How to solve AireOS raw Telnet mode problem
Given that telnet sends data in clear text, we prefer to use SSH instead of telnet for security reasons. This article does not recommend using telnet to connect to AireOS WLC, but hopes that my analysis process will bring some benefits to viewers.
When we try to access AireOS WLC via Python telnetlib module, it will not be accessible. The error message is “Raw mode will not be supported, Closing connection”. Using Google, I saw that this problem was discussed as early as 2014(link1, link2), but unfortunately the solution did not work.
Refer to the official documentation, we can understand that AireOS WLC does not support raw Telnet mode.
The controller does not support raw Telnet mode.https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/configuration-guide/b_cg81/b_cg81_chapter_011.html
raw Telnet mode
There is a connection type called Raw on the putty terminal.
Refer to the official documentation, we can understand that the Raw connection type not using real telnet protocol, but a TCP connection using port 23.
Although the Unix telnet program provides this functionality, the protocol being used is not really Telnet. Really there is no actual protocol at allhttps://documentation.help/PuTTY/using-rawprot.html
The fourth protocol, Raw, is not used for interactive login sessions; you would usually use this for debugging other Internet serviceshttps://documentation.help/PuTTY/gs-insecure.html
Assume that WLC has a mechanism to determine whether the telnet client uses the real telnet protocol or raw Telnet mode.
Let’s see what is the difference between the real telnet protocol and raw Telnet mode.
In the working case(via putty telnet mode), the first packet sent by the telnet client contains information such as SUPPRESS-GO-AHEAD and ECHO.
But in non-working case(via telnetlib module), the telnet client sends data directly.
but structured within the TELNET Protocol are various “options” that will be sanctioned and may be used with the “DO, DON’T, WILL, WON’T” structure (discussed below) to allow a user and server to agree to use a more elaborate (or perhaps just different) set of conventions for their TELNET connection.https://tools.ietf.org/html/rfc854.html
Here is a really detailed explanation for the telnet negotiation process.
My next plan is let telnetlib send the SUPPRESS-GO-AHEAD option to negotiate telnet. Now Check the telnetlib source code, to understand the defined Telnet protocol characters.
I tried to send the SUPPRESS-GO-AHEAD option with the following code, but it did not work. I saw that the SUPPRESS-GO-AHEAD option was never sent to the server(in packet capture).
tn.write(telnetlib.IAC + telnetlib.WILL + telnetlib.SGA)
Fortunately I saw a solution in stackoverflow, the key point is get_socket().
import telnetlib import time HOST = "10.106.66.201" user = "admin" password = "test123" command = "show interface summary" tn = telnetlib.Telnet(HOST) def write_raw_sequence(tn, seq): sock = tn.get_socket() if sock is not None: sock.send(seq) write_raw_sequence(tn, telnetlib.IAC + telnetlib.WILL + telnetlib.SGA) tn.write(user.encode('ascii') + b"\n") tn.write(password.encode('ascii') + b"\n") tn.write(command.encode('ascii') + b"\n") time.sleep(1) data = tn.read_very_eager().decode('ascii') print(data)
Now the SUPPRESS-GO-AHEAD option was successfully sent, and the WLC did not refuse the connection, it works like a charm!
Another solution is to use the telnetlib3 module. Here is a simple example.
import asyncio import telnetlib3 host, port, username, password, command = '10.106.66.201', 23, 'admin', 'test123', 'show interface summary' @asyncio.coroutine def shell(reader, writer): while True: outp = yield from reader.read(1024) writer.write(username + '\n') writer.write(password + '\n') writer.write(command + '\n') if not outp: break elif 'Number of Interfaces' in outp: break print(outp) loop = asyncio.get_event_loop() coro = telnetlib3.open_connection(host, port, shell=shell) reader, writer = loop.run_until_complete(coro) loop.run_until_complete(writer.protocol.waiter_closed)
But telnetlib3 has not been widely used, there is no much information for reference, except official document.
Personally, I prefer netmiko, it is more secure (SSH) and easy to use. For example, netmiko will automatically execute “config paging disable” when connecting, which is really useful for collecting information such as “show tech”.
I hope this article is helpful to those who need to use telnetlib to connect to WLC with special needs.