Python and Linux on Cisco IOS?

Key Takeaways

in previous videos which I've linked here I showed you how to use Linux commands on Cisco IOS this was using traditional cisco iOS or monolithic cisco iOS you kind of restricted in the linux commands that you can use in this video however I'm going to show you how to take that to the next level by using a Linux container running directly on Cisco IOS XE I'll show you how to use Python in other words correct Python scripts how to install applications within that Linux container so you could as an example install Nano that's just a basic application that I'll show you in this video but I mean you could install any type of application that runs on Linux within that container obviously you need to think about what you're going to be doing you don't want to run a huge kind of server database application on the container but the point is is that you can run Linux directly on a Cisco iOS device this is true Linux so you can use any command that's supported in st. OS that's the flavor of Linux that the Cisco IOS XE users you can run Python scripts directly within that Linux container or call them from within the Cisco IOS okay because this is youtube please could I ask you to subscribe to my youtube channel please could ask you to like for this video if you find it useful please click on the bell to get notifications to make it easier for you I've put all the scripts below this video and links to documentation so if you get bored hopefully not of this video you can refer to the documentation below the video to get more information and samples of the scripts that I'm running [Music] now some feedback from you please before we get started I am creating quite complex of video Xie I'm going into quite a lot of detail with regards to the configuration of some of the cinetic automation stuff other videos too long do you enjoy the videos please put comments below this video and let me know how I can make this better for you give on shorter videos do you want more in-depth videos how can I make this better for you and help you become a better network engineer okay so to demonstrate this i'm not using this physical equipment that's for my kali linux hacking videos in this example i'm going to be using gns3 I've got a Linux container here this is a Linux server which I'm going to use just for testing purposes I've got a switch I've got an iOS V router that's simply there to enable net or to run net to get us to the internet so this is just a basic infrastructure running within gns3 what I'm going to do however is bring a Cisco CSR into the topology the default here within genus 3 doesn't have enough memory so I'm going to right click click configure I'm gonna change this to use 4096 Meg of RAM and give it to CPUs this device is running within the genus 3 VM locally on my Mac so here I'm running genus 3 version 2.2 release candidate 5 I'm running that CSR on the genus 3 VM okay I'm going to start this up now it takes a while to boot so while it's booting let me talk a little bit more about what we doing here I'm going to configure the CSL router so that I can access a Linux container running within the CSR now CSR routers use iOS XE that's different to monolithic or traditional iOS in traditional iOS or monolithic iOS the operating system is installed directly on the hardware here the operating system iOS as we used to runs on top of Linux so we can have is running within Linux running side by side to the Cisco IOS now there's a lot of documentation online showing you how to do this here's an example from dev net I'll put links to this document and others below the video so that you can have a look at that in your own time but basically what we're going to enable is the guest shell application this is a Linux container that we can run on an iOS XE device you can do many things such as run the Nix commands and I'm going to show you that here you can run Python scripts I'll demonstrate that there's also device level API integration now in this document and many others that I've seen online they get you to configure NAT or network address translation between the guest shell container and iOS XE we're not going to do that we're going to use something that's been around for many years we're going to use what's called IP unnumbered which allows you to use an IP address from one network on another logically what's happening within the CSR is we have one network let's say Gigabit Ethernet one that connects us to the Internet or the local area network but logically there's a cable from the iOS XE to this container this has been used for many many years so I remember back and forgive me for showing my age on the old old 5500 Cisco Catalyst switches that's like going back many many years they had a catalyst switch that would run one operating system and then logically there was a connection within the switch to what was called an RSM which was a router switch module and you would move from cat OS which had set based commands into a RSM which was running Cisco IOS as we know today so you had this logical connection that you could jump from one to the other within the same device same kind of concept yet a more modern example of that is a unity Express module that runs within a Cisco CM e router so if you've got a call manage Express router that's running Cisco IOS and then you would have this logical connection to a Linux operating system that ran the Unity Express voice messaging system so that kind of concept has been around for a long time but yeah what we're doing is we doing it with a container so we are going to create a logical connection as they've shown over here in this document from Cisco IOS XE to the container and we're using what's called a virtual port group for that I'm not going to do it the way they've done here I think it's too complicated we'll use IP a numbered which once again has been around since the days of modems call manage Express unity Express been around for a long time used in many many products okay so my CSR device has booted up once again I dragged a CSR into the genus tree topology this is a brand new device so hence we see a system configuration dialog do I want to enter the initial configuration dialog I'm going to say no I don't want to use the initial configuration dialog and I want to terminate auto install now going back here one of the reasons I changed the RAM and CPUs is I've found that when you start up the guest shell on iOS XE in other words a Cisco CSR engine is three using the defaults it doesn't work causes problems okay so show version here's the command you can see we're using Cisco IOS XE this is the version of operating system notice yeah Linux this is using Linux and we can use a Linux container directly on this rada okay so go to global config mode let's give it a room name such as CSR one it's a host name CSR one this interface gigabit one is connected to my network I've got the iOS v router here configured as a standard internet router so all it's doing is acting as our default gateway to get to the Internet this IP address is actually a physical Cisco router in my network here at home so that actually gets me to the internet but this router is acting as our internet router to get us out of gns3 into the physical world all I've done on this router is configure IP addresses so it's got to this IP address as the inside IP address this IP address as the outside IP address so from a NAT or network address translation point of view that's the inside interface this is the outside interface this is our default gateway to get to the Internet okay so back on the CS our brand new router all have done is give it a host name ok type end show iox service this command shows us that the i/o X service is not running at the moment so that service is not currently running to enable it now I'll put all these commands below so don't worry about trying to you know remember or write down all the commands in global configuration mode I'm going to enable IO X ok so we can see that the server io X has been notified to start so do the show come on again show io x service what you'll notice is these services are now running I'm not going to use H a in this example so that's ok ok show IP interface brief the broader is a brand new router we haven't configured anything on it so the first thing I'm going to do is give this router an IP address of let's say 10 1 1 1 255 255 0 and no shut of the interface very basic stuff this router should hopefully be able to ping the iOS V router which is the internet router okay so interface took a while to come up Gina 3 version 2.2 now supports link status so we actually see the links like on a real router so it took it a while for the keeper lives to kick in and bring the interface up so we can now ping our default gateway ok so this is where it gets interesting we're going to create an interface which is our virtual port group as per this diagram from Cisco dev net so interface a virtual port group and I'm going to pick a number 0 and this is once again where I'm going to use commands from the past rather then configuring like they've done here a separate subnet on the physical interface and then this virtual cable between X E and the container I'm going to simply reuse the same subnet so this container will logically appear as if it's on the physical network even though it's not if you look at the logical tables within the device so just in your mind's eye imagine you've got a router physical cable to the physical network and then there's logical cable to a container typically every interface on a router needs to be in a separate subnet but we're going to put this in the same subnet as the physical network by using IP n numbered it was a way in the past to conserve IP addresses here I'm using it to make things a lot simpler than the examples they've got on Cisco's website ok so show IP interface brief in the output here you can see that the virtual port group has the same IP address as the gigabit interface now from a routing point of view that can get confusing so we're gonna have to create some specific static routes to make the routing work in this topology in a moment but for now that's all we need to do the next command is to enable guest shell so I'm going to say guest shell enable because I want to run this guest shell the virtual port group is going to be 0 the guest IP so what IP address am I going to allocate to the container remember we've got the router logical cable to the container we need to allocate an IP address to this container it's kind of like DHCP to the container if you like not a true analogy but there you go ok now it says please wait for completion now I've had problems with us you can as an example at the end of this command add a DNS server I want to use Google because I want to get the container to connect to the internet and I want to install applications on this container so I've found sometimes in gin III that's giving that gave me problems doing it this way you work better I'm not sure if you can hear my Mac but it's starting to spin up and make a lot of noise as it starts this guest to shell up but as you can see there that's been completed successfully just to show you the command notice you could specify a name server here I've had problems doing that so I didn't do that here I'll do that in a moment directly through Linux okay so that's all you had to do just to remind you what I did was configure a virtual port group you used the IP address from the gigabit one interface gigabit one has an IP address configured interfaces no shut and scrolling down notice I've got iox enabled so that's basically all I had to do once again I'll put the config below yes so that you can see how to set this up yourself I had quite a lot of problems getting it to work smoothly okay so now what I'm gonna do is run the guest shell I'm gonna run bash in this example so basically what this is doing is connecting me to that container and I've now connected to Linux notice please this is Linux so you name a shows us that we're running Linux here this is not I Oh s so show IP interface brief as an example doesn't work but sudo giving me root privileges I have config shows me the IP address of this container again the router allocated the IP address to the container when we ran the guest shell command over here so I allocated that IP address to the docker container okay so that's nice and I get a lot of stick for using IP config so I'll use IP address notice the IP address configured on the guest shell is this I mean you can run kamancheh like you would on any linux device but notice the IP addresses fail the guest shell is not able to ping out and the reason for that is I need to set up rotting notice when I look at the writing-table I only see this 10110 is out of gigabit one there's no route to the docker container so what I need to do now is add a route to the docker container and just to prove a point actually before I do that notice if I ping 10 one-one-two from the router it doesn't know where to send the traffic because there's no route to the docker container so what I'm going to do is I peer out ten one one two this will be a / 32 route and I'm going to point it to the virtual port group of 0 so hopefully now I'll be able to ping the Linux container which I can there you go ok but I also want to put a route to the Internet so on my writer I'm going to add a default route to the iOS V router that's my internet router okay so ping 10 1 1 2 5 4 can the rider ping default gateway yes it can I need to enable IP domain lookup on this router I need to enable a name server so that I can get to the Internet and hopefully I'll be able to ping Internet addresses which I can so I can ping google.com as an example can I ping cisco.com yes I can so I have Internet reach ability from the router but what I want to do now is run bash and make sure that this device can ping outside notice that didn't work before neither did this so I can't ping the default gateway from the guest shell all sorted out in a moment but as an example I won't be able to ping google.com because because I haven't configured a DNS server cat Etsy resolve dot conf shows me that there's no DNS server configured on this device so I'm going to copy a command here again I'll put this below the video basically I'm gonna echo name server Google and append that to the file they didn't show that nicely but if I do cat it see resolve confer added which I didn't have previously so if we do have internet connectivity that should resolve that at the moment I'm having a problem I have had quite a few issues running this in gns3 so if you do struggle with things you might have to reboot it okay so let's just confirm that I haven't done something stupid on the CSR show IP interface brief paying ten one one two five four I can ping the default gateway I can ping the Linux container and as a sanity check I'll connect to this Linux server so here's my Linux PC it's got this IP address paying 10111 can I ping the CSL router yes I can cannot ping the Linux container yes I can so this seems to be a gns3 problem rather than an issue on the csr so I might have to delete some links this once again is the IP address of the server over here let me test if I can get the CSR Linux container running here to ping to the Linux container so let's go back into bash ping 10 1 101 okay so notice the Linux container on the router can ping the Linux server in our network but it comping the router I'll delete some links in a moment to sort that out but before I get there let's add a user here so sudo user add David sudo password David I'll set up password of Cisco not a great password at the moment I've connected to the shell via the console if you like so notice the IP address but I'll go to the Linux server so this device has this IP address can I SSH to the container running on the router yes I can put my password in and I'm in so again this is the Linux server this is the router linux shell if I type whoo notice I have another connection I've now SSH from Linux here on to Linux on the csr so before I do any troubleshooting in Janis 3 I just want to make the point that this is Linux so PWD that's my home directory CD root Alice - L this is full-blown Linux so you can do all kinds of things sharing pleadings installing applications including running Python so this is Python running within Linux on that CSR in the topology so this is Python 2.7 5 over there I can install Python 3 if I like but basically this is Python as you know it and this is Linux as you may know it st. OS running on that CSR okay so gin is 3 what I'm going to do is delete this link and then I'll add it back again so hopefully that will solve the issue between the iOS v rada and the CSR okay so paying 10111 can I ping the CSR writer from the iOS v-rod e yes I can can I ping the container on the CSR yes I can so notice by deleting that link and relabeling it in Janis 3 I solve the problem so let's go back to the guest shell again this is the guest shell running on the CSR okay so let's see if we can paint google.com notice we can so I'm pinging the internet from a Linux container running within the CSR okay so that works clear the screen let's install an application so sudo yum install and Nano and I must say yes just to make sure that it downloads the software and installs it on the container installing this through gns3 can be a bit slow so I'm installing this via a switch through a iOS v-rod download can be pretty slow in gns3 so what I'll do is speed this up so you don't have to watch the installation okay so the installation is now completed so notice I can use Nano here just like I would in Linux VI is installed or them some people could get upset when I call this VI rather than them but verne is installed by default Nano isn't installed man is gonna be a lot easier for you if you need to Linux then VI so let's call this Python script 1 dot py and I'll just type something very basic here we've got to do a holo Network automation script just to prove the point I'll save the script so Ellis Python shows us that we've got this Python script and I'll use Python now to run that script so I've been able to run a python script within the linux guest shell on that csr now again that might not be very useful so let's do something better here I'll cut that text and I'll say import sis import CLI and just to make sense of us I'll do this interactively first I've run Python and what I can do now is imports US and import CLI I'm going to be able to run CLI commands using Python on box on this device in other words I don't need a separate server I'm running this Python script directly on the CSR and then I could use a command like CLI execute P show IP interface brief and notice that command has executed I could do something like show version and there's the show version on the router yes my Python command and here's the output I could do something like show version include a version or something like that and that should be uppercase actually so there's my command and notice there's the version of operating system I'm basically running shell commands within my script okay so let's do that again but through a script okay so here's my script I'll save that and then I could run Python Python script one and there's the output so let's push that two more on Linux so my Python script over there yes my show IP interface brief here's my show version information and again I might want to make that easier to use so do that clear my script run the script and there you go now some people have asked us when I've demonstrated stuff previously and notice I'm back on the CLI so clear doesn't work because I'm on the writer now can you run these Python scripts from the CLI and the answer is yes you can in this document programmability configuration guide they show you a lot more and what I'm demonstrating so as an example they show you that you can run Python directly from the router and you could also run a script that you've stored in flash so here's a sample script that they're running directly from flash and then here they are running a script from guest shell ok so let's demonstrate that ok so once again I'm on the router now this is iOS XE this is not Linux what I can do now is say guest shell run Python and then I'm going to specify the script that that is stored in Linux so what this has done now is run the Python script that's stored in the Linux container here's the output of show IP interface brief here's show version now again you can per the Cisco documentation put strips in the flesh of the router so you might not want to keep them in the Linux container you want to store them in the flash and then you want to execute them from flash and they have a lot more complicated examples on the cisco documentation much better than the examples I've just shown you I'm just trying to get you started ok so in this video I showed you how to get a CSR configured within Janissary how do you enable the guest shell how to access the guest shell use Linux commands install Linux applications use Python run Python scripts and hopefully open up a whole new world for you with regards to network automation using unbox methods in other words we don't need Python on a separate server in separate videos I'll show you how to use Python on a Linux server like this and then configure devices that way that in this example I'm running Linux and Python on the router and I'm making changes on the writer one of the advantages of that is here we don't need IP connectivity to the router to run scripts so if we lost IP connectivity to the rider the rider could still run scripts locally whereas if I connect remotely and I'll lose be connectivity to that router my scripts will no longer work okay this is a long video again if you enjoyed this video please like it please subscribe to my youtube channel and please click on the bell to get notifications when I post a new video I'm David bumble I want to wish you all the very best [Music]