84

Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Embed Size (px)

Citation preview

Page 1: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service
Page 2: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service
Page 3: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Device Programmability Options with APIs

Thusi Kumarage

Lead Systems Engineer – Service Provider

BRKSDN-1119

Page 4: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

• What People Want To Automate

• Key Technologies, Protocols & APIs

• NETCONF / YANG

• REST

• JSON-RPC

• RESTCONF

• Above the Device API

• DevOps

• Controllers

Agenda

Page 5: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Types of Interactions:

Bootstrap

Configure

Monitoring

Extend

What’s Evolving:

Manual -> Automated

Static -> Dynamic

Generic -> Custom

Why:

Agility

Scale

Cost

Complexity

Evolving Our Interaction with Network OS

Page 6: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

The Evolution of Device Interaction

Traditional

Evolving ONIE

iPXE

Plug n Play

PoAP

Smart Install

Auto Install

CLI

BootstrapControllers

Openstack

Puppet/Chef

REST

JSON RPC

NETCONF

CLI

ConfigureI2RS

onePK

OpenFlow

Onbox

Python

EEM

ExtendPush model

BGP-LS

Netflow

SNMP

Syslog

CLI

Monitor

Page 7: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Configuration Management

Device 1

Vendor A

Model a

Version 1.1

Device 2

Vendor B

Model b

Version 2.3

Device X

Vendor Y

Model Ya

Version a.b

Device 3

Vendor C

Model C2

Version 11.5

Device 4

Vendor D

Model Dx

Version 1.7

• Different Management Interfaces

• Different Capabilities and Limitations

Page 8: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

How > 70% of Config Management is Done Today

zaphod# conf t

Enter configuration commands, one per line. End with CNTL/Z.

zaphod(config)#

Task Oriented

Engineer

Friendly

Easy To Replay

No Special Tools

Software Unfriendly

Subject To Change

No Common Data Model

No Error Reporting

Page 9: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

What about SNMP? That’s Software-Friendly…Right?

• SNMP works “reasonably well for device monitoring” (RFC 3535)

• Typical config: SNMPv2 read-only community strings

• Typical usage: interface statistics queries and traps

• Empirical Observation: SNMP is not used for configuration management

Lack of Writeable

MIBs

Security Concerns

Hard to Replay / Rollback

Requires special

applications

Page 10: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Requirements of Next-Gen Config Management

Easy to Use

Separates Config and Operational Data

Lots of Tooling

Accessible Format

Error Checking

Backup/Restore Capability

Human & Machine Friendly

Page 11: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Key Protocols: NETCONF

Page 12: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF is an IETF Config Management Protocol

V 1.0

• RFC 3535 Background and requirements

• RFC 47411.0 Base NETCONF Protocol

• RFC 4742NETCONF over SSH

V 1.1

• RFC 6241 –1.1 Base NETCONF Protocol

• RFC 6242 –NETCONF over SSH

Extensions

• RFC 5277 Notifications

• RFC 5717 Partial Locking

• RFC 6243 With defaults

• RFC 6244 NETCONF + YANG Architectural Overview

Content

Operations

Messages

Transport

Protocol Stack

Page 13: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

• NMS

• Script

• Plugin

• Cut-n-Paste

NETCONF Uses a Client-Server Model

ServerClient

SSH

Connection-Oriented

Authenticated

Reliable

Trustworthy

Secure

Page 14: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Clients Make Requests Using RPCs

ServerClient

<rpc message-id=“1”>

<rpc-reply message-id=“1”>

A simple Remote Procedure Call (RPC) paradigm facilitates communication

between the client and the server (aka the network device).

Page 15: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Operations: What Clients Do to ServersOperation Description

<get-config> Retrieve all or part of specified configuration datastore

<edit-config> Loads all or part of a configuration to the specified configuration datastore

<copy-config> Replace an entire configuration datastore with another

<delete-config> Delete a configuration datastore

<commit> Copy candidate datastore to running datastore

<get> Retrieve running configuration and device state information

<lock> / <unlock> Lock or unlock the entire configuration datastore system

<close-session> Graceful termination of NETCONF session

<kill-session> Forced termination of NETCONF session

Page 16: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Data Stores: Target of Operations

• Named containers that may hold an entire copy of the configuration

• Not all data stores are supported by all devices

• Running is the only mandatory data store

• Not all data stores are writable

• Check the device’s capabilities

• To make changes to a non-writeable data store, copy from a writable one

• URL is supported by IOS (for config-copy)

<running> <startup> <candidate> <URL>

Page 17: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Encodes Everything In XML

<?xml version='1.0' encoding='UTF-8'?>

<rpc message-id="1001">

<get-config>

<source>

<running/>

</source>

</get-config>

</rpc>

eXtensible Markup Language

• XML describes data

• <> delimit markup text (tags)

• Machine and human readable

• W3C Recommendation

• Self-descriptive

Page 18: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Protocol Stack Summary

• Config / Operational DataContent

• <get>, <get-config>, etcOperations

• <rpc>,<rpc-reply>Messages

• SSHTransport

Page 19: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Configuring Cisco Network Devices for NETCONF

Configuration Notes

XR5.2 (config)#ssh server v2

(config)#netconf agent tty

Requires k9sec and

mgbl packages

XR5.3/

6.0

(config)#ssh server v2

(config)#ssh server netconf port 830

(config)#netconf-yang agent ssh

NETCONF 1.1

Specifying port is

optional, default is 830

NXOS (config)#feature ssh Enabled by default

IOS /

XE

(config)#ip ssh version 2

(config)#netconf ssh

Need to enable SSH

Page 20: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Demo: NETCONFThe Hard Way

Page 21: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Demo – Hard Way

ssh [email protected] -p 830 -s netconf

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><ns2:hello

xmlns:ns2="urn:ietf:params:xml:ns:netconf:base:1.0"><capabilities><capability>ur

n:ietf:params:netconf:base:1.1</capability><capability>urn:ietf:params:xml:ns:yan

g:ietf-netconf-

monitoring</capability><capability>urn:ietf:params:netconf:capability:candidate:1.

0</capability><capability>urn:ietf:params:netconf:capability:rollback-on-

error:1.0</capability><capability>urn:ietf:params:netconf:capability:validate:1.1</c

apability><capability>urn:ietf:params:netconf:capability:confirmed-

commit:1.1</capability></capabilities></ns2:hello>

]]>]]>

Page 22: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Demo – Hard Way

#166

<?xml version="1.0" encoding="UTF-8"?><rpc message-id="101"

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><get-

config><source><running/></source></get-config></rpc>

##

#266

<?xml version="1.0" encoding="UTF-8"?><rpc message-id="102"

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><get-

config><source><running/></source><filter><interface-configurations

xmlns="http://cisco.com/ns/yang/Cisco-IOS-XR-ifmgr-cfg"/></filter></get-

config></rpc>

##

Page 23: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Demo – Hard Way#463

<?xml version="1.0" encoding="UTF-8"?><rpc message-id="104"

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><edit-

config><target><candidate/></target><config><interface-configurations

xmlns="http://cisco.com/ns/yang/Cisco-IOS-XR-ifmgr-cfg"><interface-

configuration><active>act</active><interface-name>Loopback100</interface-

name><description>Configured by Netconf CLI</description></interface-

configuration></interface-configurations></config></edit-config></rpc>

##

#123

<?xml version="1.0" encoding="UTF-8"?><rpc message-id="106"

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><commit/></rpc>

##

Page 24: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

<hello> in IOS XRTKUMARAG-M-80UC:~ tkumarag$ ssh -p 830 -s [email protected] netconf

[email protected]'s password:

<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">

<capabilities>

<capability>urn:ietf:params:netconf:base:1.1</capability>

<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-monitoring</capability>

<capability>urn:ietf:params:netconf:capability:candidate:1.0</capability>

<capability>urn:ietf:params:netconf:capability:rollback-on-error:1.0</capability>

<capability>urn:ietf:params:netconf:capability:validate:1.1</capability>

<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.1</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-cdp-cfg?module=Cisco-IOS-XR-cdp-

cfg&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-cdp-oper?module=Cisco-IOS-XR-cdp-

oper&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-config-mibs-cfg?module=Cisco-IOS-XR-config-

mibs-cfg&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-crypto-sam-cfg?module=Cisco-IOS-XR-crypto-sam-

cfg&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-crypto-sam-oper?module=Cisco-IOS-XR-crypto-sam-

oper&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-crypto-ssh-cfg?module=Cisco-IOS-XR-crypto-ssh-

cfg&amp;revision=2015-01-07</capability>

<capability>http://cisco.com/ns/yang/Cisco-IOS-XR-crypto-ssh-oper?module=Cisco-IOS-XR-crypto-ssh-

oper&amp;revision=2015-06-02</capability>

<snipped>

Page 25: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

<hello> in IOS XETKUMARAG-M-80UC:~ tkumarag$ ssh -s [email protected] netconf

Password:

<?xml version="1.0" encoding="UTF-8"?>

<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">

<capabilities>

<capability>

urn:ietf:params:netconf:base:1.0

</capability>

<capability>

urn:ietf:params:netconf:capability:writeable-running:1.0

</capability>

<capability>

urn:ietf:params:netconf:capability:startup:1.0

</capability>

<capability>

urn:ietf:params:netconf:capability:url:1.0

</capability>

<capability>

urn:cisco:params:netconf:capability:pi-data-model:1.0

</capability>

<capability>

urn:cisco:params:netconf:capability:notification:1.0

</capability>

</capabilities>

<session-id>3090573800</session-id>

</hello>

]]>]]>

Page 26: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Demo: NETCONFEasy Ways

Page 27: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF Demo – Easy Way

Download @ https://developer.cisco.com/site/confD/downloads/

Example:

./netconf-console --user=thusi --password=thusi --host=10.67.182.158 --port=830

--get-config

Page 28: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NETCONF References

• Tutorials:

• https://www.youtube.com/watch?v=Vr4kB1_6fLQ

• https://www.youtube.com/watch?v=xoPZO1N-x38

• Tools:

• Ncclient: https://github.com/leopoul/ncclient/

• Confd Netconf-console: http://www.tail-f.com/management-agent/

• References

• RFC 6241 https://tools.ietf.org/html/rfc6241

• RFC 6242 https://tools.ietf.org/html/rfc6242

Page 29: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Key Technologies: Data Models & YANG

Page 30: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Models

Source: https://en.wikipedia.org/wiki/Bunnings_Warehouse

Page 31: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Data Model Requirements for NETCONF

Easily Instantiated as XML

Easy to Read

Domain Specific

Extensible

Rich Conditions & Constraints

Page 32: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Network Management

Device 1

Vendor A

Model a

Version 1.1

Device 2

Vendor B

Model b

Version 2.3

Device X

Vendor Y

Model Ya

Version a.b

Device 3

Vendor C

Model C2

Version 11.5

Device 4

Vendor D

Model Dx

Version 1.7

Netconf

Yang

Device Models Service Models

Page 33: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Container

Leaf

Container

Leaf-List

Container

List

Leaf

Container Leaf Leaf Leaf-Ref

Leaf

Container Leaf Leaf Leaf-Ref

Leaf

Container Leaf Leaf Leaf-Ref

YANG Model Statements and Hierarchy

Leaf: single value of a defined type

Leaf-list: multiple values of the same type

List: multiple records containing at least one leaf (key) and an arbitrary hierarchy of other statements

Container: groups other statements; has no value

Leafref: is a reference to another leaf

RFC6020

Page 34: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

YANG Is A Language

module ietf-interfaces {import ietf-yang-types {

prefix yang; }container interfaces {

list interface { key "name"; leaf name {

type string;}leaf enabled {

type boolean; default "true";

}…

Self-contained top-level hierarchy of nodes

Import or define data types

RFC7223

Edited for Brevity

Leaf nodes for simple data

Lists for sequence of entries

Containers group related nodes

Page 35: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

The Interfaces Data Model in Tree Diagram

Source: http://www.ietf.org/rfc/rfc7223.txt

Page 36: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

The XML Instantiation<rpc-reply

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"

message-id="101">

<data>

<interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces”

xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type” >

<interface>

<name>eth0</name>

<type>ianaift:ethernetCsmacd</type>

<enabled>false</enabled>

</interface>

</interfaces>

</data>

</rpc-reply>

Page 37: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Where Yang Models Come From

IETF Vendors OpenConfig Other

Page 38: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

YANG References

• Tutorials

• http://www.yang-central.org/twiki/bin/view/Main/YangTutorials

• https://www.youtube.com/watch?v=33VBb6N4yOY

• Tools

• Pyang (python) https://code.google.com/p/pyang/

• Commercial YANG browsers – MG-Soft, Segue Soft

• http://rob.sh/post/209 (pyangbind)

• References

• RFC 6020 (YANG) : http://tools.ietf.org/html/rfc6020

• RFC 7223 (Interface Model) http://www.ietf.org/rfc/rfc7223.txt

• https://github.com/YangModels/yang/tree/master/experimental/openconfig (OpenConfig)

• https://github.com/YangModels/yang/tree/master/vendor/cisco (Cisco)

Page 39: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Demo: YANG

Page 40: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Yang Demo

get-schema for Cisco-IOS-XR-ifmgr-cfg

#248

<?xml version="1.0" encoding="UTF-8"?><rpc message-id="102"

xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><get-schema

xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-monitoring" ><identifier>Cisco-

IOS-XR-ifmgr-cfg</identifier></get-schema></rpc>

##

Page 41: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Yang Demo

~ ubuntu$ git clone https://github.com/YangModels/yang.git

~ ubuntu$ cd /yang/vendor/cisco/xr/600

ubuntu:~/yang/vendor/cisco/xr/600$ vim Cisco-IOS-XR-ifmgr-cfg.yang

ubuntu:~/yang/vendor/cisco/xr/600$ pyang -f tree Cisco-IOS-XR-ifmgr-cfg.yang

Page 42: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Available Tools : Yang Explorer

Page 43: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Key API: REST

Page 44: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST Follows a Familiar Model

HTTP GET

HTML

Describes how data

should be displayed to

please human viewer

HTTP GET

JSON/XML

Describes data in a

format applications

can understand

{"ids":[303776224, 19449911, 607032789,

86544242, 2506725913, 17631389],

"next_cursor":0, "next_cursor_str":"0",

"previous_cursor":0, "previous_cursor_str":"0"}

Web Browsing REST API

Page 45: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

This is a RESTful API. Try It Yourself!https://restcountries.eu/

JSON

• JavaScript Object Notation

• Language independent data

format

• Light-weight, open

standard, human readable

• Compact alternative to XML

• RFC 4627

Page 46: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST= REpresentational State Transfer

Proposed by Roy Fielding in 2000

Developed by W3C in parallel with HTTP 1.1

REST is An Architectural Style

Simple CRUD using HTTP

Stateless client-server model

Uses URIs to identify resources of interest

Page 47: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

There Are LOTS of RESTful APIs

Page 48: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Why Does This Matter for Networking?

Human Readable

Software Friendly

Large Developer

Base

Client Libraries in Many

Languages

Page 49: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST: It’s Not Just for Web Services

https://developer.cisco.com/

Page 50: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST: Coming Soon to a Device Near You?

CSR1kV in 3.10S, RSP2 in XE 3.16

ASR1001-X, ASR1002-X in XE 3.14S

ASA 5500-X/ASAv v1.0 Dec14,FP9300 ASA Module v1.2 March15

Support Features are evolving

Page 51: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Demo: CURLing/ POSTMAN

Page 52: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Enabling REST API – CSR1000v

Configuration Notes

(config)#interfaceGigabitEthernet1

(config)#ip address <address> <mask>

Configure shared

Management Interface

(config)#virtual-service csr_mgmt

(config-virt-serv)#no activate

(config-virt-serv)#ip shared host-

interface GigabitEthernet1

(config-virt-serv)#activate

Configure virtual service

container and map

management interface

http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/csr1000Vswcfg/RESTAPI.html

Page 53: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST Demo – Curling

##### Curl - Authenticate and Create a New Token

curl -X POST https://10.67.182.155:55443/api/v1/auth/token-services -H "Accept:application/json" -u "cisco:cisco" -k -3 -s | ./TXTFormat

TOKEN={”returned token ID”}

##### Show Interface Config

curl -H "Accept:application/json" -H "X-Auth-Token:$TOKEN" -H "content-type:application/json" -X GET https://10.67.182.155:55443/api/v1/interfaces/Gigabitethernet1 -k -3 -s | ./TXTFormat

##### Show Interface Stats

curl -H "Accept:application/json" -H "X-Auth-Token:$TOKEN" -H "content-type:application/json" -X GET https://10.67.182.155:55443/api/v1/interfaces/Gigabitethernet1/statistics -k -3 -s | ./TXTFormat

Page 54: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST Demo – Curling

##### Configure ACL without port ##

curl -H "Accept:application/json" -H "X-Auth-Token:$TOKEN" -H "content-type:application/json" -X POST https://10.67.182.155:55443/api/v1/acl -d '{"rules":[{"sequence":"1","protocol":"tcp", "source":"10.1.1.0/24", "destination":"20.1.1.0/24", "action":"permit" }]}' -k -3 -s

##### Show ACL ##

curl -H "Accept:application/json" -H "X-Auth-Token:$TOKEN" -H "content-type:application/json" -X GET https://10.67.182.155:55443/api/v1/acl -k -3 -s | ./TXTFormat

##### Delete ACL ##

curl -H "Accept:application/json" -H "X-Auth-Token:$TOKEN" -H "content-type:application/json" -X DELETE https://10.67.182.155:55443/api/v1/acl/onep-acl-2953-2 -k -3 -s

Page 55: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST Demo – POSTMAN

Page 56: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Key APIs: JSON-RPC

Page 57: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

JSON-RPC: Like REST but Different

Source: http://www.drive.com.au/motor-news/head-to-head-subaru-brz-v-toyota-86-gts-20120806-23otc.html

Page 58: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Alike: Both Send/Receive JSON

REST (CSR 1000v) JSON-RPC (N7K NX-API)

Page 59: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST: Many Resources

• https://10.67.182.155/api/v1…

…/global/banner

…/global/hostname

…/global/reload

…/interfaces/…

…/routing-svc/…

…/nat-svc/…

…/acl/…

JSON-RPC: Few Resources

• https://10.66.166.94/ins

Different: Resources (URIs)

CSR1kV Nexus 3/5/7/9K

Page 60: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

REST: Standard HTTP Methods

• GET: Retrieve/List

• PUT: Replace

• POST: Create New Entry

• DELETE: Delete

JSON-RPC: POST + body method

Different: Methods

Page 61: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

JSON-RPC Details

• A very simple remote procedure call protocol encoded in JSON

• http://www.jsonrpc.org/specification

JSON RPC Request Properties

• jsonrpc - (string) specifying the version - MUST be exacly "2.0"

• method – (string) name of the method to be invoked.

• params – (array) objects to be passed as parameters to the defined method.

• Id – (any type) used to match the response with request

JSON RPC Response Properties

• jsonrpc - (string) specifying the version - MUST be exacly "2.0"

• result - data returned by the invoked method.

• error - specified Error code if there was an error invoking the method, otherwise null.

• id - id of the corresponding request.

Page 62: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

NX-API: JSON-RPC (and XML, JSON)

Nexus 9000, Nexus 3000, Nexus 7000 and 5000

Extension of CLI over HTTPs

• Show, config, Linux Bash

Page 63: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Demo: JSON-RPC

Page 64: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

JSON-RPC Demo

curl -X POST http://10.66.166.94/ins -u "admin:123Cisco123" -H "content-type:application/json-rpc" -d '{"jsonrpc": "2.0", "method": "cli", "params": {"cmd": "show int count err", "version": 1.2 }, "id": 1}’

Interface config – change description :

curl -X POST http://10.66.166.94/ins -u "admin:123Cisco123" -H "content-type:application/json-rpc" -d '[{"jsonrpc": "2.0", "method": "cli", "params": {"cmd": "conf t", "version": 1.2}, "id": 1}, {"jsonrpc": "2.0", "method": "cli", "params": {"cmd": "interface eth 2/1", "version": 1.2}, "id": 2}, {"jsonrpc": "2.0", "method":"cli", "params": {"cmd": "description changed by CiscoLiveDemo", "version": 1.2}, "id": 3}]'

Page 65: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

JSON-RPC Demo

Page 66: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Key APIs: RESTCONF

Page 67: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

RESTCONF: Best of Both Worlds?

NETCONF/YANG

– SSH

– XML

+ JSON

+ HTTP(S)

RESTCONF

NETCONF RESTYANG

JSON

HTTP

“the simplicity of the HTTP protocol with the predictability

and automation potential of a schema-driven API”

Page 68: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

RESTCONF is Not A Replacement for NETCONF

• Enables Web Applications to access configuration and operational data

• A simplified transaction model

• Data can be XML or JSON

• Operations include: DELETE, PATCH, POST, PUT, GET

NETCONF Operations Not Supported By RESTCONF

• Config locking

• Candidate config

• Startup config

• Validate

• Confirmed commit

Page 69: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

It’s Still Early Days for RESTCONF

RESTCONF

NETCONF http://datatracker.ietf.org/doc/draft-ietf-netconf-

restconf/

HTTP REQUEST:

GET /restconf/operational/opendaylight-inventory:nodes/node/pe1

HTTP/1.1

Host: norcal-00:8181

Accept: application/xml

Page 70: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Above the API

Page 71: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

DevOps: Applying IT Automation Tools to Networks

Master/client

Agent-driven (mostly)

Intent-based

Page 72: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Openstack: Applying Cloud Automation Tools To Networks

• Openstack: set of software tools for building and managing cloud computing platforms

• Allows users to spin up and connect VMs and other resources

• Can spin up virtual routers (e.g. CSR) and configure physical and virtual routers.

• Actual interface to device: NETCONF (NX), REST (CSR)

Page 73: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Controllers: Applying a Centralized Model

Page 74: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Controllers: Applying a Centralized ModelTAIL-F NCS

Page 75: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Controllers: Applying a Centralized Model

Page 76: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Resources• Devops

• http://www.infoworld.com/article/2609482/data-center/data-center-review-puppet-vs-chef-vs-ansible-vs-salt.html

• http://jedelman.com/home/leveraging-cisco-nx-api-with-ansible-to-make-your-life-easier/

• https://github.com/spotify/napalm

• Openstack

• http://www.cisco.com/c/en/us/solutions/data-center-virtualization/openstack-at-cisco/index.html

• http://docwiki.cisco.com/wiki/Install_and_Setup_of_Cisco_Cloud_Services_Router_(CSR)_for_OpenStack_VPN

• Controllers

• http://www.opendaylight.org/

• http://www.tail-f.com/

• https://developer.cisco.com/site/apic-em/

Page 77: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Conclusion

Page 78: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

The Network Isn’t Isolated Anymore

Network

Web Apps

Cloud

DevOpsREST

JSON

RubyPython

JSON-RPC

XMLNETCONF

RESTCONFAnsible

Puppet

Openstack

Mashups

YANG

Chef

Page 79: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Configuration Automation SummaryProtocol / Tool Platform Availability Coverage Pros Cons

XR NX XE IO

S

ASA

CLI All All Features, All

Platforms

Not Automation Friendly

NETCONF All Industry Standard Evolving Data Models

YANG Growing Tooling Early days

REST Task-specific Popular format Limited Platforms

JSON-RPC All Popular format Limited Platforms

Puppet/Chef Task-specific Devops-ready Server optimized

Openstack Task-specific Cloud-ready Limited use cases

Page 80: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Further Interested ?

• DEVNET-1000 - Coding 100: Why should I care about APIs?

• DEVNET-1077 - Automating with NX-OS - Let's Get Started

• BRKSPG-3630 - Service Driven Network Automation - Powered by Tail-f

• DEVNET-1081 - Introduction to RESTCONF

• BRKSPG-3616 - SDN and NFV for Service Providers

• BRKSEC-2760 - Automating and Accelerating Security Through SDN and NFV Architecture

• BRKSDN-2065 - Cisco Virtual Managed Services (vMS)

• DEVNET-1623 - The APIC Enterprise Module API - Overview

Page 81: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Q & A

Page 82: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Complete Your Online Session Evaluation

Learn online with Cisco Live!

Visit us online after the conference

for full access to session videos and

presentations.

www.CiscoLiveAPAC.com

Give us your feedback and receive a

Cisco 2016 T-Shirt by completing the

Overall Event Survey and 5 Session

Evaluations.– Directly from your mobile device on the Cisco Live

Mobile App

– By visiting the Cisco Live Mobile Site http://showcase.genie-connect.com/ciscolivemelbourne2016/

– Visit any Cisco Live Internet Station located

throughout the venue

T-Shirts can be collected Friday 11 March

at Registration

Page 83: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service

Thank you

Page 84: Device Programmability - …d2zmdbbm9feqrf.cloudfront.net/2016/anz/pdf/BRKSDN-1119.pdf · Device Programmability Options with APIs Thusi Kumarage Lead Systems Engineer –Service