INE’s CCIE R&S v5 topology for EVE-NG

The last days I was working on adapting INE‘s lab topology, most specific the CCIE Routing and Switching v5 one, to be used in EVE-NG.

In my opinion, INE offers some of the best training materials for Cisco and Juniper certifications. Along certification training you can find in their All Access Pass Subscription valuable learning materials for Network Automation, Security and Traffic Analysis (like Wireshark).
By the way I’m not affiliated with nor this post is the result of some sponsorship from INE. I just wanted to have the possibility to use their materials on using the entire topology, including the Switches, in EVE-NG.

I’ve picked Cisco‘s vIOS L3 and L2 images to support the topology in EVE-NG. You can argue that vIOS is a bit unstable and lacks some features, that CSR1000v images are better when combined with real Cisco switches and so on. Yes yes, all these are quite right, but I’m not here to debate about the best way to create a topology, rather a simple and sustainable one which works even for low end devices with less resources (CPU, RAM). Is no secret that vIOS will use less resources than CSR1000v images.

It brings me great happiness to let you know that I’ve succeeded in adapting not only the topology (not that hard honestly), but also the initial configuration files. The challenge lies in the fact that vIOS L2 images are build to support Ethernet ports in group of four, resulting in a slight different naming convention.

If you’ll check INE’s CCIE R&S v5 topology, the Cisco switches are using the Port from 19 to 24 to interconnect. On switch SW1, Port 1 is used to bridge the switching part to the routing one. You cannot replicate this exact port configuration scheme using vIOS L2 images.

I was forced to come with an alternative scheme, to map the original interface to the virtual ones and to adapt the configuration files.

This is what I came with:

INE CCIE R&S v5 switches

The interface mapping is as follows:

Real Switches – vIOS-L2

Fa0/1  - Gi0/0 - SW1 only connection to bridge

Fa0/19 - Gi0/2
Fa0/20 - Gi0/3
Fa0/21 - Gi1/0
Fa0/22 - Gi1/1
Fa0/23 - Gi1/2
Fa0/24 - Gi1/3

For the Routers is easy, since the interfaces are almost the same:

CSR1000v – vIOS-L3

Gi1 - Gi0/1

Here is how the network topology looks like:
INE CCIR R&S v5 Topology

We have 10 Routers using vIOS-L3 and 4 Switches using vIOS-L2. The connections between routers and switches are facilitated by the Net bridge.
10 routers should be sufficient for most of the labs. However if you need more, just add nodes and connect them to the Net bridge using the Gi0/1 interface.

As said previously, the configuration files have been adapted to match the interfaces listed above. I’ve tried my best not to have any errors, I also did some testing, everything looks to be fine. Most probably you’ll notice some errors at the copy / paste, but these are just cosmetic and related mostly to some proprietary CSR1000v commands or management interface which is not needed in EVE-NG. If you encounter errors that are critical, please let me know and I’ll try to correct them.

If somebody from INE’s team reads this post (that would be something :)) and consider inappropriate to share the modified initial configuration files, please let me know and I’ll take them down. They are derived from the public available ones on the CCIE R&S v5 Topology Diagrams & Initial Configurations page and do not contain any workbook information or somehow else related to INE’s training materials.

Download files:
INE-CCIEv5-RS-Topology-for-EVE-NG.zip
INE-CCIEv5-RS-Initial-Configuration-for-EVE-NG.zip

Happy labbing and let me know if you find these materials useful!

Ubuntu image for EVE-NG – Python for network engineers

Lately I’ve started working more and more with EVE-NG to test various network scenarios, automation and in general to try and learn something everyday.

If you’re familiar with EVE-NG, you know where to find various Linux images which you can download and install . Very helpful indeed, however all of them are coming without any pre-installed tools which I need for network oriented tests. I need Python, IPerf, Ansible, various Python libraries for network automation, etc.
Basically every time when I setup a new lab in EVE-NG, I need to make sure that the Linux image has a connection to Internet to download all these tools. Doable, but too much time consuming.

Lately EVE-NG has the Pro version, where you have Docker images which support some of the tools for a network engineer needs to test automation. If you already have EVE-NG Pro, then maybe this is a bit redundant. However if you’re still using the Community version, it may sounds interesting.

I’ve developed the Ubuntu (18.04) image using the same tools that you can find in my Docker image (Ubuntu 16:04 Pfne):
* If you’re not sure what I’m talking about, please read my previous post.

  • Openssl
  • Net-tools (ifconfig..)
  • IPutils (ping, arping, traceroute…)
  • IProute
  • IPerf
  • TCPDump
  • NMAP
  • Python 2
  • Python 3
  • Paramiko (python ssh support)
  • Netmiko (python ssh support)
  • Ansible (automation)
  • Pyntc
  • NAPALM

The image is hosted on my Firstdigest Project at Sourceforge.
If you are in a hurry, download directly using this link: Ubuntu 18.04 Pfne for EVE-NG.

For convenience here are the steps, but if you run into trouble be sure to check the EVE-NG Documentation.

  • Download the image
  • Using favorite SFTP Client (WinSCP, FileZilla) connect to your EVE-NG and upload the image to the location: /opt/unetlab/addons/qemu/
  • Connect via SSH to your EVE-NG machine and go to location:
cd /opt/unetlab/addons/qemu/
  • Unzip your uploaded image file.
tar xzvf linux-ubuntu-server-18.04-pfne.tar.gz
  • Remove the archived image file (be sure to have a copy somewhere to avoid you have to download it again)
rm -f linux-ubuntu-server-18.04-pfne.tar.gz
  • Fix permissions
/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

The image comes with the following predefined username and password (security was not the point here):

User: root
Password: root
User: pfne
Password: pfne

With this image you have everything ready for your tests. You want to test QoS? Just design a network and two (client / server pair) machine using this image and push some packets with IPerf. Or maybe you want to test some automation. Here you have it, just start playing with.

Btw, I assume you have the EVE-NG installed. If not and you’re into learning topics, I’ll advise you to install this great application. You can start with Community version which is free (and honestly has enough features for most of the self-teaching engineers out there) and if you feel like go with the Pro version.

Let me know if you find it useful. In case of problems, please comment and I’ll try to help in my spare time.

Docker image – Python for network engineers

Lately I’m looking more and more into Python, with respect to automation implementations useful for network engineers. In the learning process I’ve used different materials, like the excellent video trainings Python Programming for Network Engineers from David Bombal which are available free on Youtube.

This training in particular relies on a Ubuntu Docker image in order to support Python learning following interaction with Cisco devices in GNS3. Everything is great, just that the image doesn’t contain all necessary tools (like Paramiko, Netmiko, Ansible…). As you can guess, whenever you close / open the Project in GNS3, all the installed packages installed in the Ubuntu Docker image are gone.

Since we’re talking automation, I got bored to install the necessary tools everytime I wanted to start a new project or I had to close GNS3 for some reason. I’ve tried to find a Docker image that suits my needs, but I couldn’t (please point me to one if you know it).

So, I’ve build a Docker image, based on Ubuntu 16.04, which contains the necessary tools to start learning Python programming oriented for network engineers:

  • Openssl
  • Net-tools (ifconfig..)
  • IPutils (ping, arping, traceroute…)
  • IProute
  • IPerf
  • TCPDump
  • NMAP
  • Python 2
  • Python 3
  • Paramiko (python ssh support)
  • Netmiko (python ssh support)
  • Ansible (automation)
  • Pyntc
  • NAPALM

The above list can be extended, but I would like to keep it to the minimum necessary (I want to keep the image size at decent level).

If you’re interested, please find the image at: https://hub.docker.com/r/yotis/ubuntu1604-pfne/, or you can download it:

$ docker pull yotis/ubuntu1604-pfne

I’ve tested the image for couple of days and it works fine. However if something doesn’t work as expected, please let me know and I’ll try to fix it.

For those using GNS3 is possible to import the image above directly into GNS3 using the PFNE Appliance.

F5 BIG-IP Plugin with Firefox 52 workaround

It’s not news anymore that Mozilla is stopping support for NPAPI (Netscape Plugin API). With the release of Firefox 52 version, I believe that only Flash plugin is enabled by default.

I’ll skip the discussion about NPAPI plugins and Mozilla’s decision to stop the support, however the reality is that for me it has a strong impact in certain areas. One of this areas is the F5 BIG-IP, specifically the APM and possibility to launch Application (like RDP) from the Webtop interface.

I’m relying heavily on a F5 BIG-IP VE machine to connect to my home lab when I’m remote. The Webtop functionality gives me the possibility to use only a Browser to connect to my applications at home, keeping me away from any F5 client installation on the machine that I use. Usually this machine is my MacBook or PC, and the F5 client installation should not be a big thing, however I like the clientless option.

The F5 Webtop functionality is possible due to a NPAPI plugin called “F5 Network Host Plugin” which usually installs in the browser when you access the F5 APM. So yes, you still need to install something, but this browser plugin is easy to install / remove when compared with a F5 client.

One morning I wake up to find out that my Firefox browser was silently upgraded in the background and instead of being able to launch an Application from the F5 Webtop interface I see this:

Useless to say that the plugin was already installed and everything seemed to be fine. Googling around I could find a lot of information why is not working, but no workaround until I read this article on the F5 DevCentral page.
F5 is aware of the problem, they are working on a solution but so far everything points out to use of the F5 client.

Until Firefox 51 everything was still fine but with the release of Firefox 52 you will get the error showed above. Long story short, for now, there is a workaround which suppose to work fine on Firefox 52 and the upcoming 53 version.

You need to create in Firefox 52 a configuration parameter called “plugin.load_flash_only” and set the value to “False”. Remember that this parameter is not there, so don’t just search for it…create it.

  1. Head to the Firefox URL bar and type about:config.
  2. Accept the responsibility that you’ll not destroy your Firefox installation.
  3. Right click
  4. Chose New > Boolean from the menu
  5. In the newly open window type: plugin.load_flash_only
  6. Set the value to: False

In the end you’ll see something like this:

Remember that I said in the first line that only Flash plugin is still enabled by default? This setting reverse that setting, by saying that not only Flash plugin should be enabled.

Not sure what I’ll do for future. Not to upgrade Firefox 52 (and possible 53) to the next release is not a long term option and from security perspective is a disaster. To keep a parallel installation of Firefox just to reach my trusted URL…doable, but still a bit of a hassle. I hope F5 will come up with a solution.

Draw network diagrams online [2016 Edition]

In this post from 2011 I was explaining that my preferred online tool to draw network diagrams is LucidChart.com. Since then LucidChart.com developed really good and added constantly new features. Unfortunately with the new great additions some not so nice restrictions appeared for the free account.
Those restrictions (like 5 active documents) really make it difficult for me to work with this tool as I got used to a different style.

I’m not a cheap guy! If I would use this tool professionally there would be no problem to buy a subscription package, but at work Visio is saint (unfortunately) and the rest of the time, especially when I’m on my Mac, I just need a fast tool to draw brief network diagrams like for my blog or fast explanation to somebody online.

LucidChart.com is my recommendation if you rely on online tool to work with Visio documents. Last time when I checked their Visio import tool was doing a great job.

Back to this story, I was looking online for another tool when I came across Draw.io.

Draw.io doesn’t need an account creation, rather it just give you direct access to the tool.
Since you don’t have an account you cannot save your work on the application, but it does offer you the option to save on Dropbox, Google Drive or OneDrive online or directly on your machine.
Later you can open your document from any of these locations.

In terms of shape the tool is pretty generous and the Cisco ones, really important for me, are there:

draw.io

The tool is very easy to use, it gives you a Visio feeling (if you’re used with this Microsoft software) and works pretty fast for me.

I tried to open a Visio document from my machine…did not work that well:

draw.io-visio-open

Importing the same document did not work better:

draw.io-import-visio

It seems that in both cases the Riverbed Steelhead shapes loaded fine, but not the Cisco ones.

Well, I would like to see this working, but in the end nothing to complain. I explained already that I don’t need the online tool to work with Visio. It’s nice if it can, but not mandatory for me. I’ll try some more tests with different Visio files, who knows maybe it’s something wrong with my test file.

One feature which I would like to see is the ability to add your own shapes. Who knows maybe in the future.

If you know a better alternative to LucidChart.com that has a free option and you consider it better than Draw.io please let me know.