Plexxi Switch Administrator Guide using Linux and Plexxi CLI Release 3.1.1

Transcription

1 Plexxi Switch Administrator Guide using Linux and Plexxi CLI Release May 31, Innovative Way - Suite 3322 Nashua, NH Tel PLEX (7539)

2 Notices The information contained herein is subject to change without notice. Plexxi and the Plexxi logo are trademarks of Plexxi, Inc. in the United States and other countries. Other product or service names may be trademarks or service marks of others. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Plexxi, Inc. Plexxi, Inc. provides this documentation AS IS, without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms, or conditions of merchantability, satisfactory quality, non-infringement and fitness for a particular purpose. Plexxi, Inc. reserves the right to make changes to equipment design or program components described in this documentation, as progress in engineering, manufacturing methods, or other circumstances may warrant. No responsibility is assumed for the use of Plexxi, Inc. software or hardware, all rights, obligations and remedies related to which are as set forth in the applicable sales and license agreements. Plexxi, Inc. 100 Innovative Way - Suite 3322 Nashua, NH Tel: PLEX (7539) Published May 31, 2017 Printed in United States of America. Copyright Plexxi, Inc. All rights reserved. The Plexxi Switch system is classified as a class 1 telecommunications laser product employing embedded class 1 lasers and complies with the following: THIS PRODUCT COMPLIES WITH FDA RULE 21 CFR SUBCHAPTER J IN EFFECT AT DATE OF MANUFACTURE. PRODUCT COMPLIES WITH 21 CFR AND PRODUIT CONFORME SELON LE SOUS CHAPITRE J DU DOCUMENT FDA RÈGLE 21 CFR EN VIGUEUR LORS DE LA DATE DE FABRICATION. PRODUIT CONFORME SELON 21CFR ET Electrotechnical Commission (IEC) , This product is classified as a: CLASS 1 LASER PRODUCT APPAREIL À LASER DE CLASSE 1 This unit is intended to be installed in a Restricted Access Location only with access only by trained personnel. Warning: The primary hazards of exposure to invisible laser radiation from an optical fiber communications system are: ï Damage to the eye by viewing an unterminated optical fiber or fiber optic connector. ï Damage to the eye from invisible laser radiation from viewing a cut fiber or a broken fiber. Never attempt to view optical connectors that may be emitting laser energy and always avoid possible exposure to invisible optical laser radiation. Using optical fiber scopes or magnifying lenses may increase the possibility for an eye hazard. It is recommended that you use an optical power meter to determine if there is optical laser radiation present or use a remote video display inspection tool to inspect connectors. 2 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

3 Table of Contents Notices... 2 Welcome Related Documentation Contacting Plexxi Support Chapter 1 Switch Management Connections Ports Serial Console Port SSH through Management Port SSH Session opened from Plexxi Control Logging into the switch User Accounts Chapter 2 Initial Switch Setup Serial Console Running px- setup Connecting through the Management Interface Changing the admin User Password Accessing the Plexxi CLI Configuring 1 or 2 LightRails on a Plexxi Switch 3eq Saving the Configuration Upgrading Plexxi Switch Software Chapter 3 Plexxi Linux Utilities for Switch Configuration px- adduser px-hostname px- lspart px- package- check px- setup px- topology Chapter 4 Managing Plexxi Switch Linux User Accounts and Authentication Methods Local Switch Authentication Adding a Local User Using the Plexxi px- adduser Utility Accessing the Plexxi CLI TACACS+ Authentication for a Switch Overview Configuring TACACS+ Authentication on a Switch TACACS+ PAM setup TACACS+ NSS Configuration LDAP Authentication for a Switch Overview Configuring LDAP Authentication for a Switch Enabling the Authentication Method for a Switch Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

4 Chapter 5 Debian Linux Commands for Switch Configuration Configuring Clocks Manually Setting the Time and Date Changing the Time Zone Setting Time Once with NTP Configuring NTP Configuring the IP Domain Configuring the Management Interface Configuring the IP Address of the Management Interface Configuring the MTU Size of the Management Interface Enabling and Disabling the Management Interface Configuring a VLAN on the Management Interface Configuring IP Routes Configuring SNMP Groups Communities MIB Views SNMP v3 User- Based Security Model Copying Files to a Switch Configuring SSH Keys on a Switch Regenerating SSH Host Keys on the Switch Starting or Stopping the SSH service on the Switch Making SSH Persistent on the Switch Chapter 6 Saving Configuration Changes Saving Configuration Changes Checking the Current Configuration Chapter 7 Handling Files Handling Files from the Debian Linux Prompt Copying Files from a Remote System Handling Files from the Plexxi CLI running- config and startup- config Copy, Move, and Delete Examples File Copy with URL Chapter 8 Upgrading Plexxi Switch Software Partitions Upgrading Software Using the Plexxi Control UI Upgrading Software Using the Plexxi CLI Viewing the Currently Running Software Version Displaying Versions for Aggregated Components Viewing Installations on Internal Partitions Copying Files from a Remote Server Installing a Software Update Reloading to Complete an Installation Configuration Persistence Reverting to the Previously Running Switch Software Version Chapter 9 In- Band Management Overview Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

5 Configuring In- Band Management Related Plexxi CLI Commands inband- management config port inband- management config dhcp inband- management config ip inband- management delete show inband- management Chapter 10 Switch 2e DCI Mode Operation Modes of Operation Confluent Ring DCI Example: 3 DCs Building the Example Network CLI for Switch2e DCI Mode ring redirect Switch 2e I/O Panel Ports Chapter 11 Fabric Link Encapsulation (FLE) Overview Configuring DCI L2 FLE on Plexxi Switches 2, 2s, 2p, 2sp Example: Switch 2 East- Flexx Example: Switch 2 West- Flexx Configuring DCI L2 FLE on Plexxi Switch 2e Example: Switch 2e W- SFP Example: Switch 2e SFP- E Configuring L2 FLE on Plexxi Switch 3eq Example: Switch 3eq LightRail 1 West Port Encapsulation Example: Switch 3eq LightRail 1 East Port Encapsulation CLI Commands Chapter 12 Plexxi CLI Modes Opening the Plexxi CLI Shell Entering the CLI Modes Entering the EXEC Mode Entering the PRIV- EXEC Mode Entering the CONFIG Mode Entering the CONFIG- LINE Mode Exiting the CONFIG- LINE Mode Exiting the CLI Modes Returning to the Previous CLI Mode Returning to the PRIV- EXEC Mode Exiting Plexxi Shell to Bash Chapter 13 CLI Command Reference Exec mode clear access- list clear counters clear ip clear ipv clear mac sw- table debug bgp Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

6 debug ip debug mrd debug nsm debug ospf debug pim debug pip debug prd disable enable exit quit help logout no no debug all ping quit reset log show access- list show bgp show cli show clock show crossbars show cutthru show debugging show flow show hardware show history show hold- policy show hosts show interface show interface summary show ip show ip arp show ip dhcp- relay show ip domain- list show ip domain- name show ip fastpath statistics show ip host show ip igmp snooping show ip interface show ip name- server show ip route show lacp show lacp lag show lag show lag lacp show lag IFNAME vlan show list show lldp Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

7 show lldp local- info show locate- led show log show mrib show neighbor- discovery show nsm show ntp show post show privilege show qinq svlan show qsfp show ring show router- channel show router- id show sflow show system resources show system uptime show timezone show topography show transceivers show translation tvlan show users show version show virtual- routers show vlan ssh telnet terminal trace- attachment traceroute undebug Chapter 14 CLI Command Reference PRIV- EXEC mode boot toggle clear arp- cache clear controller address clear controller config clear cores clear hold clear ip route kernel clear mac hw- table clear policer statistics configure (terminal) controller set HOST copy FILE copy running- config copy startup- config copy URL cutthru dci- behavior Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

8 delete FILE delete startup- config dir disable enable fabric- encap create fabric- encap delete flow hold hold- policy hold IFNAME inband- management config port inband- management config dhcp inband- management config ip inband- management delete install <FILE> lldp port IFNAME receive locate- led logout migrate- data move FILE mstat mtrace ptp qsfp config quit reload (rescue) ring confluent- ring- links ring control (in- band out- of- band) [force] ring lightrails (Switch 3eq only) ring redirect (for Switch 2e) ring redirect (for Switch 2, 2p, 2sp) show boot show controller show debugging snmp show fabric- encap show file show flow show fsat show history show hosts show inband- management show install show interface show loop- detection- stats show mac hw- table show mac sw- table show nsm client show peers Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

9 show process show psat show running- config show startup- config show system cores show tech- support show topography show topology residual show topology vlan show user- defined- path show users support log- bundle verify FILE Chapter 15 CLI Command Reference CONFIG mode access- list arp banner motd bgp debug debug nsm do <command> dump bgp enable password exit quit fib retain help interface ip forwarding ip route line console line vty log file max- fib- routes max- static- routes maximum- access- list maximum- paths no route- map <tag> router bgp router ospf router- channel router- id service advanced- vty service password- encryption service terminal- length show cli show list show running- config synce Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

10 Chapter 16 CLI Command Reference CONFIG- LINE mode exec- timeout end exit quit CTRL- D help history login privilege level show cli show list show running- config Appendix A CLI Help Output Modifiers Repeat a Show Command Appendix B Troubleshooting Switch Log Test Network Connectivity Assess System Health Display Running Processes Hardware Status Power Supply Details Temperature Sensor Readings Fan Status Appendix C Working with Plexxi Care Support Opening the PRIV- EXEC Mode Combining show Command Output Redirecting show Command Output Bundling Log Files Specifying the Number of Days to Include in Log Output Specifying a Time Copying Plexxi Switch Core Files Checking for Core Files Copying a Core File to Another Network Host Copying a Core File to Local User Disk Space Verifying a Core File in its Original Location Deleting Core Files Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

11 Welcome This document describes switch administration tasks and commands/functions that are performed at either the Debian Linux Bash prompt or at a Plexxi configuration command line interface (CLI) prompt. The CLI is used for initial switch set up, some feature configurations, and troubleshooting. You can use the CLI to access information available from Plexxi Control and to display system status. Although some Plexxi Switch configurations are performed using the Plexxi CLI, most switch configuration tasks are performed using either the Plexxi Control graphical user interface (GUI) or the Plexxi Connect GUIs. Configuration parameters that are set at the Linux prompt as outlined in this document include: Clocks management interface NTP SNMP switch user management Configuration parameters that are set at the Plexxi CLI prompt as described in this document include: L2 Fabric Link Encapsulation In-band Management Redirection Configuration parameters that are set using the Plexxi Control GUI are described in the Plexxi Control Online Help and include: VLANs Affinities User-Defined Paths Switch ports Switch software upgrades Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

12 Related Documentation The following additional documentation supports this release: Plexxi Compatibility Matrix, Version 6 or greater. The Plexxi Compatibility Matrix contains versionspecific software and hardware support information as well as cable and transceiver support information. Plexxi Release Notes, Release Plexxi Control Installation, Upgrade and Administration Guide, Release Plexxi Control Online Help is available while logged into the Plexxi Control UI Except for the online help, this documentation is available on the Resources > Technical Publications page of Contacting Plexxi Support Plexxi Technical Support services are available to answer your questions and to make sure that your software and hardware continue to operate properly. You can contact Plexxi Support at: support@plexxi.com (US/Canada toll-free) (US/International) 12 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

13 Chapter 1 Switch Management Connections Ports You can connect to a Plexxi Switch to perform switch management using the following methods: connect via SSH through the management port open a terminal session from Plexxi Control connect a console system to the console port on the switch. IMPORTANT: If you are performing an Initial Setup of the switch, refer to in Chapter 2, Initial Switch Setup on page 15. Serial Console Port The serial console may be needed for part of the initial switch setup, for troubleshooting, or for general switch management using Linux and the Plexxi CLI. For serial access, the console system must be connected to the console port on the switch. To connect to the serial console port, the following settings are needed: Kb/s 8 data bits 1 stop bit No Parity SSH through Management Port If a switch has undergone the initial switch setup and if the management port is connected to a network for management, you can SSH remotely through the switch s management port. IMPORTANT: If you are performing an Initial Setup of the switch, refer to in Chapter 2, Initial Switch Setup on page 15. SSH Session opened from Plexxi Control You can open an SSH session from Plexxi Control as described in the Plexxi Control Online Help, which is accessible from the Plexxi Control UI (User Interface). Logging into the switch When you connect to the switch, you are prompted for a username and password. The default values for the pre-configured administrator account are: username: admin password: plexxi When you log in, you start in your home directory at /home/<username>. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

14 At the shell prompt, you can: perform initial switch setup using the px-setup utility as described in Chapter 2, Initial Switch Setup on page 15. perform some switch configuration tasks as described in Chapter 5, Debian Linux Commands for Switch Configuration, page 33. access the Plexxi CLI to perform Plexxi-specific configuration tasks. Refer to Chapter 12, Plexxi CLI Modes, page 68 for information on accessing the CLI modes. User Accounts For information on managing Plexxi user accounts from Linux, refer to the next chapter. 14 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

15 Chapter 2 Initial Switch Setup When you initially install a switch, you need to open a console connection to any switch in the fabric, then run the px-setup command to configure the appropriate switch(es) as described in the sections that follow. Additionally, you can specify a new password for access to Linux on any new switches, and for switch 3eq, define LightRail configuration. Serial Console The serial console may be needed for part of the initial switch setup, for troubleshooting, or for general switch management using Linux and the Plexxi CLI. For serial access, the console system must be connected to the console port on the switch. To connect to the serial console port, the following settings are needed: Kb/s 8 data bits 1 stop bit No Parity Running px-setup px-setup is a Plexxi utility that simplifies Plexxi switch setup by eliminating the need to edit configuration files and restart services on the Plexxi Switch. The utility queries administrators for information, then configures the IP or hostname of the Plexxi Control software, time zone, network address, default gateway, SNMP management, and several network services, including NTP and DNS. The px-setup commands require root/sudo privilege to modify core services. For example, logged into the switch as admin: $ sudo px-setup To setup all switches and all network characteristics for a new install, use px-setup without arguments: $ sudo px-setup For detailed information about the px-setup command, refer to the following section in this document: px-setup on page 22. Connecting through the Management Interface Connect to the switch using the ssh command. This requires that the MGMT port on the switch be connected and that you know the IP address of the switch management port (the address you just configured). Connect to the switch using ssh and log in using the default credentials. For example: ssh admin@ipaddress Reply as prompted; the default administrator login is: Username: admin Password: plexxi This puts you at the Debian Linux prompt on the switch in the /home/admin directory. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

16 Changing the admin User Password You can change the password for the Linux admin user on any new switches using the Linux passwd command while logged in as admin and at the Linux prompt on the switch: $ passwd Accessing the Plexxi CLI Access the Plexxi CLI as follows: 1. Open the Plexxi CLI Shell. At the Bash prompt, enter the following sudo command and then enter the password for admin: admin@switch:~$ sudo px-shell This opens the EXEC Mode prompt: switch> For example: admin@plexxi1:~$ sudo px-shell [sudo] password for admin:... plexxi1> 2. Enter the PRIVILEGED EXEC mode, from the EXEC mode, enter the enable command. For example, on switch Plexxi1: plexxi1> enable plexxi1# The prompt changes from > to #. Configuring 1 or 2 LightRails on a Plexxi Switch 3eq If the switch being set up is a Switch 3eq, you may need to configure the number of LightRails connected to the Plexxi Switch 3eq. The default setting supports 2 LightRails. If you are connecting only one LightRail to a Switch 3eq, you will need to configure the setting for 1 LightRail as described below. If you are adding a 2 nd LightRail to a switch operating with 1 LightRail, configure for 2 LightRails as described below. This command needs to be executed from px-shell immediately after installing and cabling a Switch 3eq. To configure 1 LightRail, enter the command: plexxi1# ring lightrails 1 To configure 2 LightRails, enter the command: plexxi1# ring lightrails 2 To see the number of LightRails configured, use "show ring" command. For example: plexxi1> show ring Ring redirect setting: west-east Ring control channel setting: in band Number of links aggregated into confluent ring: 2 Number of lightrails: 2 (12 QSFPs, 48 Uplinks) Uplink Ports Speed Setting Actual Speed Egress Limit Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

17 xp81-84 (auto detect) (no link) (unknown) xp85-88 (auto detect) Mbps (none set) xp (auto detect) (no link) (unknown) xp (auto detect) Mbps (none set) xp (auto detect) Mbps (none set) xp (auto detect) Mbps (none set) Saving the Configuration An asterisk preceding the prompt indicates that the configuration has changed and not saved. In the PRIV-EXEC mode (# prompt), save the new configuration settings to the switch, enter the command: *plexxi1# copy running-config startup-config Building configuration... [OK] plexxi1# Upgrading Plexxi Switch Software You might need to upgrade to the latest version of the switch software when you initialize the switch for the first time. If you are not sure, verify with your Plexxi representative. If necessary, upgrade the Plexxi switch software as described in Chapter 8, Upgrading Plexxi Switch Software. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

18 Chapter 3 Plexxi Linux Utilities for Switch Configuration Some Plexxi switch specific configuration settings are accomplished using Plexxi Linux utilities as outlined in the sections that follow. IMPORTANT: Man pages are available for Plexxi px- utilities. px-adduser Adding a User The px-adduser utility enables you to easily create accounts that adhere to Plexxi switch user roles. It is accessible in the switch Bash environment; it is not available from the px-shell CLI. Note: It is not mandatory that you use this utility to create Plexxi switch user accounts - it just makes it easier. Syntax px-adduser <username> px-adduser [--user-role administrator operator viewer] [--full-name <name>] <user_name> px-adduser [--disabled-login] <user_name> px-adduser [-h --help] Helper utility for creating local user accounts that adhere to Plexxi user roles. Options -h, --help Display help for this command. --user-role role Specify the role for this account: administrator, operator or viewer. --full-name name Indicate the full name of this user or any comment for the account. --disabled-login Create the account without prompting for the initial password. Issuing this command with only the user_name argument prompts you to enter the user role, full name and password for this new account. The optional parameters listed above can be passed to avoid entering settings interactively. Note:, The password cannot be passed on the command line. You can use the disabled-login option to create the account initially disabled, then later, use the passwd command to set the initial password and enable the account. User Roles Plexxi supports the following user roles: Administrator - This role has the highest privileges on the system. It equates, indirectly, to superuser access. User accounts of this role have: o o Membership in group px_administrator; this group has sudo access to all system commands Default shell is /bin/bash Operator - This is the second highest privilege level. It allows for configuration changes in pxshell, but is more limited for the rest of the system. It has: o o Membership in group px_operator; this group has sudo access only to px-shell. Default shell is /bin/bash 18 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

19 Viewer - This is the least privileged role. Users with this role are only allowed unprivileged access to px-shell and no access to Bash. It includes: o o Examples Membership in group px_viewer; this group has no sudo privileges Default shell is /bin/px-shell The following command, you are prompted for role, full name and initial password. $ sudo px-adduser nemo The following command generates no prompts and creates an operator account that is disabled: $ sudo px-adduser --user-role operator --full-name "Dory fish" --disabled-login dory The following command displays Help for the px-adduser command: $ sudo px-adduser -help Exit Status This utility essentially calls the useradd command, followed by the passwd command (unless opted out). If either of these exhibit an error, their status is propagated out by this utility. See useradd(8) and passwd(1) for more details on their status codes. Scripting It may be desirable to script the creation of accounts. This can be accomplished by using the optional --user-role and --full-name arguments to pass the information normally prompted for. The password cannot be passed on the command line - it could be visible to other users in the process listing. Instead, the --disabled-login option can be passed, and the account gets created in an initially disabled state. Later on, /usr/bin/passwd can be used to set the initial password and enable the account. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

20 px-hostname Configuring the Switch Host Name The standard Linux hostname command does not make a persistent change to the switch hostname. To make a persistent switch hostname change, use the Plexxi px-hostname utility from BASH. When using the px-hostname command to change the hostname of the switch, the command must be run as 'root' (with 'sudo'). Note: The host name becomes part of the Linux and Plexxi CLI command prompts on the next login. Syntax px-hostname px-hostname <new_host_name> [-y --yes-restart] px-hostname -h --help Options: -h, --help -y, --yes-restart Print help for this command. Proceed with the hostname change without prompting. When you configure the switch hostname, various services are restarted. Therefore, you will be prompted to continue. You can avoid the prompt by entering y or --yes-restart as a command argument. px-hostname with no arguments returns the current active hostname. px-hostname with a new hostname persistently applies the new hostname to the switch. px-lspart Displaying Install Partition Information The /usr/bin/px-lspart utility lists the installed software version for each of the install partitions (A and B). It also indicates which partition is currently running ( r is shown next to the partition) and which partition is currently the default boot partition ( b is shown next to the partition). Syntax px-lspart px-lspart -h --help Options -h, --help Notes Display a help summary. If the alternate partition is not mounted, an error is given indicating as such. The command relies on /alt being mounted. Also, the version strings shown are those for the install package that was installed to the partition (either via ONIE or Plexxi upgrade). If you need to know more granular information about specific package versions, try the px-package-check or dpkg commands. 20 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

21 px-package-check Listing Installed Software Packages The Plexxi px-package-check utility returns a report of any packages that have been added, removed, or updated since the current partition was installed. Syntax px-package-check [-h] [-e] [-i] [-r] [-u] Optional Arguments -h or --help Show help for this command. -e or --errors List error conditions. Returns the name, version, and status. -i or --installed List packages installed since initial install. Returns the name and version. -r or --removed List packages removed since initial install. Returns the name and version. -u or --upgraded List packages upgraded since initial install. Returns the name, original version and current version. If no arguments are passed, the px-package-check utility lists the following: packages that do not appear to be fully installed. packages that have been added since the initial installation packages that have been removed since the initial installation packages that have upgraded (or otherwise changed version) since the initial installation This utility does not detect reinstallation or reconfiguration of packages. Note: You can also refer to the 'dpkg-query' command and the /var/log/dpkg.log file. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

22 px-setup Switch Setup px-setup is a Plexxi utility that simplifies Plexxi switch setup by eliminating the need to edit configuration files and restart services on the Plexxi Switch. The utility queries administrators for information, then configures the IP or hostname of the Plexxi Control software, time zone, network address, default gateway, SNMP management, and several network services, including NTP and DNS. The px-setup commands require root/sudo privilege to modify core services. For example, logged into the switch as admin: $ sudo px-setup To setup all switches and all network characteristics for a new install, use px-setup without arguments: $ sudo px-setup To setup a new Plexxi switch added to an existing Plexxi fabric, use px-setup and define the switch by its MAC address: $ sudo px-setup t MAC_Address To configure a specific parameter in an existing Plexxi fabric, use px-setup with the protocol/network characteristic to configure. For example, to configure time zone: $ sudo px-setup-tz Note: px-setup uses UTC by default for time zone. Plexxi recommends that you use UTC for Plexxi Switch and Plexxi Control. IMPORTANT: Plexxi recommends that Plexxi Connect, Plexxi Control and Plexxi Switches all be connected to a reliable NTP service. Determining Your Operating Environment Determine whether the installed switches will use static IP addresses or DHCP. For static IP, run px-setup without arguments to configure all parameters. $ sudo px-setup For DHCP, determine which services DHCP configures in your environment, and which services you configure with px-setup. Refer to the Syntax below. Syntax px-setup px-setup [-t switch,,switch] px-setup --help Command px-setup Function Entering px-setup with no arguments queries for all service information and applies the configuration to all Plexxi switches on the fabric. You can answer 'n' to omit service queries as they are prompted. With no arguments, it configures ALL switches discovered by census info;; in other words, all switches properly connected and detected on the Plexxi fabric. 22 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

23 Command px-setup-ctrl px-setup-hostaddr px-setup-tz px-setup-ntp px-setup-dns px-setup-snmp Function Configure the fully-qualified host name or IP address of the Plexxi Control server. Configure the host name and management IP address for each switch being configured. Set the time zone for each switch being configured. Note: px-setup uses UTC by default for time zone. Plexxi recommends that you use UTC for Plexxi Switch and Plexxi Control. Configure NTP for each switch being configured. Configure DNS for each switch being configured. Configure SNMP for each switch being configured. Options -t MAC,,MAC Specify one or more switches to configure. This is a comma delimited (no spaces) list of MAC address which uniquely identify the Plexxi switches. If one or more switches is specified using the -t, only the listed switches are configured and only questions which apply to those switches will be posed. This option is recommended to configure an individual switch or multiple switches of a similar class (city, service-type, etc). --help Display a help summary. Examples $ sudo px-setup This asks a series of questions about all detectable switches and common services, then applies the configuration to the switches. $ sudo px-setup -t 01:02:03:aa:bb:cc This prompts and collects configuration information for a specified switch (01:02:03:aa:bb:cc) identified by its unique base MAC address. The configuration is applied to the specified switch only. $ sudo px-setup -t 01:02:03:aa:bb:cc,55:44:ff:ee:bb:00 Specifies two switches. The utility queries about all services common to the specified switches, then applies the configuration on the specified switches. $ sudo px-setup-ntp Queries only about NTP, then applies the configuration to all Plexxi switches. $ sudo px-setup-ntp -t 01:02:03:aa:bb:cc Queries only about NTP, then applies the configuration to only the specified switch. $ sudo px-setup --help Displays a help summary. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

24 Notes The px-setup commands create a set of backup files of the puppet manifests it utilizes to distribute and apply the configuration. These are stored in the /var/opt/px-setup-backups directory in a subdirectory which uses a date-time format such as _ This directory is populated with configuration data (in an intermediary state) on all systems where the configuration is to be applied. To prevent disk over-usage, a limited set of backup files is retained. If an automated backup system is in place, it is advisable to collect the data in these directories. The px-setup commands keep the output simple and clean. More detailed debug information can be found in /var/log/px-setup.log. This log is only produced on the switch where px-setup was executed. It is unique per switch and not shared or distributed. 24 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

25 px-topology Viewing and Diagnosing the Plexxi Fabric Topology The px-topology command can be used to view and diagnose the Plexxi fabric (topology). Syntax px-topology -s --show residual px-topology -s --show vlan [vlan <VLAN>] [root <ROOT>] px-topology -t --trace residual px-topology -t --trace vlan <VLAN> [root <ROOT>] px-topology -t --trace attachments px-topology -v --validate px-topology -e --state residual px-topology -e --state vlan px-topology -c --control px-topology -i --info px-topology -h --help Optional Arguments -s, --show -t, --trace -v, --validate -e, --state -c, --control -i, --info -h, --help vlan The --show option displays the currently active paths from this switch to one or more root switches in the Plexxi network. The --trace option sends trace packets from this switch to destination switches on the residual or VLAN (ISO) topologies. When tracing, you can specify the "attachments" argument to simulate actual lookup failures to follow attachments from this switch to the root switches the attachments reside on. The --validate option uses trace packets to test if the topology is healthy. It outputs a status message that indicates success or failure of the topology. The --state option shows the state of active and backup paths for either the residual or VLAN (ISO) topologies. Failures are indicated in the output; for example, switch or uplink failures. Show the active list of Plexxi switches. Show information on the state of the last fitting transaction. Display help for this command. The vlan (ISO) option filters results for a specific VLAN or root switch. Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

26 Chapter 4 Managing Plexxi Switch Linux User Accounts and Authentication Methods Plexxi Switch supports the following user authentication methods: Local switch authentication TACACS+ LDAP Local Switch Authentication Local Linux and Plexxi CLI users can be created on each Plexxi switch. Linux users can be created on the switch platform using the Plexxi px-adduser utility. Each Plexxi switch user must be a member of one of the following pre-defined groups which give them their privileges: IMPORTANT: Only an Administrator can create users. px_administrator This user Role provides root access to the Plexxi Switch through pre-arranged sudoers config file. Upon login, any px_administrator user has full administrator access to all Linux commands and utilities, via sudo. px_operator This Role provides normal, unprivileged access to the Linux system. It cannot, for example, create or edit user accounts. Upon login, a px_operator user has elevated sudo privileges for 'px-shell' only. In this way, the user has full configuration ability within the Plexxi CLI. px_viewer - This user Role provides only viewing access in the Plexxi CLI, and NO access to Linux, Adding a Local User Using the Plexxi px-adduser Utility Important: This is the preferred utility to use when adding a user. Any Administrator can add a local user at the Linux prompt on the switch using the px-adduser utility: 1. Create the user by issuing this command and following the prompts: $ sudo px-adduser <username> Important: The px-adduser utility is described in detail in Chapter 4, in the section, Adding a User - px-adduser. This section also provides options on how to script px-adduser without user interaction. 2. Respond to the prompts, assigning the appropriate group (px_administrator, px_operator, or px_viewer) Accessing the Plexxi CLI As an Administrator To access the Plexxi CLI, at the Linux prompt on the switch, a user with Administrator role must execute the command: $ sudo px-shell In the Plexxi CLI, this user has full configuration privileges. Upon exiting the Plexxi CLI, this user is returned to their Linux shell until logout. 26 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

27 As an Operator To access the Plexxi CLI, at the Linux prompt on the switch, a user with Operator role must execute the command: $ sudo px-shell In the Plexxi CLI, this user has full configuration privileges. Upon exiting the Plexxi CLI, this user is returned to their Linux shell with read-only privileges until logout. As a Viewer Upon login, a user with Viewer role is placed directly in the Plexxi CLI with Viewer privileges. Viewer users do not have Linux access. TACACS+ Authentication for a Switch Overview TACACS+ support allows Switch users to be authenticated using TACACS+ using the standard Linux Pluggable Authentication Modules (PAM) infrastructure. In Release 3.0, this needs to be configured directly on each Plexxi switch. When enabled, users that log in to the Switch platform using ssh, will be authenticated using an external TACACS+ server, and placed in an Administrator, Operator or Viewer group as defined in the TACACS server configuration. The groups refer to the privileges as documented in the Local AAA feature. Configuring TACACS+ Authentication on a Switch To configure TACACS for PAM authentication on a switch: 1. Configure TACACS+ PAM as described in TACACS+ PAM setup, page If you are going to support remote users (as opposed to local users in /etc/passwd), then configure TACACS+ NSS as described in TACACS+ NSS Configuration page if you are using NSS, then add tacplus to the passwd and group lines in /etc/nsswitch.conf. For example: # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat tacplus group: compat tacplus 4. Enable TACACS+ using the pam-auth-update utility as described in Enabling the Authentication Method for a Switch, page if you are using TACACS+ NSS, restart the NSCD service: $ sudo service nscd restart Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

28 TACACS+ PAM setup For PAM, configure the /etc/tacplus.conf file with the following parameters: Variable Description Valid values server TACACS+ server. May have more than one entry. server=hostname server=ip_addr server=hostname:port server=ip_addr:port secret TACACS+ server secret. May have more than one entry. Each entry will be applied to the servers defined before the entry. secret=plain-text-string login TACACS+ authentication service. login=pap login=chap login=login DEFAULT is pap (suggest login=login) service TACACS+ service for authorization and accounting Don't care but the protocol wants it to be defined protocol TACACS+ protocol for authorization and accounting Don't care but the protocol wants it to be defined timeout Timeout value in seconds The default value is 5 seconds Example /etc/tacplus.conf server= secret=mysecret login=login service=linuxlogin protocol=ssh 28 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

29 TACACS+ NSS Configuration For NSS, configure the /etc/nss_tacplus.conf file with the following parameters: Field name Description Example server Comma separated list of TACACS+ servers server server :49 server , secret secret used to authenticate to the TACACS+ server secret=plain-text-string timeout timeout in seconds The default value is 5 seconds debug enable debug logging service service to query on TACACS+ server This is where UID and ROLE need to be defined protocol The default value is ssh Example /etc/nss_tacacs.conf server secret mysecret timeout 2 service linuxlogin protocol ssh Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

30 LDAP Authentication for a Switch Overview LDAP allows Switch users to be authenticated using LDAP using the standard Linux Pluggable Authentication Modules (PAM) infrastructure. In Release 3.0, this needs to be configured directly on each switch. When enabled, users that log in to a switch using ssh will be authenticated using an external LDAP server, and placed in an Administrator, Operator or Viewer group as defined in the LDAP server configuration. Configuring LDAP Authentication for a Switch When LDAP is configured, the nsswitch.conf file must be edited to use LDAP. In this case, LDAP is configured for passwd, group and shadow: # /etc/nsswitch.conf # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: ldap compat group: ldap compat shadow: ldap compat gshadow: files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sudoers: files ldap Example: Configuring LDAP with SSL Before configuring LDAP with SSL, make sure to copy your LDAP server's certificate to the switch. The 'tls_cacertfile' option in the nslcd config should point to wherever the certificate is located on the switch. # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldaps:// :636 # The search base that will be used for all queries. base dc=qa,dc=plexxi,dc=com # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. #binddn cn=annonymous,dc=example,dc=net #bindpw secret # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options ssl on tls_reqcert demand tls_cacertfile /etc/ldap/slapd.crt # The search scope. #scope sub 30 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

31 Example: Configuring LDAP with TLS Similar to the SSL configuration, before configuring LDAP with TLS make sure to copy your LDAP server's certificate to the switch. The 'tls_cacertfile' option in the nslcd config should point to wherever the certificate is located on the switch. # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap:// :389 # The search base that will be used for all queries. base dc=qa,dc=plexxi,dc=com # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. #binddn cn=annonymous,dc=example,dc=net #bindpw secret # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options ssl start_tls tls_reqcert demand tls_cacertfile /etc/ldap/slapd.crt # The search scope. #scope sub Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

32 Enabling the Authentication Method for a Switch To enable the authentication method (LDAP or TACACS+) for a switch: Note: You must be logged in as administrator user. 1. Using sudo, enter the following command to run the interactive PAM (Pluggable Authentication Modules) configuration tool: sudo pam-auth-update 2. In the PAM configuration window, select the authentication method, then click OK. For example, to enable LDAP authentication: 3. Restart the nscd and nslcd services on the switch to finish applying the configuration. For example: sudo service nscd restart sudo service nslcd restart 32 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1

33 Chapter 5 Debian Linux Commands for Switch Configuration Some switch configuration settings are accomplished using Debian Linux commands as outlined in the sections that follow. IMPORTANT: These commands are issued from the Linux Bash prompt, and may require sudo to execute. NOTE: Refer to the Debian Linux man pages for command-specific information. Configuring Clocks Manually Setting the Time and Date You can manually set the time and date using the date command. For example: $ sudo date Thu May 4 13:22:00 EDT 2017 $ Refer to the man page date[1]. Changing the Time Zone To change the time zone, Debian recommends reconfiguring the 'tzdata' package which is done with the command: $ sudo dpkg-reconfigure tzdata When this is run, an interactive menu prompt is displayed for you to select the desired system time zone. Setting Time Once with NTP The NTP protocol can be configured to continually keep system time synchronized using an NTP server. To perform a one-time setting of system time based on an NTP server, the ntpdate command can be used only if the NTP service is disabled. For example, the following uses an NTP server at IP address : $ sudo ntpdate Refer to the man page ntpdate(8) for more details. Configuring NTP The NTP client can be configured by editing the file /etc/ntp.conf. Details about this file's syntax can be found in the man page ntp.conf(5). The client itself is the executable 'ntpd' which also has more information in its man page ntpd(8). The following is a generic example of an ntp.conf file. You must fill in values that make sense for your environment: $ cat /etc/ntp.conf # /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help driftfile /var/lib/ntp/ntp.drift # Enable this if you want statistics to be logged. #statsdir /var/log/ntpstats/ Plexxi Switch Administrator Guide using Linux and Plexxi CLI,

34 statistics loopstats peerstats clockstats filegen loopstats file loopstats type day enable filegen peerstats file peerstats type day enable filegen clockstats file clockstats type day enable # You do need to talk to an NTP server or two (or three). #server ntp.your-provider.example # pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will # pick a different set every time it starts up. Please consider joining the # pool: < server server #server 0.debian.pool.ntp.org iburst #server 1.debian.pool.ntp.org iburst #server 2.debian.pool.ntp.org iburst #server 3.debian.pool.ntp.org iburst # Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for # details. The web page < # might also be helpful. # # Note that "restrict" applies to both servers and clients, so a configuration # that might be intended to block requests from certain clients could also end # up blocking replies from your own upstream servers. # By default, exchange time with everybody, but don't allow configuration. restrict -4 default kod notrap nomodify nopeer noquery restrict -6 default kod notrap nomodify nopeer noquery # Local users may interrogate the ntp server more closely. restrict restrict ::1 # Clients from this (example!) subnet have unlimited access, but only if # cryptographically authenticated. #restrict mask notrust # If you want to provide time to your local subnet, change the next line. # (Again, the address is an example only.) #broadcast # If you want to listen to time broadcasts on your local subnet, de-comment the # next lines. Please do this only if you trust everybody on the network! #disable auth #broadcastclient $ NTP can be started or stopped via 'monit' as follows: $ sudo monit start stop ntpd To persistently enable or disable NTP to run when the system boots, use 'update-rc.d' instead as follows: $ sudo update-rc.d ntp enable disable 34 Plexxi Switch Administrator Guide using Linux and Plexxi CLI, 3.1.1