Better Network Management Through Network Programmability

Better Network Management Through
Network Programmability
Dan Jerome, Consulting Systems Engineer

Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Agenda
 Legacy Protocols and Methods
 NETCONF
 OnePK
 Python Scripting
 Embedded Event Manager (EEM)
 Example Use Cases
 Cisco Live Orlando Case Study
3

Manual CLI
4
Slow, Error-prone and Does Not Scale
I need to get the
CDP neighbors…

Scripted CLI
5
foreach device [array
names devs] {
set username [lindex
$devs($device) 0]
set password [lindex
$devs($device) 1]
….
send “show cdp neir”
Better, but…

CLI Drawbacks
 Command Line Interface is not meant to be an API
– CLI is for people!
– No well-defined structure to output
 Using CLI forces use of a VTY (i.e., a terminal)
– Slow character-by-character or line-by-line interface
– Not ideal for large data transfers
 Changes to the CLI can break scripts
(remember “show mac-address-table”  “show mac address-table”?)
 Difficult to determine if an error actually occurred in the command sequence
6

CLI Drawbacks
 CLI output is different across different platforms:
7
show ip route (NX-OS)show ip route (IOS)

SNMP
8
snmptable –v2c –c notpublic 10.1.1.4
cdpCacheTable

SNMP Structure
 SNMP uses the Structure of
Management Interface
(SMI) as its data modeling
language
 The SMI model is laid out
as the Management
Information Base (MIB) in a
tree structure
 Objects are accessed in
lexicographical order, which
may not be conducive for all
data (e.g., large ARP
tables)
9

SNMP Drawbacks
 While structured, SNMP MIBs can be difficult to understand
 SNMP uses UDP as a transport and thus it may not be reliable
 No clear separation of operational and configuration data
 Not ideal for holistic configuration management
 Not scalable from a programmatic standpoint
– No transaction support
– No rollback
 Different devices support different MIBs (sometimes for the same function)
10
Huh?

What is NETCONF?
 NETCONF is an IETF standard configuration management protocol
 It addresses many of the short-comings in SNMP’s Structured Management
Interface (SMI) specifically to aid in the management of configuration data
– Lack of backup and restore capabilities for configurations
– No concept of transactions
– Strange or legacy concepts (e.g., limited length of string labels)
– Lack of reliable error reporting
 The “wherefore” of NETCONF can be found in RFC 3535,
“Overview of the 2002 IAB Network Management Workshop”
 NETCONF was meant to ease configuration management burden across
multiple vendors
12

Comparing NETCONF and SNMP
13
SNMP NETCONF
Data Models Defined in MIBs Defined in YANG modules (or XML
schema documents)
Data Modeling Language Structure of Management
Information (SMI)
YANG (and XML schema)
Management Operations SNMP NETCONF
Security SNMPv1/2c – Community Strings /
None
SNMPv3 – Authentication MD5/SHA
SNMPv3 – Encryption
SSH subsystem
RPC Encapsulation Basic Encoding Rules (BER) XML
Transport Protocol UDP TCP (reliable transport)

Comparing NETCONF and SNMP
14
 SNMP is a simple “object = value” representation
nocuser@nms$ snmpget -csnmpstring -v2c 10.0.0.1 sysDescr.0
RFC1213-MIB::sysDescr.0 = STRING: "Cisco IOS Software, 2800 Software
(C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T4, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 13-Mar-08 03:04 by prod_rel_team”
 A Network Management System (NMS) must still be able to parse the results
and correlate object and value
– In this example, might the multiline response cause a problem? How about special
characters?

The NETCONF Protocol
 NETCONF is defined in RFC 6241
 Provides multiple operations for interacting with configuration and operational
data
 Includes multiple configuration data stores (candidate, running, startup)
 Offers clear indication of when errors occur in operations
15
– get-config
– get
– edit-config
– commit
– validate
– copy-config
– discard-changes
– delete-config
– lock
– unlock
– create-subscription

The Protocol Layers
16
• Configuration Data
• Operational DataContent
•<get-config>
•<edit-config>
•<get>
•<…>
Operations
•<rpc>
•<notification>
•<…>
Messages
• SSH
• BEEP
• SOAP
• TLS
Transport

Flow Breakdown - Request
17
<?xml version="1.0" encoding="ISO-8859-1"?>
<rpc message-id="11">
<get-config>
<source>
<running/>
</source>
<filter>
<config-format-xml/>
</filter>
</get-config>
</rpc>
]]>]]>
NETCONF RPC
(Message) Layer
Operation Layer
Content Layer
Framing Marker

Flow Breakdown - Response
18
<?xml version="1.0" encoding="UTF-8"?>
<rpc-reply message-id="11" xmlns="urn:ietf:params:netconf:base:1.0">
<data>
<xml-config-data>
<Device-Configuration xmlns="urn:cisco:xml-pi">
<version>
<Param>15.2</Param>
</version>
<service>
<timestamps>
<debug>
<datetime>
<msec/>
</datetime>
</debug>
</timestamps>
</service>
...
</rpc-reply>
]]>]]>

Example NETCONF Interaction
Get Config
19
SSH
Client
Server

Example NETCONF Interaction
Error Reporting
SSH
Client
Server
20

One Platform Kit (onePK)
 onePK is a device-level API for Cisco’s core operating systems
 Enables one to create applications that run on or near Cisco
devices
 Provides capabilities to…
– Innovate
– Extend
– Automate
– Customize
– Enhance
– Modify
…the default behavior of Cisco devices
Overview
22
Applications
that YOU
create
Any Cisco
Router or
Switch

Hardware Silicon
IOS | IOS-XE | NX-OS | IOS-XR
Cisco onePK API’s
Applications
PhysicalDevice
onePK Architecture
23

DATA PATH
POLICY
ROUTING
ELEMENT
DISCOVERY
UTILITY
DEVELOPER
Packet delivery services to application – e.g. copy, punt,
inject
Filtering (NBAR), classification (class-map, policy-map),
actions (marking, policing, queuing), applying policy to interfaces
Read RIB Routes, add/remove routes, receive RIB
notifications
CPU/Memory statistics, interface statistics, element and
interface events
Layer 3 topology and local service discovery
Access to AAA, Syslog event and path tracing capability
Debug capability and CLI extension (invoke CLI from application)
onePK Service Sets
24

C
Jav
a
Python REST
Eclipse IDE
NetBeans IDE
Other IDE
onePK
Supports applications written in C, Java, Python, or any language that
supports REST.
Combine C API with SWIG (http://www.swig.org) to build bindings in
other languages.
Application Development
25

Router/Switch
ServerService Blade
Runs locally on the device
Router/Switch
Runs on a remote serverRuns on a service blade
onePK
APPAPP
APP onePK onePK
Application Deployment Models
26
Process Hosting Blade Hosting End-Node Hosting

Getting System Properties (in C)
char *str = NULL;
onep_element_connect(elemA, user, pwd, NULL, &sh);
onep_element_get_property(elemA, &property);
if (property) {
onep_element_to_string(elemA, &str);
if (str) {
fprintf(stderr, "nElement Info: %sn", str);
free(str);
}
}
27

Custom Routing with onePK
Data Center Traffic Forwarding Based on a Custom Algorithm
28
Custom
Routing
Application
Data Center
Data Center
Path A
Path B
Policy
onePK
onePK
onePK
API presentation layer
Unique Data Forwarding Algorithm Highly Optimized
for the Network Operator’s Application

Getting and Setting Routes (in Java)
Get Routes
Set Routes
29

How do I get started with onePK?
http://developer.cisco.com/web/getyourbuildon
30

Python Scripting Engines
 In addition to the external onePK Python API, Nexus switches include
embedded Python interpreter
 The Nexus 3K and Nexus 9K switches include a Cisco-specific set of Python
modules that provide API access to certain subsystems
 Use the python command to enter the interpreter in interactive mode
32

Getting Just-In-Time Help
 Python interpreters have built-in help that can be accessed using the help()
command once in the Python shell
 “Help” mode provides details about built-in Python modules as well as the
Cisco NX-OS API
– modules
– topics
– cisco
33

Python Scripting
Create a VRF and Add an Interface
34
import sys
from cisco import VRF
if len(sys.argv) < 3:
print "usage: vrf_demo.py VRF_NAME INTERFACE"
exit(1)
vname = sys.argv[1]
intf = sys.argv[2]
v = VRF(vname)
if not v.create():
print "Failed to create VRF %d" % (vname)
exit(1)
if not v.add_interface(intf):
print "Failed to add interface %s to VRF %s" % (intf, vname)
exit(1)
print "Successfully created VRF %s and added interface %s to it." % (vname, intf)
Create a script to
simplify the creation of
a new VRF and then
add an interface to it.
NX-OS on the Cat3K
exposes an API for
VRF management.

Python Scripting
Running the Script
35

Python Scripting
 N3K Documentation - http://tools.cisco.com/squish/4F41b
 N9K Documentation - http://tools.cisco.com/squish/4D32A
 GitHub repository for N9K scripts:
– https://github.com/datacenter/nexus9000/tree/master/nx-os/python
– https://github.com/datacenter/nexus9000/tree/master/nx-os
 Monitor framework for N3K - https://github.com/datacenter/PyMonitor
 Who Moved My CLI? - https://github.com/datacenter/who-moved-my-cli
Getting More Help and Samples
36

Python Scripting
github
37

What Is Embedded Event Manager (EEM)?
39
 An extremely flexible and powerful subsystem within Cisco Software
 Provides real-time network event detection and onboard automation
 Generate and react to events when certain conditions are met in devices
 Trigger the execution of custom modules written in either:
– CLI
– Tcl (Tool Command Language) script
 Adapt device behavior and insert business logic without an OS upgrade

EEM Architecture
40
 Extremely flexible and powerful
subsystem within Cisco IOS, IOS-
XE, IOS-XR, and NX-OS Software
 Adapt device behavior and insert
custom logic without OS upgrade
 24 Event Detectors (ED) integrated
with IOS modules for wide range of
system event detection
 CLI and Tcl based policy provides
consistent programmability interface
 Powerful event engine supporting
multi-event correlation, advance
scheduling and more
Cisco IOS

Event Detectors
 Cisco IOS CLI ED
Triggers policies based on commands entered via the CLI.
 Cisco IOS Counter ED
Policies can be triggered based on a change of the designated
Cisco IOS counter.
 Cisco IOS Redundancy Facility ED
Provides for detection of hardware and software failures related
to the Stateful Switchover service. This ED will trigger policies
based on the RF state change. It is also used to initiate
switchovers as a result of a policy action.
 Cisco IOS Timer Services ED
Policies can be scheduled to occur at the designated time or
interval.
 Cisco IOS Watchdog / System Monitor ED
Triggers policies based on certain conditions relative to a
certain Cisco IOS process or subsystem’s activity.
 EEM Application Specific ED
Application specific events can be detected or set by a Cisco
IOS subsystem or a policy script. This provides the ability for
one policy to trigger another policy.
 Interface Counter ED
Policies can be triggered based on the specific interface
counter; includes thresholds.
 Online Insertion and Removal (OIR) ED
Triggers policies based on hardware installation and
removal activity.
 Object Tracking ED
Triggers policies based on routing protocol events.
 SNMP ED
Triggers policies based on the associated SNMP MIB
variable; includes MIB variable threshold setting.
 SNMP Notification ED
Intercept incoming and outgoing SNMP traps and
publish events
 Syslog ED
Triggers policies based on the regular expression
match of a local Syslog message.
41

Event Detectors (cont.)
 Resource Thresholding ED
Triggers policies based on certain internal resource usage
and conditions; interface to Embedded Resource Manager.
 Generic Online Diagnostics ED
Triggers policies based on diagnostic results
 XML-RPC
Listen to SOAP request over SSH and trigger EEM policy
execution.
 “None”ED
Triggers policies by command
42

EEM Applet Policy
43
 Step 1 – Set Environment Variables
– Configure necessary EEM environment
variable
 Step 2 -- Register Policy
– register the policy with the applet policy
engine
 Step 3 -- Establish Event Trigger
– Define the event that triggers the policy
 Step 4 -- Define Action
– Define the action to take upon detection of the
event
event manager environment _email_server
172.27.121.177
event manager applet email_hsrp_state_change
event syslog pattern ".*%HSRP-5-STATECHANGE.*"
action 1.0 info type routername
action 1.1 cli command "enable"
action 1.3 cli command "show standby | append hsrp_state_change"
action 1.4 cli command "show standby brief | append
hsrp_state_change“
………..
action 1.8 mail server "$_email_server" to "$_email_to" from
"$_email_from" subject "HSRP_STATE_CHANGE Alert from
$_info_routername: $_syslog_msg" body "$_cli_result"

EEM 4.0 Event Detectors EEM 4.0 Applet Actions
44

EEM Tcl Policy
45
 Step 1 – Register User Directories
– Register user policy directory and user library
directory
 Step 2 – Develop Policies Offline
– No online editor available.
 Step 3 – Download Policy
– Download TCL policies using standard IOS file
transfer mechanisms
– Support script auto refresh from remote location
 Step 4 – EEM Environment Variable
Configuration
 Step 5 – Register Policy
– Register policy to TCL policy engine
mkdir disk2:/eem
event manager directory user policy disk2:/eem
event manager directory user library disk2:/eemlib
copy tftp disk2:/eem
Address or name of remote host []? 10.1.88.9
Source filename []? cl_acl_change.tcl
Destination filename [cl_acl_change.tcl]? eem/cl_acl_change.tcl
Accessing tftp://10.1.88.9/cl_acl_change.tcl...!
1232 bytes copied in 0.620 secs (1987 bytes/sec)
event manager update user policy group “*.tcl” repository
tftp://2.2.2.2/users2/eem_1
event manager policy cl_acl_change.tcl type user
event manager environment _email_server 172.27.121.177

EEM Tcl Policy
Suspending Inactive Ports
46
::cisco::eem::event_register_syslog pattern "LINEPROTO-5-UPDOWN" maxrun 600
if { ![info exists suspend_ports_config] } {
set result "ERROR: Policy cannot be run: variable suspend_ports_config has not been set"
error $result $errorInfo
}
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
proc run_cli { clist } { … }
array set arr_einfo [event_reqinfo]
if { ! [regexp {Interface ([^,]+), changed state to up} $arr_einfo(msg) -> iface] } {
exit
}
while { 1 } {
set results [run_cli [list "show event manager policy pending | include
tm_suspend_ports.tcl"]]
if { ! [regexp {tm_suspend_ports.tcl} $results] } {
break
}
after 1000
}
if { [catch {open $suspend_ports_config "r"} result] } {
exit
}
…
Say you want to
suspend (i.e.,
shutdown) ports that
haven’t been active in
a week…
…Use EEM to watch
for ports that become
active…

EEM Tcl Policy
Suspending Inactive Ports (Cont.)
47
set fd $result
set contents [read $fd]
close $fd
set contents [string trim $contents]
array set ports [split $contents]
if { [info exists ports($iface)] } {
array unset ports $iface
set fd [open $suspend_ports_config "w"]
puts -nonewline $fd [array get ports]
close $fd
}
…Then delete those
newly active ports
from a log file tracking
ports that are down.

EEM Tcl Policy
Track Ports That Are Down
48
::cisco::eem::event_register_timer cron cron_entry "0 0 * * *" queue_priority normal maxrun 600
if { ![info exists suspend_ports_days] } {
set result "ERROR: Policy cannot be run: variable suspend_ports_days has not been set"
}
if { ![info exists suspend_ports_config] } {
set result "ERROR: Policy cannot be run: variable suspend_ports_config has not been set"
}
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
proc run_cli { clist } { ... }
set SECS_IN_DAYS 86400
set DOWN 0
set UP 1
set ADMIN_DOWN 2
set now [clock seconds]
set susp_time [expr $suspend_ports_days * $SECS_IN_DAYS]
array set suspend_ports [list]
if { [catch {open $suspend_ports_config "r"} result] } {
array set ports [list]
} else {
set fd $result
set contents [read $fd]
close $fd
set contents [string trim $contents]
array set ports [split $contents]
}
…
Every night at
midnight, another
EEM policy runs that
records each “down”
port into a file…

EEM Tcl Policy
Track Ports That Are Down (Cont.)
49
set result [run_cli [list "show ip interface brief | include Ethernet"]]
foreach line [split $result "n"] {
set line [string trim $line]
regsub -all {s+} $line " " line
set elems [split $line]
set iface [lindex $elems 0]
if { ! [regexp {Ethernet} $iface] || [llength $elems] < 6 } {
continue
}
if { [lindex $elems 4] == "administratively" && [lindex $elems 5] == "down" } {
set status $ADMIN_DOWN
} elseif { [lindex $elems 4] == "down" } {
set status $DOWN
} elseif { [lindex $elems 4] == "up" && [lindex $elems 5] == "up" } {
set status $UP
} else {
set status $DOWN
}
if { [info exists ports($iface)] } {
if { $status == $UP || $status == $ADMIN_DOWN } {
array unset ports $iface
} else {
if { [expr $now - $ports($iface)] >= $susp_time } {
set suspend_ports($iface) $ports($iface)
}
}
} else {
if { $status == $DOWN } {
set ports($iface) $now
}
}
}
…
…If the port has been
down long enough, it
is put on a “to-be-
shutdown” list.

EEM Tcl Policy
Track Ports That Are Down (Cont.)
50
set fd [open $suspend_ports_config "w"]
puts -nonewline $fd [array get ports]
close $fd
set cli [list "config t"]
foreach port [array name suspend_ports] {
if { [info exists suspend_quarantine_vlan] } {
set cli [concat $cli [list "interface $port" "switchport access vlan $suspend_quarantine_vlan"]]
action_syslog msg "Moving port $port into quarantine VLAN $suspend_quarantine_vlan since it
was last used on [clock format $suspend_ports($port)]"
} else {
set cli [concat $cli [list "interface $port" "shut"]]
action_syslog msg "Shutting down port $port since it was last used on [clock format
$suspend_ports($port)]"
}
}
lappend cli "end"
if { [catch {run_cli $cli} result] } {
action_syslog priority err msg "Failed to shutdown ports: '$result'"
}
…For each port in the
list, it is
administratively shut
down or moved to a
quarantine VLAN (if
said VLAN is defined).
Download the full version from
https://supportforums.cisco.com/docs/DOC-39192

EEM For Real-World Challenges
 Challenge 1: Every few weeks a router is running low on memory and I want to find out
what’s happening
Solution: EEM script could be triggered based on the memory utilization, capture the memory information and send the
output with Syslog or Email
 Challenge 2: One of the (redundant) links has problems with occasional high error rates,
but does not go down. It causes service interruption for my customer
Solution: EEM script could be triggered on the interface errors, remove the link to force the use of the stable link and
send a notification by Syslog
 Challenge 3: My ACL configuration gets changed, I want to get notified, but I can’t sit
there and monitor it all the time
Solution: EEM script could be triggered by CLI command, take a snapshot of the logged in user, changed
configuration, and send an email to you
51

EEM For Real-World Challenges
 Challenge 4: I want to save energy, but I can’t go around turn off everyone’s IP
phone everyday
Solution: Timer ED can be used to trigger the execution of an EEM script to turn off your IP phone at
7pm everyday and turn it back on 7am the next day
 Challenge 5: My NMS system need this MIB that is missing from my router, and
I can’t wait for the next IOS release
Solution: Using EEM SNMP Proxy ED, an EEM script can be configured to intercept and process
SNMP requests, collect the information from other management interface, e.g., show commands, and
simulate the MIB
52

EEM Version/Product Support Matrix
53
CISCO ACCESS ROUTERS - Current Models
EEM Version Cisco 800 Series
Cisco 1800
Series
Cisco 2800
Series
Cisco 3800
Series
Cisco 1900
Series
Cisco 2900
Series
Cisco 3900
Series
1.0 12.3(11)T 12.3(11)T 12.3(11)T
2.0
2.1 12.3(14)T1 12.3(14)T1 12.3(14)T1
2.1.5
2.2 12.4(2)T 12.4(2)T 12.4(2)T 12.4(2)T
2.3 12.4(11)T 12.4(11)T 12.4(11)T 12.4(11)T
2.4 12.4(20)T 12.4(20)T 12.4(20)T 12.4(20)T
3.0 12.4(22)T 12.4(22)T 12.4(22)T 12.4(22)T
3.1 15.0(1)M 15.0(1)M 15.0(1)M 15.0(1)M 15.0(1)M 15.0(1)M 15.0(1)M
3.2 15.1(3)T 15.1(3)T 15.1(3)T 15.1(3)T 15.1(3)T 15.1(3)T 15.1(3)T
4.0 15.2(2)T 15.2(2)T 15.2(2)T
CISCO ACCESS ROUTERS - Old Models
EEM Version Cisco 1700 Series
Cisco 2600
Series
Cisco 2600XM
Series
Cisco 2691
Series
Cisco 3600
Series
Cisco 3700
Series
1.0 12.3(4)T 12.3(4)T 12.3(4)T 12.3(4)T
2.0
2.1 12.3(14)T1 12.3(14)T1 12.3(14)T1 12.3(14)T1 12.3(14)T1 12.3(14)T1
2.1.5
2.2 12.4(2)T 12.4(2)T 12.4(2)T 12.4(2)T 12.4(2)T 12.4(2)T
2.3 12.4(11)T 12.4(11)T 12.4(11)T 12.4(11)T 12.4(11)T 12.4(11)T
2.4
3.0
3.1
3.2
Shipping
Coming Soon
Planning

EEM Version/Product Support Matrix
54
CISCO SERVICE AGGREGATION/CORE ROUTERS
EEM
Version
Cisco
ASR1000
Series
Cisco 7200
Series
Cisco 7301 Cisco 7304
Cisco 7600
Series
Cisco UBR
10000
Cisco UBR
7200
Cisco
12000
Series
Cisco XR
12000
Cisco
CRS-1
Cisco ASR
9000
1.0 12.0(26)S
2.0 12.2(27)SBC FM FM FM
2.1 12.3(14)T1 12.3(14)T1 12.2(28)SB 12.2(18)SXF5 12.2(28)SB 12.2(28)SB FM FM FM
2.2 12.4(2)T 12.4(2)T1 FM FM FM
2.3 2.1XE 12.4(11)T 12.2(33)SB 12.2(33)SB 12.2(33)SRB 12.2(33)SB 12.2(33)SB FM FM FM
2.4 12.2(33)XN RLS7 12.4(20)T 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE FM FM FM
3.0 12.2(33)XN RLS7 12.4(22)T 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE 12.2(33)SRE FM FM FM
3.1 15.1(3)S3 15.0(1)M Planning Planning Planning Planning Planning Planning Planning Planning Planning
3.2 Planning 15.1(3)T Planning Planning Planning Planning Planning Planning Planning Planning Planning
4.0 Planning
CISCO CATALYST SWITCHES
EEM Version
Catalyst 3000
Switches
Cisco 3400ME
Switches
Catalyst 4500
Switches
Catalyst 4900
Switches
Catalyst 6500
Switches
2.1
IOS w/o Modularity
12.2(18)SXF5
2.1.5
w/ Modularity
12.2(18)SXF4
2.3 12.2(40)SE 12.2(40)SE 12.2(44)SG 12.2(44)SG 12.2(33)SXH
2.4 12.2 (50) SE 12.2 (50) SE 12.2(52)SG 12.2(52)SG 12.2(33)SXI
3.0 12.2 (52) SE 12.2 (52) SE 12.2(54)SG1 12.2 (54)SG1
3.1 12.2 (52) SE 12.2 (52) SE
3.2 12.2 (52) SE 12.2 (52) SE 15.0(2)SG 15.0(2)SG
4.0 Planning Planning 15.1(1)SY
Shipping
Coming Soon
Planning

Ensuring Consistent Interface Settings Using onePK
N3K
CRS-1
ASR9K
ASR1K
ISR
1. Network begins with mismatched
parameters on either side of link (e.g.
MTU)
2. Application checks parameters on either
side and identifies mismatches (red lines)
3. Application sets parameters to match
(lines turn green)
4. Application registers for events related to
parameters change.
5. Users logs into console and manually
changes parameter. Topology indicates
change.
1
2
MTU 1518
MTU 15184
5
3
Problem: Misconfigurations cause network outages, degrade performance, impact SLAs.
Value proposition: Get, set, and detect configuration changes via cross-platform API
MTU 1500
MTU 1600
MTU 1600
MTU 1500
MTU 1500
MTU 1000
56

MTU In Action
57

MTU Code (in Java)
58
public void checkInterfacesMTU(NetworkElement ne) {
for (NetworkInterface intf : ne.getInterfaceList(new InterfaceFilter(null,
NetworkInterface.Type.ONEP_IF_TYPE_ETHERNET))) {
InterfaceConfig ic = intf.getConfig();
if (ic.getMTU() != STANDARD_MTU) {
intf.setMTU(STANDARD_MTU);
ne.createSyslogMessage(NetworkElement.OnepSyslogSeverity.ONEP_SYSLOG_INFO, "Changed MTU of " + intf.getName()
+ " from " + ic.getMTU() + " to " + STANDARD_MTU);
}
}
}
public void handleEvent(CLIEvent e, Object clientData) {
checkInterfacesMTU(e.getNetworkElement());
}
CLIFilter cfilt = new CLIFilter("^mtu ");
cfilt.setSync(0);
cfilt.setSkip(0);
ne.addCLIListener(new RouteTest(), cfilt, null);
checkInterfacesMTU(ne);
Iterate through each
interface and verify MTU.
Register a CLI handler for
whenever anyone types a
command starting with
“mtu ”.
Callback to re-run the
interface check whenever
MTU is changed from the
CLI.

Customized Provisioning
 EEM XML-RPC can be used
to split the intelligence
between the device and the
NMS
 The NMS can use a known
API when talking to each
device type
 The “driver” or device-specific
code can be maintained within
an EEM policy on each device
 EEM XML-RPC Perl API
available at
https://supportforums.cisco.co
m/docs/DOC-19523
Distributing Intelligence To the Device
59
my $pol = new Cisco::EEM::RPC::Policy(”add_customer.tcl");
$pol->setArgList(’Acme Co.', ’192.168.17.0/29’, ‘GOLD’);
…
my $result = $rpc->invoke($pol);
On the NMS (Perl)
…
if { $arr_einfo(arg2) == {GOLD} } {
cli_exec $cli(fd) “service-policy GOLD”
cli_exec $cli(fd) “ class acme_co”
cli_exec $cli(fd) “ bandwidth 1024”
}
…
On the Device (Tcl)

Getting Interface Parameters
With NETCONF
60
<rpc message-id="4" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-config>
<source><running/></source>
<filter type="cli"><config-format-xml options="interface GigabitEthernet0/0">
</config-format-xml></filter>
</get-config>
</rpc>]]>]]>
Request:

<?xml version="1.0" encoding="UTF-8"?><rpc-reply message-id="4"
xmlns="urn:ietf:params:netconf:base:1.0"><data><xml-config-data>
Building configuration...
<Device-Configuration>
<interface><Param>GigabitEthernet0/0</Param>
<ConfigIf-Configuration>
<ip><address><dhcp/></address></ip>
<duplex><auto/></duplex>
<speed><auto/></speed>
</ConfigIf-Configuration>
</interface>
<end></end>
</Device-Configuration></xml-config-data></data></rpc-reply>]]>]]>
Getting Interface Parameters
With NETCONF
61
Response:

<rpc message-id="edit-config addhosts"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<edit-config>
<target><running/></target>
<config>
<xml-config-data>
<Device-Configuration>
<ip>
<host>
<NameHost>shangrila</NameHost>
<HostIPAddress>1.2.3.4</HostIPAddress>
</host>
</ip>
<ip>
<host>
<NameHost>valhalla</NameHost>
<HostIPAddress>1.2.3.5</HostIPAddress>
</host>
</ip>
</Device-Configuration>
</xml-config-data>
</config>
</edit-config>
</rpc>]]>]]>
Editing Device Configuration
With NETCONF
62
Request:

<?xml version="1.0" encoding="UTF-8"?><rpc-reply message-id="edit-config addhosts"
xmlns="urn:ietf:params:netconf:base:1.0"><ok /></rpc-reply>]]>]]>
Editing Device Configuration
With NETCONF
63
Response:

Getting / Setting Interface Parameters
With EEM
64
 Built-in EEM policy: tm_cli_cmd.tcl (timer CLI command)
 Set a few variables
_email_server Hostname or IP address of SMTP server
_email_to Recipient email address
_email_from Sender email address
_email_cc Carbon-copy recipient email address
_cron_entry Defines the CRON specification when the policy will run
_show_cmd Defined the command to be executed with the policy runs

Getting / Setting Interface Parameters
With EEM
65
 Config example – email trunk interface stats every 2 hours
hostname cpu
ip domain-name example.com
event manager environment _email_server smtp.example.com
event manager environment _email_to noc@example.com
event manager environment _email_from routera@example.com
event manager environment _cron_entry 0 0-23/2 * * 0-7
event manager environment _show_cmd show interface gig1/24
event manager policy tm_cli_cmd.tcl

Uploading Data Via HTTP
66
namespace import ::http::*
set output [cli_exec $cli(fd) “show mac address-table | include Total”]
if { ! [regexp {: (d+)} $output -> tmacs] } {
action_syslog priority err msg “Failed to get total MAC count: ‘$output’”
exit 1
}
::http::config -useragent ”MAC Updater/1.0 (Cisco EEM)”
set query [::http::formatQuery count $tmacs device [info hostname]]
set tok [::http::geturl –query $query "http://www.company.com/rest/mac_addrs/total"]
if { [::http::error $tok] != "" } {
puts "ERROR: Failed to upload total MAC count; '[::http::error $tok]'"
exit 1
}
action_syslog msg ”Total MAC count uploaded successfully."
 In addition to email and syslog, EEM includes an HTTP API
 Data can be shipped off-box to a web service application for further processing
– Database insertion
– Analytics
– Etc.

Interface Statistics Using onePK
 OnePK provides APIs to gather
throughput, load, errors, and
drops from interfaces
– Most stats seen under “show
interface” are available via the API
 API is event-based so changes
can notify the application instead
of relying on continuous polling
67
Live event-driven
updates

Interface Statistics Using onePK
(The code in Java)
6868
Interface Selector Code
Callback on Stats Change
Register for stats change events

Service Validation (with IPSLA)
With EEM
69
 Assume we’d like to ensure another device or path is still operational using a
router’s IPSLA feature – we can trigger EEM
track 100 rtr 50 reachability
ip sla 50
icmp-echo 192.168.1.10
ip sla schedule 50 life forever start-time now
event manager applet watch-ipsla-down
event track 100 state down
action 1.0 syslog priority errors msg "IP SLA operation 50 to priority service is down"
event manager applet watch-ipsla-up
event track 100 state up
action 1.0 syslog msg "IP SLA operation 50 to priority service is up"

Service Validation
 In addition to syslog messages and
traps, EEM can generate
application-specific events
 These events can be picked up by
onePK apps
 Apps can form a bridge between
systems like change management
or trouble-ticketing
With onePK
70
event manager applet watch-ipsla-down
event track 100 state down
action 1.0 syslog msg "IP SLA operation 50 to priority service is down”
action 2.0 publish-event sub-system 798 type 3451 arg1 “Down”
Uplink down,
opening case

Service Validation
The code in Java
71
/**
* Listen for application events coming from our EEM policy.
*/
ApplFilter filter = new ApplFilter(798, 3541);
ne.addApplListener(this, filter, null);
…
public void handleEvent(ApplEvent event, Object clientData) {
String status = "Up";
try {
status = event.getData(1);
} catch (Exception e) {
getLogger().error("Failed to get data element 1", e);
return;
}
/**
* Change the line color based on the results of our IP SLA collector.
* Open case if need be.
*/
if (status.equals("Down")) {
this.lineColor = Color.red;
this.case = Case.createCase();
} else {
this.lineColor = Color.green;
this.case.updateCase(Case.Status.CLOSED);
}
this.repaint();
}

Device Health Monitoring
With EEM
72
 Assume we’d like to get an emailed list of processes running on an IOS-based
device when the CPU goes above 75%
event manager applet snmp_cpu_ge75
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val 75 poll-interval 10
action 1.0 cli command "enable”
action 2.0 cli command "show process cpu”
action 3.0 mail server "192.168.1.10" to ”noc@example.com" from ”router-a@example.com"
subject ”CPU High Alert" body "$_cli_result"

Health Monitoring With onePk
A Network “Top”
 Use onePK to build a live process
monitor similar to UNIX top
 The same app can connect to
multiple devices to display the top
processes across the entire network
while (!done) {
List<ElementProcess> plist = ne.getProcessList();
for (ElementProcess proc : plist) {
displayProcess(proc);
}
try {
Thread.sleep(delay);
} catch (InterruptedException e) { }
}
73

Case Study: Network Programmability at Cisco Live
Orlando 2013

Embedded Automation
Using EEM To Set Port Descriptions
75
EEM dynamically sets descriptions
on ports based on last connected
CDP neighbor.
Applet available from
https://supportforums.cisco.com/do
cs/DOC-24529

Embedded Automation
Converting Access Switches From Stage to Production
76
Switch from stage
to production
VLAN
Ping production
default GW, and
verify reachability
If reachable,
reconfigure switch
for production…
…If not, then revert
to stage.
Applet available from
https://supportforums.cisco.com/do
cs/DOC-34529

Monitor an Interface for Errors
 Interface errors can be the
silent killer
 As the interface takes
errors, performance suffers
but no alerts are seen
 Using EEM, we can
monitor for increases in
errors and send
notifications to the NMS
event manager applet error_monitor_GigabitEthernet0/1
event interface name GigabitEthernet0/1 parameter input_errors
entry-op ge entry-val 5 entry-type increment poll-interval 10
action 1.0 syslog priority errors msg “Interface
GigabitEthernet0/1 has seen $_interface_delta_value input errors
in the past 10 seconds”
action 2.0 cli command “enable”
action 3.0 cli command “show int GigabitEthernet0/1 | inc error”
action 4.0 syslog priority errors msg “$_cli_result”
ERROR!
Jun 2 02:34:45.381: %HA_EM-3-LOG:
error_monitor_GigabitEthernet0/1: Interface
GigabitEthernet0/1 has seen 7 input errors in the past 10
seconds
Jun 2 02:34:45.417: %HA_EM-3-LOG:
error_monitor_GigabitEthernet0/1: 59 input errors, 58 CRC, 1
frame, 0 overrun, 0 ignored
77

Recommended Reading
78
# ISBN-13: 978-0130385604
# ISBN-13: 978-0596528126
# ISBN-13: 978-0596007645
# ISBN-13: 978-1587059452
# ISBN-13: 978-1-4419-6769-5

Cisco Beyond Has a New Home
79
Discussion forums
Ask questions, get answers
Video tutorials
Script repository
Over 130+ open source scripts,
learn by example
http://www.cisco.com/go/ciscobeyond

Join Cisco Support Communities!
 Free for anyone with Cisco.com
registration
 Get timely answers to your technical
questions
 Find relevant technical
documentation
 Engage with over 200,000 top
technical experts
 Seamless transition from discussion
to TAC Service Request (Cisco
customers and partners only)
80
supportforums.cisco.com
supportforums.cisco.mobi
The Cisco Support Community is your one-stop
community destination from Cisco for sharing
current, real-world technical support knowledge
with peers and experts.
Documents
Discussions
Blogs
VideoAsk the Expert
Mobile

Don’t forget to activate your Cisco Live Virtual
account for access to all session material,
communities, and on-demand and live
activities throughout the year. Activate your
account at the Cisco booth in the World of
Solutions or visit www.ciscolive.com.
Complete Your Online Session Evaluation
 Give us your feedback and
you could win fabulous prizes.
Winners announced daily.
 Receive 20 Passport points
for each session evaluation
you complete.
 Complete your session evaluation
online now (open a browser
through our wireless network to
access our portal) or visit one of
the Internet stations throughout
the Convention Center.
Note: This slide is now a Layout choice
81

Better Network Management Through Network Programmability

More Related Content

What's hot (20)

Similar to Better Network Management Through Network Programmability (20)

More from Cisco Canada (20)

Recently uploaded (20)

Better Network Management Through Network Programmability