Ansible, Cisco-ACI, EvE-NG, AWS CloudFormation integration & information gathering role
Hi, my name is iDustBin, i´m a Fullsnack & DevOps Engineer. My Projects are mostly Security & Automation related. I would please you to write constructive criticism into comments, feel free to comment and ask.
Story Overview:
- CiscoACI Management Summary / Architectures & helpful hints
- CiscoACI & public/privat Cloud Connectivity
- CiscoACI Rudimental Function Overview
- CiscoACI Ansible AAA User Role ( add, query or delete )
- CiscoACI Ansible Information Gathering Role
- …
This is my first Public BlogPost, actually im working on fully Cisco-ACI Automation installations routines & verifications… ill publish my work if im done.
These Story is the first explainer and information gathering run, later on ill create an series to demonstrate how-to include Cisco images into my EvE-NG laboratory.
My Customers goal was to test & emulate the whole existent environments.
From previous projects i was routined into (“host-only”) network adapter & nested virtualised instances (‘VT-X’), EvE-NG is able to emulate a bunch of Switch, Firewall, Hypervisor, Storage & many more Images. Its my first EvE-NG Integration but im really fascinated and really can recommend it. Actually im using an Professional Version which costs: 197$
EvE-NG is running on an VMWare-ESXi Hypervisor which allows VT-X, EVE is an nested-virtualised instance including:
- I7 9999K 80000GHz
- 256GB DDR4 RAM
- 1TB M2 Storage :(
- 1Gbit Down/Up
- pfSense { Firewall & VPN Splitt-Tunneling }
Cisco ACI {{ Cloud | AWS Integration }}
AWS for Continuous Integration & Continuous Delivery, Production Application will be hosted on OnPremise site.
External connectivity to the Internet for workloads in AWS Cloud can be configured in two ways:
1. Cloud L3Out: A cloud Internet connection (also called L3Out in Cisco ACI terminology) can be defined for workloads deployed on AWS. It is achieved by configuring a cloud-External EPG in MSO for the cloud site in AWS.
A Cloud-External EPG can create an Internet Gateway (IGW) and attach it to every VPC in AWS cloud site and appropriate routes will be programmed into the VPC route tables.
2. On-premise L3Out: Let us Handle an OnPremise L3Out to have fully IP Outbound Control, we can forward all the traffic from a VPC in AWS to transit to an on-premises site and be inspected through an on-premises firewall/IDS/IPS before the traffic exits to, or enters from, the Internet.
For example, the web and application tiers of an application (two EPGs) in the same VRF running in the on-premises Cisco ACI data center. By stretching the same VRF to the cloud site, we can deploy web and application tiers in the cloud site. You can deploy on-premises web and application tiers as active, and the cloud tiers can act as slave, and can failover to a cloud tier in case of a disaster recovery.
All of this can be achieved by using MSO as a single point of orchestration; you can configure contracts between these tiers spread across the hybrid cloud environment. Simply publishing this policy from MSO to both sites programs the end-to-end constructs required to implement the workload segmentation policy.
Cisco ACI Cloud streched EPG Architecture OverView
Cloud example Szenario:
The AWS AMI images for Cisco Cloud APIC are available at AWS marketplace, and uses the BYOL model for licensing at the time of the writing of this white paper. Readers are encouraged to refer to the ordering guide for any other options.
The first step to deploy Cisco Cloud ACI is to configure the Infra VPC and to launch Cisco Cloud APIC in AWS. Those steps are all performed by using a Cisco-provided AWS CloudFormation template, which allows you to create automation workflows called stacks that will execute a series of steps on your behalf.
more details coming soon…
Cisco ACI - Network & Grouping Overview
Cisco ACI Short Explainer {{ 802.1q_overview }}
hint: Stretched EPG´s over different onPremise Hypervisor Environments like libvirt/qemu/km & VMWare_ESXi + VMWare_vSphere client.
Cisco ACI privat & public Cloud Connectivity through BridgeDomains, EPG´s and Contracts
Is is possible to stretch your onPremise networks to public cloud provider like Azure or AWS, for this scenario please analyse my image attached.
Ansible: Cisco ACI - Network Modules
https://docs.ansible.com/ansible/latest/modules/list_of_network_modules.html
already_included():
todo():
- cisco_aci_aep (X)
- cisco_aci_aep_to_domain (X)
- cisco_aci_bridge_domain (onGoing)
- cisco_aci_endpoint_group (onGoing)
- cisco_aci_virtual_route_forwarding (onGoing)
rudimential_architecture_overview():
version: 0.0.1 | emulated EvE-NG Lab
required_images():
For my existent lab im using KVM images which are working perfectly on EvE-NG environment. For further Deployment Testings you can send me an personal message on social networks.
baremetal_hardware_requirements():
2x Spine Cisco-Nexus 9000
2x Leafe Cisco-Nexus 9000
1x Cisco APIC Controller
1x Citrix Netscaler
1x HAProxy | Debian or CentOS
Get iDustBin’s stories in your inbox
Join Medium for free to get updates from this writer.
Required Budget: xx.xxx,xx€
#CISCO-ACI
https://software.cisco.com/download/home/286283149/type/286283168/release/5.0(1k)#CISCO-NX-OS
https://software.cisco.com/download/home/286312239/type/282088129/release/9.3(4)?i=!pp#VMWare ESXi & vSphere
https://my.vmware.com/web/vmware/downloads#FortiGate
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-vm-install-54/download-vm-deploy-pkg.htm#Citrix NetScaler
https://www.eve-ng.net/index.php/documentation/howtos/howto-add-citrix-netscaler/
test_connectivity():
ansible-playbook -i inventories/aci.ini aci-login.yml --diff -vvvvdebug_output():
Visit & login into your APIC Interface
Define your login method and authentication credentials
Click():
- Admin
- AAA
- double click -> local_users | “admin”
- specify ssh_key & or user_certificate
My Recommendation:
Create for every tenant a new aaa user to separate an granularly your APIC privileges. Ill publish an Story later on
Analyse existent roles:
- cisco_aci_aaa_fabric_user (/)
- cisco_aci_aaa_user_keybased (/)
FYI: Some German Privat Cloud Provider are handling all bridge_domains subnets in one tenant to offer an customer shared network environment, these gives you a few ISP ( contracted ) features.
Please read: (link) for AWS & Azure integrations !
Configure your APIC host and credentials
cisco-aci-information-gathering
Lets use my role & play Development environment to get informations about your APIC Infrastructure, ill included some aci-rest calls to get datas about switch: health_status & faults :P If you're spine & leafe switches are working correctly you're getting some informations there. ill show you later on
Look inside my example inventory and provide needed informations.
My Play is an false, positive role which means its possible to ask for NULL values ! Don´t worry to define an aaa_admin user & tenant :) informations gathering only include query methods, nothings will be inserted or deleted !
vi poc/inventories/aci.iniSpecify the following initial variables:
[apic]
apic1.bin.lab ansible_ssh_host=192.168.250.40 ansible_ssh_user=admin ansible_ssh_key=~/.ssh/id_rsa.pub[apic:vars]
cisco_aci_host=192.168.250.40
cisco_aci_username=admin
cisco_aci_password=passw0rd
cisco_aci_tenant=IDUSTBIN
Role variables
First all we want only informations about one specific tenant. The role accepts various variables, including:
cisco_aci_host=192.168.250.40
cisco_aci_username=admin
cisco_aci_password="{{ aci_passwd | password_hash('sha512') }}"
cisco_aci_tenant=IDUSTBINcisco_aci_bridge_domain=intranetBD
cisco_aci_vrf=Intranet
cisco_aci_bd_type=vmm
mac_address_id=00:00:00:00:00
cisco_aci_app_profile=WEB
cisco_aci_endpoint_group=WEB
cisco_aci_bridge_domain=intranet.bin.lab
cisco_aci_bd_type=ethernet
ap_name=Intranet
cisco_aci_epg=Intranet
Verify Ansible Version
Run the following command using Ansible v2.9.6
ansible --versionoutput():
test_connectivity():
ansible -i inventories/aci.ini all -m pingoutput():
CISCO-ACI Information-Gathering Role:
ansible-playbook -i inventories/aci.ini aci-info.yml --diff -vThe first time it will ask your existent APIC Environment about Informations from your default inventories/aci.ini file. You can make modifications and extend the existent play & roles logic, run it again as often as you like, debug the output, write output values to an file.
output():
we want to ask the api for existent tenants, domains, bridge_domains, apps, app_profiles, endpoint_groups & contracts between epg´s and apps.
My Information Gathering role is able to get your required strings, variables and objects. If your APIC was successful installed & configured we can use my role to validate your application central logic.
Were using my information gathering role to get informations about existend environments. Its also possible to include my role & playbook to an SIEM Service to verfiy specifiy VLAN / xVLAN Settings & Port Policies.
cisco_fabric_sfp_port.py
Another helpful python script which is able to find free sfp_port on cisco nxos switch devices
If you liked these tutorial i would be really thankful for an like, subscribe, follow, comment & or dislike. Ill try to post every week, every second week in a month to post more detailed informations about Cisco-ACI, Ansible, AWX & Jenkins deployments & maintenance Plays.
Please write in comments below, what are you more interested in:
Installation Manual ACI & NX-OS, ESXi Environment
CISCO-ACI Inventory & AWX/Jenkins Pipeline Deployments
Ansible fundamentals
Cisco-ACI fundamentals
you can find the existent information gathering role & play on GitHub (link), Star, Follow, Subscribe & Comment for more Content :P
If you're running into some issues, feel free to create an GitHub issue or post an comment. Ill try to answer immidiadently
https://instagram.com/idustbin
https://github.com/idustbin
Made with ❤ by <https://idustbin.de/>
