Same Ansible playbook fails on subset of SMS

[boneyard]

Confusing situation to me.

From one Ansible server (Ansible 2.15.3, python 3.11, latest Check Point gaia collection) running a playbook which should add or delete an user in the gaia config. Doing this on six SMSes (3 x HA) and it works on four, but on one pair I get:

ansible.module_utils.connection.ConnectionError: Server returned response without token info during connection authentication: 401

This SMS pair is for a VSX environment, the other pairs are for regular firewalls. All on R81.20 with the latest take. Reboot of SMSes with the issue has been tried. It has also worked in the past, then on R81.10, but unsure if it really stopped after the upgrade or already earlier / later.

Running an API call via curl from the Ansible server to these not working SMSes with Ansible works fine. So it doesn't seem to be an account / password or connectivity issue.

The api.elg doesn't show anything for the failed Ansible playbook. So it feels the response doesn't reach the API but fails on the HTTP server(s?) in front. Unfortunately I'm unable to see any logging for that.

With a packet capture I can confirm the Ansible request reaches the SMS, but as it is encrypted I can see the content.

Is there anything else to investigate by myself? I would like to see the logging of the HTTP server which receives this request and probably sends the 401.

[Alex-]

You could check the allowed hosts configuration in the GAIA UI for these SMS to see if they accept the same SSH connections than the others.

[boneyard]

Thanks. Checked that, is the same. Also confirmed by trying to login with SSH and API from the Ansible server. That is allowed and working.

[boneyard]

Eventually found out the issue was caused by performing upgrades on the devices. The clean install method was used with putting back the CLISH config afterwards. But the API access for the used account isn't in CLISH, has to be done via GUI or with the gaia_api access command.

So own mistake. But would be nice if API account access becomes a regular part of the CLISH config.