davidbetz/virlconfig

Cisco VIRL Config Creator

Copyright © 2019 David Betz

https://img.shields.io/github/license/mashape/apistatus.svg]() https://travis-ci.org/davidbetz/virlconfig.svg?branch=master](https://travis-ci.org/davidbetz/virlconfig) https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg]([***]

Why do you want this?

• You want to console to each VIRL device.
• You want to use Ansible with VIRL devices.

How do you use it?

Download the binary and skim below instructions.

One of the core purposes of using Go is to avoid the needs to install a library and download the source. You can use the binary directly.

• https://raw.githubusercontent.com/davidbetz/virlconfig-binary/master/virlconfig

• https://raw.githubusercontent.com/davidbetz/virlconfig-binary/master/virlconfig.exe

• Docker: docker run davidbetz/virlconfig

For Docker, it's more practical to use the docker-compose.yml file.

Modes

There are a few modes:

• shows node, interface, and telnet data for each device (config)
• creates a SecureCRT VBS script to connect to each device via telnet (securecrt)
• creates Linux and CLI config required to enable SSH on each device (ssh)
• creates an Ansible inventory file for a simulation (ansible)
• creates RESTCONF and SSH tunneling config (restconf)
• provides unified RESTCONF and SSH config for CSR1000v (csr1000v)

Sample usage:

./virlconfig -host 10.10.20.160 -alias -writeToFiles -mode ansible -path '/home/user/ansible-cisco/multicast-mpls'

Use Cases

This tool will create the SecureCRT for you so you can connect to each device, create SSH config so you can enable SSH on each device, and create an Ansible inventory file which will let you interact with the devices with Ansible.

Use Case: I just want consoles to the devices.

Use securecrt. This will give you the VBS file you can open in SecureCRT. You should just keep a single VBS file around and update the contents of Setup. See the following output:

' two-GXx69L.vbs
Sub Main()
    Setup "10.10.20.160"
End Sub

Sub Setup(address)
    StartInNewTab address, "csr1000v-1", ***
    StartInNewTab address, "csr1000v-2", ***
End Sub

Sub StartInNewTab(address, name, port)
    Set tab = crt.Session.ConnectInTab("/telnet " & address & " " & port)
    tab.Caption = name
End Sub

Use Script->Run in SecureCRT to open a console to each node.

Use -alias for simpler names:

' two-GXx69L.vbs
Sub Main()
    Setup "10.10.20.160"
End Sub

Sub Setup(address)
    StartInNewTab address, "r1", ***
    StartInNewTab address, "r2", ***
End Sub

Sub StartInNewTab(address, name, port)
    Set tab = crt.Session.ConnectInTab("/telnet " & address & " " & port)
    tab.Caption = name
End Sub

Use -writeToFiles to create the SecureCRT vbs file automatically. It will be in the same folder as virlconfig.

Use Case: I want to use RESTCONF to interact with CSR1000v devices.

To use RESTCONF on a device, you enable restconf, the HTTP server, and enable AAA for exec and for HTTP. Basically this:

conf t
aaa new-model
aaa authorization exec default local
restconf
ip http authentication local
ip http secure-server
end

You'll add that to each device.

You can use the SecureCRT mode to quickly connect to all devices at once.

OPTIONAL: typing a password once isn't a big deal, so copying an SSH key seems a big overkil, but you can do it:

sshpass -p guest ssh-copy-id guest@JUMPBOXIP

With that you can get on your jumpbox and run your HTTP calls:

curl -k -u "cisco:cisco" -H "Accept: application/yang-data+json, application/yang-data.errors+json" [***]

Done.

You can access the jumpbox with ssh guest@JUMPBOXIP. That IP address is provided when the tool is run with restconf mode.

Of course, being stuck on a jumpbox sucks, so let's continue: for each device, add a LocalFoward line to your ~/.ssh/config file. This will allow you to call locally (127.0.0.1) with your calls magically going out to the RESTCONF-enabled device.

Your ~/.ssh/config file would look something like this:

Host 172.16.30.70
User guest
LocalForward 20093 10.255.0.93:443
LocalForward 20095 10.255.0.95:443
LocalForward 20096 10.255.0.96:443
LocalForward 20097 10.255.0.97:443
LocalForward 20098 10.255.0.98:443
LocalForward 20099 10.255.0.99:443
LocalForward 20100 10.255.0.100:443
LocalForward 20101 10.255.0.101:443
LocalForward 20102 10.255.0.102:443
LocalForward 20094 10.255.0.94:443

You then you setup an SSH tunnel in a separate window:

ssh -N JUMPBOX_IP

Now you can interact using something like this (notice the address and port change):

curl -k -u "cisco:cisco" -H "Accept: application/yang-data+json, application/yang-data.errors+json" [***]

All of this information is provided when you run virlconfig in restconf mode.

Here's example output:

# ~/.ssh/config
cat >> ~/.ssh/config <<\EOF
Host 172.16.30.71
User guest
LocalForward 20104 10.255.0.104:443
LocalForward 20106 10.255.0.106:443
LocalForward 20107 10.255.0.107:443
LocalForward 20108 10.255.0.108:443
LocalForward 20109 10.255.0.109:443
LocalForward 20110 10.255.0.110:443
LocalForward 20111 10.255.0.111:443
LocalForward 20112 10.255.0.112:443
LocalForward 20113 10.255.0.113:443
LocalForward 20105 10.255.0.105:443
EOF

# Setup Jump Box
sshpass -p guest ssh-copy-id guest@172.16.30.71

# SSH Tunnel
ssh -N 172.16.30.71

# Enable RESTCONF on CSR1000v
! CSR100v
conf t
aaa new-model
aaa authorization exec default local
restconf
ip http authentication local
ip http secure-server
end

Just dump the config in, add the ~/.ssh/config content, and run the ssh command.

Be careful not to overwrite the ~/.ssh/config file. You might have other important things in there. The script provides appends to the config file, so you may need to remove old entries.

Use Case: I want to interact with the nodes with Ansible.

For this use case, you can start with https://github.com/davidbetz/virlconfig-ansible-sample as a template project.

Ansible uses SSH. To setup SSH, you need a console. So, you'll be using securecrt, ssh, and ansible. This seems like a bit much, but after you do it a few times, it's no big deal.

1. follow the instructions in the SecureCRT use case to connect to each device

2. use ssh. Output similar to the following will appear:

    == Devices ==
   
    ! CSR1000v (only one config for device type)
    en
    conf t
    ip domain-name ciscolab
    *** key generate rsa
    1024
    ip ssh version 2
    username cisco priv 15 secret cisco
    line vty 0 15
    transport input ssh
    login local
    end
   
    ! iosvl2-1 (one config per device)
    en
    conf t
    ip domain-name ciscolab
    *** key generate rsa
    1024
    ip ssh version 2
    username cisco priv 15 secret cisco
    line vty 0 15
    transport input ssh
    login local
    int g0/0
    no switchport
    ip address 10.255.0.201 255.255.0.0
    no shut
    end
   
    ! iosxrv-1 (config per device)
    *** key generate rsa general-keys
    2048
    conf t
    ssh server v2
    line default transport input ssh
    interface MgmtEth0/0/CPU0/0
    ipv4 address 10.255.0.202/16
    no shut
    commit
    end
   
    ! iosxrv-2 (config per device)
    *** key generate rsa general-keys
    2048
    conf t
    ssh server v2
    line default transport input ssh
    interface MgmtEth0/0/CPU0/0
    ipv4 address 10.255.0.203/16
    no shut
    commit
    end
   
    ! nx-osv-1 (config per device)
    ! username: admin
    ! password: admin
    conf t
    int mgmt0
    ip address 10.255.0.204/16
    end
   
    ! nx-osv-2 (config per device)
    ! username: admin
    ! password: admin
    conf t
    int mgmt0
    ip address 10.255.0.205/16
    end
   
    ! nx-osv-3 (config per device)
    ! username: admin
    ! password: admin
    conf t
    int mgmt0
    ip address 10.255.0.206/16
    end
   
    ! nx-osv-4 (config per device)
    ! username: admin
    ! password: admin
    conf t
    int mgmt0
    ip address 10.255.0.207/16
    end
   
   
    # Jump Box
    sshpass -p guest ssh-copy-id guest@172.16.30.86
   

You can use the csr1000v mode to get a unified RESTCONF and SSH config.

2b) Dump the generated config into each device. For CSR1000v and IOSv, configuration is per device type. For XRv, since each config block includes an IP address, it's per dervice.

Timing can be an issue here. For CSR1000v, the device may not be renamed yet, so the SSH keys won't generate. XRv will likely require you to create a system user. Type something random.

2c) Run the jump box command. This will copy an ssh key to the jump box, clearing the way for Ansible to connect.

Example jump box command:

sshpass -p guest ssh-copy-id guest@172.16.30.71

3) Use ansible to generate the Ansible group vars and inventory file. Assuming you know Ansible, you know where to put the files.

Sample group_vars/all.yml:

---
ansible_user: "ansible"
ansible_password: "ansible"
ansible_ssh_common_args: '-o ProxyCommand "ssh -q -W %h:%p guest@172.16.30.79"'
interface: g2

Sample Ansible inventory file:

  {
    "all": {
      "children": {
       "csr1000v": {
         "hosts": {
           "csr1000v-1": {
             "ansible_host": "10.255.0.200"
           }
         }
       },
       "iosvl2": {
         "hosts": {
           "iosvl2-1": {
             "ansible_host": "10.255.0.201"
           }
         }
       },
       "iosxrv": {
         "hosts": {
           "iosxrv-1": {
             "ansible_host": "10.255.0.202"
           },
           "iosxrv-2": {
             "ansible_host": "10.255.0.203"
           }
         }
       },
       "nxosv": {
         "hosts": {
           "nx-osv-1": {
             "ansible_host": "10.255.0.204"
           },
           "nx-osv-2": {
             "ansible_host": "10.255.0.205"
           },
           "nx-osv-3": {
             "ansible_host": "10.255.0.206"
           },
           "nx-osv-4": {
             "ansible_host": "10.255.0.207"
           }
         }
       }
     }
    }
  }

Use -alias for simpler names (csr and l2 only):

"r1": {
  "ansible_host": "10.255.0.200"
}

and

"s1": {
  "ansible_host": "10.255.0.201"
}

Usage

-alias Default is false. When true, csr1000v- is replaced with r and iosvl2- with s -host string IP address of VIRL server. -mode string config, ansible, securecrt, ssh -sim string Name of simulation. Only required if there's more than one. -verbose Default is false. When true, HTTP data is displayed. -writeToFiles Default is false. When true, files are written out (securecrt only).

Docker Compose

Quickly runnable via:

    docker-compose up config
    docker-compose up ansible
    docker-compose up securecrt
    docker-compose up ssh

...or via code:

    docker-compose up config-local
    docker-compose up ansible-local
    docker-compose up securecrt-local
    docker-compose up ssh-local
    docker-compose up test

See Docker docs to install docker-compose: https://docs.docker.com/compose/install/

Makefile

If you want to install Go, you can also use the Makefile:

    make run ARGS
    make clean
    make test
    make coverage
    make linux
    make windows

make linux and make windows build static binaries.