In previous videos, which I've linked here, I showed you how to use Linux commands on Cisco iOS.
This was using traditional Cisco iOS or monolithic Cisco iOS.
You're kind of restricted in the Linux commands that you can use.
In this video, however, I'm going to show you how to take that to the next level by using a Linux
container running directly on Cisco, iOS, XXI.
I'll show you how to use Python.
In other words, create Python scripts.
How to install applications within that Linux container.
So you could, as an example, install Nano.
That's just a basic application that I'll show you in this video.
But I mean, you could install any type of application that runs on Linux within that container.
Obviously, you need to think about what you're going to be doing.
You don't want to run a huge kind of server database application on the container.
But the point is, is that you can run Linux directly on a Cisco iOS device.
This is true Linux, so you can use any command that's supported in CentOS.
That's the flavor of Linux that the Cisco iOS users.
You can run Python scripts directly within that Linux container or call them from within the Cisco iOS
OC because this is YouTube.
Please, could I ask you to subscribe to my YouTube channel, please?
Could I ask you to like this video?
If you find it useful, please click on the bell to get notifications to make it easier for you.
I've put all the scripts below this video and links to documentation, so if you get bored, hopefully
not of this video, you can refer to the documentation below the video to get more information and samples
of the scripts that I'm running because we bought this.
Now some feedback from you, please, before we get started.
I am creating quite complex videos here.
I'm going into quite a lot of detail with regards to the configuration of some of this network automation
stuff.
Other videos.
Too long.
Do you enjoy the videos?
Please put comments below this video and let me know how I can make this better for you.
Do you want shorter videos?
Do you want more in depth videos?
How can I make this better for you and help you become a better network engineer?
Okay, so to demonstrate this, I'm not using this physical equipment.
That's for my Kelly Linux hacking videos.
In this example, I'm going to be using three.
I've got a Linux container here.
This is a Linux server which I'm going to use just for testing purposes.
I've got a switch, I've got an iOS V router that simply there to enable Nat or to run Nat to get us
to the internet.
So this is just a basic infrastructure running within is three.
What I'm going to do, however, is bring a Cisco CSR into the topology, the default here.
With Engine three doesn't have enough memory.
So I'm going to right click click configure.
I'm going to change this to use 4096 meg of RAM and give it to CPUs.
This device is running within the three VM locally on my Mac.
So here I'm running three version 2.2 release candidate five.
I'm running that CSR on the three VM.
Okay, I'm going to start this up.
Now it takes a while to boot.
So while it's booting, let me talk a little bit more about what we doing here.
I'm going to configure the CSR router so that I can access a Linux container running within the CSR.
Now CSR routers use iOS iSCSI.
That's different to monolithic or traditional iOS.
In traditional iOS or monolithic iOS, the operating system is installed directly on the hardware here.
The operating system, iOS, as we used to, runs on top of Linux so we can have containers running
within Linux, running side by side to the Cisco iOS.
Now there's a lot of documentation online showing you how to do this.
Here's an example from Dev Net.
I'll put links to this document and others below the video so that you can have a look at that in your
own time.
But basically what we're going to enable is the guest shell application.
This is a Linux container that we can run on an iOS device.
You can do many things such as run Linux commands, and I'm going to show you that here you can run
Python scripts.
I'll demonstrate that.
There's also device level API integration.
Now, in this document and many others that I've seen online, they get you to configure Nat or network
address translation between the guest shell container and iOS iSCSI.
We're not going to do that.
We're going to use something that's been around for many years.
We're going to use what's called IP unnumbered, which allows you to use an IP address from one network
on another.
Logically, what's happening within the CSR is we have one network, let's say gigabit Ethernet, one
that connects us to the Internet or the local area network.
But logically, there's a cable from the iOS SCSI to this container.
This has been used for many, many years.
So I remember back and forgive me for showing my age on the old, old 5500 Cisco Catalyst switches.
That's like going back many, many years.
They had a Catalyst switch that would run one operating system.
And then logically, there was a connection within the switch to what was called an RSM, which was
a router switch module, and you would move from OS, which had set based commands into a OSM, which
was running Cisco iOS as we know today.
So you had this logical connection that you could jump from one to the other within the same device,
same kind of concept.
Yeah.
A more modern example of that is a Unity Express module that runs within a Cisco CME router.
So if you've got a cool manager express router that's running Cisco iOS and then you would have this
logical connection to a Linux operating system that ran the Unity Express of voice messaging system.
So that kind of concept has been around for a long time.
But yeah, what we're doing is we doing it with a container.
So we are going to create a logical connection, as they've shown over here in this document from Cisco,
iOS, iSCSI to the container.
And we're using what's called a virtual port group for that.
I'm not going to do it the way they've done here.
I think it's too complicated.
We'll use IPA numbered, which once again has been around since the days of modems called Manage Express
Unity Express been around for a long time, used in many, many products.
Okay, so my CSR device has booted up once again.
I dragged a CSR into the Gen three topology.
This is a brand new device, so hence we see system configuration dialog.
Do I want to enter the initial configuration dialog?
I'm going to say no, I don't want to use the initial configuration dialog and I want to terminate auto
install.
Now going back here, one of the reasons I changed the RAM and CPUs is I've found that when you start
up the guest shell on iOS XY, in other words, the Cisco CSR engine is three using the defaults.
It doesn't work, causes problems.
Okay, so show version.
Here's the command.
You can see we're using Cisco, iOS, XY.
This is the version of operating system notice here, Linux, this is using Linux and we can use a Linux
container directly on this router.
Okay.
So go to global config mode.
Let's give it a name such as CSR one.
So hostname CSR one.
This interface gigabit one is connected to my network.
I've got the iOS v router here configured as a standard internet router.
So all it's doing is acting as our default gateway to get to the internet.
This IP address is actually a physical Cisco router in my network here at home, so that actually gets
me to the internet.
But this router is acting as our internet router to get us out of three into the physical world.
All I've done on this router is configure IP addresses, so it's got this IP address as the inside IP
address, this IP address as the outside IP address.
So from a net or network address, translation point of view, that's the inside interface.
This is the outside interface.
This is our default gateway to get to the Internet.
Okay.
So back on the CSR brand new rotter.
All I've done is give it a hostname.
Okay.
Top End show iocs service.
This command shows us that.
The IOCs service is not running at the moment, so that service is not currently running to enable it.
Now I'll put all these commands below, so don't worry about trying to remember or write down all the
commands in global configuration mode.
I'm going to enable IOCs.
Okay.
So we can see that the server iocs has been notified to start.
So do the show command again.
Show IOCs service.
What you'll notice is the services are now running.
I'm not going to use HRA in this example, so that's okay.
Okay.
Show IP interface brief.
The router is a brand new router.
We haven't configured anything on it.
So the first thing I'm going to do is give this router an IP address of, let's say ten 111 255 255
zero and no, shut the interface.
Very basic stuff.
This router should hopefully be able to ping the iOS v router, which is the internet router.
Okay.
So Interface took a while to come up.
Janus three Version 2.2 now supports link status, so we actually see the links like on a real router.
So it took it a while for the keeper lives to kick in and bring the interface up so we can now ping
our default gateway.
Okay.
So this is where it gets interesting.
We're going to create an interface which is our virtual port group as per this diagram from Cisco Dev
net.
So interface virtual port group and I'm going to pick a number zero.
And this is once again where I'm going to use commands from the past rather than configuring like they've
done here.
A separate subnet on the physical interface and then this virtual cable between iSCSI and the container.
I'm going to simply reuse the same subnet.
So this container will logically appear as if it's on the physical network, even though it's not.
If you look at the logical cables within the device.
So just in your mind's eye, imagine you've got a router, physical cable to the physical network,
and then this logical cable to a container.
Typically every interface on a router needs to be in a separate subnet, but we're going to put this
in the same subnet as the physical network by using IPA numbered.
It was a way in the past to conserve IP addresses.
Here I'm using it to make things a lot simpler than the examples they've got on Cisco's website.
Okay.
So show IP interface brief in the output share.
You can see that the virtual port group has the same IP address as the gigabit interface.
Now from a routing point of view, that can get confusing.
So we're going to have to create some specific static routes to make the routing work in this topology
in a moment.
But for now, that's all we need to do.
The next command is to enable Guest Shell.
So I'm going to say Guest Shell enable because I want to run the guest shell virtual port group is going
to be zero.
The guest IP.
So what IP address am I going to allocate to the container?
Remember we've got the router logical cable to the container.
We need to allocate an IP address to this container.
It's kind of like DHCP to the container if you like.
Not a true analogy, but there you go.
Okay.
Now it says please wait for completion.
Now I've had problems with this.
You can as an example at the end of this command, add a DNS server.
I want to use Google because I want to get this container to connect to the Internet and I want to install
applications on this container.
So I've found sometimes engineer three that's giving that gave me problems doing it this way work better.
I'm not sure if you can hear my Mac, but it's starting to spin up and make a lot of noise as it starts
this guest shell up.
But as you can see there, that's been completed successfully.
Just to show you the command notice, you could specify a name server here.
I've had problems doing that, so I didn't do that here.
I'll do that in a moment directly through Linux.
Okay.
So that's all you had to do.
Just to remind you what I did.
Was.
Configure a virtual port group, use the IP address from the gigabit one interface gigabit one has an
IP address configured interfaces, no shut and scrolling down notice I've got IOCs enabled, so that's
basically all I had to do.
Once again, I'll put the config below if so that you can see how to set this up yourself.
I had quite a lot of problems getting it to work smoothly.
Okay, so now what I'm going to do is run the guest shell.
I'm going to run bash in this example.
So basically what this is doing is connecting me to that container and I've now connected to Linux notice
please this is Linux so you name a shows us that we're running Linux here this is not iOS.
So show IP interface brief as an example doesn't work, but sudo giving me root privileges i have config.
Shows me the IP address of this container.
Again, the router allocated the IP address to the container when we ran the guest shell command over
here.
So I allocated that IP address to the docker container.
Okay.
So that's nice.
And I get a lot of stick for using IP config.
So I'll use IP address.
Notice the IP address configured on the guest shell.
Is this mean you can run commands here like you would on any Linux device, but notice the IP address
is fail.
The guest shell is not able to ping out and the reason for that is I need to set up routing notice.
When I look at the routing table, I only see this ten 110 is out of gigabit one.
There's no route to the Docker container.
So what I need to do now is add a route to the Docker container.
And just to prove the point actually before I do that, notice if I ping ten 112 from the router, it
doesn't know where to send the traffic because there's no route to the Docker container.
So what I'm going to do is IP Route ten 112, this will be a slash 32 route and I'm going to point it
to the virtual port group of zero.
So hopefully now I'll be able to ping the Linux container, which I can.
There you go.
Okay.
But I also want to put a route to the Internet.
So on my router, I'm going to add a default route to the iOS router.
That's my Internet router.
Okay.
So ping ten 11254.
Can the router ping?
Default gateway?
Yes, it can.
I need to.
Enable IP domain.
Look up on this router.
I need to enable a name server so that I can get to the internet and hopefully I'll be able to ping
internet addresses which I can so I can ping google.com as an example.
Can I ping cisco dot com?
Yes, I can.
So I have internet reachability from the router.
But what I want to do now is run bash and make sure that this device can ping outside.
Notice that didn't work before.
Neither did this.
So I can't ping the default gateway from the guest shell.
I'll sort that out in a moment.
But as an example, I won't be able to ping google.com because because I haven't configured a dns server
cat etsi resolve dot conf shows me that there's no DNS server configured on this device, so I'm going
to copy a command here.
Again, I'll put this below the video.
Basically I'm going to echo name server google.
And a pen that to the file that didn't show that nicely.
But if I do cat it's resolve conf.
Notice I've got a name server added, which I didn't have previously.
So if we do have internet connectivity that should resolve.
But at the moment I'm having a problem.
I have had quite a few issues running this and Janus three.
So if you do struggle with things, you might have to reboot it.
Okay, so let's just confirm that I haven't done something stupid on the CSR show.
IP interface brief ping ten 11254.
I can ping the default gateway.
I can ping the Linux container.
And as a sanity check, I'll connect to this Linux server.
See, here's my Linux PC.
It's got this IP address.
Ping ten 111.
Can I ping the seesaw router?
Yes, I can.
Can I ping the Linux container?
Yes, I can.
So this seems to be a Janus three problem rather than an issue on the CSR.
So I might have to delete some links.
This once again is the IP address of the server over here.
Let me test if I can get the CSR.
Linux container running here to ping to the Linux container.
So let's go back into bash.
Ping ten one 101.
So notice the Linux container on the router can ping the Linux server in our network, but it comping
the router.
I'll delete some links in a moment to sort that out.
But before I get there, let's add a user here.
So pseudo user add David.
Pseudo password, David.
I'll set a password off Cisco.
Not a great password at the moment.
I've connected to the shell via the console, if you like.
So notice the IP address, but I'll go to the Linux server.
So this device has this IP address.
Can I switch to the container running on the router?
Yes, I can put my password in and I'm in.
So again, this is the Linux server.
This is the router linux shell.
If I type who notice I have another connection.
I've now switched from Linux here onto Linux on the CSR.
So before I do any troubleshooting in Genesis three, I just want to make the point that this is Linux.
So you'd.
That's my home directory seed route.
Alice Dash L.
This is full blown Linux, so you can do all kinds of things yet, including installing applications,
including running Python.
So this is Python running within Linux on that CSR in the topology.
So this is Python 2.7.5 over there.
I can install Python three of our like, but basically this is Python as you know it and this is Linux
as you may know it.
St OS Running on that.
CSR okay, so Ginn is three.
What I'm going to do is delete this link.
And then I'll edit back again.
So hopefully that will solve the issue between the iOS, the router and the CSR.
So paying ten 111.
Can I ping the CSR router from the iOS router?
Yes, I can.
Can I ping the container on the CSR?
Yes I can.
So notice by deleting that link and re enabling it in three.
I've solved the problem.
So let's go back to the guest shell.
Again.
This is the guest show running on the CSR.
Okay.
So let's see if we can ping google.com.
Notice we can.
So I'm pinging the internet from a linux container running within the CSR.
So that works.
Clear the screen.
Let's install an application.
So pseudo yum, install and nano.
And I'm going to say yes just to make sure that it downloads the software and installs it on the container.
Installing this through Janus three can be a bit slow, so I'm installing this via a switch through
a iOS router.
Download can be pretty slow in DNS three.
So what I'll do is speed this up so you don't have to watch the installation.
Okay.
So the installation is now completed.
So notice I can use nano here.
Just like I would in Linux, VI is installed on them.
Some people get upset when I call this VI rather than them, but VM is installed by default.
Nano isn't installed.
Nano is going to be a lot easier for you if you new to Linux than VI.
So let's call this Python script one dot p y and I'll just type something very basic here.
We've got to do a hollow network automation.
Script.
Just to prove the point, I'll save the script.
So Alice Python shows us that we've got this Python script and I'll use Python now to run that script.
So I've been able to run a Python script within the Linux guest shell on that CSR.
Now again, that might not be very useful, so let's do something better here.
I'll cut that text and I'll say Import CIS.
Import Seelye.
And just to.
To make sense of this.
I'll do this interactively first.
I've run Python and what I can do now is imports and import cli.
I'm going to be able to run cli commands using python on box on this device.
In other words, I don't need a separate server.
I'm running this python script directly on the CSR and then I could use a command like CLI execute p
show IP interface brief.
And notice that command has executed.
I could do something like show version.
And there's the show version.
On the router.
He has my python command and he has the output.
I could do something like show version, include version or something like that.
And that should be uppercase, actually.
So there's my command.
And notice there's the version of operating system.
I'm basically running.
Shell commands within my script.
Okay, so let's do that again.
But through a script.
Okay, so here's my script.
I'll save that.
And then I could run Python Python script one and there's the output.
So let's push that to more on Linux.
So my Python script over there.
Yes.
My show EIP interface brief.
Here's my show version information.
And again.
I might want to make that easier to use.
So do that.
Clear my script, run the script, and there you go.
Now, some people have asked us when I've demonstrated stuff previously and notice I'm back on the sly,
so clear doesn't work because I'm on the rider now.
Can you run these Python scripts from.
The Sealy, and the answer is yes you can.
In this document, Programmability Configuration Guide, they show you a lot more than what I'm demonstrating.
So as an example, they show you that you can run Python directly from the router and you could also
run a script that you've stored in Flash.
So here's a sample script that they're running directly from Flash, and then here they are running
a script from Guest Shell.
Okay, so let's demonstrate that.
Okay.
So once again, I'm on the router now.
This is iOS, ESXi, this is not Linux.
What I can do now is say guest shell.
Run Python.
And then I'm going to specify the script that that is stored in Linux.
So what this has done now is run the Python script that's stored in the Linux container.
Here's the output of show IP interface brief.
Here's show version.
Now again, you can put the Cisco documentation, put scripts in the flesh of the router.
So you might not want to keep them in the Linux container.
You want to store them in the flash, and then you want to execute them from Flash.
And they have a lot more complicated examples on the Cisco documentation, much better than the examples
I've just shown you.
I'm just trying to get you started.
Okay.
So in this video I showed you how to get a CSR configured within Janus three, how to enable the guest
shell, how to access the guest shell, use Linux commands, install Linux applications, use Python
run Python scripts.
And hopefully open up a whole new world for you with regards to network automation using on box methods.
In other words, we don't need Python on a separate server.
In separate videos, I'll show you how to use Python on a Linux server like this and then configure
devices that way.
But in this example, I'm running Linux and Python on the router and I'm making changes on the router.
One of the advantages of that is here we don't need IP connectivity to the router to run scripts.
So if we lost IP connectivity to the router, the router could still run scripts locally.
Whereas if I connect remotely and I'll lose IP connectivity to that router, my scripts will no longer
work.
Okay.
This is a long video.
Again, if you enjoyed this video, please like it.
Please subscribe to my YouTube channel and please click on the bell to get notifications when I post
a new video.
I'm David Bumble.
I want to wish you all the very best as we vote this.