Network Automation and Orchestration

[ReneMolenaar]

This topic is to discuss the following lesson:

Network Automation and Orchestration

[michmoor (Michael M)]

Hi Rene. Its been a very long time since we spoke. Still a huge fan of your website. You helped me through my CCNP/CCIE(written) studies. I will always be eternally grateful
That being said I am entering the phase in my career will automation through Python is a great interest. Will you write an article about Python for Network Engs? Im thinking about Python + REST apis + Postman. If the article can be written like this network automation and orchestration article I think it will greatly help alot of people. No in depth knowledge of Python or REST is even needed. What do you think?

[ReneMolenaar]

Hi Michael,

You are very welcome, it’s good to hear my work has been so useful to you. I’m definitely going to add some python material in the future. The “evolving technologies” blueprint also has REST APIs so I’m going to write some articles what REST APIs are and how to play around with postman or python.

It doesn’t take too long to learn python and use it to talk with APIs or manage network devices. It’s a lot of fun too.

Rene

[ankisang (Ankit S)]

Seems like the Network Automation and Orchestration link is broken. getting 403 error message.
Did the topic link has moved to other location.

[lagapidis (Lazarus Agapidis)]

Hi Ankit

I tried it out now and it seems to work. Can you tell me from which page you are trying to link? The page may be up but the link may be incorrect. Let us know and we’ll fix it.

Thanks!

Laz

[ankisang (Ankit S)]

page timed out error was related to my vpn connection…thanks.

[coolcomfort22 (Cool C)]

Hello, I am having some trouble understanding the Kubernetes section. I understand how Master Components and Node Components are separated, correct? I am trying to match your definitions to the diagram.

Master Components = Master Node
Node Components = Worker Node

But you describe the Node Components as “[running] on all master and worker nodes”. Does this mean kubelet, kube-proxy, and container runtime also exist on Master Components? Or does this mean Node Components is a general term that refers to both Master Node and Worker Node?

[Giovanni (Giovanni Cesare O)]

Hi,

I know that it is an old topic but I’m tryng to replicate the ansible lab without success.

ansible give me this error.

TASK [Configure credentials] *************************************************************************************************************************************************************************************
ok: [R1]
ok: [R2]
ok: [R3]

TASK [Backup Configuration] **************************************************************************************************************************************************************************************
fatal: [R3]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3"}, "changed": false, "msg": "operation requires privilege escalation"}
fatal: [R2]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3"}, "changed": false, "msg": "operation requires privilege escalation"}
fatal: [R1]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3"}, "changed": false, "msg": "operation requires privilege escalation"}

PLAY RECAP *******************************************************************************************************************************************************************************************************
R1                         : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   
R2                         : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   
R3                         : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0  

What I’m missing? the yaml file is the same of this lesson.

[lagapidis (Lazarus Agapidis)]

Hello Giovanni

The message “operate requires privilege escalation” initially gave me the impression that the credentials being used are not provided with privilege level 15 on the Cisco IOS. I’m sure that’s something that you’ve checked however…

Looking a litter deeper I have found that others have had similar problems and it may be a result of a strange combination of Ansible version and IOS version. In particular, you can take a look at this GIT bug report for Ansible.

ios_config traceback on some devices

If you do a search for that error, you’ll find more resources. Some have solved it by downgrading their Ansible version, while others have done so by adjusting other parameters.

I hope this has been helpful!

Laz

[ruben.trazanet (Ruben S)]

Hi Team,
Great lesson!! I tried to run a playbook connecting from a Centos 8 (ansible 2.9.27) to a cisco Cisco IOS XE Software, Version 16.06.07 by using ssh keys. I followed the lesson where ssh key connectivity is explained and I am able to connect with success. Despite all the changes I tried I always receive: fatal: [Cisco1941]: FAILED! => {“ansible_facts”: {“discovered_interpreter_python”: “/usr/libexec/platform-python”}, “changed”: false, “msg”: “not a valid RSA private key file”}.

I uncommented this to disable SSH key host checking in ansible.cfg
host_key_checking = False
the key has 2048 module
I also tried
ansible-playbook --private-key=/root/.ssh/id_rsa -u root playbooks/show_version.yml

Any suggestions

Thanks in advanced for your support

Ruben

[ReneMolenaar]

Hello Ruben,

What kind of SSH key do you have? Does it show up as OPENSSH or RSA?

[root@localhost test-ansible]# cat ~/.ssh/id_rsa | grep "KEY"
-----BEGIN OPENSSH PRIVATE KEY-----
-----END OPENSSH PRIVATE KEY-----

I think it has to do with the key format. The output above is from a CentOS 8 test machine.

Rene

[ruben.trazanet (Ruben S)]

@ReneMolenaar

cat ~/.ssh/id_rsa | grep "KEY"

Hi Rene,
I am using a centos8 and the outpout of the command indicates openssh:

[root@centos8-ansible ssh]# cat ~/.ssh/id_rsa | grep "KEY"
-----BEGIN OPENSSH PRIVATE KEY-----
-----END OPENSSH PRIVATE KEY-----

I can however connect to the router from centos with no issues:

[root@centos8-ansible ssh]# ssh root@10.100.50.29
Cisco1941#

It is failing when using ansible playbook. Is there anyway to address this or should I use Ubuntu instead of Centos8?
I will in any case deploy Ubuntu and give it a go. I will keep you posted.

Thanks

Ruben Sanchez
Hi Rene,

I found out the root cause. Paramiko doesn’t support openssh. The workaround is PEM:

 sudo ssh-keygen -p -m PEM -f ~/.ssh/id_rsa. Now I get 
ruben@Ubuntu-20:~$ cat ~/.ssh/id_rsa | grep "KEY"
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

and playbooks are running with no issues. You put me in the right direction.
Thank you
Ruben Sanchez

[lagapidis (Lazarus Agapidis)]

Hello Ruben

It’s great to hear that you found the root cause and resolved the issue! It’s helpful to have this information on the forum.

Thanks for updating your post!

Laz

[lennarnoc2020 (michel S)]

Hi Rene, while following the steps, the ssh connection was refused. I’m getting a Connection refused error when trying to ssh into the host IP.

[rod.deluhery (Rod D)]

in the ansible lab, copying a html file to the web root directory. question on this topic. is there a way to do this so the html file in on the ansible server itself, or another server? so doing a network copy (scp copy) from one host to another?
thanks!

[lagapidis (Lazarus Agapidis)]

Hello Michel

The SSH connectivity can sometimes be tricky, and it occasionally depends upon the versions you are using. The best way to troubleshoot this would be to debug SSH on the Cisco device to see the reason behind the refused connection so that you can further correct the problem. Take a look at this NetworkLessons note on SSH connectivity troubleshooting for some additional info.

Let us know how you get along and if you require any additional help.

I hope this has been helpful!

Laz

[lagapidis (Lazarus Agapidis)]

Hello Rod

Anything you can do with the CLI can be automated. So if you are able to copy the HTML file to another server, either the ansible server or another server, using the CLI, then you can automate it using automation.

Before creating a playbook, the first thing that you should do is determine what you want to achieve, and how this can be achieved using the CLI. You then automate those CLI commands using the process described in the lesson.

I hope this has been helpful!

Laz

[AZEAHMED (MUHAMMAD azeem A)]

Hello Rene,

chef, puppet and ansible are config management tool. Are there any tools available to upgrade the router/server operating system . Any insight will appreciated.

P.S> Found paid product below wanted to know about open source tool.

Automating Software Upgrades | Itential Network Automation

Thanks,
Mu

[lagapidis (Lazarus Agapidis)]

Hello Muhammad

Take a look at this answer here:

Tools to upgrade the OS of routers or servers

Hello Muhammad There are several tools available that can be used to automate the upgrading of router and server operating systems. First of all, Chef, Ansible as well as Puppet are all not only configuration management tools, but all three can be used for the purpose of upgrading server OS or router firmware. Specifically: Ansible: It is not only a configuration management tool, but it can also be used to automate software upgrades and manage patches for servers. Chef: It provides tools fo…

I hope this has been helpful!

Laz