Multicast and Yang with RESTCONF

[Noel Cantenot]

Hello,

I'm trying to get the equivalent of "show ip mroute" with RESTCONF on catalyst 9500 with ios-xe version 16.12.3a.

I checked several Yang modules, but it seems the only ones to have these information are MIB modules, like Cisco-IPMROUTE-MIB.

I didn’t succeeded in making it work.

With snmpwalk, it works fine : snmpwalk -v 3 -u username -a SHA -A userpwd -x AES -X pwd2 -l authPriv 10.1.1.1 1.3.6.1.2.1.83.1.1.1 gave an the answer (the number of mroute on the switch).

But I didn’t find how to add username, userpwd and pwd2 in https request!

I tried: https://username:userpwd@10.1.1.1/restconf/data/CISCO-IPMROUTE-MIB/ciscoIpMRoute/ciscoIpMRouteNumberOfEntries

But I don’t know how to give “pwd2”…

Any ideas ?

Thanks.

[yangorelik]

Hi Noel

With SSL connectivity you don't need 'pwd2'. The SSL connection authentication is going over server CA certificate verification. In order to make it work from YDK or using curl utility, you need to obtain server CA certificate from your device and then install it on your application platform. The YDK-0.8.5 offers some guidance on this subject; please check it here.

Also. In the command line (and YDK) you have to specify port number, where Restconf is listening. For example:

curl https://username:userpwd@10.1.1.1:443/restconf/data/CISCO-IPMROUTE-MIB/ciscoIpMRoute/ciscoIpMRouteNumberOfEntries

[Noel Cantenot]

I Yan,

thanks for your reply.

I think my issue is not at the SSL level, as this kind of request works fine (I diabled the SSL certificate verification):

curl --location --request GET 'https://10.200.44.1/restconf/data/ietf-routing:routing' 
--header 'Accept: application/yang-data+json' 
--header 'Authorization: Basic XX'

The pwd2 is the password for SNMP packets AES encryption, and I don't know where to write it.

[David Spindola · Accepted solution]

Hello Noel,

I setup a quick lab with a C9500-40X and version 16.12.3a:

LAB_Switch# show version | begin Switch Ports Model
Switch Ports Model              SW Version        SW Image              Mode   
------ ----- -----              ----------        ----------            ----   
*    1 50    C9500-40X          16.12.3a          CAT9K_IOSXE           BUNDLE 

In order to be able to retrieve SNMP MIBS from RESTCONF/NETCONF we need to add specific configuration to the device:

username cisco privilege 15 password 0 cisco
!
ip http server
ip http authentication local
ip http secure-server
!
snmp-server community cisco RW
!
netconf-yang
netconf-yang cisco-ia snmp-community-string cisco
restconf

Is important to include the command netconf-yang cisco-ia snmp-community-string <string> with the same string that is applied with the snmp-server community <community> <RW | RO> configuration.

I setup only 1 multicast route entry in the box, but this is enough for the test:

LAB_Switch# show ip mroute summary 
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
       L - Local, P - Pruned, R - RP-bit set, F - Register flag,
       T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet,
       X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
       U - URD, I - Received Source Specific Host Report, 
       Z - Multicast Tunnel, z - MDT-data group sender, 
       Y - Joined MDT-data group, y - Sending to MDT-data group, 
       G - Received BGP C-Mroute, g - Sent BGP C-Mroute, 
       N - Received BGP Shared-Tree Prune, n - BGP C-Mroute suppressed, 
       Q - Received BGP S-A Route, q - Sent BGP S-A Route, 
       V - RD & Vector, v - Vector, p - PIM Joins on route, 
       x - VxLAN group, c - PFP-SA cache created entry, 
       * - determined by Assert
Outgoing interface flags: H - Hardware switched, A - Assert winner, p - PIM Join
 Timers: Uptime/Expires
 Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 224.0.1.40), 03:19:34/00:02:07, RP 0.0.0.0, OIF count: 2, flags: DCL

LAB_Switch# show ip mroute count terse 
IP Multicast Statistics
1 routes using 1384 bytes of memory
1 groups, 0.00 average sources per group

To retrieve this information with SNMP run the command snmpwalk -v <version> -c <community> <host> 1.3.6.1.4.1.9.10.2, the result is:

MacOS_Catalina_10.15.7$ snmpwalk -v 2c -c cisco 10.62.149.55 1.3.6.1.4.1.9.10.2

SNMPv2-SMI::enterprises.9.10.2.1.1.1.0 = Gauge32: 1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.12.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.13.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.14.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.15.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.16.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.17.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.18.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.19.224.0.1.40.0.0.0.0.255.255.255.255 = Gauge32: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.20.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: -1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.21.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2147483647
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.22.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: -1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.23.224.0.1.40.0.0.0.0.255.255.255.255 = Timeticks: (26513740) 3 days, 1:38:57.40
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.24.224.0.1.40.0.0.0.0.255.255.255.255 = Gauge32: 4294967295
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.25.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.26.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.27.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.28.224.0.1.40.0.0.0.0.255.255.255.255 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.30.224.0.1.40.0.0.0.0.255.255.255.255 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.31.224.0.1.40.0.0.0.0.255.255.255.255 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.32.224.0.1.40.0.0.0.0.255.255.255.255 = Gauge32: 4294967295
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.33.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 1
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.34.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.35.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.36.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.37.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.38.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.39.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.40.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.2.1.41.224.0.1.40.0.0.0.0.255.255.255.255 = INTEGER: 2
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.9.224.0.1.40.0.0.0.0.255.255.255.255.13.224.0.1.40 = Gauge32: 4294967295
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.9.224.0.1.40.0.0.0.0.255.255.255.255.45.224.0.1.40 = Gauge32: 4294967295
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.10.224.0.1.40.0.0.0.0.255.255.255.255.13.224.0.1.40 = ""
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.10.224.0.1.40.0.0.0.0.255.255.255.255.45.224.0.1.40 = ""
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.11.224.0.1.40.0.0.0.0.255.255.255.255.13.224.0.1.40 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.3.1.11.224.0.1.40.0.0.0.0.255.255.255.255.45.224.0.1.40 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.1.13 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.1.45 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.2.13 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.2.45 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.3.13 = Counter32: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.3.45 = Counter32: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.4.13 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.4.45 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.5.13 = Counter32: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.5.45 = Counter32: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.6.13 = Counter64: 0
SNMPv2-SMI::enterprises.9.10.2.1.1.5.1.6.45 = Counter64: 0

To retrieve the MIB from RESTCONF in JSON format run:

curl -k -u cisco:cisco -H "Accept: application/yang-data+json"  https://10.62.149.55:443/restconf/data/CISCO-IPMROUTE-MIB   
         
{
  "CISCO-IPMROUTE-MIB:CISCO-IPMROUTE-MIB": {
    "ciscoIpMRoute": {
      "ciscoIpMRouteNumberOfEntries": 1
    }
  }
}

To filter the result and change the output to XML run:

curl -k -u cisco:cisco -H "Accept: application/yang-data+xml"  https://10.62.149.55:443/restconf/data/CISCO-IPMROUTE-MIB:CISCO-IPMROUTE-MIB/ciscoIpMRoute/ciscoIpMRouteNumberOfEntries

<ciscoIpMRouteNumberOfEntries xmlns="urn:ietf:params:xml:ns:yang:smiv2:CISCO-IPMROUTE-MIB"  xmlns:CISCO-IPMROUTE-MIB="urn:ietf:params:xml:ns:yang:smiv2:CISCO-IPMROUTE-MIB">1</ciscoIpMRouteNumberOfEntries>

The difference with RESTCONF and SNMP is due to the YANG model:

https://github.com/YangModels/yang/blob/master/vendor/cisco/xe/16121/MIBS/CISCO-IPMROUTE-MIB.yang

This model provides the number of entries in the IPMROUTE through OID 1.3.6.1.4.1.9.10.2.1.1.1 with the container ciscoIpMRoute:

  container CISCO-IPMROUTE-MIB {
    config false;

    container ciscoIpMRoute {
      smiv2:oid "1.3.6.1.4.1.9.10.2.1.1";

      leaf ciscoIpMRouteNumberOfEntries {
        type yang:gauge32;
        description
         "Maintains a count of the number of entries in the
          ipMRouteTable.";
        smiv2:max-access "read-only";
        smiv2:oid "1.3.6.1.4.1.9.10.2.1.1.1";
      }
    }

[Noel Cantenot]

Hello David,

thanks for your reply.

My configuration is SNMPv3 only, so I have no community configured.

I will had one and test this solution.

Does that mean that it is not possible to make it work with SNMP v3 ?

[Noel Cantenot]

I haded a community, and it works fine !

Thanks !