Downloaded 99 times
![© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 10DEVNET- 1002 Jinja Template # Simple Variable Replacment hostname {{sitecode}}-fw # Variable Replacement based on Dictionary route outside 0.0.0.0 0.0.0.0 {{config['vlan101']['ip'][1]}} # Loop Through set of data to create multiple lines {%for route in config['routes'] %} route oob-vpn {{config['routes'][route]['network']}} {{config['routes'][route]['mask']}} {{config['vlan90']['ip'][1]}} {% endfor %} # Conditional Statements {% if config[‘vlan41’] is defined %} route dmzext {{config['vlan41']['ip'][0]}} {{config['vlan41']['ip'].netmask}} {{config['vlan102']['ip'][1]}} {endif %} Contains variables and/or expressions which get replaced with values when rendered](https://image.slidesharecdn.com/devnet-1002kuhlsv1-160807233045/75/NetDevOps-for-the-Network-Dude-How-to-get-started-with-API-s-Ansible-and-Python-10-2048.jpg)
Uploaded byCisco DevNet
NetDevOps for the Network Dude: How to get started with API's, Ansible and Python
This document provides an agenda and overview for a presentation on network automation using APIs, Ansible, and Python. The presentation introduces network programmability and automation tools like Ansible, discusses using infrastructure as code approaches, and provides examples of automating network device configurations and modules using Python and Jinja templates. It aims to help network engineers get started with network automation.
NetDevOps for the Network Dude: How to get started with API's, Ansible and Python
- 1. NetDevOps for theNetwork Dude How to get started with API's, Ansible and Python Kevin Kuhls, Technical Leader @sdn_dude DEVNET- 1002
- 2. • Introduction • AutomationMotivation • Tools • Infrastructure as Code • Programmable Modules • Conclusion Agenda
- 3. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 3DEVNET- 1002 Who’s this guy? • 1998 – Cisco Router • 2002 – PIX Firewall • BIG LULL • 2012 – DC Technologies (UCS, Nexus, VMWare) • 2014 – OpenStack, ACI • 2015 – Network Programmability, SDN • Old Dog learning new tricks …and should I listen or look at my phone?
- 4. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 4DEVNET- 1002 Motivators for Automation • Lots of Equipment • ~1000 Network Devices • Multiple Operating Systems • IOS • IOSXR • IOSXE • NXOS • ASA OS • Multivendor Security Appliances (WAF, DDoS, LB) • Small team • 6 people • Rapid Deployment • Several new Datacenters per year • Several Service Deployments requiring changes
- 5. Demo – AutomatedFabric Install
- 6. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 6DEVNET- 1002 Automation Requirements • Efficient • Repeatable • Reusable • Observable • Revision controlled • Standard We need an Automation framework that is full of ERRORS
- 7. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public What is Ansible Ansible, an open source community project sponsored by Red Hat, is the simplest way to automate IT. Ansible is the only automation language that can be used across entire IT teams – from systems and network administrators to developers and managers. Ansible by Red Hat provides enterprise-ready solutions to automate your entire application lifecycle – from servers to clouds to containers and everything in between. It uses no agents and no additional custom security infrastructure, so it's easy to deploy - and most importantly, it uses a very simple language (YAML, in the form of Ansible Playbooks) that allow you to describe your automation jobs in a way that approaches plain English. 7DEVNET- 1002
- 8. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public Why did we choose Ansible? • Agentless • Server and support teams already using Ansible • Infrastructure as code • Simple to use and learn • Community and vendor driven • Modular framework, easily modified • Leverage many common programming languages 8DEVNET- 1002
- 9. Exercise 1 -Ansible 2.1 IOS
- 10. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 10DEVNET- 1002 Jinja Template # Simple Variable Replacment hostname {{sitecode}}-fw # Variable Replacement based on Dictionary route outside 0.0.0.0 0.0.0.0 {{config['vlan101']['ip'][1]}} # Loop Through set of data to create multiple lines {%for route in config['routes'] %} route oob-vpn {{config['routes'][route]['network']}} {{config['routes'][route]['mask']}} {{config['vlan90']['ip'][1]}} {% endfor %} # Conditional Statements {% if config[‘vlan41’] is defined %} route dmzext {{config['vlan41']['ip'][0]}} {{config['vlan41']['ip'].netmask}} {{config['vlan102']['ip'][1]}} {endif %} Contains variables and/or expressions which get replaced with values when rendered
- 11. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 11DEVNET- 1002 Yaml • Structure to define: • dictionary (unordered set of key value pairs, lists) • list of items • key value pair # A sample employee record name: Kevin Kuhls job: Network Engineer skill: Advanced employed: True certifications: - CCIE RS - CCIE DC - CISSP - VCP languages: perl: Novice python: Intermediate education: | BS in Computer Engineering
- 12. Exercise 2 –Ansible 2.1 IOS
- 13. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 13DEVNET- 1002 Infrastructure as Code svc_object_groups: - name: ossdm-elk-ports-tcp protocol: tcp values: - 9092 net_object_groups: - name: ossdm-elk values: - '{{ ossdm_kfk_001 }}' - '{{ ossdm_kfk_002 }}' - '{{ ossdm_kfk_003 }}’ Represent a Configuration as a set of machine-processable definition files access_lists: - name: APPS-IN entry: dest_address: ossdm-elk src_address: cis-apps dest_service: ossdm-elk- ports-tcp permit: true protocol: tcp position: 1
- 14. Infrastructure as Codeexercise
- 15. Customize or Writeyour own
- 16. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public 16DEVNET- 1002 Network Device Application Program Interfaces • IOS • CLI • IOS-XE • CLI • Netconf (with ConfD) • IOS-XR • CLI • Netconf • NXOS • CLI • NXAPI • ACI • APIC Rest API • ASA • CLI • ASA Rest API
- 17. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public References Ansible – http://www.Ansible.com Jinja - https://kontrolissues.net/2016/01/14/intro-to-jinja2/ YAML - http://www.yaml.org/start.html VIRL – Virtual Internet Routing Lab (how the demos were deployed) http://virl.cisco.com/ dCloud – The Cisco Demo Cloud (where the demos were deployed) https://dcloud.cisco.com/ Source code in Github: • Clone exercises from session: git clone git@github.com:kuhlskev/devnet1002.git • Ansible Networking - https://github.com/ansible/ansible-modules-core/tree/stable-2.1/network • Napalm - https://github.com/napalm-automation/napalm • Pycsco - https://github.com/jedelman8/pycsco • Pyiosxr - https://github.com/fooelisa/pyiosxr • ASA - https://github.com/networklore/ansible-cisco-asa, https://github.com/kuhlskev/ansible-cisco-asa • Netmiko - https://github.com/ktbyers/netmiko Blogs: • https://pynet.twb-tech.com/ • http://jedelman.com/home/ansible-for-networking/ • https://pynet.twb-tech.com/blog/automation/napalm-ios.html • https://networklore.com/ 17DEVNET- 1002
- 18. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public Complete Your Online Session Evaluation Don’t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online • Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 Amazon gift card. • Complete your session surveys through the Cisco Live mobile app or from the Session Catalog on CiscoLive.com/us. 18DEVNET- 1002
- 19. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public Continue Your Education • Demos in the Cisco campus • Walk-in Self-Paced Labs • Lunch & Learn • Meet the Engineer 1:1 meetings • Related sessions: • DEVNET-1016 Transforming Network Operations from Configuration Automation Through State Validation with Ansible • LABNMS-1023 NX-OS Programming Lab • BRKDCT-2459 Programmability and Automation on Cisco Nexus Platforms 19DEVNET- 1002
- 20.
- 22. © 2016 Ciscoand/or its affiliates. All rights reserved. Cisco Public Network Programmability Cisco Education Offerings Course Description Cisco Certification Integrating Business Applications with Network Programmability (NIPBA); Integrating Business Applications with Network Programmability for Cisco ACI (NPIBAACI) Learn networking concepts, and how to deploy and troubleshoot programmable network architectures with these self-paced courses. Cisco Business Application Engineer Specialist Certification Developing with Cisco Network Programmability (NPDEV); Developing with Cisco Network Programmability for Cisco ACI (NPDEVACI) Learn how to build applications for network environments and effectively bridge the gap between IT professionals and software developers. Cisco Network Programmability Developer Specialist Certification Designing with Cisco Network Programmability (NPDES); Designing with Cisco Network Programmability for Cisco ACI (NPDESACI) Learn how to expand your skill set from traditional IT infrastructure to application integration through programmability. Cisco Network Programmability Design Specialist Certification Implementing Cisco Network Programmability (NPENG); Implementing Cisco Network Programmability for Cisco ACI (NPENGACI) Learn how to implement and troubleshoot open IT infrastructure technologies. Cisco Network Programmability Engineer Specialist Certification For more details, please visit: http://learningnetwork.cisco.com Questions? Visit the Learning@Cisco Booth or contact ask-edu-pm-dcv@cisco.com 22DEVNET- 1002
Editor's Notes
- #2 Everyone will have computer with Anyconnect to dcloud instance with IOSXR, IOSXE, IOS, NXOS, ASA devices. Try out simple ansible core network modules for IOS/IOSXE/IOSXR/NXOS, and asa-api Clients need Python, ansible, pycsco, pyiosxr, netmiko from pip Git pull asa-api,
- #6 Show VIRL with the layout and intended outcome I want to deploy (or redeploy) a new Datacenter. “Server A” and “server B” are in separate subnets and different security zones on the fw. We need L2, L3, FW rules, and routing all configured to establish connectivity. I’m going to kick off the ansible playbooks to create and deploy configs. Then we’ll step through the simple bulding blocks to get us there.
- #7 I something that is ... efficient - it has to save time, not just for fun repeatable - repeat the process and expect a similar result if there are minor changes or I want to run again and take advantage of idempotency reusable - the same framework Im using for routers I want to use for switches or even servers observable - logging and output data to validate and audit revision controlled - a central repo for code to share and collaborate (git, gerrit, cvs, etc) standard - I want an industry backed product or tool that is going to be there for a while and that I can leverage a wide range of developers
- #8 Got permission from Warren Zweigart <wzweigart@ansible.com> https://www.ansible.com/logos
- #9 Agentless- we cant load an agent on most network devices Server team was already on ansible for deployment and Represented the infrastrucure as code – maintain the yaml and deploy via playbooks Simple – can spin up users and developers in days or weeks Community – there are modules for nearly everything you could need Modular – chop up, add, remove, whatever its all open source Leverage languages – python, perl, ruby, tcl, bash, whatever the endpoint can execute and return values
- #10 Let’s say your OSS team just deployed another Monitoring server or the security team has a new scanning tool that you need to permit access. Oridinarily that would mean updating a VTY acl on every device. Ansible can take an inventory of devices and make the vty update via config module Command – sends arbritrary command Config – Block of commands with context and order Template – Push config based on template, compare config to template https://docs.ansible.com/ansible/list_of_network_modules.html https://github.com/ansible/ansible-modules-core/tree/aa995806b9b5a41de4bd3d2a6ba917528fe8b6bb/network/ios
- #12 Education is multiline entry to preserve the newline
- #13 Now, we want to use what we learned to deploy a new site. We don’t want to do find/replace on a template document (show getvpn cvd). We’d like something that can grow dynamically. What do we really need to know to build a config from the template. Show the vars/main.yml. We can generate configs based on a template. We can take it a step further and generate the config from the template and apply it to the inventory of devices.
- #15 ASA-API, NAPALM, nxos-ansible Bring up git hub to show the code and examples of what they can do. Demonstrate ASA-API
- #16 Modules are an executable piece of code, many are python Bring up github, and show the code. Bring up code in There is a lot of functionality baked into ansible and there are several projects created as foundation or to enhance the experience. If something is not quite what you want, fork the code and do it yourself or create something altogether new. Go to github and start looking at ansible network code, then… For example, Nxos-ansible (Jason Edelman), many have become core Ansible Pyiosxr Napalm Or stay in python Ignite Netmiko
- #17 I’d be remiss in not mentioning APIC-EM or NSO which can present a northbound API with CLI southbound. Similarly, Prime can interact with the devices.