Cisco Meraki is a cloud managed architecture, which is used to deploy, configure, manage and monitor WiFi, routing and security appliances for service providers, large enterprises, and small to medium businesses. Phantom Cyber is an extensible security automation and orchestration package which allow custom applications to be written within its framework. See the phantom blog for additional information on this use case. This Meraki app, along with an F5 app, was awarded a first place entry in the Phantom app contest. This video demonstrates how the Meraki device provisioning APIs can be used by a Phantom app to quickly locate devices in the Meraki network. ... View more

At World Wide Technology, our IT department is implementing APIC-EM and I'm helping with the initial deployment. I have an APIC-EM instance running in our Advanced Technology Center (ATC), and I'll be using this for training the IT network operations staff. There are initial router configuration updates required for the Cisco APIC-EM features to work properly. I'll use Cisco ISR G2 routers  to demonstrate APIC-EM device discovery. I need the required configuration updates applied to these routers. The lab is only 4 routers, how long would it take to SSH and apply the changes?  I have an existing Ansible playbook in our enterprise GitHub server which configures IOS or IOS-XR routers via FTP.  As a challenge to myself, I decided to update the four routers using Ansible Tower rather than applying the changes manually. To accomplish this, I need to do the following: Create the IOS configuration file template for the changes required by APIC-EM Create a playbook to reference the template and list the routers Define a project and job template in Ansible Tower Initiate the job from the template. The job executed successfully on the first initiation, applying the configuration to all routers. The playbook is rather straight forward. The credentials for the routers are encrypted using Ansible Vault and stored in Git as well. --- # # Copyright (c) 2016 World Wide Technology, Inc. # All rights reserved. # author: Joel W. King, World Wide Technology # - hosts: APIC_EM   gather_facts: no   vars:   network_device:   - managementIpAddress: 10.255.138.120   - managementIpAddress: 10.255.138.121   - managementIpAddress: 10.255.138.122   - managementIpAddress: 10.255.138.123   tasks:   - name: Decrypt the password file   include_vars: "./passwords.yml"   - name: Update IOS configuration   cisco_ios_install_config:   URI: ftp://username:password@192.0.2.1/sdn/lab_config_files/APIC_em_device_configuration.cfg   host: "{{item.managementIpAddress}}"   username: admin   password: "{{password}}"   enablepw: "{{password}}"   with_items: network_device The point of this exercise is to adjust your mindset that even for minor changes, automate it! Once you have a few jobs, job templates and playbooks configured, you will be surprised how little time it takes to automate configuration changes. It is a matter of viewing your network not through the lens of SSH and the CLI, rather as a configuration file and automation dashboard. Now that APIC-EM can initiate a network discovery, we can use it as a reference inventory for future network updates. ... View more

At World Wide Technology we have a number of training and demonstration fabrics in our Advanced Technology Center to educate our customers and help them deploy ACI in their data centers. We are working on a project called, ACI xStart, which demonstrates the capabilities of ACI outside the network infrastructure teams.  Recently I posted a video which uses Ansible to automate deploying a virtual machine from a template, configuring an F5 load balancer and installing and initiating an application in a Docker container. Our goal in developing these automation solutions is maximize the value of automation while minimizing the effort. While we can configure the tenant for this application from Jinja templates of the underlying XML files, it can be time consuming. Why not create a library of common tenant configuration templates and clone the tenant in the same manner a virtual machine is cloned from a template? Once the tenant is cloned, we can automate additions or deletions from the template configuration. This demonstration also illustrates how the security operations and network operations can collaborate, yet maintain a separation of responsibilities. We show how the workflow can move from the requester, to security operations to network operations and use Git for version control of the policy applied to the tenant template. This workflow is illustrated below and demonstrated in the video. We have simplified the deployment of ACI tenant configurations to satisfy end-user requests, while both collaborating and separating the responsibilities between network and security operations.  The Ansible playbook and configuration files are available on GitHub and the video demonstration is on youtube. ... View more

Last week I checked out the Spark for Developers portal and used the Spark learning lab #1 to develop an Ansible module to manage Spark rooms, members and messages from an Ansible playbook. Ansible has an existing extras module, mail, to send email from a playbook. Sending an email is a common way to notify people in a team that a playbook has been run or to request additional tasks in a workflow. In many organizations, collaboration tools like Spark, are being used instead of email to streamline workflow and help teams improve the way they work with colleagues . In this example, I extend the APIC-EM and Ansible integration modules to include an Ansible module I wrote to create a Spark room, add members, and to send a message based on the facts gathered about the network from APIC-EM. The sample playbook is available on GitHub.  It queries APIC-EM for a list of discovered devices, creates a Spark room, adds members to the room, and sends a message to the room requesting an upgrade of several Cisco 2911 routers running a specific release of IOS. The following is a screen snapshot of the Spark room with the output of the Ansible playbook. At World Wide Technology, we are demonstrating an integration of ServiceNow and Spark to manage the WWT customer proof of concepts. This illustration of Ansible, APIC-EM and Spark, is another example of how tools can be easily combined via their REST APIs to provide a more robust collaboration experience and improve network agility. ... View more

Earlier this year I blogged about Using APIC-EM as the single source of truth. Since then, APIC-EM as become GA and I've updated my Ansible module shown in that post to use the GA release. A WWT customer recently requested the capability to automate the collection of output from a series of 'show' commands from routers and switches. An example of the Ansible playbook to accomplish that task is available on GitHub. We can leverage that development effort into a demonstration of using APIC-EM and Ansible to provide an Asset and Lifecycle management tool. For this use case, we will use the APIC-EM database of discovered devices to provide an inventory of routers to the Ansible playbook, and specify the commands to be issued on the router.  For example: However, rather than issue the commands on all the devices in the inventory, we will use the facts provided by APIC-EM to filter on only selected devices in the inventory.  T his playbook will only issue the  commands for Cisco 2911 routers running IOS version 15.3(3)M5. The output of the show commands are stored in files specific to each device in inventory, and following the execution of the playbook, we can glean additional information from the collected data. As an example, we can grep the files to determine which devices  have 4 Port GE Non-POE EHWICs based on the captured output. By combining APIC-EM, Ansible and the WWT developed modules, we can easily identify network devices which meet our selection criteria by using APIC-EM for an inventory and by modifying a simple Ansible playbook and issuing basic Linux commands. ... View more

The job role of a data center network engineer is changing as the network infrastructure configuration and management is becoming integrated into DevOps. This virtual NPUG (Network Programmability Users Group) webinar demonstrates how the popular configuration and IT automation tool, Ansible, can be used to manage Nexus 9000 series switches in either NX-OS through the NX-API or under the ACI SDN controller, or APIC. The webinar demonstrates how both fabrics can be configured from Excel spreadsheets (CSV files), which are commonly used to document and organize the infrastructure in data centers. Using the methods demonstrated in the webinar, a network engineer can begin automating the network configuration without programming and incorporating data from existing spreadsheets. The content for the webinar is available at http://www.npug.net/past-events/ for download. ... View more

I recently had the opportunity to develop and deliver a three day class for the World Wide Technology Cisco ACI (Application Centric Infrastructure) Professional Services deployment engineers on automation and programmability of an ACI fabric. These engineers are experienced and senior data center networking engineers who, during their 10 weeks of training, were immersed in all aspects of ACI configuration and troubleshooting. It might surprise you, but for this class, I did not teach the engineers Python. The class was a series of lectures and labs that included such topics as: Markup Language Tutorial for #netdevops, Fundamentals of REST API, Introduction to using Chrome Postman with Cisco ACI, APIC GUI / XML Lab – Exercise on saving, modifying and posting configurations via XML and GUI, Ansible Playbook - Develop a playbook to gather facts and configure the fabric via Ansible, Ansible Tower Demonstration, Creating ACI configuration templates with Jinja2, Using Ansible to automate vSphere  / vCenter, Introduction to Git for Network Engineers, Using  Git and Ansible Roles. By using the Ansible ACI modules I’ve written, these engineers can automate the provisioning of an ACI fabric without the need to code. While it is helpful to understand some programming basics, the key concepts are an understanding of markup languages (YAML and XML), the fundamentals of REST, a basic knowledge of Ansible, structuring playbooks into roles and using Git for version control and sharing configuration templates across the team. While this training was centered on ACI, a major portion of the class would apply to automation of other data center network components as well as applicability to automation of Nexus Open NX-OS. The key takeaways from this class, from the instructors perspective, is creating the necessary Jinja templates is the most tedious and time consuming part of this automation effort. Until we have Ansible modules written to abstract each configuration task, or documentation delivered as templates and an associated YAML variable file, the library of roles being created by these engineers are invaluable to increase the speed of deployment of an ACI fabric. While these hurdles need to be overcome, we have made real progress in abstracting the complexity of deploying data center fabrics and I am extremely pleased of how capable these engineers have become in automating the deployment of ACI fabrics for our customers. ... View more

At World Wide Technology we are working with APIC-EM and recently a conversation with a customer identified a potential use case. This customer is tasked with taking over network operations for a network described as a 'spaghetti' mess of cables. They were particularly interested  in automation tools and I described some of the Python modules I've written to use Ansible for automation of the Cisco ACI controller, APIC. A point I made to this customer, however, is you can't automate what you don't understand. To that end, we have APIC-EM installed in our Advanced Technology Center (ATC) and this customer requirement would be an good exercise in demonstrating how to use APIC-EM as the 'single source of truth' of the network inventory. APIC-EM incorporates a network discovery function with the results available via the northbound REST-API.  Ansible requires an inventory file of devices as a target of the playbook. By writing an Ansible module which queries the northbound REST API of the APIC-EM controller, we are able to provide a list of discovered devices to subsequent steps of the Ansible playbook. This integration is shown in the diagram below. Ansible runs on a virtual machine, either with the command line interface or with the Ansible Tower GUI calling the playbook.  The APIC-EM virtual machine has been configured for device discovery. The management IP addresses of the discovered devices are provided to the Ansible playbook as a list of gathered facts about the network. For more details on the code to implement the integration of Ansible and Cisco APIC-EM, see the GitHub repository and visit World Wide Technology on the web at wwt.com. ... View more

This white paper illustrates how the Cisco Application Centric Infrastructure (ACI) can be implemented as a single fabric stretched between two data centers, with the ability to optimally route traffic to and out of the data center where the resource is located. https://www2.wwt.com/stretched-active-active-aci-fabric/white-paper-stretched-active-active-aci-fabric/ The paper is result of the partnership between WWT and Cisco Systems in developing solutions for the next generation of data centers. ... View more

WWT is developing solutions to help customers realize the benefit of SDN by enabling the deployment and orchestration of next generation datacenter networks. This video demonstrates how python modules can be used together in an Ansible playbook to gather facts from the APIC and then using the variables returned, modify the configuration of the fabric based on the results. Our use case is to meet the requirements of the network security administrator, implementing security policy filters on all end-user tenants. The playbook applies a Service Contract to a single tenant for testing, and then illustrates how we can use the ACI fabric to return the operating system version of a specific VM attached to the fabric. ... View more

Network engineers (NetOps) need tools to automate the configuration and deployment of the next generation data center. Cisco's Application Centric Infrastructure (ACI) is easily integrated with Ansible playbooks. The advantages of automating the configuration of ACI fabrics with Ansible include: a dramatic reduction time spent configuring routine tasks, consistency of configurations across multiple fabrics, less time spent implementing, more time for planning. This is a hands-on demonstration of Ansible, an open source automation tool, which is used to configure a Cisco Application Centric Infrastructure (ACI) fabric. Ansible playbooks are used to call a WWT developed python module which configures the fabric through the ACI controller (APIC) northbound REST API interface. ... View more

To  provide  redundancy  and  disaster  recovery,  most  organizations  deploy  multiple  data  centers.  These  multiple  data  centers  are  used in  conjunction  with  a  disaster  recovery  plan  to  provide  business  continuity. This  paper and video illustrates  how  the  Cisco  Application Centric Infrastructure  (ACI)  can  be  implemented  as  two  fabrics,  with  federated  controllers  implementing  autonomous  infrastructure with  replicated  tenant  configurations  that  will  provide  for  disaster  recovery. White Paper on ACI and Disaster Recovery Solution implemented in the World Wide Technology ATC. ... View more

World Wide Technology’s Advanced Technology Center has implemented QualiSystems (www.qualisystems.com) CloudShell, a DevOps self-service orchestration and automation platform for IT infrastructures and networks. This white paper describes a Software‐Defined Networking use case, using the XNC controller and OpenFlow switches to implement Open Systems Interconnection model (OSI) Layer‐1 matrix switch functionality for the WWT ATC. http://goo.gl/XWDmua ... View more