12

v2.3.0 (released 2017-08-17)

  1. Permissions (by **Sergio Pereira**)

    • Examples: nscli permissions -t [TICKET] or nscli permissions -d [DEVICE]

    • Displays customer permissions of devices attached to a ticket and customers marked as recipients

    • Displays device permissions

  2. ASA/F5 File MD5 Verification (by **Joe Wesch**)

    • Examples: nscli asa md5 DEVICE /OR/ nscli f5 md5 DEVICE

    • Allows you to verify the MD5 checksum of a file without requiring ZSP to be unlocked

    • Just listing the device will print a list of files on the device and lets you choose

    • Optional -file and -checksum flags allow you to provide specific items to verify

  3. Maintenance checks (by **Sergio Pereira**)

    • Example: nscli maint checks [TICKET]

    • Perform Ping sweeep, gets VPN status, VIP status and updates public comment with the result obtained.

  4. Core changes (by **Micah Culpepper**)

    • Upgrade changes. There is now an nscli install script on the mirror. This script will handle normal installation as well as upgrades. Because it is hosted on the mirror, rather than distributed with nscli, it can be updated to deal with new upgrade challenges as they arise. The nscli upgrade function downloads this script and runs it.

    • Refactored __main__, auth.cisco_nla, and switch.ns_switch. User experience should be the same or slightly improved. API is mostly the same. cisco_nla now tracks timestamps for the different DCs separately.

v2.2.8 (released 2017-07-18)

  1. Juniper SRX Packet Tracer (by **Pedro Ortale**)

    • Perform the show security match-policies on SRX devices.

    • Just Device, Source, Destination and Port is required for TCP Checks (-u to check UDP).

    • No more time wasted performing zone / route lookup for filling the match-policies arguments.

    • Matches Zone and Global policies.

  2. Ghost Browser integration for ssh gui (by **Joe Wesch**)

    • Ghost Browser allows you to have multiple tabs open to different F5 gui’s at the same time

    • Simply add Ghost Browser to your OSX Applications and it will detect it and start using it

  3. win.sh replaced by install.sh (by **Micah Culpepper**)

    • install.sh does what win.sh used to do - installs nscli

    • install.sh is smarter than win.sh was, and does some dependency checking/installation for you

    • install.sh can be used on linux and mac, too

    • The installation method on rax.io/nscli is still preferred, generally. But install.sh may be more effective if you need to install nscli on a brand-new machine, or if you need to nuke your existing nscli install from orbit and reinstall.

  4. Internal NSCLI changes (by **Micah Culpepper**)

    • settings is now importable from nscli. settings.ini is a dictionary containing the data from the user’s settings.ini. This should make it easier for plugin authors to use the config file.

    • NSCLI now requires sqlite3, which has been part of the standard library since 2.5. If your Python installation did not come with sqlite, you will need to upgrade.

    • NSCLI now respects the XDG_CONFIG_HOME environment variable. Config files will be saved in ~/.config/nscli/ by default.

    • Plugin authors can import config_dir from nscli to get the path to the config directory.

    • NSCLI will attempt to import existing settings from the legacy directory ~/.nscli/

    • When running nscli in a virtual environment, a config directory for that virtual environment will be created relative to sys.prefix. Now your separate NSCLI installations can have separate configs, too!

    • bastions.json: This config file is now deprecated. Several copies of it have been found and deleted. The remaining copy is in nscli/data, and will be removed once the remaining references to it have been replaced.

    • nscli/data/infrastructure.json is the replacement for bastions.json. However, you should avoid accessing this file directly, except to record new datacenters/bastions/etc. See the next point.

    • config_db: NSCLI maintains a database of infrastructure facts instead of just using flat config files. NSCLI reads infrastructure.json and creates a SQLite database from its contents. This database is saved in the user’s config directory and loaded on subsequent runs of NSCLI. It will be rebuilt if the file is missing, or if infrastructure.json in the user’s config directory is newer than the database.

    • find_geo: The new nscli.config_db module provides a function called find_geo. Plugin authors are encouraged to use this function to get infrastructure facts, given a data center or region.

v2.2.7 (released 2017-06-15)

  1. Replace appstats with NewRelic

  2. maint mrt (by **Duane Herman**)

    • generates MRT (Maintenance Request Template)

  3. provisioning (by **Matthew Manning**)

    • NetSec Provisioning Related Scripts

v2.2.6 (released 2017-05-08)

  1. JunosPW Decoder Enhancements (by **Cameron Exley**)

    • Added interactive option to avoid strings being malformed by the bash shell when entered without single quotes.

    • Created optional argument, -e or --encrypted-string, in case you preferred the non-interactive version.

    • Added a check for malformed strings, if the single quotes are still forgotten when using non-interactive mode (-e)

  2. ACS INFO enhancements (by **Cameron Exley**)

    • Now prints out ACS servers for location of device

    • -c or –config will produce necessary TACACS configuration for device

  3. maint ram_conv (by **Sergio Pereira**)

    • ASA RAM upgrade and System Software upgrade (pre-to-post)

    • Uploads System Software asa917-16-k8.bin and converted Configuration to the firewall

  4. maint sweep (by **Sergio Pereira**)

    • Queries the NAT Public IPS of either ASA Firewall or BigIP F5 devices

    • Queries core devices numbers given a public IP address

    • Perfoms from cbastion ‘sudo nmap -n -sP -v -PE [PUBLIC IPS]’

    • Displays total live hosts.

v2.2.5 (released 2017-04-20)

  1. ASA VPNPrep

    • Added some basic error handling

  2. ASA Console v1.2

    • Minor text fixes, bugs and code improvements

    • Fixes basing of interfaces for 5505 with -down flag

v2.2.4 (released 2017-04-17)

  1. Torq imports (by **Steve Hurley**)

    • nscli torq add-device <device>

    • Lets you manually import a device into torq, in case the automatic import didn’t happen.

  2. Added ASA VPNPrep module (by **Cameron Exley**)

    • An interactive script to produce the required commands for a new IKEv1 L2L tunnel

    • Checks crypto map name, sequence number as well as phase 1 and 2 policies/transform-sets

  3. Added ASA Console module (by **Joe Wesch**)

    • Converts ASA running config to paste-ready format for a new firewall

    • Using the -down flag, it can help quickly restore a config for a replacement firewall

v2.2.3 (released 2017-03-21)

  1. Maintenance team script improvements

v2.2.2 (released 2017-02-15)

  1. NSCLI config file (by **Josh Silvas**)

    • Improvements to the config file, moving towards supporting more items

    • You can now set your balabit bastion, so you can use, e.g. the GET bastion instead of the support one

    • nscli reset now deletes cached session data and tokens instead of blowing away your config file

  2. Passwordsafe (by **Josh Silvas**)

    • On a 401/403 response, NSCLI now prompts for your password again, instead of assuming you need to create a project

  3. Added ORD cbast (by **Josh Silvas**)

    • nscli cbast ord

  4. Auto-enable firewalls (by **Josh Silvas**)

    • NSCLI can now log in to firewalls with aaa authorization exec authentication-server auto-enable without crashing

  5. ADX Library Enhancements (by **Aaron Hackney**)
  6. NSCLI Maintenance (by ***Sergio Pereira**, **Topher Martin**, and **Trevor Becker**)

    • parallel Maintenance generator for Parallel migration

    • minor ASA/F5/ADX minor code upgrade

    • failover Failover testing

    • luno Template for LUNO maintenances

  7. NSCLI WAF protected_ips (by **James Wathen**)

    • Determine if IP is part of WAF protected IPs

  8. Add Devices to Ticket (by **Micah Culpepper**)

    • Attach devices to a CORE ticket via nscli

  9. Torq Backup (by **Josh Silvas** and **Micah Culpepper**)

    • moved functionality from ns_fe.SwitchApi to Torq

    • Torq backup now displays a progress bar instead of acting like it’s hung

  10. ASA shun (by **Micah Culpepper**) - config parsing improvements

  11. NSCLI administrative (by **Micah Culpepper**) - NSCLI will now be released monthly - New submissions to NSCLI must be accompanied by unit tests - See the new guidelines for contributing at docs/src/Contributing.rst

v2.2.1 (released 2016-12-07)

  1. Update for ASA Shun (by **Micah Culpepper**)

    • Users should no longer see the “failover state unknown” message unless it is accurate.

    • Show Shun Statistics output is now filtered to only display the address that was shunned.

  2. New Module: NSCLI Torq (by **Micah Culpepper**)

    • Use nscli torq list-files to view metadata about a device’s config files in torq.

    • Use nscli torq get-file to download a file from torq. For example, to download the running config for the Zulu lab firewall, run nscli torq get-file 349764 running-config > zulucfg.txt

    • This module uses the Torq API, so you need ldap_netsec_torq (or better) in your LDAP for it to work.

  3. API Change: ns_apilibs.Ndapi.post (by **Micah Culpepper**)

    • Minor API change to allow downloading text files from Torq.

    • Now returns the raw response body if the response is not JSON.

    • Did not modify “Accept” header, so anything that was using this before should still work after the update.

  4. Update for ZSP Unlock (by **David Patino**)

v2.2.0 (released 2016-10-26)

  1. ASA Build Options - In this update, you can now perform the following actions to an ASA:

    • Build a configuration file from (TORQ, Firekick, Pre-to-Post Converter)

    • SCP the new configuration file to the appliance

    • Stage code specific to the destination device platform

    • Set bootvar and startup file

    • Reboot the ASA

    • NOTE: This is first time, you will be able to bring a customer down via nscli without actually logging into the device.

    • nscli asa build <device_id> <ha_device_id>

  2. ASA Shun Tool (by **Micah Culpepper**) - Manage ASA Shuns via NSCLI - nscli asa shun <device> <ip_address>

    Optional Arguments –user USERNAME ASA username, if different from ACS. –password PASSWORD Login password, if different from ACS. Enter ‘?’ to be prompted. –enable ENABLE Enable secret, if different from ACS. Enter ‘?’ to be prompted –searchonly Search the firewall for the address(es), but do not shun –delete delete IP from the ASA’s shun table, i.e. “no shun <ip>”

  3. Minor changes and updates to “nscli projects” tool (by **Julian Coleman**)

  4. Finder Plugin - Just a simple implementation of Hozers Finder in NSCLI - nscli finder <search_string>

    Optional Arguments -s, –seniority view the finder seniority report -l, –locations Employee count by location

v2.1.5 (released 2016-09-26)

  1. SCP to/from network devices proxy via NextGen Balabit Proxies

    • nscli ssh <device_id> -s

  2. Attempt to retrieve core token from an open FireFox session prior to prompting for credentials

    • This update is added to remove a prompt for RSA Token authentication, if there is already a valid session in your web browser.

  3. Support for user credential storage in PasswordSafe.

    • Will create (if not found) a personal PasswordSafe project for TACACS/ACS/SSO credentials.

    • Subsequent authentication request will first look in PasswordSafe for the user credentials before prompting for them.

  4. Migrated local user credential OS keyring. (by **George Markeloff**)

    • Local cache for user credentials will be stored in the system keyring.

  5. Added support for WebMux logins

  6. Patch to the nscli build function (by **Nick Roberts**)

    • nscli build <device> --findnetworks

    • Script will parse an ASAs routing table and all remote encryption domains and print a table with the info or find where a given IP lives

  7. Added password generator from nspylibs

    • nscli passgen

      -c [LENGTH], --length [LENGTH]  Length of password to generate (Default: 30)
-a [ADD], --add [ADD]           Add characters to the generator
-l, --no_lower                  Remove lowercase letters from passgen.
-u, --no_upper                  Remove uppercase letters from passgen.
-s, --no_special                Remove special characters from passgen.

  8. Added a settings.ini file that is user modifiable for default settings.

    • nscli settings

  9. JunOS Password Decoder (by **Cameron Exley**).

    • nscli juniper junospw

    • Decrypt Junos $9$ passwords.

      • Bash can cometimes attempt to interpret ‘special’ characters as commands. It is highly likely your string will contain these characters. Ensure your encrypted string is wrapped in single quotes.

  10. ACS Search (by **Julian Coleman**)

    • Script to download and search through ACS logs, printing the results in a useable format

    • nscli acs-search

      -e - Exclude automated users (fwportal,backups,monitor.netsec, etc...)
-u - Only include logs for the specified user
-c - ACS client IP (device)
--start - Start date (UTC) for the logs to be pulled
--end - End date (UTC) for the logs to be pulled

    • nscli acs-search -c 104.239.180.156 --start 05-28-16 --end 05-31-16 -u prab8505

      2015-08-24 20:18:37 UTC (prab8505) show user-alert
2015-08-24 20:20:26 UTC (prab8505) show logging
2015-08-24 20:20:35 UTC (prab8505) show logging
2015-08-24 20:20:36 UTC (prab8505) show logging
2015-08-24 20:34:38 UTC (prab8505) quit

  11. F5Scripts (by **Julian Coleman**)

    • Upload cutom scripts to and F5

    • nscli f5scripts <device ID / IP>

    • Example: nscli f5scripts 349759

      Scripts:
    f5user

Destination:
    Device: 349759
    IP: 10.12.144.24
    Path: /opt/nscli-f5scripts/

  12. RCVLAN (beta) (by **Julian Coleman**)

    • Generates commands to assgin packet filters to VLANs. nscli rcvlan <Device ID / IP>

    • Example:

      • nscli rcvlan 733297

Downloading and parsing F5 configuration...
Analysing VLANs, self IPs and packet filters...

Total Unassgined RackConnect VLANs: 519

/////////////////// CHANGE //////////////////////
modify net packet-filter RCAuto-ID_30878-NP_19176-CS_1117317-DN_8965 vlan rackconnect151
modify net packet-filter RCAuto-ID_30404-NP_19176-CS_1116843-DN_1826 vlan rackconnect151
modify net packet-filter RCAuto-ID_30116-NP_104354-CS_1116695-GW_154871 vlan rackconnect151
modify net packet-filter RCAuto-ID_30801-NP_19176-CS_1117268-DN_8969 vlan rackconnect149
modify net packet-filter RCAuto-ID_30130-NP_104354-CS_1116696-DN_8961 vlan rackconnect151
modify net packet-filter RCAuto-ID_30841-NP_19176-CS_1117319-DN_1827 vlan rackconnect151
...
/////////////////// ROLLBACK //////////////////////
modify net packet-filter RCAuto-ID_30878-NP_19176-CS_1117317-DN_8965 vlan none
modify net packet-filter RCAuto-ID_30404-NP_19176-CS_1116843-DN_1826 vlan none
modify net packet-filter RCAuto-ID_30116-NP_104354-CS_1116695-GW_154871 vlan none
modify net packet-filter RCAuto-ID_30801-NP_19176-CS_1117268-DN_8969 vlan none
modify net packet-filter RCAuto-ID_30130-NP_104354-CS_1116696-DN_8961 vlan none
...

  13. https://github.rackspace.com/NSI/nscli/releases/download/2.1.5/nscli-2.1.5.tar.gz

v2.1.4 (released 2016-07-01)

  1. HTTP proxy through ssh tunneling via local web browser. (for DRAC access)

    • nscli ssh -g

  2. ADX SSL Uploader

    • SSL Uploading tool for Brocade ADX. As of right now, you can upload SSL certs/keys to the brocade and list the certs from a Brocade from nscli.

  3. https://github.rackspace.com/NSI/nscli/releases/download/2.1.4/nscli-2.1.4.tar.gz