13 smart ways to program your cisco ios...

13 Smart Ways to ProgramYour Cisco IOS Network

BRKNMS-3114

Bruno Klauser

Is there too much manual monitoring of your network?

Have you ever needed a metric beyond a single MIB value?

Need to temporarily monitor services during critical time windows?

Are you worried about maintaining the accuracy of your already configured monitoring?

Your Cisco IOS Network provides a wealth of advanced device manageability instrumentation (DMI) and

Embedded Automation Systems (EASy) to design and implement your own Network Automations. Learn

how Network Automation allows you to automate manual tasks, better operate existing network services

and even enable new and innovative networking solutions.

This Breakout Session uncovers embedded Network Automation capabilities you can use to interact with

your network elements for the purpose of implementing network testing, verification and service

assurance in a more effective, efficient and robust way. Network Automation fundamentals as well as the

choice and use of appropriate practices are illustrated through a combination of presentation and best

practice examples.

The topic is relevant for network planners and administrators, engineers and system integrators for both

enterprises and service providers.

© 2015 Cisco and/or its affiliates. All rights reserved.BRKNMS-3114 Cisco Public

Welcome Aboard

This Session IS:

• Embracing the Software-Defined Era

• Automating Custom Behavior in Your Network

• Linking Software Applications and Networks

• Using Network Programming

• Practical Examples

This Session is NOT:

• An Introduction to Programming Concepts

• An In-Depth Session on One Single Feature

• Engineering Details of IOS

• NMS applications

4


Highly motivated individuals

Full control over every single detail

Towards: Collaborative operations of a partially autonomic system

From: Detailed control by a single central authority

An Analogy

Highly skilled and trained crew

Human brain in every control loop

Specialized distributed crew

Reasonable control within boundaries

5

“Civilization advances by extending the number of

important operations which we can perform without

thinking of them.”

Alfred North Whitehead, 1911(Mathematician and Philosopher, Author of “An Introduction to Mathematics” and “Principia Mathematica”)


Agenda

7

1

2

3

4

5

6

7

8

9

10

11

12

13

Your Network may not be there yet …

Cisco VNI and RIPE ATLAS1


What if Your Cisco Network is not there yet ?

Problem: You may need network data and statistics *before* deploying into a specific location

Solution: Trending and Forecasting information provided by Cisco Visual Networking Index

Global initiative to analyze and forecast IP network growth

• Fixed Internet, Managed IP and Mobile data collection

• Business vs. Consumer

• Customizable Filters

• Graphical reports and datasummaries publicly available

See: www.ciscovnipulse.com

9

http://www.ciscovnipulse.com/


What if Your Cisco Network is not there yet ?

Problem: You may need network data and statistics from locations beyond your own network

Solution: Current and historical Performance Metrics provided by RIPE ATLAS

“With your help, the RIPE NCC is building thelargest Internet measurement network ever made.RIPE Atlas employs a global network of probesthat measure Internet connectivity and reachability,providing an unprecedented understanding of thestate of the Internet in real time.”

• Weather Map Reports

• Detailed Probe Reports

• Standard and User DefinedMeasurements

• REST API

• Contribute to a Bigger Cause

See: https://atlas.ripe.net

USB (Power)

RJ45 (Network)

10

https://atlas.ripe.net/


RIPE ATLAS – API Examples

See https://atlas.ripe.net/docs/rest/

RIPE Atlas REST API Covers

• Measurements

• Probes

• Participation / Enrollment

With extensive Filter Capabilities

{

"asn_v4": 6730,

"asn_v6": null,

"country_code": "CH",

"id": NNNN,

"is_anchor": false,

"is_public": false,

"latitude": 47.4275,

"longitude": 8.3095,

"prefix_v4": "188.154.0.0/15",

"prefix_v6": null,

"status": 2,

"status_name": "Disconnected",

"status_since": 1421929692,

"tags": [

"home",

"nat",

"system-v2“ ]

}

Get some Details about my Probe (JSON Format)https://atlas.ripe.net/api/v1/probe/NNNN/

Get Results of a specific Measurement (JSON Format)https://atlas.ripe.net/api/v1/measurement/1769099/result/? … …

11

https://atlas.ripe.net/docs/rest/

https://atlas.ripe.net/api/v1/probe/NNNN/

https://atlas.ripe.net/api/v1/measurement/1769099/result/

Some Common Ground

Embedded Event Manager (EEM)2


Embedded Event

Manager

Syslogemail

notification

SNMP set

Counter

CLI

Applets

SNMP

get

SNMP

notification

Application

specific

TCL

Policies

Reload or

switch-over

EEM Applets

multi-event-correlation

IOS.sh

Policies

Actions

Event Detectors

Syslog

Event

Process

Scheduler

Database

Interface

Descriptor

Blocks

Syslog

ED

Watchdog

ED

Interface

Counter

ED

CLI

ED

OIR

ED

ERM

ED

EOT

ED

RF

ED

none

ED

GOLD

ED

XML

RPC

ED

SNMP

EDs

Remote:

• Notification

Local:

• Notification

• Get/Set

NetFlow

ED

IPSLA

ED

Route

ED

Timer

EDs

• Cron

• Count

down

HW

EDs

• Fan

• Temp

• Env

• ...

CDP

LLDP

ED

802.1x

ED

MAC

ED

Embedded Event Manager (EEM)

13


Example: EEM Applets – Loops, Variables

Problem: None in Particular

Solution: Have fun exploring EEM Applet capabilities

See also: http://www.99-bottles-of-beer.net/language-cisco-ios-embedded-event-manager-applet-2909.html

event manager applet 99-bob

description written by bklauser inspired by http://www.99-bottles-of-beer.net

event none

action 100 set b 99

action 110 while $b gt 1

action 120 puts "$b bottles of beer on the wall, $b bottles of beer."

action 130 decrement b

action 140 puts "Take one down, pass it around, "

action 150 puts "$b bottles of beer on the wall.\n"

action 160 end

action 170 puts "$b bottle of beer on the wall, $b bottle of beer."

action 180 puts "Take one down, pass it around, "

action 190 puts "no more bottles of beer on the wall.\n"

action 200 puts "No more bottles of beer on the wall, "

action 210 puts "no more bottles of beer."

action 220 puts "Go to the store and buy some more, "

action 230 puts "99 bottles of beer on the wall.\n"

!

alias exec sing event manager run 99-bob

Setting a Variable

Decrementing a Variable

Referencing a Variable

While Loop – {

While Loop – }

Using an Alias to run our Applet

Real-World Example

14


Packaging Network Automations

Problem: Cisco IOS Embedded Automation Systems often include multiple configuration items, files, checks and procedures – how to ensure they are deployed consistently?

Solution: Cisco EASy provides a simple packaging mechanism and open-source EASy Installer. A developer guide is available online to assist with the creation of EASy packages.

MyPackage.tar

Package Description

Pre-Requisite Verification

Pre-Installation Config

Pre-Installation Exec

Environment Variables

Configuration

Files

Post-Requisite Verification

Post-Installation Config

Post-Installation Exec

Uninstall

+

EASy Installer = Menu Guided Installation

Router# easy-installer tftp://10.1.1.1/mypackage.tar flash:/easy

-----------------------------------------------------------------

Configure and Install EASy Package ‘mypackage-1.03'

-----------------------------------------------------------------

1. Display Package Description

2. Configure Package Parameters

3. Deploy Package Policies

4. Exit

Enter option: 2

See: http://www.cisco.com/go/easyEASy Package guide: http://tools.cisco.com/squish/cEAe3

15

http://www.cisco.com/go/easy

http://tools.cisco.com/squish/cEAe3


Embedded Automation Systems (EASy)

1. Browse and Download EASy Packageswww.cisco.com/go/easy

2. Make Sure to also download EASy Installer

3. Browse Other Embedded Automationswww.cisco.com/go/ciscobeyond

4. Learn About The Technology Under The Hoodwww.cisco.com/go/instrumentationwww.cisco.com/go/eemwww.cisco.com/go/pec

5. Discuss, Ask Questions, Suggest Answers supportforums.cisco.comsupportforums.cisco.mobi

6. Upload your own Examples to CiscoBeyondwww.cisco.com/go/ciscobeyond

7. Engage via [email protected]

16

http://www.cisco.com/go/easy

http://www.cisco.com/go/ciscobeyond

http://www.cisco.com/go/instrumentation

http://www.cisco.com/go/eem

http://www.cisco.com/go/pec

https://supportforums.cisco.com/

http://www.supportforums.cisco.com/

http://www.cisco.com/go/ciscobeyond

mailto:[email protected]


Example: Event-Based Configurations

17

When a printer is added to the network, use an EEM applet to create a new custom AutoSmartPort-like event

event manager applet dectect-printer

event neighbor-discovery interface regexp FastEthernet.* cdp add

action 001 regexp ".*LasterJet.*" "$_nd_cdp_platform"

action 002 if $_regexp_result eq 1

action 003 cli command "enable"

action 004 cli command "config t"

action 005 cli command "interface $_nd_local_intf_name"

action 006 cli command "switchport access vlan $printer_vlan"

action 007 cli command "switchport mode access"

action 008 cli command "switchport port-security"

action 009 cli command "switchport port-security violation restrict"

action 010 cli command "switchport port-security aging time 2"

action 011 cli command "switchport port-security aging type inactivity"

action 012 cli command "spanning-tree portfast"

action 013 cli command "spanning-tree bpduguard enable"

action 014 cli command "end"

action 015 syslog msg "New printer added: $_nd_cdp_entry_name , type:

$_nd_cdp_platform"

action 016 end

Real-World Example


Format and Share Remote Information – 1/2

Problem: How to actively gather and share information from a router and from a few devices behind the router – across organizational and technical borders?

Solution 1: Initiate a project to make use of SNMP, Syslog, Event Management Software, Reporting, Provisioning and CRM Systems ...

Solution 2: Use Cisco IOS Network Automation to collect and post the information

namespace import ::http::*

Using Cisco IOS Embedded Event Manager and Tcl:

1. Import the http package into EEM policy

2. Collect the information required

set my_query [::http::formatQuery "status" $my_info]

3. Build a query for the http POST operation

set my_reply [::http::geturl $my_server_url -query $my_query]

4. POST the information to a website

Real-World Example

18


See: http://twitter.com/EASyDMINote: it is NOT recommended to use a public site or feed other than for demo purpose

Format and Share Remote Information – 2/2

19

Real-World Example

Scripting and Programming at the Edge

Device-Level APIs and Containers3


Supported on CSR1kV since XE 3.10

• ASR1K in XE 3.14

Primarily for Config

• DNS, NTP, Interface, Routing, ACL, NAT

Some Stats

• Interface, CPU, Memory

Runs in a service container

• Uses onePK Python APIs under the hood

Programmable Network Layer – REST @ IOS XE

21


REST Follows a Familiar Model

HTTP GET

Describes how data

should be displayed to

please human viewer

HTTP GET

Describes data in a

format applications

can understand

{"ids":[303776224, 19449911, 607032789,

86544242, 2506725913, 17631389],

"next_cursor":0, "next_cursor_str":"0",

"previous_cursor":0,

"previous_cursor_str":"0"}

Web Browsing REST API Twitter: IDs of last five followers

HTML JSON/XML

22


Programmable Network Layer

Programmable

Network Layer

(Physical + Virtual)Cisco IOS (Enterprise, Data Center, Service Provider)

Data Plane – (ASIC and Software)

Cisco onePK Agent Infrastructure .

one

PK

Loca

tion

Se

rvic

e S

et

one

PK

BG

P S

erv

ice

Se

t

Cis

co

819 A

irV

isio

nA

PIs

Op

en

Flo

w

. . .

I2R

S

PC

EP

Neutr

on

OM

I

Pu

pp

et

NE

TC

ON

F +

Ya

ng

one

PK

Da

taP

ath

Se

rvic

e S

et

one

PK

Po

licy S

erv

ice

Se

t

one

PK

Ro

utin

g S

erv

ice

Se

t

one

PK

Ele

me

nt S

erv

ice

Se

t

one

PK

Dis

co

ve

ry S

erv

ice

Se

t

one

PK

Utilit

y S

erv

ice

Se

t

one

PK

De

ve

lope

r S

erv

ice

Se

t

Cisco one IoT APIsCisco Cloud Connector Toolkit

Cisco onePK API Presentation, Software Development Kit, Runtime

. . .

. . .

onePK BASE

23


Programmable Network Layer – Evolution

Programmable

Network Layer

(Physical + Virtual)

Cisco IOS – Feature Implementation


Feature API Wiring

C Java

24



Programmable

Network Layer




Feature API Wiring

C Java Python

25



Programmable

Network Layer




Feature API Wiring

Feature Information Model Wiring

Data Models

Generation from Data Models

C Java REST NETCONF

Extend and Customize . . . Configure and Operate

. . .Python

26



Programmable

Network Layer




Feature API Wiring


Data Models


C Java REST NETCONF


. . .Python

27



Programmable

Network Layer




Feature API Wiring


Data Models


C Java REST NETCONF


. . .Python

28

From Towards

Hand-crafted API Infrastrcture Model-driven generation

Manual platform adaption Model-driven generation

Inconsistencies between Agents Consistent model and data across agents

Focus on Agents across Platforms Focus on Models and Platform strengths


Programmable Network Layer – Hosting Models

Programmable

Network Layer



Device-Level Shell or API (such as guestshell, onePK, RESTCONF, etc)

Choice of 3

Hosting Models “Process”

On the Node• Shared memory/compute

• Very low latency and delay

• Available on select platforms

“Blade”

On A Hardware Blade• Dedicated memory/compute

• Low latency and delay

• Requires modular hardware blade

“End-Node”

On An External Server• Plentiful memory/compute

• Higher latency and delay

• Supported by all platforms

29


Programmable Network Layer – Containers

30

Virtualized environment on a Cisco device.

Examples of LXC Use Cases:• Cisco Virtual Services:

• ISR4451X-WAAS

• Device Agents:

• Nexus – Cisco Openflow Agent

• Nexus – Cisco Puppet Agent

• Third Party Services (onePK applications):

• Process Hosted OnePK Applications

Cisco supports multiple service container environments

• LXC – Linux Containers

• KVM/QEMU - Hypervisor

Container

Network OS

Virtual Service

Service Containers


Example: Nexus NXOS Guest Shell

GUEST SHELL

Open Source

Packages

(Optional)

Apps

Apps

NXOS CLI

onePK

Cisco

Libraries

(Optional)

Python

enabled root

filesystem

Secure Linux Container (sLXC)

Python

System APIs

Nexus

DevOps

Open SourceTools, utilities, applications

3rd Party

Apps

Cisco

RepositoryDevNet

bootflash

Apps

NXOS CLI interface• Access the Guest Shell from

NXOS CLI

• Access NXOS CLI from within the

Guest Shell

onePK APIs• Access to a rich set of NXOS APIs

for interface to management and

datapath functions.

Python System APIs• BCM shell ?

• What else?

bootflash• Read/write access to the NXOS

bootflash.

Guest Shell is an embedded Linux

environment that allows customers (DevOps)

to develop and run custom applications for

automated control and management of the

Nexus family of datacenter switches.

Guest Shell is

automatically enabled.

Zero-touch.

64bit application

environment

Guest Shell ships with

python support enabled.

C and Java support can

be added through YUM

installs.

Upgradeable rootfs

packages

Built on Secure LXC.

231


Physical Containers – UCS E-Series S

ca

lab

ility

Feature Richness

Cisco UCS-E140S

• Service Module

• Vmware, Hyper-V,

Citrix Certified

• Intel E3 4 Core

Processor

• vWLC, vWAAS,

Physical Security

Cisco UCS-E180D

• Service Module

• Vmware, Hyper-V, Citrix

Certified

• Intel E5 8 Core Processor

• vWLC, vWAAS, Virtual

Desktops, Physical

Security, Security

applications

Cisco UCS-E160D

• Service Module

• Vmware, Hyper-V, Citrix

Certified

• Intel E5 6 Core

Processor

• vWLC, vWAAS, Virtual

Desktops, Physical

Security

Cisco UCS-EN120S

• Service Module

• VMware and

Hyper-V Certified

• Network Compute

Applications –

vWLC, vWAAS

28


NIM-SSD:

• 1 or 2 hot-swappable 200GB SSD drives

• 100GB and 400GB options in the future

NIM-HDD:

• 1 hot-swappable 500GB or 1TB drive

• Available as soon as a container supports it

SSD-MSATA-200G:

• Doesn’t consume a NIM slot!

• Embedded 200GB SSD storage

• Not available on 4431 & 4451

ISR 4400 Series Storage Options

29


VM 1 VM 2 VM 3WAAS Energywise Future App

Service Containers

Dedicated virtualized compute

resources

CPU, disk, memory

for each service

Easily repurpose resources

Industry-standard hypervisor

Benefits

Better performing network services

Ease of deployment with zero

footprint; no truck roll

Greater security through fault isolation

High reliability

Flexibility to upgrade network services

independent of router IOS® Software

Virtual Containers – ISR 4400 Series

30


Virtual Containers – ISR 4400 Series

Third Party Service Containers

• Partners and other 3rd parties can now write apps hosted on an ISR4K!

• Digital signing is REQUIRED so they must be approved by Cisco (ISR Team).

• Development tools are still rough so we’re partnering very closely with the first few.

• Also soliciting ideas for general-purpose common tools in a container.

31

Combining Things

Some more Real-Life Examples4


Example: Emergency Response Network

Problem: How to deliver secure, trusted, robust, cost-effective broadband connectivity to mobile emergency response units?

Solution: Use Network Programming based on Cisco onePK and Cisco IOS Embedded Event Manager to integrate low-cost, high-bandwidth options with accredited legacy radio connectivity:

Cisco ISR/M2M 819

WiFi

1

1. Connect high-bandwidth forward clients via WiFi

EEM

2

2. Use Cisco IOS EEM for onboard system integration and adaptation

Cisco ISR 29xx

PMR Network

3

3. Use Cisco onePK to redirect IKE key exchange out-of-band via legacy radio

Ka Band4

4. Secure IPSec tunnel via cost-effective high bandwidth Ka Band

5. Reliable, secure emergency response network saving ~4M€operating cost annually

Real-World Example

37


Maximize Utilization of Dynamic Bandwidth

Real-World Example

Problem: Bandwidth depends on ground weather and space weather, accurate short-term forecasts. How to optimize QoS configuration for dynamically changing bandwidth of satellite links?

Solution: Dynamically adjust ground station router config to maximize bandwidth

A B

Weather

A

Weather

B

Space

Weather

1. Acquire and Normalize Space Weather and Weather Conditions

Optimizer App

2. Calculate optimal topology and configuration for upcoming period

3. Derive required configuration changes

4. Inject incremental changes and harvest required metrics

5. Repeat

38

“Computer programming is an art,

because it applies accumulated knowledge to the world,

because it requires skill and ingenuity,

and especially because it produces objects of beauty.”

Donald Ervin Knuth, 1974(Computer Scientist, Author of “The Art of Computer Programming”)

How to Architect a Fast and Bimodal IT ?

SDN-Inspired Application-Centric Architecture5


Application Economy and Software-Defined


Programmatic OperationsApplications

Self-* and New Applications

SaaS and Software Driven

Integration

Context Awareness

Operations, Business Intelligence

Application-Centric Infrastructure

Embedded AutomationVisibility and ControlIntelligence, Manageability

Controller Layer

Controllers, Analytics, PolicyManagement and Orchestration

ServicesOrchestration

Analytics

Applications

Network

Harvest Network

Intelligence

Program for Optimized

Experience

38


Evolving Interactions / Bimodal ITApplications

Self-* and New Applications

SaaS and Software Driven

Integration

Context Awareness

Operations, Business Intelligence

Application-Centric Infrastructure

Embedded AutomationVisibility and ControlIntelligence, Manageability

Controller Layer

Controllers, Analytics, PolicyManagement and Orchestration


Virtual / Overlay Networks

ICT G

overn

ance a

nd O

pera

tions

Network

Domain Controllers

Applications and Users

a

1

use

2

use

4

interact

5

interact

3

interact

ma

na

ge

b

c

d control e

39


Network-aware

Applications

Cisco Unified Framework

Cisco Enterprise ACI

Programmable

Network Layer



Controller Layer

(Orchestration + Analytics)

Device Interfaces and Agents – (onePK, OpenFlow, OpenStack, I2RS, …)


Users and Applications – across Business Domains and Segments

ICT

Go

ve

rna

nce a

nd O

pe

ratio

ns

Service Abstraction Layer, Common Policy ModelCLI

SNMP …

IdentityLocationDevice TypeDevice Posture

SLAQoS

SecurityLoad Balancing

Application Enablement Platform

Application Centric Infrastructure

Applications Applications Applications Applications

40

What can a Controller do for me?6


Controller Layer

Programmable

Network Layer



Controller Layer

(Orchestration + Analytics)Service Abstraction Layer

Controller Core

Controller Advanced Functionality

Application Interfaces – (OSGi, REST, …)

Device Interfaces and Agents – (onePK, OpenFlow, OpenStack, I2RS, …)


CLI SNMP …

42


Controller Layer – OpenDaylight

Programmable

Network Layer

Network


Controller Layer

(Orchestration + Analytics)Service Abstraction Layer

Controller Core

Application Interfaces – (OSGi, REST, …)

CLI SNMP …


Controller Applications

Authentication Troubleshooting

Flow Manager TIF Slice Manager

43


Common Policy Namespace Across Domains

Programmable

Network Layer

Controller Layer


App

ProfileUser

Profile

ISE

DATA CENTER ACCESSWANCLOUD

44


Controller Layer – APIC Enterprise Module

Programmable

Network Layer

Network


Controller Layer


Service Abstraction Layer

Controller Core


Application Interfaces – (REST, …)

CLI SNMP …

Cisco Applications based on APIC-EM

Plug-N-PlayQoS

Automation

Path Visualization

and Inventory

… … ...QoSACL

Security Automation

IWAN Automation

45

Getting Started with Northbound Interfaces

APIC-EM REST API – I7


APIC-EM Northbound REST APIProblem: How to get started with a Controller API?

Solution: Explore

Example:

1) In the APIC-EM User Interface,click on [API]

2) Navigate to the desired APIin our example:/network-device/count

47


APIC-EM Northbound REST API

Problem: How to get started with a Controller API?

Solution: Explore

Example:


2) Navigate to the desired APIin our example:/network-device/count

3) Note Request URLhttps://<APIC-EM IP>/api/v0/ +

/network-device/count

4) Prototype in Chrome/Postman

5) Code in your App (Python, Java, …)

48


APIC-EM in DevNet Sandbox

Login at developer.cisco.comhttps://developer.cisco.com/site/apic-em/

(note: password may not be synchronized with the rest of cisco.com)

Navigate to Sandbox

49


APIC-EM in dCloud

• Cloud-based Demos(and Learning)

• Scheduled or on-demand

• Customize and Save your own

• Login to:http://dcloud.cisco.com

50

http://dcloud.cisco.com/


APIC-EM in dCloud – REST API Tasks

55

Scenario 1 – Using Python / PyCharm

• List Device Inventory

• Create ACL Policy

• Delete ACL Policy

Scenario 2 – Using Postman / Chrome

• Count Number of Devices in Inventory

A closer Look at Northbound API

APIC-EM REST API – II8


APIC-EM – Topology APIProblem: How to interact with Device and Topology data via the REST API?

Solution: Let’s Explore

Example:


2) Drill down to Topology

3) Let’s look at L3 Routing Topology …

53


APIC-EM – Topology API4) Try it out:

5) The Response Body includes …

… Nodes …

http://<APIC-EM IP>/api/v0/topology/ospf

{ "response": {

"nodes": [

{ "deviceType": "ROUTER",

"label": "SDN-BRANCH-ISR4451",

"id": "2504be29-7684-43ae-8417-a75ca618287c",

"x": 182,

"y": 43,

"ip": "40.0.2.2",

"softwareVersion": "03.11.00.S",

"osType": "isr4400-universalk9.03.**.bin",

"fixed": true,

"role": "Border Router",

"nodeType": "device",

"deviceRoleOrigin": "auto",

"aclApplied": true,

"family": "ISR4451-X/K9"

},

:

:

:

{ "deviceType": "WIRED",

"label": "40.0.5.12",

"id": "8f41bef8-698c-4701-af14-471e910ed9ff",

"x": 200,

"y": 108,

"ip": "40.0.5.12",

"fixed": true,

"role": "host",

"greyOut": true,

"nodeType": "host"

},

:

:

{ "deviceType": "SWITCH",

"label": "SDN-CAMPUS-C4K",

"id": "e5f93514-3ae5-4109-8b52-b9fa876e1eae",

"x": 40,

"y": 108,

"ip": "40.0.1.30",

"softwareVersion": "03.03.02.SG",

"fixed": true,

"role": "Distribution",

"nodeType": "device",

"deviceRoleOrigin": "auto",

"aclApplied": true,

"family": "C4507R"

},

:

54


APIC-EM – Topology API

… Links …"links": [ {

"id": "4bde281e-e079-40ca-9427-647bb360a429",

"source": "a632c6e8-89bf-4949-8e4d-a249105f2c7c",

"startPortID": "d3054716-73ed-4a6c-89c9-095ebe7f3445",

"target": "526c8fc6-f732-41a9-9faf-5876293a2e8c",

"endPortID": "2fdb927f-a5a7-47b2-bbed-8499c1c12105"

},

:

Source Node ID

Target Node ID

… and Node Sets for arbitrary grouping

"nodeSet": [ {

"name": "access-SDN-BRANCH-3750-STACK",

"id": "SET-7895a45f-47aa-42ee-9d06-c66d3b784594",

"type": "access",

"root": "7895a45f-47aa-42ee-9d06-c66d3b784594",

"nodes": [

"8f41bef8-698c-4701-af14-471e910ed9ff",

"c40e4287-4263-498a-852b-8944e089d427",

"7895a45f-47aa-42ee-9d06-c66d3b784594" ],

:

},

:

55

Signaling per-Application, per-Session QoS

APIC-EM and Dynamic QoS Policies9


Signaling per-Application, per-Session QoS

Problem: What if an Application requires a specific QoS policy to be applied for the duration of a Transaction or Session ?

Solution: Provide an API for Applications to request predefined Policies

Example:

1) Operator defines and approvesrelevant Policies

2) Application requests Policies upon Session Start and Signals Session End to Controller-based App

3) App and APIC-EM validate, deploy, report the dynamic change


Network

APIC-EM QoS and ACL Apps

Applications

Application Interfaces – (REST)

reportdeploy

NOC Operators

responserequest managedefine

57


Example: Dynamic Policy for Jabber Video/Voice


Network

APIC-EM QoS and ACL Apps

Cisco UC Manager


report3) deploy

NOC Operators

response2) request managedefine

Jabber Client BJabber Client A

1) Client A initiates Call to Client B

1)

2) CUCM Requests predefined Policy via APIC-EM REST API

3) APIC-EM QoS and ACL Apps validateand deploy into the Network via APIC-EM

4) Call Ends

5) CUCM Signals to APIC-EM

6) APIC-EM Apps remove Policy from Network

http://<APIC-EM IP>/api/v0/policy POST

{ "policyName": "voice:audio:10.1.1.7",

"policyOwner": "Admin",

"networkUser":{

"userIdentifiers":["10.1.1.7"],

"applications":["20324,20324,UDP"]},

"actionProperty": {"priorityLevel": "46"},

"actions": ["PERMIT"]

}

58

NOT Provisioning Static Infrastructure

A Real Life Example10


NOT Provisioning Static Infrastructure

Problem: How to deliver Application Transactions – dynamic, deterministic, in compliance with business rules, fully audited and without exposing resources during idle times?

1. Define relevant IT Resources

2. Define Business Transactions“Process this swap option trade”

3. Triggers and Parameters“Jurisdiction, Priority, Cost, Policy, …”

4. Dynamic Allocation and Auditing

5. Repeat Sequence

Solution: Per Transaction sequential allocation of Compute, Storage, Network resources across DC, Cloud and Premise.

Applications

60

Visibility into Remotes Sites and Tenants

Virtual Network Analysis Module (vNAM) – I11


Link Application Visibility to Network ControlApply Control/Configuration Changes to improve Application Performance and Availability

Hosted Workload for Tenant

Application Services

CSR

Tenant-AApplication Services

Cisco

Daylight(XNC)

PROGRAMMABILE

Traffic SteeringPath Setup

Traffic Engineering

• Apply Service Policies (Police, Mark,

Shape, Queue) for reprioritization

• Implement custom routing optimized for

specific application topology

• Set ACLs to establish the access rules

Service Assurance Actions (Examples)

Network Application

REST/XML

API

Problem: How to dynamically provide application visibility into remote sites or per virtualized tenant?

Virtual NAM

Solution: Deploy vNAM into the virtual workload POD

62


Branch

ISR

Large

Remote

Site

ISR

Branch

ISR

Data Center

ASR

Cisco Prime Virtual NAM (vNAM)

INTERNET/ WAN

Application

Servers

Virtual NAM

Virtual NAM

APPLICATION AWARENESS DEEPER NETWORK ANALYTICS DEPLOYMENT AGILITY

Extends Application Intelligence to the Virtual Infrastructure

• Deployed on any x86 platform

• Supported in ESXi and KVM environments

• Performance-Based License

NAM-VX10: Up to 150 MbpsNAM-VX20 (ESXi only): Up to 1Gbps

Deploy vNAM Anywhere in the Network

• Multitenant Clouds

• Remote Sites

• Wireless/Wired Access

63


Cisco Prime Virtual NAM (vNAM) – Data Sources

• SPAN

• ERSPAN

• RSPAN

• VACL

• NetFlow

• Promiscuous Mode (ESXi)

Virtual NAM

64

Trigger and Extract Data from NAM

Virtual Network Analysis Module (vNAM) – II 12


Cisco Prime Virtual NAM (vNAM) – API Coverage

API CategoryCRUD Operation Support

POST GET PUT DELETE

Authentication / Single Sign On

Site √ √ √ √

Data Source √

Application / Application Group √ √ √ √

Action √ √ √ √

Threshold √ √ √ √

Packet Capture √ √ √ √

WAAS Monitoring √ √ √

System Info √

Data Extraction √ (XML)

From NAM 6.1 key capabilities offer REST API support

66


Cisco Prime Virtual NAM (vNAM) – API Examples

See http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/network_analysis_module_software/6-1/developer/guide/nam-rest-api-guide-12.pdf

Example: Define Thresholds and Actions

<alarmAction>

<name>This Action Triggers Everything</name>

<email>enabled</email>

<trap>

<community>public</community>

</trap>

<triggerCapture>

<session>4</session>

<action>start</action>

</triggerCapture>

<syslog>enabled</syslog>

</alarmAction>

1) Configure an Alarm Action(and capture Action ID from Response)

<query-data>

<query>

SELECT

clientSite,

SUM (numRsps),

SUM (sumRspTime)/SUM (numRsps),

SUM (numTrans),

SUM (sumTransTime)/SUM (numTrans),

SUM (numRTT),

SUM (sumRTT)/SUM (numRTT)

FROM ARTSiteClt

WHERE

TIME >= <START-TIME> AND

TIME <=<END-TIME> AND

appId= <APP-ID> AND

client=10.1.1.1

GROUP BY clientSite

</query>

</query-data>

Example: Export Performance Data

Extract application response time data (Average round trip time, Average transaction time,Average Server Response Time) for application=<APP-ID> for Client=10.1.1.1

<iapThreshold>

<name>My Threshold</name>

<severity>High</severity>

<risingAction>7</risingAction>

<fallingAction>7</fallingAction>

:

<iapMetrics>

.. Criteria specific to Type ..

</iapMetrics>

</iapThreshold>

2) Configure Threshold to trigger Action(URI specifies Threshold <type> )

67

http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/network_analysis_module_software/6-1/developer/guide/nam-rest-api-guide-12.pdf


Cisco Prime Virtual NAM (vNAM) – API Examples

72

Field Name Description Data Type Maximum Size

serverSite ID of the site associated with the server integer 4 bytes

server IPv4/IPv6 address of the server string variable

clientSite ID of the site associated with the client integer 4 bytes

client IPv4/IPv6 address of the client integer variable

appId Application ID integer 4 bytes

dataSource ID of the data source where this traffic was monitored integer 4 bytes

dcsp DSCP value observed in the traffic integer 4 bytes

encapLayer1 Description of first encapsulation layer observed in the traffic, if any string variable

encapLayer2 Description of second encapsulation layer observed in the traffic, if any string variable

encapLayer3 Description of third encapsulation layer observed in the traffic, if any string variable

serverPort TCP port number used by the server integer 8 bytes

numRsps Total number of responses during the interval integer 8 bytes

lateRsps Number of responses with a response time that was greater than all pre-defined ranges integer 8 bytes

sumRspTime Sum of all response times observed at the NAM location during the interval integer 8 bytes

maxRspTime Maximum single response time times observed at the NAM location during the interval integer 4 bytes

minRspTime Minimum single response time times observed at the NAM location during the interval integer 8 bytes

: : : :

Application Performance Client-Server Data Schema (subset)

See http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/network_analysis_module_software/6-1/developer/guide/nam-rest-api-guide-12.pdf

http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/network_analysis_module_software/6-1/developer/guide/nam-rest-api-guide-12.pdf

Finding Needles in multiple transient Haystacks

Distributed Network Analytics (DNA)13


Finding Needles in multiple transient Haystacks

Problem: Sometimes we now exactly what we are looking for – but don’t know when and where it might appear. If the source data set is transient, highly distributed and large, central aggregation and post-processing are not an option …

Network Telemetry Data

Solution: Distribute the Query and Data Reduction rather than centralizing the Data

Distributed Network Analytics (DNA)embeds

Big Data Smarts (Map/Reduce)into the

Network to enable

Analytics at the EdgeNetwork Device OS

LXC Container

DNA Agent

DNA Control App

Applications


report, discover, monitor

deploy

NOC Operators

70



DNA Agent

DNA Control App

Applications NOC Operators

Distributed Network Analytics (DNA)

Network Analytics Task

Requested by an Application or Operatorof the DNA Control App

“Where’s my IP Traffic (from 10.1.2.0)?“

DNA Maplet

Delegated by the Controllerto the DNA Agents• Configure data source

• Aggregate Query

• Decompose Results

DNA Reducelet

Performed by the DNA Controlleron incoming Maplet Results

(1) Request task

(2) Resolve task,

determine maplets

(3) Deploy maplets

(4) DNA CAC

(5) Data producer setup

(6) Query engine setup

(7) ack

(8) Task status maint.

(9) Data stream start

(10) Aggregation

(11) Report results

(ongoing/one-time)

(12) Result aggregation

{reducelet processing}

(13) Report results

(14) Auto-cleanup

if not refreshed

71


Configuration of a DNA

Network Analytics Task

Templates are “precanned”

queries supplied by the controller

Parameters, help texts rendered

by data-driven GUI

Define Network Scope by policy:

draw, device type, tags, import

previous scopes, …

72


Visualization of Analytics Results

• “Watch” any given task

• GUI displays scope and status

of the query

• Timeline visualizes when

network identifies analytics

matches on “event timeline”

• Zoom into analytics records

• Provide analytics task status

“on demand”


Distributed Network Analytics (DNA) – API Example

Applications can inject Queries and retrieve Results via the RESTCONF API

Example: Find IPv4 Traffic from 101.101.1.1


Network Device OS

LXC Container

DNA Agent

DNA Control App

Applications


report, discover, monitor (IPFIX, JDBC)

Deploy (IPFIX)

NOC Operators

(RESTCONF)

<dna-data-producer>

<dna-data-producer-id> 1 </dna-data-producer-id>

<netflow>

<flow-field>

<field-name> src </field-name>

<ieName> source_ip </ieName>

<isflowkey/>

</flow-field>

<timeout-Cache>

<expTimeout> 5 </expTimeout>

</timeoutCache>

</netflow>

</dna-data-producer>

<dna-data-operator>

<op-id> 58 </op-id>

<cqe> sql blob </cqe>

<match>

<field-name> src < / …>

<comparator> equal</comparator>

<value > 101.101.1.1</value>

</match>

</data-data-operator>

74

Summary and Close


A Word of Caution

80


A Word of Caution – or Two

81


Agenda Recap

82

1 Cisco VNI and RIPE ATLAS

2 Embedded Event Manager (EEM)

3 Device-Level APIs and Containers

4 Some more Real-Life Examples

5 SDN-Inspired Application-Centric Architecture

6 What can a Controller do for me?

7 APIC-EM REST API – I

8 APIC-EM REST API – II

9 APIC-EM and Dynamic QoS Policies

10 NOT Provisioning Static Infrastructure

11 Virtual Network Analysis Module (vNAM) – I

12 Virtual Network Analysis Module (vNAM) – II

13 Distributed Network Analytics (DNA)


Cisco ACI and SDN @ CiscoLive Milan

83

• Recommended Learning Path on SDN60+ Breakouts, Tech Seminars, Labs, Panel Discussion, …

Content Catalog: http://cs.co/CLEU15-ACI

• DevNet @ CiscoLiveLearning Labs, Demo Pods,Arena Sessions, Hackathon

• World of Solutions

• Table TopicsLevel 1 North

http://cs.co/CLEU15-ACI


Cisco ACI and SDN Sessions @ CiscoLive Milan

84

Monday TECACI-2009 Application Centric Infrastructure (ACI) - The Policy Driven Data Center

Monday TECSDN-3600 APIC Enterprise Module – SDN in the Enterprise

Monday TEC-NMS-3601 Advanced Network Programming - Lab Technical Seminar

Monday TECSPG-2300 Network Function Virtualization Seminar

Monday TECRST-2611 Network Simulation: The VIRL Compendium

Monday TECMPL-3200 SDN WAN Orchestration in MPLS and Segment Routing Networks

Monday TECCRS-2003 Advanced WAN Design Topics

Over 60 Sessions on ACI and SDN ( http://cs.co/CLEU15-ACI ) :

Tech Seminars

Tuesday PNLSDN-1000Using Software-Defined Concepts and OpenDaylight-inspired Controllers to

Increase Business Agility and Competitive Differentiation

Tuesday PNLDCT-2001 Overlays in the Data Center - A Customer Perspective

Panel Discussions




85

Tuesday LABACI-2223 APIC integration with OpenStack

Tuesday LABSDN-2331 Cisco ACI hands on Lab

Tuesday LABSPG-2443 Cisco EPN Labs

Tuesday LABVIR-2446 Network Function Virtualization

Tuesday LTRDCT-1224 Implementing VXLAN in Datacenter

Wednesday LTRDCT-1224 Implementing VXLAN in Datacenter

Wednesday LABSPG-2442 NCS: Network Control System Hands-on Lab (Tail-f)

Thursday LABNMS-2001 Advanced Network Automation and Solutions using Cisco IOS EEM

Friday LABNMS-2001 Advanced Network Automation and Solutions using Cisco IOS EEM

Friday LABSDN-1335 Getting Started with OpenDaylight


Labs




86

Tuesday BRKSDN-2120 Demystifying Security in the Software Defined Era

Tuesday BRKSDN-1014 Introduction to Software-Defined Networking (SDN) and Network Programmability

Tuesday BRKRST-2015 SDN - From Concepts To Reality

Tuesday BRKRST-2121 Self Learning Networks

Tuesday BRKDCT-2131 Mobility and Virtualization in the Data Center with LISP and OTV

Tuesday BRKACI-2244 Application Virtual Switch for Application Centric Infrastructure Overview

Wednesday BRKCRS-3447 Network Function Virtualization for Enterprise Networks

Wednesday BRKNMS-3043 Performance Measurement for IP and SDN Traffic with Cisco IOS IP SLA

Wednesday BRKACI-1025 Migration from Classic Design to ACI

Wednesday BRKDCT-2367 OpenStack Deployment in the Enterprise

Wednesday BRKSPG-2515 SDN-enabled Carrier Ethernet Architectures

Wednesday BRKSDN-1200 Cisco Applications on OpenDaylight - An Introduction


Breakout Sessions – 1/4




87

Wednesday BRKACI-2678 Building Application Centric Network Containers and Service Graphs with ACI and UCSD

Wednesday BRKSPG-2516 SDN Protocols in Internet

Wednesday BRKSDN-2118 Simulating networks using Cisco Modeling Labs

Wednesday BRKGEN-2999 Introductory - Autonomic Networking

Wednesday BRKSDN-1119 Device APIs — A Guide For the Perplexed

Wednesday BRKACI-2345 ACI: What We Have Learnt from Early Deployments

Wednesday BRKIOT-2442 Enabling the Internet of Everything: Cisco’s IoT Architecture

Wednesday BRKOPT-2102 Software Innovations and Control Plane Evolution in the new SDN Transport Architectures

Wednesday BRKSDN-3014 Packet Inspection and Manipulation for Fun and Profit

Wednesday BRKSPM-2001 GiLAN and Service Chaining

Wednesday BRKACI-2333 Application Centric Networking Troubleshooting 101 - Install & Implementation of ACI

Wednesday BRKACI-1789 How to Perform Common Tasks in ACI






88

Thursday BRKNMS-3114 13 Smart Ways to Program Your Cisco IOS Network

Thursday BRKCRS-3011 APIC-EM (Application Policy Infrastructure Controller - Enterprise Module) SDN in Enterprise

Thursday BRKACI-3456 Mastering OpenStack and ACI

Thursday BRKDCT-1349 Application Traffic Visibility and Analysis with Cisco Nexus Data Broker

Thursday BRKSPG-2722 SDN deployment in ASR9000

Thursday BRKACI-2249 Future Direction of SDN and NFV

Thursday BRKDCT-2255 Infrastructure Designs for Intercloud Data Centers

Thursday BRKACI-2001 Integration and Interoperation of existing Nexus networks into an ACI architecture

Thursday BRKACI-2006 Integration of Hypervisors and L4-7 Services into an ACI Fabric

Thursday BRKSPG-2456 The True Realisation of SDN and NFV in an SP environment

Thursday BRKNMS-1036 IT Operations Management in the SDN Era – with Prime Infrastructure and APIC Controllers

Thursday BRKSPG-2520 Evolved Programmable Network for Seamless Service Transport






89

Thursday BRKSDN-2777 Network Programming and DevOps Software Development Lifecycle

Friday BRKSPG-2016 Architectures for new services over Cable

Friday BRKSPG-2517 Hosted Security as a Service Solution Architecture Design

Friday BRKACI-3344 Application Centric Networking Troubleshooting 201 – Day 2 Operations

Friday BRKARC-3467 Cisco Enterprise Silicon - Delivering Innovation for Advanced Routing and Switching

Friday BRKNMS-2445 Improve Application Delivery with Cisco AVC in the Data Center and Cloud

Friday BRKSDN-2116 Run your apps and tools natively on Cisco boxes





Call to Action

• Visit the World of Solutions for

– Cisco Campus

– Walk in Labs

– Technical Solution Clinics

• Meet the Engineer

• Lunch time Table Topics

• DevNet zone related labs and sessions

• Recommended Reading: for reading material and further resources for this session, please visit www.pearson-books.com/CLMilan2015

90

http://www.pearson-books.com/CLMilan 2015


Complete Your Online Session Evaluation

• Please complete your online sessionevaluations after each session.Complete 4 session evaluations& the Overall Conference Evaluation(available from Thursday)to receive your Cisco Live T-shirt.

• All surveys can be completed viathe Cisco Live Mobile App or theCommunication Stations

91


Network Programming and Automation

•

•

•

•

What will YOU Program ?

92

13 smart ways to program your cisco ios...

Documents