Cisco Zero Touch Provisioning & IPXE with Patrick Warichet

all right so just actually just kick off I'm pixie and then let's go over IP C and zero that provisioning it's a little bit of what I should touch based upon right the evolutions of the iOS 6 are stacks since we initiate under 6.0 which is a completely redraw of the software architecture we wanted to bring a lot of the constraint that existed before into something more so I wanted to break it down a little bit into two three three parts the first part is what we're doing right now we are I pick seeing the box we are just let it to boot which was difficult in the past you probably had to do a manual update or an upgrade from the system and then after that we wanted to enable services on the box where is deploying a docker container your own applications and and configuring services etc and then finally the monitoring of the box as soon as the box is ready instruction packets box and force you wanted to have full visibility over it you wanted to monitor and troubleshoot the box and and all of that in the past we're coming with quite a pain bringing up the first two operations of initial bring up and and service provisioning could take a long time and some time you had to resource tickle script and stuff like that to make it make it work and then analyze this to SNMP was was kind of a pain as well to map the correct nip to what exactly you wanted to monitor so coming from the web customers we wanted to adapt this to a faster speed so we are doing for the device onboarding so from the truck to the rack Poron should be done automatically no no hands on keyboard at that point and for that we set up ztp nor zero touch provisioning framework and of course i pixie so and I'm gonna go there in a few minute then after that of course as you want to deploy services and configure and manage the box we want it to be compatible with two links that exists in the data center like ansible chef pipette and also net conf applications if you want to use yang models to configure the box we wanted to bring that and then as monitoring and analyzes we wanted to have Delta as short as possible we wanted to have a push mechanism that push data as fast control playing data and data playing data as fast as we can in in a good format that is both human readable but also machine readable an attractive interpretable so this I shot will cover probably the day one and we're going to see a small demo of unstable configuration using a young model and then victory will finish with telemetry now do you guys actually have the modules developed for like ant Bowl and all that integration so we've been maintaining the ansible modules for a while the ansible core modules will be ready by around March timeframe and cool so some of them are already there but like things like the net conf modules were created by us now they will be incorporated into ansible coding for puppet and puppet and chef has just repackage dedicated for over six hours from their website we work with them to make sure that they integrate perfectly Weaver so I pick C so we we moved away from the traditional bias very two-bit to a 64-bit UEFI firmware that gave us a lot of capability right we could we can now boot from USB on Aki discs directly if you want you and we wanted to open the boot loader and in this case we we we set alone I pixie why Pixies an open-source boot where you can download it on IPTC dot o-r-g you can download ISO image you can even they even provide ROM if you want to update your own Nicks it's fully backward with pixie which is the de facto standard in that data center environment but come with a bunch of stuff that is really make it a little bit more modern than the traditional pixie that rely solely on TFTP this one use HTTP and you can control the boot process via scripts and menu so we support for example what a dynamic URL for booting so your DHCP server will give you a boot file that contain a series of variable the system knows this variable like the serial number the PID or the MAC address of the management interface will fill that up and do an HTTP GET by filling up all those variables so dynamic URL it's one cool things that you can do you can chain nodes your your boot even so you can have a master I pick C boot that you pass which is just a script actually written in a pixie scripting language which resemble to PHP and from there you can chain node so based on certain aspect so it will try to get a file that matched the serial number or its host name or eventually is PID or stuff like that and then you will collect the right image from that script and if everything fail at the end you can still bring up a menu and from there the operator can shoe select the image to wants and download it so they have a lot of enhancements bringing from the original pixie that are now available in ITC I'm going to so think about pixie boot is it was never really standardized but we emerged on something yeah so we are like if I'm deploying a data center and I've got three thousand five thousand servers pixie boot is absolutely necessary yes but I might only be installing a half a dozen NCS routers do I really need a process which is not pixie but I guess I'm struggling to understand why I would autoboot an NCS router in that sort of what's the use case for auto booting in and NCS for a limited number of volume devices the devices in Seoul and it's it's fairly simple because cattle that your the devices with each roll having a separate the classification that this process affords you you can have specific images go to specific devices which specific scripts go running on specific device yeah no I'll get that right so a lot of the classification exercise is what actually the web guys do so even if they have like ten devices they can just set it up and forget and entire bringing up of the system is centralized so forget all that I understand why I what I'm doing I don't understand why you would invest money putting this process together for what seems to be a corner condition barring at like why would I don't reboot my NCS routers this is for building others usually for provisioning and upgrades that some people use it so I mentioned about the truck to roll out times particularly change in the yes that's shortened to around 15 minutes for a lot of these guys so they get it off the truck get it into the system and no one logs in yep right you know you need that to be automated which means that the process of image download exit color doesn't come with an image as well as the config or script needs to be automated right so so the reason they're doing that is they don't want to make one make any mistakes and do the entire process of manual intervention is no no and that's one aspect the truck rule of the other aspect is also upgrades so a lot of folks do not like the idea of trying to upgrade a running box by making sure that they backup everything from the system so by creating a centralized system beforehand yes when you do the upgrade the next time all they do is exactly just to read it it'll come back there's only one process for bringing up a router and it's a rebuild and a wife a wife a reboot and restart so in fact the upgrade use cases what we've seen some of the tradition last year service providers moving to know ya they realize that it allows them to centralize their state of they only have to develop one word for multiples right like a reset like rebuild an environment you could trigger it I didn't mean to derail you I was just struggling what's the value of this to me as a client it has an additional value that I'm gonna get to the next slide or a few slides down the road so I tweaked so or or distributions right now Phi or 6r is in form of an eyesore yeah and it contains a mini or all the necessary component all it the mini ice or because it contains no package is a process to use you still have to install your SPF your ice is your canine package if you wanna triple their security accessibility package etc but what you can do when you can actually take that I saw image and we provided a tool that I'm going to talk about and then pack all the packages you want your configuration on top and reform the eyes'll and that's the ice so it the box can can come up pre-configure from the get-go and using I pixie you can for example correlate that to its serial number there any plans to standardize this across Cisco more widely the challenge we have with Cisco is just because iOS XR is doing this we have to learn this is a special banana case for you guys but not with XE or iOS or you know since there's lack of standardization on these features becomes a real issue in the field because we don't know which and where's and where you've got POA P running on Nexus I don't make so s1 into gtp yes right but it'll be lovely if I could have one system that we could put in for whatever this is yeah like this idea like you know I could treat all of my network switches in my data center this way like I should be able to do this to my Nexus it instead of upgrading them I should be able to just IP XE them and load a new image right yeah if you do a hard way I'll be replacement DTP is phenomenal yes plug it in and it just comes up be a lot more likely to its box if you hope also within the industry so the industry has had only for a while which is an equivalent forum but at least the way these systems are designed is that there is no cisco sauce here yeah there is yes a library to configure exert which is always going to be specific to exert however the initial process of exchange with the DHCP server etcetera it mimics the only workflow pretty much right so it is so why not just use Ernie back well we could but no pixie in itself is also a standard within the industry right so they're they're both standard used by different folks for different purposes it is the server line uses pixie yes by giving I pixie on these boxes it gets you one book through four servers anyways at this point yeah it's supported before in my six so then the next the next part of it is zero touch or zero touch provisioning framework so it is actually kicked at the end of the boot process it's kicked by XR itself but it executed inside the linux shell so that's important and it's executed automatically if the box has no configuration whatsoever we actually have a check for that and then it's automatic you can invoke it by hand at the CLI if you already get your hand you the first thing that actually in iOS 6 saw our box ask you when you boot up fresh is a username and a password to configure a username and a password and give you the problems so that's the first thing you check is there a username configure there is non ztp kicks in now if you already logged in you we have a set of CLI that you can invoke GTB manually we call it one provision at that point and you can do that as well so it rely on DHCP we provide tons of options in the DHCP actually it's very rich DHCP environment we provide the serial number the PID we provide the release hardware release version the MAC address of the management etc are actually provided in the options and what we expect from the DHCP server is option 67 boot file name it can be in 54 it can be in ipv6 and then from there we can kick start the script so the scripts themselves they can be in bash or Titan we support both at this point if you run shell script you have access to the full Linux environment of the container or the control plane container the XR container if you run Titan we provide you around 54 package available including URL Lib for example if you want to use libraries to configure your systems if you want to do I should be get within your script you can do that as well we have curl we have arc set you name it and grab all of that is already pole always available or you have a pipe an equivalent Python library for it now we also provide you a sets of helper functions if it's if it's a script it's you have the source and that helper function if it's a Python you have to embed the library you have to include the library and that gives you access to the xor configuration right and yeah so this okay I remove that set sorry for that so and and what what is it gonna really do is give you capability to visualize output or or to configure things so what are the ztp function and that point you can do pretty much everything with it you can apply a configuration if you want you can perform software update or great in install packages or applications you can deploy container and actually will show will showcase a demo on on that and and you can execute Python and shell scripts so this is a little bit of the workflow I don't want to spend too much time on this but there's a series of verifications that are occurring what is really interesting is that it use actually the same flow as I pick C so we use an option 77 in the DHCP to differentiate between the two phases because they come from different clients the DHCP clients of I Pixies are not the same as the one has gtp so we basically give the DHCP server options 77 we mention we are in config mode at that point and then the DHCP server with a simple if statement you can actually decide to provide you the file rather than an ISO and actually if it's badly configured we have a check there the file is bigger than 100 Meg yes something got wrong and we cut it off right there no if you just want to apply a static configuration from the get-go you're allowed to do that you just provide just a configuration in case of a script and then that's applied it goes through the parser so verify for syntax error and commit error then it's applied if there is an error that is non-blocking it will spit out a syslog saying okay for example interface this interface does not exist in the system you wanted to put an IP address in your configuration I cannot do that I spit an error lock but I apply the rest right if it's a script then is going to start executing the script within the linux shell environment and then it has access through or TPN s infrastructure to all the interfaces like extra just showed you and then you can download whatever you wants right from there it can download additional script and download packages can deploy containers and you can also apply configuration to that when you're executing the script it's running in the content and well in the user space for X or bash and the primary requirement there is that applications are able to use the user space to do whatever they want I mentioned that earlier the script is basically nothing but an application right so it is downloaded and whatever you want to do in the script you're allowed to do it you're basically routed your route you route at that point yeah I do you guys do you have terraform integration as well oh well not yet not yet but we've been juicing all right so that just a few example of what's in the helper function this is for the shell you have access to XR command that's just a way to do a command like show running config or show interface brief if you want you can do XR apply and if you do an extra apply that will merge a configuration block provided in a in a specific file inside the system you do replace XR replace that will actually replace a complete configuration block with the one you're providing and then this - you can do with XR applying with reason that's basically putting in the configuration log an event that you specify you say for example ztp has done this and you can track that in the log you can also do XR apply string where inside your script you just pass the command straight inside and of course you can do it and also syslog it into the common configuration history of iOS 6 our same thing with the Python library is exactly the same command there is nothing difference here so whatever you choose to write your zero touch provisioning script in shell or in Python you have access to the same primitive function to access iOS XR right so that was the question are coming from I pick C when I presented I pick C if you look at the deployment process with a traditional stock image and then from from running it's actually still a serial is a serial process right you boot your ISO you install your package your smooth for iOS 6i which has basically bug-fix then finally when you system if it needs to reboot at the end you have to reboot and then you apply the configuration if you have to if your package or smooth don't require reboot you can skip that test but you basically go sequentially now you can do that in parallel and in parallel we provide insight actually and on github we provide heightened application we called the golden eyes or builder and with that outside the box on any Linux systems you you just set up requirement you have to have a set of package installed prior to that you can open the ISIL then pre-install or your smooth and packages or your third-party applications if you have to apply a configuration candidate and then repackage it inside the ISO so and then you can deploy that image that is not tailored for your specific need whether package you wanted to have canine you want to have OSPF and is is you can just put that and now you deploy that just as a single package to the system through I pick see your system come up pre-configured already you can do that through USB as well or you can do a system upgrades if you want to so the important thing is because this golden ISO process still keep the signature of all the packages intact whereas if you do it without this application you may corrupt the signature of the ISO and the system will refuse to boot also EP is essentially a technology that come from the data center because it rely on DHCP we are actually looking towards a different type of environment to deploy this and we already are able to perform in a layer tree ring we support on the HTTP proxy and and DHCP snooping for example things like that we are looking towards layer to ring within integrations of dynamic villain discovery where the the ztp script will tack the traffic with the correct VLAN by dynamically discovered the VLAN of the neighbor so we have this capability as well and that's coming up in the in in in a few months with the next release major release alright so we have this heavily documented inside or XR Doc's websites I it's a good source of information there's tons of example of scripts in shell or in Titan that do different things actually I think this presentation will be published there I wrote quite a few Akshat will wrote quite a few as well so I if you want to have no more feel free to go to those links for your reference

Channel: Tech Field Day

Views: 3,672

Keywords: Tech Field Day, TFD, Networking Field Day, NFD, Networking Field Day 17, NFD17, Cisco, IOS XR, Zero-Touch Provisioning, DevOps, Streaming Telemetry, Model-Driven Telemetry, Application Hosting, Patrick Warichet

Id: XdTGv3iKr9M

Length: 23min 7sec (1387 seconds)

Published: Wed Jan 31 2018