In this demo,
we will see how to configure VyOS API northbound
interface to enable programmatic access,
then we'll learn how to make API calls by means of simple Python scripts.
Let me tell you why we are focusing on VyOS
configuration with a programmatic approach.
The legacy or non‑API approach is CLI based.
The CLI approach is based on a manual approach.
You have the operator to which SSH to the router
and issue a sequence of commands.
Such an approach is error prone.
I mean if you have multiple devices to configure,
you have to repeat the same process manually many times,
and the risk of doing a configuration error increases.
Finally,
this approach is time consuming and does not allow for real‑time
configuration as a response to some event.
On the other hand,
an API approach allows for programmatic configuration done
by an application which communicates with the device by
means of its API interface.
This approach allows you to create templates,
resulting in an overall configuration process which is less error prone,
and you can configure many devices, or your entire infrastructure,
at the same time.
And finally,
you are able to operate a real‑time configuration as a response to
some event which occurs in your infrastructure.
The home lab starting configuration is the one we have
successfully configured in our previous module.
In the current lab what we are going to do is focus
in on VyOS API configuration.
The first thing that we have to do is to enable VyOS API interface.
We need to provide a key for our VyOS API.
Just remember that this key has to travel along with your API calls.
Then we have to specify that our API is exposed on HTTPS protocol on port 8080.
Then we have to set up certificates.
Unfortunately,
release 1.3 does not allow for a complete public key infrastructure suite,
so we have to settle for locally self‑generated certificates.
Then we create a virtual host,
which exposes API over HTTPS protocol on port 8080,
and bind the API to VyOS outer interface.
The last command is used to assign a fully qualified
domain name to the virtual host.
Never forget the commit command, which applies the configuration,
and the save command, which makes the configuration permanent at reboot.
Now the fun part.
let us learn how to craft API calls with the simple Python scripts.
Let's start with an API call which reads the current configuration.
The script should contain at least the following elements,
the import request model,
which is a Python model which deals with RESTful APIs; the url,
which points to the IP address where the interface is exposed; and the endpoint,
which, in this case, is retrieve.
And then we have a payload where operation is set to showConfig,
and the key is set to the string we have configured
doing the setup of VyOS API interface.
If we run this script, we receive a non‑formatted JSON string.
Now we have many ways to deal with JSON.
In this lab I will use an online service which
makes this JSON easy to understand.
All you have to do is to copy and paste the non‑formatted JSON response
in the Text tab and then switch to the Viewer tab.
We can see that now we can browse across VyOS configuration,
and we can confirm that the configuration is correct,
you can see the IP address of the outer interface.
And now it's time to issue a configuration command by means of API calls.
In this script we will configure a loopback interface.
As you can see, there are two main variations in respect to the previous script.
Url is now set with the configure endpoint,
and in the payload part, operation is set,
and the path contains the loopback interface configuration commands.
If we run this script, we'll receive a response which says success.
Let me remark here with something.
Even if not specified anywhere,
we have that the commit command is implicit here whenever we show
configuration command by means of an API interface.
In case we want further confirmation that correct configuration is in place,
we can give another go to the read configuration script.
Import the response in the JSON Viewer and browse the configuration to
confirm that the new loopback interface is present.
The final step is the save configuration.
Save configuration is done by a dedicated API call
where operation is set to save,
and we have the startup configuration file location passed as a parameter.
If we run this script, a success response is returned,
and this confirms that the operation was performed correctly.
In the next demos,
we'll see how VyOS can be used to deploy a scenario with
network segmentation and network segregation.