Application Hosting in IOS-XE

Transcription

1

2 DEVNET-1695 Application Hosting in IOS-XE Bryan Byrne, CCIE (R/S) Technical Solutions Architect Enterprise

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#devnet Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Introduction Enabling Guest Shell Accessing Guest Shell Installing and Running Applications Wrap Up

5 How Did I Get Here? It Started with a Simple Question: Any interest in talking about application hosting on IOS-XE at Cisco Live? DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 5

6 Why would I run apps in the network?

7 Current Application Challenges Not enough network bandwidth Most of the data is not interesting The use of data may be at the edge Computation can be optimized for some purposes Data normalization Data redirection based on the content of the data Data time stamping, algorithmic ownership Data Reduction Filtering Latency Optimization Partitioning Application Simplification Dynamic Changes Analytic Support DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 Empowering the Edge Leverage the Network! Existing hardware footprint No need for separate compute machinery IoT Applications Management Business Applications Analytic Systems Billing Integrated security Reduced latency & bandwidth cost DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 Network Application Hosting Spectrum Script Hosting Utility Hosting Containers Small VM Full Compute Python Access platform details Integrate with events Linux utilities RPMs Application Code + Dependencies LXC and Docker support Complete control Limited resource needs Linux KVM Significant resource needs Bare-metal or Hypervisor DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 9

10 Network Application Hosting Spectrum Script Hosting Python Access platform details Integrate with events Guest Shell Utility Hosting Linux utilities RPMs Containers Application Code + Dependencies LXC and Docker support Cisco IOx Small VM Complete control Limited resource needs Linux KVM Full Compute Significant resource needs UCS Bare-metal or Hypervisor Express DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 10

11 What is Cisco IOx? Host applications and services at the network edge across different hardware platforms A compute platform, application framework, and software development kit Manage life cycle aspects of applications Cisco IOx Application Linux + + Cisco IOS DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 11

12 What is Cisco UCS Express Cisco UCS Blade server installed and running in router/switch Bare-metal or hypervisor operating systems supported Independent server management (from network) DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 12

13 What is Guest Shell and Why do I care?

14 What is the Guest Shell? 64-bit Linux environment running on IOS XE and NX-OS platforms Install, update, and operate 3rd party Linux apps (e.g. Puppet, Chef, Splunk) Bundled with Python Intended for agent or script hosting Guest Shell Linux applications Open Application Container API Network OS DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 14

15 What is the Guest Shell? Maintain host system integrity Isolated user space Fault isolation Resource isolation Access to bootflash On-box rapid prototyping Integrate into existing Linux workflows Guest Shell Linux applications Open Application Container API Network OS DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Cisco Guest Shell Capabilities Guest Shell 1.0 (Lite) Guest Shell 1.0 Guest Shell 2.1 Operating System IOS-XE a IOS-XE 16.5 NX-OS 7.x Platforms CAT 3650, CAT3850 CAT 9000, ISR 4000 Nexus 3000, 9000 Guest Shell Environment MontaVista CGE7 CentOS 7 CentOS 7 Python 2.7 Python 3.0 Python GNU C Compiler RPM Install OVA Enable/Upgrade User Defined Resources DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 ISR 4000 Guest Shell Support ISR 4221 ISR 4321 ISR 4331 ISR 4351 ISR 4431 ISR 4451 Default/Max DRAM 4 GB 4 GB / 8 GB 4 GB / 16 GB 4 GB / 16 GB 4 GB / 16 GB 4 GB / 16 GB Guest Shell Support Memory Requirements: Guest Shell requires 8GB of DRAM Other Limitations: KVM and Guest Shell containers cannot co-exist DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 17

18 Enabling the Guest Shell

19 Enabling Guest Shell Task Overview Enable IOX on the device IOX is the manager that handles guest shell and other 3 rd party applications in IOS-XE Configure the Virtual Port Group and NAT Statements The Virtual Port Group is the interface the device uses to communicate with guest shell The device provides access to off-box resources through a NAT Enable and log into the guest shell DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Step 1: Enabling IOX DEVNET-1695#conf t DEVNET-1695(config)#iox DEVNET-1695(config)#exit DEVNET-1695#show iox-service Machine types supported Machine types disabled : LXC : KVM IOx Infrastructure Summary: IOx service (CAF) : Running IOx service (HA) : Not Running IOx service (IOxman) : Running Libvirtd : Running IOx is the manager handling application hosting in IOS-XE Guest Shell is just one use of IOx Notes: The IOx service can take up to 3 minutes to start The IOx service (HA) may not run DEVNET-1695# DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 20

21 Step 2: Create the Virtual Port Group conf t Configuration only valid on routing platforms interface VirtualPortGroup 0 ip add no shut exit Used to provide network connectivity to the Guest Shell On switching platforms Guest Shell connectivity is bridged from the Mgmt port DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 Step 3: Create NAT Entry conf t interface VirtualPortGroup0 ip nat inside! Interface connected to local network interface GigabitEthernet1 ip nat outside ip access-list standard NAT_ACL permit ip nat inside source list NAT_ACL \* interface GigabitEthernet1 overload Configuration only valid on routing platforms Used to NAT traffic from Guest Shell off box Example: to access Internet resources (ex.: code repository) Inbound access to the Guest Shell requires additional NAT configuration Alternative to using NAT is to advertise the Virtual-Port Group into the routing domain DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 Step 4a: Enable the Guest Shell! Entered from Enable Mode! Command is entered on a single line guestshell enable VirtualPortGroup 0 guest-ip show app-hosting list App id State guestshell RUNNING Virtual-Port Group and IP address only needed on routing platforms Guest Shell session management guestshell disable Removes access and kills the current session Files and data are preserved guestshell destroy Deletes the guestshell file system All data is lost Additional command argument for adding name server to the Guest Shell Does not address environments with proxy-servers DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 Accessing the Guest Shell Environment

25 Running Linux Commands Directly from IOS CLI DEVNET-1695#guestshell run pwd /home/guestshell DEVNET-1695#guestshell run sudo ifconfig eth0 eth0: flags=4163<up,broadcast,running,multicast> mtu 1500 inet netmask broadcast inet6 fe80::5054:ddff:fee9:598e prefixlen 64 scopeid 0x20<link> ether 52:54:dd:e9:59:8e txqueuelen 1000 (Ethernet) RX packets 8 bytes 648 (648.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8 bytes 648 (648.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 Linux commands are run by issuing guestshell run before shell command Valid for any binary under /bin and /sbin DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 26

26 Direct Access to the Guest Shell DEVNET-1695#guestshell run bash ~]$ pwd /home/guestshell DEVNET-1695#vi.bashrc Log into the Guest Shell by running guestshell run bash Environment variables can be customzed by editing.bashrc or.bash_profile if [ -f /etc/bashrc ]; then. /etc/bashrc fi echo "Welcome to DEVNET-1695" DEVNET-1695#guestshell run bash Welcome to DEVNET-1695 DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 27

27 Setting Up Name Resolution ~]$ cat /etc/resolv.conf nameserver ~]$ ping pool.ntp.org PING pool.ntp.org ( ) 56(84) bytes of data. 64 bytes from acheron.bitsrc.net ( ): icmp_seq=1 ttl=62 time=111 ms DNS can be pushed into the Guest Shell as part of the guestshell enable command. Does not add the DNS server to Note: Guestshell in NX-OS must explicitly configure within /etc/resolv.com If the network requires proxy it must be manually configured in the /etc/resolv.conf file DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 28

28 Accessing the CLI from the Guest Shell dohost command built into Guest Shell Send commands directly to the router Limited to exec privilege commands. No access to config mode. ~]$ dohost 'show ip int bri' Interface IP-Address OK? Method Status Protocol GigabitEthernet YES DHCP up up GigabitEthernet2 unassigned YES unset administratively down down GigabitEthernet3 unassigned YES unset administratively down down VirtualPortGroup YES manual up up ~]$ dohost 'show log inc DHCP' *Jul 27 18:51:09.796: %DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet1 assigned DHCP address , mask , hostname iosxe1 DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 29

29 Install and Run Applications

30 Installing Applications within Guest Shell YUM Package manager for Linux systems. Install, update and remove applications repos or file repositories Git Installed via yum Access code from GitHub and other repositories Useful for distribution of custom applications. ~]$ sudo yum install git Loaded plugins: fastestmirror ===================================================================================================================== Package Arch Version Repository Size ===================================================================================================================== Installing: git x86_ el7_2.1 base 4.4 M Installed: git.x86_64 0: el7_2.1 Complete! [guestshell@guestshell ~]$ git version git version Output edited for brevity and clarity DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 31

31 Install and Run Applications Application Examples MTR Combines ping and traceroute. Tracks response time and reachability over time. tcpdump well known Linux packet analyzer Custom Python Applications Launch custom apps from IOS-XE based Embedded Event Manager applets DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 33

32 MTR Application Examples Combines the function of traceroute and ping into a single tool. Probes routers over time and tracks response times. DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 34

33 tcpdump Application Examples IOS-XE has a built-in packet capture but depending on the size the capture finding data can be difficult tcpdump is a well known Linux tool that can view the exported packet capture csr1kv#guestshell run sudo tcpdump -qns 0 -X -r flash:buff.pcap The run command has been modified to: sudo tcpdump -qns 0 -X -r /flash/buff.pcap reading from file /flash/buff.pcap, link-type EN10MB (Ethernet) 13:55: IP ssh > : tcp 96 0x0000: 45c b82e 0000 ff06 ea70 0a00 020f E...p... 0x0010: 0a db1f 8a2a a4c3 0e72 f907...*...r.. 0x0020: f20 976c 0000 dcea ead2 ab06 36fa P...l x0030: 8dd4 f5a4 f0ed aa16 9bb3 43e bab8...c.ya.. 0x0040: a a a6b edd3 f22e 291f be27..&...r...)..' 0x0050: a5a 4aa3 b4c3 c643 2d63..hG.)zZJ...C-c 0x0060: 5f99 085a 846c 804d 4610 fe84 02e2 c5d1 _..Z.l.MF... 0x0070: 1cbe e42f 1a fe6 6b61 c19d b2d8.../.6dr..ka... 0x0080: 4ed2 bbf e6af N...4`.. DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 35

34 Extending Application Support Through Python Application Examples Python is the defacto automation language of the day. Customers are already familiar with Linux and Python Helps overcome operational shortcomings of CLI Access Cisco s python API in IOS DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 36

35 Using Python with IOS-XE Devices Application Examples IOS-XE Off-Box Python IOS-XE On-Box Python Python IOS-XE Device IOS Python IOS SSH/NETCONF External Python Execution Environment IOS-XE Device scripts executed locally on switch or router Ideal for: provisioning automation (ZTP) automating Embedded Event Manager responses application development IOT scripts executed externally from switch or router Ideal for: configuration management automation telemetry / operational data controller use cases including APIC-EM / Cisco Network PNP DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 37

36 Using Python with IOS-XE Use Case Example Are you sure nothing has changed on the network? By leveraging a combination of EEM and On-Box Python the router can notify when the configuration has been modified. Python script posts Check out the details here - DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 38

37 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#devnet Cisco and/or its affiliates. All rights reserved. Cisco Public

38 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

39 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions DEVNET Cisco and/or its affiliates. All rights reserved. Cisco Public 41

40 Thank you

41