Network Operational Simplicity with Zero Touch Deployment

Transcription

1 Network Operational Simplicity with Zero Touch Deployment Ahmed Abeer, Technical Marketing Engineer, Cisco Patrick Warichet, Technical Marketing Engineer, Cisco

2 Agenda What is Zero Touch Deployment (ZTD) ZTD Deployment Scenarios Solution Components Step by Step Flow Use Cases

3 Introduction 3

4 Life of a Device - Yesterday Device onboarding (Day 0) Service Provisioning (Day 1) Monitoring and Analytics (Day 2) New device plugin Software upgrade Initial Configuration Enable/Activate new services Day 2 Operations (maintenance, upgrade, troubleshooting) Takes Hours to days to weeks Unstructured, slow, non scalable, Reactive

5 Modernizing the Life of a Device Device Onboarding (Day 0) Service Provisioning (Day 1) Monitoring & Analytics (Day 2) Yesterday Manual, Lengthy, Skilled Worker, Costly Device Bring-up High Maintenance, Inflexible, Custom Scripts for Service Bringup Unstructured, Non scalable, Pull Mechanism, Non Machine Readable Format Today Orders of Magnitude Quicker, Automated Device Bring-up Automation Friendly, Flexible, Predictable, Vendor Neutral Model Driven Service Bring-up Push mechanism, consistent, machine readable, high performance, real time

6 What is Zero Touch Deployment (ZTD) ZTD allows you to provision new devices in your network automatically, without manual intervention. ZTD Goals: ü ü ü Bring Up the Device with Customer Certified Software or Image. Download Day 0 Configuration or Script for Remote Connectivity. Connect the Device to NMS, Controller or Orchestrator. Secure Communication Channel Between Device and Server; Multivendor Support

7 ZTD Components 7

8 ZTD Architectural Components DHCP Server DNS Server HTTP/HTTPS/TFTP Server IPXE ONIE DHCP Server DNS Server HTTP/HTTPS Server Scripts Server Orchestrator ZTP

9 Boot Process - ipxe ipxe is an open source boot firmware. Provides an environment for installing any NOS ipxe is supported on the management interfaces (IPv4 and IPv6) Fully backward compatible with PXE with several enhancements. Boot from a web server via HTTP Boot from locally attached storage, (USB memory stick) Control the boot process with scripts and menus. DNS support.

10 Boot Process - ONIE ONIE is a small operating system, pre-installed on bare metal network switches, that provides an environment for automated provisioning. Combines a boot loader with a Linux kernel and BusyBox. Provides an environment for installing any NOS. Supported on the management interfaces (IPv4 and IPv6). Aggressive Image discovery Statically configured from the boot loader Locally attached storage, (USB memory stick) Bootfilename from DHCPv4 / DHCPv6 IPv4 / IPv6 link local neighbors mdns / DNS-SD PXE-like TFTP and HTTP waterfalls

11 Boot Process with ipxe Start Valid image on Disk Y Boot installed Image N Valid image on USB N Y Download and Run Installer IPXE Y N Success Y Boot Installed Image N MgMt Link Up Y Download and Run Installer Success Y N

12 Boot Process with ONIE USB Drive Y Download and Run Installer Success Y N URL from DHCP Y Download and Run Installer Success Y N URL from DNS-SD Y Download and Run Installer Success Y N Less exact method Y Download and Run Installer Success N Y Reboot into installed NOS

13 DHCP options make things easy Host identification can be done using mac-address. Including Serial Number in option 61 dhcp-client-identifier for example makes provisioning easy (S/N is written on the package) ######## Hosts ######### host ncs-5001-b { option dhcp-client-identifier "FOC1947R144"; Option 61 if exists user-class and option user-class = "ipxe" { Option 77 filename = " } else if exists user-class and option user-class = "exr-config" { filename = " } } } fixed-address ; Option 77

14 Dynamic URL makes things easy The URL provided by the DHCP server does not have to be a static. For example, you could direct ipxe to boot from the URL {serial:uristring} Which would expand to a URL such as: The boot.php program running on the web server could dynamically generate a script based on the information provided in the URL. <?php header ( "Content-type: text/plain" ); echo "#!ipxe \n"; echo "set myurl \n"; echo "boot myurl \n";?>

15 HTTP headers make things easy HTTP Headers Header Value Example ONIE-SERIAL-NUMBER: Serial number XYZ ONIE-ETH-ADDR: Management MAC address 08:9e:01:62:d1:93 ONIE-VENDOR-ID: 32-bit IANA Private Enterprise Number in decimal ONIE-MACHINE: <vendor>_<machine> VENDOR_MACHINE ONIE-MACHINE-REV: <machine_revision> 0 ONIE-ARCH: CPU architecture x86_64 ONIE-SECURITY-KEY: Security key d3b07384d-ac-6238ad5ff00 ONIE-OPERATION: ONIE mode of operation os-install or onie-update

16 ipxe Scripting and Chainloading Chainloading is the capability to jump from one boot statement to another. Using chainloading and the embedded scripting capability of ipxe we can have a very detail and complex selection mechanism for the boot image. Chainloading remove the need to create DHCP host definition Agnostic IPv4 or IPv6

17 Chainloading Example

18 Chainloading Example with IPv6 ipxe> autoboot net0 <- autoboot from the mgmt interface net0: c4:72:95:a7:ef:c0 using dh8900cc on PCI01:00.1 (open) [Link:up, TX:108 TXE:0 RX: RXE: ] Configuring (net0 c4:72:95:a7:ef:c0)... Ok net0: fe80::c672:95ff:fea7:efc0/64 net0: fd:30:12::1124/64 gw fe80::fa72:eaff:fe8b:ce80 <- ipv6 stateful address assignment Filename: <- ipv6 boot URI from DHCPv6 boot.ipxe... ok <- boot script is downloaded /boot.ipxe.cfg... ok <- boot variable are chained /ipxe/uuid ipxe No such file or directory ( /ipxe/mac-c47295a7efc0.ipxe... No such file or directory ( /ipxe/serial-foc1947r143.ipxe... No such file or directory ( /ipxe/pid-ncs-5001.ipxe... No such file or directory ( Network unreachable ( ok <- boot menu is executed

19 Future Enhancement Security Trusted Platform Module (TPM) UEFI Secure Boot

20 ZTP 20

21 ZTP Functions Apply Configuration Deploy Containers ZTP Software Upgrade/ Downgrade Execute Scripts Install Applications/Packages

22 ZTP Flow of Operations ZTP start ZTP end ZTP end Y N Username configured Start DHCP Client Option 67 or 59 Download 2 1 DHCP Request DHCP Response DHCP SERVER IP address Next-server Filename= or Filename= HTTP SERVER Delete file End ZTP Delete file End ZTP N N Text file < 100 MB config or script script Execute script config Apply config Download 3 GET scripts/pkg/conf script.sh config.txt Additional Scripts Packages, etc

23 ZTD via NETCONF/YANG 23

24 The Day 0 Challenges Rapid Nodes and Service deployments 5G Large number of devices to bring up Simplify Day 0 device deployments SD-WAN Service-Ready Infrastructure Expected to be service ready on bringup Devices distributed in different physical locations IoT

25 ZTP Requirements Baseline requirements across both deployment scenarios No pre-staging required DHCP for management IP address Configuration download Image upgrade/downgrade Docker/LXC install Connection to the NMS Baseline requirement for in-band management deployment scenario Auto L3 adjacency configuration in any topology L2 VLAN auto-discovery Layer 3 Ring Topology Layer 3 Layer 2 Ring Topology Layer 2 Compound Topology Layer 2 MPLS Layer 2 L3 Network MPLS MPLS MPLS Value added requirements Robust connection to NMS Secure Multi-vendor support Configuration template Hub & Spoke Network MPLS

26 1 ZTP Two Different Deployment Scenarios Routers are connected to a management network via out-of-band management port Popular in Data Center, Enterprise, and Web customers out-of-band Management network Servers (DHCP/NMS) 2 There is no dedicated management network. Routers are managed via in-band, the same as user data network L3 link Sub-int L2 EVC L3 link Servers (DHCP/HTTP) Typical deployment in the SP Access/ Metro L3 link in-band management L3 link

27 Option 1: Provisioning from the DHCP Server Device boot up and initiate a DHCP Discover DHCP server provides a script using bootfilname (option 67) Upon commit DHCP server: Registers device to Orchestrator using REST Asks Orchestrator to retrieve RSA keys from device Device Downloads scripts from HTTP server. Scripts is executed on the device. 1 4 Discover 3 Server Initiated Get Script Provision.py Post Keys Post Config Offer DHCP HTTP Orchestrator 2 4 Once registered, the script perform a sync from the Orchestrator server

28 Option 1: Server Initiated When Device do not run any Script or Compute Server Initiated Start ZTP DHCP Request ( Broadcast) DHCP Request ( Unicast) DHCP Server Notification address leased Python Script Orchestrator IP Address, Default GW Bootfile name DHCP Option 67 DHCP Response ( Unicast) HTTP Request Config Run Script Enables: SSH, User name, Password, Netconf HTTP File: Script Netconf Operations Sync from, Get Serial Number, Apply Day 1 Configuration Config Config Synch

29 Option 2: Provisioning from the Device 1 2 Device boot up and initiates a DHCP Discover DHCP server provides a script using boot-filename (option 67) 1 Device Downloads scripts from HTTP/FTP server Discover 2 Device Initiated Get Script Offer DHCP HTTP 3-4 Provision.py Post Keys Orchestrator 3 4 Scripts is executed on the device and registers to Orchestrator using REST/RESTCONF API Once registered, the script perform a sync from the Orchestrator server Post Config

30 Option 2: Device Initiated When Device runs Script or Compute Device Initiated Run ZTP.sh DHCP Request ( Broadcast) DHCP Request ( Unicast) DHCP Server Orchestrator IP Address, Default GW Bootfile name DHCP Option 67 DHCP Response ( Unicast) HTTP Request Config Run Script Enables: SSH, User name, Password, Netconf HTTP File: Script Netconf Operations Sync from, Get Serial Number, Apply Day 1 Configuration Config Config Synch

31 Enhancements 31

32 Simple Security Vendor Customer Certificate Server Script Server Serial:Certificate Serial Certificate Encrypted Payload DHCP Server Public Key S/N Discover Bootstrap Server S/N:ABCD1234 Config URI Get Serial.cfg Public/Private Key Generated Use Private Key to validate the configuration Install configuration or execute script From

33 Day-0 Netconf Configuration Model NMS DHCP Server Bootstrap Server Yang Model Image Server Discover Bootstrap server list Script Server Script Download Configuration via Netconf Config Server

34 Day-0 Bootstrap Data using Yang Model Name of the NOS required yang-data zerotouch-information: (information-type) +--:(onboarding-information) onboarding-information boot-image os-name string os-version string download-uri* inet:uri image-verification* [hash-algorithm] hash-algorithm identityref hash-value? yang:hex-string configuration-handling? enumeration pre-configuration-script? script configuration? <anydata> post-configuration-script? script From draft-ietf-netconf-zerotouch-19 Released version of NOS required List of URIs providing bootstrapping data e.g.: merge, replace Agnostic of programing language Executed before configuration is applied Exit 0 : success Exit > 0 : Soft error -> proceed Exit < 0 : Hard error -> reset Any model supported by the device Agnostic of programing language Executed after configuration is applied Exit 0 : success Exit > 0 : Soft error -> proceed Exit < 0 : Hard error -> reset

35 ZTD Use cases 35

36 ZTP Supported Deployment Scenarios DHCP SERVER 1.1q HTTP SERVER Layer 2 Network Orchestrator DHCP SERVER 2 Layer 3 / MPLS Network 3 HTTP SERVER Orchestrator DHCP SERVER Layer 2 Network HTTP SERVER Layer 3 Network Orchestrator

37 ZTP Supported Deployment Scenarios Scenario 2: Layer 3 Network with Option 43 DHCP SERVER Orchestrator (DHCP Option 43) DHCP IP Helper Address (Required) Layer 3 Network.1q Layer 2 Network Layer 3 Network Layer 3 Network NMS (DHCP Option 43)

38 ZTP Supported Deployment Scenarios Scenario 2: L3 with Third Party NMS or Without Op43 DHCP IP Helper Address (Required) DHCP SERVER Layer 3 Network Orchestrator exr.1q Layer 2 Network Layer 2/3 Network XE/Polaris Initial Device Configuration OR Script (Required) Layer 2/3 Network TFTP/HTTP SERVER (DHCP Option 150/67/77/61)

39 ZTP Supported Deployment Scenarios Scenario 3: L3 Network with IP Unnumbered DHCP SERVER HTTP Server IP Unnumbered Layer 3 Network Router Loopback ip address DHCP IP Unnumbered Layer 3 Layer 2 Network Layer 3 Network MPLS Network TFTP SERVER

40 Summary Parallel process, multiple system can be configured at the same time. Dramatically reduce deployment time Reduce the chance of configuration errors. Tutorials, Blogs, Examples Network Field Day 17:

41 Thank You 41