topic Questions about PnP in Controllers

Questions about PnP

sw1ft-code — Fri, 01 Mar 2019 12:37:13 GMT

We are running APIC-EM in our LAB environment and I have a few pending issues/questions before going into production.

1. Is there a way to get the entire device configuration using the api? including passwords and snmp information etc.

GET /network-device/{networkDeviceId}/config

I'm working on a solution to automate the replacement of a deployed switch (in case of RMA) with PnP. In my opinion the best solution would be to allow the API to create a new PnP project using an existing configuration ID from the Inventory (not possible right now). This way I could provision the replacement switch with the exact same configuration using PnP. The other solution is using the API to download the device configuration and upload it again while creating the PnP project. The problem is that the device configuration is missing all the sensible information like passwords and snmp information.

2. We are using Tacacs on our switches and PnP isn't able to provision a new switch if I don't remove the following statements from the device configuration:

aaa authentication enable default group **** enable

aaa authorization exec default group **** if-authenticated

aaa authorization commands 15 default group **** if-authenticated

Is this problem going to be addressed in the next release?

Thanks

Re: Questions about PnP

aradford — Wed, 22 Mar 2017 23:36:57 GMT

Hi Stefano,

#1) Not today. This was a deliberate design design due to data confidentiality. GET API only require OBSERVER role. Prime Infrastructure solves this with a privileged API call. We need to address this to implement RMA ourselves.

#2). The first command is fine, is it the second two that cause the issue. This requires IOS change, or there is an EEM script you can use (as part of the config file you download to work around). My blog covers this in detail. Network Automation with Plug and Play (PnP) – Part 7

Adam

Re: Questions about PnP

sw1ft-code — Thu, 23 Mar 2017 10:06:45 GMT

Hi Adam

In that case I will use the Prime API as a workaround to solve my RMA problem.

Thank you for the suggestion about EEM.

By the way your blog posts are very helpful!

Re: Questions about PnP

aradford — Thu, 23 Mar 2017 21:28:29 GMT

Thanks Franco,

let us know if you have other questions.

Adam