Cisco SD-WAN Controllers Installation

Lessons Discussion
22

Hello everyone
I generated a private key. BUT when I tried create a root CA certificate using the private key we just created:

vManage1:~$ openssl genrsa -out ROOT-CA.key 2048
Generating RSA private key, 2048 bit long modulus
.................
.............................
e is 65537 (0x10001)
vManage1:~$ openssl req -x509 -new -nodes -key ROOT-CA.key -sha256 -days 3652 \
ab.nwl.ai" \ps://cdn.networklessons.com/C=NL/ST=NL/O=nwl-lab-sdwan/CN=vmanage1.la
> -out ROOT-CA.pem
***Subject does not start with '/'.***
***problems making Certificate Request***
vManage1:~$
23

Hello Rami

Hmm, I suggest you take a look at these issues to see if you can troubleshoot the problem.

First of all, your command to create the root CA certificate seems to be a bit off in your post. I think it may have to do with the way you pasted it. However, you must make sure that it appears as in the lesson. Notice that Rene states that it is a “one-liner” which means you can copy and paste it as-is from the lesson. Notice that’s what he did in the video as well. It should be copied and pasted exactly like so:

openssl req -x509 -new -nodes -key ROOT-CA.key -sha256 -days 3652 \
-subj "https://cdn.networklessons.com/C=NL/ST=NL/O=nwl-lab-sdwan/CN=vmanage1.lab.nwl.ai" \
-out ROOT-CA.pem

After doing a bit of research I have found that even if the command is issued correctly, this type of error is also seen in other cases where root CA certificates are created, and it can be due to a bug. You can attempt to issue the command without a subject if you like since that is optional. This may resolve the problem.

Try it out and let us know how you get along!

I hope this has been helpful!

Laz

24

Hello Rene
bizinternet and public internert, are these routers or switches? how is the connectivity of these?

25

Hello Wali

The biz-internet and public-internet “clouds” in the diagram represent the WANs that businesses can use to connect their vEdge devices. This topology is created within EVE-NG, and the clouds are entities created by the emulator. Take a look at this lesson to see the process with which the clouds, and the rest of the topology, were created.

I hope this has been helpful!

Laz

26

Would you please let me know why is this error while configuring vBond1

vedge(config-vpn-0)# exit
vedge(config)# commit
Aborted: 'vpn 0' : Only one tunnel-interface with color "default" allowed.
27

Hello Wali

Take a look at the configuration of any and all tunnel interfaces on your vEdge device. The tunnel interfaces can be assigned “colors” which are used to distinguish between the WAN tunnels being created. It looks like you have more than one tunnel interface with the color “default” (which is the default color when no other color is assigned). This is not allowed since there will be no way to distinguish between them, unless the colors are different.

Do you have more than one VPN 0 on your vEdge device? The problem here is not specific to the vBond configuration but to the colors on the tunnel interfaces. For more information about configuring the color on tunnel interfaces take a look at the vEdge onboarding lesson, and specifically, at the VPN0 underlay network section that details how to configure colors:

I hope this has been helpful!

Laz

28

image
Please help.

29

Hello Paris

I’m going to state the obvious :innocent: . Are your username and password correct? I assume they are. But still, there seems to be an authentication issue. Can you give us some more info about where in the installation you are at? Is this the addition of the vBond controller? Let us know…

I hope this has been helpful!

Laz

30

Yes, thank you for the response. I can’t get it to work still even after going through the steps multiple times. I am stuck at step 1.2.1 Start Up Configuration. I’ll go through and try it again.

31

I have just a small q
You have all sd-wan devices routed 0.0.0.0/0 to 10.1.0.254

Which device represent the 10.1.0.254

32

Hello Aysar

All controllers are placed on VLAN 10 which is configured in the DC1 switch. This VLAN uses the 10.1.0.0/24 subnet. The 10.1.0.254 address is the default gateway for that subnet which is assigned to the VLAN 10 SVI of the switch. This is explained in the first video under the Configuration heading starting at Chapter 4 of the video at 4:41.

I hope this has been helpful!

Laz

1 Like
33

Thanks dear for your reply

1 Like
34 
ValueError: source code string cannot contain null bytes
Fatal Python error: init_import_size: Failed to import the site module
Python runtime state: initialized
Traceback (most recent call last):
  File "/usr/lib/python3.8/site.py", line 73, in <module>
    import os

I am trying to config vManage with image 20.10.1 and I am getting the error below. any advice?

35

Hi Rene,

Unable to generate a certificate in Vmanage:

image
image1391×354 13.4 KB

36

Hi Pratik,

What version of vManage do you use?

Rene

37

Hi Rene,

I’m using Vsmart 20.7.1

38

Hi @kotadiyapratik ,

It seems that in your example, it cut off part of the command. It ends with “CN=vmanage1.la” instead of “CN=vmanage1.lab.nwl.ai -out ROOT-CA.pem”.

Can you try pasting it again?

openssl req -x509 -new -nodes -key ROOT-CA.key -sha256 -days 3652 \
-subj "https://cdn.networklessons.com/C=NL/ST=NL/O=nwl-lab-sdwan/CN=vmanage1.lab.nwl.ai" \
-out ROOT-CA.pem

Or as a oneliner without the </code> break line:

openssl req -x509 -new -nodes -key ROOT-CA.key -sha256 -days 3652 -subj "https://cdn.networklessons.com/C=NL/ST=NL/O=nwl-lab-sdwan/CN=vmanage1.lab.nwl.ai" -out ROOT-CA.pem

Rene
39

Thanks Rene.

Again i am stuck on below step while requesting from Vbond

image
image780×310 10.3 KB

40

Is vBond1 only in VPN 512?

Your ping in 512 works, but I can’t tell in which VPN it tries to do request download scp. In my examples, I used VPN 0 on the controllers and vedges for onboarding.

The other option is that for some reason, SSH server is not running on vManage. That’s something you can check too.

Rene

41

Hi Rene,
After restarting to vEdge Router issue get resolved but if I’m restarting the vManage then all configuration getting erased and unable to export the config in EVE-NG.

Sometime i must have to stop the SD-WAN Lab when need to restart the Server but in that case, vManage getting erase and on boarding vedge,vBond etc getting empty in vManage in the EVE-NG Lab.

Please help in this case if have a shortcut solution or alternative solution.