Getting Ansible to Talk to a Switch Older Than Some Coworkers
# ansible.cfg — scope legacy crypto to old IOS hosts
[ssh_connection]
ssh_args = -o KexAlgorithms=+diffie-hellman-group14-sha1
-o HostKeyAlgorithms=+ssh-rsa
-o Ciphers=+aes256-cbc
# and pin the SSH library:
pip install 'paramiko<3.0'
My access switch is a Cisco 2960G. It’s a solid gigabit switch that has been running for the better part of two decades, and I see no reason to replace hardware that works. Modern automation tools disagree. Getting Ansible to manage it turned into a small archaeology project, and since half the enterprise world still runs gear like this, the fixes are worth writing down.
The first wall is SSH. New SSH clients have dropped the old key exchange and cipher algorithms that old IOS speaks, so the connection dies before login. The fix is telling Ansible to allow the legacy crypto for just these hosts, in the ssh_args of your ansible.cfg. You’re explicitly re-enabling old algorithms, so scope it to the devices that need it instead of your whole config.
The second wall is the Python side. Newer versions of paramiko, the SSH library Ansible leans on for network gear, also dropped legacy support. Pinning paramiko below version 3.0 got the old IOS talking. That one cost me more time than I’d like to admit, because the error message says nothing about versions.
A few more that came out of the same project. The vault_password_file setting belongs in the defaults section of ansible.cfg, not wherever you happen to be when you get tired of typing it. If you use delegate_to localhost in a task, your hostvars context walks away with it, so capture what you need with set_fact first. And extra_vars can’t be set in ansible.cfg at all, no matter how much sense that would make. Command line only.
People ask why I bother automating a lab switch when I could just type the six commands. Because the gotchas above are the same ones waiting in any environment that runs older gear, and I’d rather meet them at home than during a maintenance window. Old hardware is the best teacher precisely because nothing works out of the box.