my cheat sheet on CML a.k.a. VIRL

CML boots a CentOS / RHEL server, uname -a is 4.18.0-80.11.2.e18_0.x8664 as of Dec 2021 4.18.0-3053.1.e18.x86₆₄ (June 1, 2021) which is old too, because 4…. is now out.

• bridge0 : the "external" interface for the CML vm ip address 192.168.2.107 (if on Bell wifi) ip address 192.168.11.66 (if on Meraki wired) ip address 192.168.2.35 (if on Bell router)

  This is the address that connect the admin web pages The breakout should use the vm host ip address 192.168.2.70 but I found I used 127.0.0.1:8080 to get the breakout ui

  This 192.168.2.0 network is also what ip addresses are leased by my Meraki dhcp server for the mgt vrf interfaces on each device connecting in to the "external" cloud.

• ens160 : the virtual port connected to "bridge0"

• virbr0 : don't know but has ip address 192.168.255.1/24
• virbr0-nic : don't know, but has no ip addr

tunnel…

I have a bridged external connection, into a lab L2 virtual switch called 'mgt' That switch connects to each devices Gig0/3 port which is in the mgt vrf. Finally, each lab device mgt vrf interface is set to ip address dhcp, so that my Meraki MX68 can lease out ip addresses to each CML node.

See the aliases for the above configs section, for the currently issued ip address leases.

Also, you DON'T need to run the entire lab if you won't use all devices. However, as a minimum you need to have the following running (hit the "play" icon against each of these devices and only those devices will start.

Also, you DON'T need to run the entire lab if you won't use all devices. However, as a minimum you need to have the following running (hit the "play" icon against each of these devices and only those devices will start.

• unmanaged switch 0
• ext-conn-0

Since configured each gig0/0 to be connected to the unmanaged switch and subsequently the external connection I setup these gig0/0 interfaces in the mgt vrf and configured them to get their ip address via dhcp, which ends up being my meraki switch, on the same networks as my laptop. That way I have direct ssh connectivity to each node, as they are on the same ip subnet.

   hostname r5
   aaa new-model

   vrf definition ZP-mgt-vrf
    address-family ipv4
    int gig0/0
    
   username ansible privilege 15 password 0 sedemo

   interface GigabitEthernet0/0
    ip address dhcp
    no shut
   !
   ip route vrf ZP-mgt-vrf 0.0.0.0 0.0.0.0 192.168.11.1

   ip ssh time-out 60
   ip ssh authentication-retries 2
   ip ssh version 2
   !
   line vty 0 4
    privilege level 15
    transport input ssh

=========
   aaa new-model

   vrf definition ZP-mgt-vrf
    address-family ipv4
    int gig0/0
    
   username ansible privilege 15 password 0 sedemo

   interface GigabitEthernet0/0
    ip address dhcp    # or assign it as a static.  up to you.
    no shut
   !
   ip route vrf ZP-mgt-vrf 0.0.0.0 0.0.0.0 192.168.11.1

   ip ssh time-out 60
   ip ssh authentication-retries 2
   ip ssh version 2
   !
   line vty 0 4
    privilege level 15
    transport input ssh

=========
   

Before you can ssh, the node needs to have a public/private key generated. You already have a host name, and the ip domain-name set. Good. Those are needed for ssh keys. Obviously you need to have ip addressing and ip routing configured and running correctly. The final pieces are the keys. Generate those as follows:

config t
  hostname r1

  ip domain-name zintis.net
  no ip domain-lookup  # to keep console sessions snappy (does not lookup names)

  crypto key generate rsa
  !  when prompted gen a key with 1024 or greater bits for ssh v2

exit

A couple of related show commands:

show ip ssh
show crypto engine
show crypto identity
show crypto key mypubkey all   ***
show crypto key pubkey-chain rsa
show crypto key pubkey-chain rsa vrf ZP-mgt-vrf
show crypto key pubkey-chain rsa
show crypto map
show crypto sockets
show crypto ?

Of particular use is:

• show crypto key mypubkey all
• show crypto key mypubkey all

If that shows no keys, you haven't generated the keys yet. So, you then run:

• crypto key generate rsa
• crypto key generate rsa

Obviously from the console, because you haven't been able to ssh to the device until your keys are generated.

On the router the above commands generated a new crypto key. But if your computer had previously ssh'd into the router, it will have stored the old key in the ~/.ssh/known-hosts file and it won't match. You'll get an error:

$ ssh r3
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:J+U4Wv93amO4aD8AOqvGtHVrIljj/0qrjq/A+s5go2M.
Please contact your system administrator.
Add correct host key in /Users/zintis/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/zintis/.ssh/known_hosts:16
RSA host key for r3 has changed and you have requested strict checking.
Host key verification failed.

To fix that simply remove the offending line from ~/.ssh/known-hosts

Should also create a default gw like so:

• ip default-gateway 192.168.11.1

If you run into trouble check out the docs on cisco.com

Obviously I had to first let the routers boot up and connect to the network in order for them to get their ip address via dhcp lease. Once that was done I could source this file to setup aliases for myself. Note the use of ansibe as the username, as obviously I am setting up ssh in order to automate the configuration of my router nodes in my cml lab using ansible running on my laptop.

Here is the alias file when on Bell's wired network, that you can source.

• . ~/bin/python/venv-pyats/cml/set-ssh-alias

alias r0='ssh ansible@192.168.2.98'
alias r1='ssh ansible@192.168.2.94'
alias r2='ssh ansible@192.168.2.100'
alias r3='ssh ansible@192.168.2.102'
alias r4='ssh ansible@192.168.2.103'
alias r5='ssh ansible@192.168.2.92'

Here is the alias file when on Meraki MX68 wired network, that you can source.

• . ~/bin/python/venv-pyats/cml/set-ssh-alias

alias r0='ssh ansible@192.168.11.68'
alias r1='ssh ansible@192.168.11.67'
alias r2='ssh ansible@192.168.11.69'
alias r3='ssh ansible@192.168.11.71'
alias r4='ssh ansible@192.168.11.70'
alias r5='ssh ansible@192.168.11.72'
vrf definition

And here is my topology related to the configs above.

This change on your Linux host:

• /etc/ssh_config or on your Macbook PRO:
• /etc/ssh/ssh_config

That would be for system wide ssh config defaults. Otherwise, you can edit ~/.ssh/config to change your own user defaults

Make this addition to your file and you will be able to ssh to these five routers (r0 to r5) without having to specify the user. i.e. you can say ssh r3 and not ssh ansible@r3 and also get the supported cyphers and exchange parameters set for each of these hosts. And no others.

Host r0
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

Host r1
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

Host r2
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

Host r3
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

Host r4
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

Host r5
  Ciphers 3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr
  KexAlgorithms +diffie-hellman-group-exchange-sha1
  User ansible

see man ssh_config for details and all the options. (at least on Mac OSX) Not sure on a Linux host.

Actually, when I try this I get partial success. Yes my user "ansible" is automatically specified for me, but no, I still get prompted for a password for use ansible. (I have not yet copied the ansible user's public key to the router as I don't know if routers behave like linux hosts in this regard)

Don't forget the sysadmin password. It is for maintaining the linux server itself. The admin password for the CML application (web access) is different, and in fact not a user in /etc/passwd file at all.

If you forget the CML admin password, you can "factory reset" the CML application where you will then be given a new user database, with user "cml" and password "cml2". Use that to login, then create the admin user, logout, login as admin, then delete cml user. This is documented here: see question 4 and 5

Other nodes have default usernames and passwords as follows:

While the REFPLAT ISO is not required to deploy Cisco Modeling Labs v2.x and boot it up, you will not be able to add nodes to labs until you do. If you mount the REFPLAT ISO after booting up the CML server, you will need to restart the CML services before they will recognize that the ISO is present.

The refplat iso is available to download from the same page where you got your cml .ova file, on https://learningnetworkstore.cisco.com/myaccount However, the "lastest" version of CML might not have a refplat iso if there were no changes from the previous reference platforms. All you have to do is download the refplat iso from a previous version, i.e. 2.2.1 (when 2.2.2 has no refplat).

Once that is downloaded, map that .iso to your IDE CDROM drive on the CML vm.

Good link for likely scenarios you may run into is at developer.cisco.com

To generate this config file, see the next section: Saving configs

My cml directory is part of the pyats project is in ~/bin/python/venv-pyats/cml

Here is my config.yaml file. This controls how cml is setup and how I can access the web interface to CML. The controller is the VM that is running in VMware Fusion. That VM has to be running. Then I can use it by opening a web page to the "controller" address. This is the "bridge0" interface ip address

console_start_port: 9000
controller: https://192.168.2.107  # 11.66 when on wifi.
extra_lf: false
lab_config_name: labs.yaml
listen_address: 127.0.0.1
password: XXXXXXXXXX
populate_all: true
ui_server_port: 8080
username: admin
verify_tls: false
vnc_start_port: 5900

Consoles will then start at port 9000 (i.e. terminal server ports, so you can telnet 127.0.0.1 9001 for the first console, etc. I create a file you can source that generates these aliases:

Before you can use these aliases, you should confirm that breakout run mapped the correct port. Do that with:

while these parameters can be set in this config.yaml file, the values set in environmental variables take precedence. Feel free to set these, maybe as a bash script called set-cml-environment.sh

Before you can run it you must config it, so these in the following order

1. breakout config
2. breakout init
3. breakout ui
4. breakout run

Remember that to quit the telnet session use C-] which will show you a telnet> prompt at which point you can type quit

I set up aliases that you can source when wanting to remote connect to each node. This is through sourcing the file: source ~~/bin/python/venv-pyats/cml/set-breakout Obviously the ports may have to be modified according to the active ports produced by . http://127.0.0.1:8080

This should be updated to reflect using native network across a mgt vrf and not break-outs. (Unless really needed breakouts set-cml-aliases file that I don't have set up yet.)

Setting a port on the router to be in a mgt vrf is done like this:

config t
ip vrf forwarding
ip vrf mgt

  description zintis out of band mgt

ip name-server 208.67.222.222
ip name-server 208.67.220.220

hostname r5 

int gig 0/0
ip vrf forwarding mgt
end

ip route vrf mgt 0.0.0.0 0.0.0.0 192.168.255.1  (the ip addr of the bridge0 switch)


show ip route vrf mgt

See the next section on cmlutils from pypi You will have to install cmlutils using pip in your pyATS virtual environment python -m pip install cmlutils

The main part is getting the testbed.yml right. With the CML breakout set up and with a telnet client on the mac (brew install telnet), you can test telnet with telnet localhost 9008 for example. transport input all should be on the line vty 0 4 for this to work.

To configure an interface in the managment vrf config as follows:

• ip vrf forwarding
• ip vrf mgt
• descri zintis out of band mgt vrf
• int g0/5 # or whatever interface connects to the L2 lab switch called 'mgt'
• ip vrf forwarding mgt
• ip addr dhcp
• no shut
• line vty 0 4
• priviledge level 15
• transport input all
• show ip vrf mgt
• no ip route vrf ZP-mgt-vrf 0.0.0.0 0.0.0.0 192.168.2.1
• ip route vrf ZP-mgt-vrf 0.0.0.0 0.0.0.0 192.168.111.1
• no ip domain-lookup

**

Uses netplan, with configs in /etc/netplan

Here is 50-cloud-init.yaml

# network: {config: disabled}
network:
    version: 2
    ethernets:
        ens2:
            dhcp4: true
            match:
                macaddress: 52:54:00:16:c4:4d
            set-name: ens2


ubuntu@yourhostname:/etc/netplan$

This can be changed to a static address with this yaml file:

network:
  version: 2
  renderer: networkd
  ethernets:
    ens3:
      dhcp4: no
      addresses:
        - 192.168.121.199/24
      gateway4: 192.168.121.1
      nameservers:
          addresses: [8.8.8.8, 1.1.1.1]

Simply use: sudo netplan apply

Then ip addr show dev ens2

https://wiki.alpinelinux.org/wiki/Configure_Networking

This was the cisco original /etc/network/interfaces file

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
        hostname localhost

I will change this to use a static ip address as follows:

After making those changes to your alpine, restart alpine's network:

• /etc/init.d/networking restart
• sudo ifup eth0 also worked.

If you are getting

$ ssh ansible@192.168.11.67 

kex_exchange_identification: Connection closed by remote host=

There could be an ssh confing on the router that is missing. Check the following is in place on the router:

hostname r5
ip domain-name zintis.net
no ip domain-lookup

aaa new-model

crypto key generate rsa

vrf definition ZP-mgt-vrf
 address-family ipv4
 int gig0/0

username ansible privilege 15 password 0 sedemo

ip route vrf ZP-mgt-vrf 0.0.0.0 0.0.0.0 192.168.11.1

ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
line vty 0 4
 privilege level 15
 transport input ssh

=========