Troubleshoot Ansible Connection Errors When Managing Junos Devices

Problem

UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ", "unreachable": true}

unknown command: /bin/sh\r\n

Cause

These errors can arise when the module is not run locally on the Ansible control node.

Normally Ansible requires Python on the managed node, and the Ansible control node sends the module to the node, where it is executed and then removed. The Juniper Networks modules do not require Python on Junos devices, because they use Junos PyEZ and the Junos XML API over NETCONF to interface with the device. Therefore, to perform operations on Junos devices, you must run the modules locally on the Ansible control node where Python is installed. If Ansible tries to execute a module directly on the Junos device, it generates an error.

Solution

To direct the Ansible control node to run the juniper.device modules locally, include connection: local in the Ansible playbook, or include the --connection local command-line argument when executing individual modules. For example:

---
- name: Get Device Facts
  hosts: junos
  connection: local
  gather_facts: no   

Problem

"msg": "Unable to make a PyEZ connection: ConnectUnknownHostError(dc1a.example.net)"

Cause

The host is not defined in the Ansible inventory file or the Ansible control node is unable to resolve the hostname.

When executing an Ansible module either directly or from a playbook, any host referenced in the module arguments or the playbook must be defined in the Ansible inventory file. The default location for the inventory file is /etc/ansible/hosts. If the inventory file references a hostname, the Ansible control node must be able to resolve the hostname.

Solution

Update the Ansible inventory file to include the missing host, and ensure that DNS resolution is working correctly.

For information about the Ansible inventory file, see Understanding the Ansible Inventory File When Managing Junos Devices as well as the official Ansible documentation at https://www.ansible.com/.

Problem

"msg": "Unable to make a PyEZ connection: ConnectRefusedError(dc1a.example.net)"

Cause

The most likely cause for a refused connection error is that NETCONF over SSH is not enabled on the Junos device.

To quickly test whether NETCONF is enabled, verify that the user account executing the Ansible module can successfully start a NETCONF session with the device.

user@ansible-cn:~$ ssh user@dc1a.example.net -p 830 -s netconf

If the user can successfully establish a NETCONF session with the device on either the default NETCONF port (830) or a port that is specifically configured for NETCONF on your device, then NETCONF is enabled. Otherwise, you must enable NETCONF over SSH on the device.

Solution

Enable the NETCONF-over-SSH service on the Junos device.

[edit]
user@host# set system services netconf ssh
user@host# commit