In previous videos which I've linked here I showed you how to use Linux commands on Cisco.
IOW this was using traditional Cisco IOW or monolithic Cisco.
IOW you kind of restricted in the Linux commands that you can use in this video.
However I'm going to show you how to take that to the next level by using a Linux container running
directly on Cisco.
IOW XY.
I'll show you how to use Python.
In other words correct python scripts.
How do install applications within that Linux container so you could as an example install nano.
That's just a basic application that I'll show you in this video.
But I mean you could install any type of application that runs on Linux within that container.
Obviously you need to think about what you're going to be doing.
You don't want to run a huge kind of server database application on the container.
But the point is is that you can run linux directly on a Cisco IOW device.
This is true Linux you can use any command that's supported in S.O.S.
That's the flavor of Linux that the Cisco Iowa's XY uses.
You can run Python scripts directly within that Linux container or call them from within the Cisco AOS.
Okay because this is YouTube.
Please could I ask you to subscribe to my YouTube channel please could I should like this video.
If you find it useful please click on the bolt to get notifications to make it easier for you.
I've put all the strips below this video and links to documentation so if you get bored.
Hopefully not of this video.
You can refer to the documentation below the video to get more information and samples of the scripts
that I'm running.
Now some feedback from you please.
Before we get started I am creating quite complex videos here.
I'm going into quite a lot of detail with regards to the configuration of some of this network automation
stuff other videos too long.
Do you enjoy the videos please put comments below this video and let me know how I can make this better
for you.
Do you want shorter videos do you want more in-depth videos.
How can I make this better for you and help you become a better network engineer.
Okay so to demonstrate this I'm not using this physical equipment that's for my Kelly Linux hacking
videos.
In this example I'm going to be using genius 3.
I've got a Linux container here.
This is a linux server which I'm gonna use just for testing purposes.
I've got a switch.
I've got an Iowa's v rotor that's simply there to enable Nat or to run Nat to get us to the Internet.
So this is just a basic infrastructure running with ingenious 3.
What I'm going to do however is bring a Cisco CSR into the topology.
The default here with ingenious 3 doesn't have enough memory so I'm going to right click click configure
I'm going to change this to use four thousand ninety six meg of RAM and give it to CPE use this device
is running within the genus 3 VM locally on my Mac.
So here I'm running genius 3 version 2 to to release candidate 5 I'm running that CSR on the June 3
VM.
Okay I'm going to start this up.
Now it takes a while to boot.
So while it's booting let me talk a little bit more about what we are doing here.
I'm gonna configure the CSR router so that I can access a Linux container running within the CSR.
Now CSR riders use R Us XY that's different to monolithic or traditional.
IOW in traditional IOW or monolithic IOW the operating system is installed directly on the hardware
here.
The operating system.
IOW as we used to runs on top of Linux so we can have containers running within Linux running side by
side to the Cisco.
IOW now there's a lot of documentation online showing you how to do this.
Here's an example from definite.
I'll put links to this document and others below the videos so that you can have a look at that in your
own time.
But basically what we're going to enable is the guest shell application.
This is a linux container that we can run on.
IOW XY device you can do many things such as run the next commands and I'm going to show you that.
Yeah you can run Python scripts.
I'll demonstrate that there's also device level API integration.
Now in this document and many others that I've seen online they get you to configure Nat or network
address translation between the guest shell container and eyewear sexy.
We're not going to do that.
We're going to use something that's been around for many years.
We're going to use what's called IP Unnumbered which allows you to use an IP address from one network
on another.
Logically what's happening within the CSR is we have one network.
Let's say Gigabit Ethernet one that can access to the Internet or the local area network.
But logically there's a cable from the Iaw XY to this container.
This has been used for many many years.
So I remember back in.
Forgive me for showing my age on the old old fifty hundred Cisco Catalyst switches.
That's like going back many many years.
They had a catalyst switch that would run one operating system and then logically there was a connection
within the switch to what was called an all reset which was a rod a switch module and you would move
from Katowice s which had set basic commands into a RSM which was running Cisco IOW as we know today.
So you had this logical connection that you could jump from one to the other within the same device.
Same kind of concept here.
A more modern example of that is a unity express module that runs within a Cisco CMU router so if you've
got a call manage Express rider that's running Cisco us and then you would have this logical connection
to a Linux operating system that render the unity express a voice messaging system.
So that kind of concept has been around for a long time but here what we're doing is we doing it with
a container.
So we are going to create a logical connection as they've shown over here and this document from Cisco
eyewear sexy to the container and we're using what's called a virtual port group for that.
I'm not going to do it the way they've done here.
I think it's too complicated we'll use IPO numbers which once again has been around since the days of
modems called manage express unity express been around for a long time.
Used in many many products.
Okay so my CSR device has booted up once again I dragged a CSR into the genus free topology.
This is a brand new device.
So hence we see system configuration dialog.
Do I want to enter the initial configuration dialog.
I'm gonna say no I don't want to use the initial configuration dialog and I want to terminate auto install.
Now going back here one of the reasons I changed the RAM and CPE use is I've found that when you start
up the guest shell on ISIS XY.
In other words a Cisco CSR in June 23 using the defaults.
It doesn't work causes problems.
Okay so show version.
Here's the command.
You can see we're using Cisco Iris XY.
This is the version of operating system.
Notice here Linux.
This is using Linux and we can use a Linux container directly on this rider.
Okay so go to global conflict mode.
Let's give it a name such as CSR one so hostname CSR one this interface gigabit one is connected to
my network.
I've got the iris V right here configured as a standard Internet right.
So all it's doing is acting as our default gateway to get to the Internet.
This IP address is actually a physical Cisco rider in my network here at home.
So that actually gets me to the Internet.
But this writer is acting as our Internet writer to get us out of Janus 3 into the physical world.
All I've done on this router is configure IP addresses so it's got this IP address as the inside IP
address this IP address as the outside IP address.
So from a Nat or network address translation point of view that's the inside interface.
This is the outside interface.
This is our default gateway to get to the Internet okay.
So back on the CSR brand you wrote it all I've done is give it a hostname okay type and show Io x service.
This command shows us that the IO x service is not running at the moment so that service is not currently
running to any bullet.
Now put all these commands below so don't worry about trying to you know remember or write down all
the commands in global configuration mode.
I'm going to enable Io x.
Okay so we can see that the server Io X has been notified to start.
So do the show come on again show Io x service what you'll notice is the services are now running I'm
not going to use H.A. in this example so that's okay.
Okay.
Show IP interface brief the writer is a brand new writer.
We haven't configured anything on it.
So the first thing I'm going to do is give this writer an IP address of let's say 10 1 1 1 255 255 0
and no shut the interface very basic stuff.
This router should hopefully be able to ping the Iowa's v Roorda which is the Internet Roorda OKC interface
took a while to come up genius 3 virgin to the 2 now supports link status so we actually see the links.
Like on a real router.
So took it a while for the keeper lives to kick in and bring the interface up so we cannot ping our
default gateway.
Okay so this is where it gets interesting.
We're going to create an interface which is our virtual port group.
As per this diagram from Cisco definite so interface virtual port group and I going to pick a number
zero and this is once again where I'm going to use commands from the past rather than configuring like
they've done here a separate subnet on the physical interface and then this virtual cable between XY
and the container.
I'm going to simply reuse the same subnet so this container will logically appear as if it's on the
physical network even though it's not.
If you look at the logical tables within the device so just in your mind's eye imagine you've got a
router physical cable to the physical network and then there's logical cable to a container.
Typically every interface on a router needs to be in a separate subnet but we're going to put this in
the same subnet as the physical network by using IP numbers.
It was a way in the past to conserve IP addresses him using it to make things a lot simpler than the
examples they've got on Cisco's website
so show IP interface brief in the output where you can see that the virtual port group has the same
IP address as the gigabit interface.
Now from a routing point of view that can get confusing so we're gonna have to create some specific
static rights to make the writing work in this topology in a moment but for now that's all we need to
do.
The next command is to enable guest shell something to say guess shall enable because I want to run
the sketch shell virtual port group is going to be zero.
The guest IP so what IP address am I going to allocate to the container.
Remember we've got the router logical cable to the container we need to allocate an IP address to this
container.
It's kind of like the HP to the container if you like not a true analogy but there you go.
Okay.
Now it says please wait for completion.
I've had problems with this.
You can as an example at the end of this command add a DNS server I want to use Google because I want
to get this container to connect to the Internet and I want install applications on this container.
So I've found sometimes ingenious three that's giving that gave me problems doing it this way worked
better.
I'm not sure if you can hear my mac but it's starting to spin up and make a lot of noise as it starts
this guest shell up.
But as you can see there that's been completed successfully.
Just to show you the command notice you could specify a name server here.
I've had problems doing that so I didn't do that here.
I'll do that in a moment directly through Linux Okay so that's all you had to do just to remind me what
I did
was
configure a virtual port group used the IP address from the gigabit one interface gigabit one has an
IP address configured interfaces no shut and scrolling down notice I've got Io X enabled.
So that's basically all I had to do.
Once again I'll put the conflict below if so that you can see how to set this up yourself.
I had quite a lot of problems getting it to work smoothly.
Okay so now what I'm going to do is run the guest shell.
I'm gonna run Bash.
In this example.
So basically what this is doing is connecting me to that container and I've now connected to Linux.
Notice please this is Linux.
So you name a shows us that we're running Linux here.
This is not I Os so show IP interface brief as an example doesn't work but pseudo giving me rude privileges
I have config shows me the IP address of this container.
Again the router allocated the IP address to the container when we ran the guest shell command over
here so I allocated that IP address to the docker container.
Okay so that's nice and I get a lot of stick for using IP config so I'll use IP address.
Notice the IP address configured on the guest Shell is this I mean you can run command here like you
would on any Linux device but notice the IP addresses fail the guest Shell is not able to ping out.
And the reason for that is I need to set up routing notice when I look at the writing table.
I only see this 10 1 1 0 is out of gigabit 1.
There is no route to the docker container.
So what I need to do now is add a raft to the docker container and just to prove a point actually before
I do that.
Notice if I'm paying 10 1 1 2 from the right it it doesn't know where to send the traffic because there's
no right to the docker container.
So what I'm going to do is IP write 10 1 1 2.
This will be a slash that to route and I'm going to point out to the virtual port group of 0.
So hopefully now I'll be able to paying the Linux container which I can.
There you go.
Okay.
But I also want to put a raft to the Internet.
So on my rider I'm gonna add a default raft to the Iaw v rider.
That's my internet rotor Okay so paying 10 1 1 2 5 4 can the rider paying default gateway.
Yes it can.
I need to enable IP domain look up on this road.
I need to enable a name server so that I can get to the Internet and hopefully I'll be able to ping
Internet addresses which I can second ping Google dot com as an example.
Can I ping Cisco dot com.
Yes I can.
So I have Internet reach ability from the router but what I want to do now is run bash and make sure
that this device can ping outside.
Notice that didn't work before.
Neither did this
so I can't ping the default gateway from the get show.
I'll sort that out in a moment.
But as an example I won't be able to ping Google dot com because because I haven't configured a DNS
server cat Etsy resolve dot conf shows me that there's no DNS server configured on this device so I'm
going to copy a command here again I'll put this below the video.
Basically I'm gonna echo name server Google and a pen that to the file that didn't show that nicely
but if I do catch it see resolved conf.
Notice I've got a name server added which I didn't have previously.
So if we do have Internet connectivity that should resolve but at the moment I'm having a problem.
I have had quite a few issues running this ingenious 3.
So if you do struggle with things you might have to reboot it.
Okay so let's just confirm that I haven't done something stupid on the CSR show IP interface brief thing
10 1 1 2 5 4.
I can ping the default gateway I can ping the Linux container and as a sanity check I'll connect to
this Linux server see here's my linux.
P.S. It's got this IP address paying 10 1 1 1.
Can I paying the CEO's all right.
Yes I can.
Can I ping the Linux container.
Yes I can.
So this seems to be a Janus 3 problem rather than an issue on the CSR so I might have to delete some
links.
This once again is the IP address of the surf over here.
Let me test if I can get the CSR Linux container running here to ping to the Linux container.
So let's go back in to bash paying 10 1 1 to 1.
Okay so notice the Linux container on the router camping the Linux server in our network but it comping
the router.
I'll I'll delete some links at the moment to sort that out but before I get there let's add a user here.
So pseudo user add David pseudo password.
David.
I'll set a password of Cisco.
Not a great password at the moment.
I've connected to the shuttle via the console if you like.
So notice the IP address but I'll go to the Linux server.
So this device has this IP address.
Can I SS H to the container running on the road.
Yes I can put my password in and I'm in.
So again this is the Linux server.
This is the router Linux shell if I type who noticed I have another connection I have now SS HD from
Linux here onto Linux on the CSR so before I do any troubleshooting in Genesis 3 I just want to make
the point that this is Linux so p WD that's my home directory seedy route.
Alice dash l this is full blown Linux so you can do all kinds of things sharing including installing
applications including running Python.
So this is Python running within Linux on that CSR in the topology.
So this is Python 2 7 top 5 over there.
I can install Python 3 if I like but basically this is Python as you know it.
And this is Linux as you may know it.
S.O.S.
Running on that CSR.
Okay.
A genius 3 what I mean to do is delete this link and then I'll add it back again.
So hopefully that will solve the issue between the IRS v. rota and the CSR Okay so paying 10 1 1 1 cannot
paying the CSR rider from the Iowa's variety Yes I can.
Can I paying the container on the CSR.
Yes I can.
So notice by deleting that link and re enabling it in Jena 3 I've solved the problem.
So let's go back to the guests shall again.
This is the guest shell running on the CSR okay.
So let's see if we can paying Google dot com.
Notice we can.
So I'm pinging the Internet from a Linux container running within the CSR.
Okay so that works clear the screen.
Let's install an application so pseudo young install nano and I must say yes just to make sure that
it downloads the software and installs it on the container.
Installing this through genius 3 can be a bit slow so I'm installing this via a switch through a US
v rider download can be pretty slow.
Ingenious 3.
So what I'll do is speed this up so you don't have to watch the installation.
Okay so the installation is not completed.
So notice I can use nano here just like I would in Linux V.I. is installed or then some people get upset
when I call is V.I. rather than VM but Van is installed by default nano isn't installed.
Man it's gonna be a lot easier for you if you need to Linux than VII.
So let's call this python script 1 Doc P Y and I'll just type something very basic here we've got to
do a hollow network automation
script just to prove the point.
I'll save the script so Alice Python shows us that we've got this python script and I'll use python
now to run that script.
So I've been able to run a python script within the Linux guest shell on that CSR.
Now again that might not be very useful.
So let's do something better here or cut that text and I'll say import SAS import Seelye and just two
make sense of this.
I'll do this interactively first.
I've run Python and what I can do now is import source and import CLIA.
I'm going to be able to run CLIA commands using Python on box on this device in other words I don't
need a separate server.
I'm running this python script directly on the CSR and then I could use a command like CLIA execute
P show IP interface brief and notice that command has executed.
I could do something like show version and there's the show version on the rotor.
Here's my Python command and here's the output I could do something like show version include version
or something like that and that should be uppercase actually.
So there's my command.
And notice there's the version of operating system I'm basically running shell commands with in my script.
Okay so let's do that again.
But through a script.
Okay so here's my script I'll save that and then I could run Python python script 1 and there's the
output so let's push that to more on Linux so my python script over there yes my show IP interface brief.
Here's my show version information.
And again I might want to make that easier to use.
So do that.
Clear my script run the script and there you go.
Now some people have asked this when I've demonstrated stuff previously and noticed I'm back on the
CLIA so clear doesn't work because I'm on the right now.
Can you run these python scripts from the CSI.
And the answer is yes you can.
In this document program ability configuration guide they show you a lot more than what I'm demonstrating.
So as an example they show you that you can run Python directly from the rotor and you could also run
a script that you've stored in Flash.
So here's a sample script that they're running directly from flash.
And then here they are running a script from guest shell.
Okay so let's demonstrate that okay.
So once again I'm on the road and now this is IOW XY.
This is not Linux.
What I can do now is say guest shell run Python and then I'm gonna specify the script that that is stored
in Linux.
So what this has done now is run the python script that stored in the Linux container.
Here's the output of show up interface brief.
Here's show version.
Now again you can per this is good documentation.
Put scripts in the flash of the rotor so you might not want to keep them in the Linux container.
You want to store them in the flash and then you want to execute them from flash.
And they have a lot more complicated examples on the Cisco documentation much better than the examples
I've just shown you.
I'm just trying to get you started.
Okay.
So in this video I showed you how to get a CSR configured with ingenious.
How do you enable the guest show how to access the guest shall use Linux commands install Linux applications
use python run Python scripts and hopefully open up a whole new world for you with regards to network
automation using on box methods.
In other words we don't need python on a separate server in separate videos.
I'll show you how to use Python on Olympic server like this and then configure devices that way.
But in this example I'm running Linux and python on the road and I'm making changes on the right.
One of the advantages of that is here we don't need IP connectivity to the writer to run scripts.
So if we lost IP connectivity to the right of the writer could still run scripts locally whereas if
I connect remotely and I lose IP connectivity to that writer my scripts will no longer work.
Okay.
This is a long video game.
If you enjoyed this video please like it please subscribe to my YouTube channel and please click on
the ballot to get notifications when I post a new video.
I'm David Bumble.
Want to wish you all the very best.