BIG-IP

! Load factory default cofig
tmsh load /sys config default

! Run management interface setup utility
config# config

F5 BIGIP Ansible

See here for more info:

https://github.com/F5Networks/f5-ansible/blob/devel/examples/0000-getting-started/playbook.yaml

Directory structure looks like this:

├── inventory

│   └── hosts

└── playbook.yaml

"hosts" file contains a single entry "localhost" (the F5 IP address is defined within the script).

<save the below to playbook.yaml>

 ---

- name: Create a VIP, pool and pool members

  hosts: all

  connection: local

  vars:

    provider:

      password: admin

      server: 192.168.1.245

      user: admin

      validate_certs: no

      server_port: 443

  tasks:

    - name: Create a pool

      bigip_pool:

        provider: "{{ provider }}"

        lb_method: ratio-member

        name: web

        slow_ramp_time: 120

      delegate_to: localhost

    - name: Add members to pool

      bigip_pool_member:

        provider: "{{ provider }}"

        description: "webserver {{ item.name }}"

        host: "{{ item.host }}"

        name: "{{ item.name }}"

        pool: web

        port: 80

      with_items:

        - host: 10.10.10.10

          name: web01

        - host: 10.10.10.20

          name: web02

      delegate_to: localhost

    - name: Create a VIP

      bigip_virtual_server:

        provider: "{{ provider }}"

        description: foo-vip

        destination: 172.16.10.108

        name: vip-1

        pool: web

        port: 80

        snat: Automap

        profiles:

          - http

          - clientssl

      delegate_to: localhost

Script to create tenant / app profile / EPG

#   Note that this script expects HTTP port 80 on the APIC, which is off by default.
# To enable HTTP in the APIC, navigate to FABRIC, FABRIC POLICIES Pod Policies     Policies   Management Acces    default  then enable HTTP
import requests
import json

def get_cookies(apic):
    username = 'admin'
    password = 'ciscoapic'
    url = apic + '/api/aaaLogin.json'
    auth = dict(aaaUser=dict(attributes=dict(name=username, pwd=password)))
    authenticate = requests.post(url, data=json.dumps(auth), verify=False)
    return authenticate.cookies

def add_tenant(apic,cookies):
    jsondata = {"fvTenant":{"attributes":{"dn":"uni/tn-acme","name":"acme","rn":"tn-acme","status":"created"},"children":[]}}
    result = requests.post('{0}://{1}/api/node/mo/uni/tn-acme.json'.format(protocol,host), cookies=cookies, data=json.dumps(jsondata), verify=False)
    print result.status_code
    print result.text

def get_tenants(apic,cookies):
    uri = '/api/class/fvTenant.json'
    url = apic + uri
    req = requests.get(url, cookies=cookies, verify=False)
    response = req.text
    return response

def add_application_profile(apic,cookies):
    jsondata = {"fvAp":{"attributes":{"dn":"uni/tn-acme/ap-Accounting","name":"Accounting","rn":"ap-Accounting","status":"created"},"children":[]}}
    result = requests.post("{0}://{1}/api/node/mo/uni/tn-acme/ap-Accounting.json".format(protocol, host), cookies=cookies, data=json.dumps(jsondata), verify=False)
    print result.status_code
    print result.text

def add_EPG1(apic,cookies):
    jsondata = {"fvAEPg":{"attributes":{"dn":"uni/tn-acme/ap-Accounting/epg-Payroll","name":"Payroll","rn":"epg-Payroll","status":"created"},"children":[{"fvCrtrn":{"attributes":{"dn":"uni/tn-acme/ap-Accounting/epg-Payroll/crtrn","name":"default","rn":"crtrn","status":"created,modified"},"children":[]}}]}}
    result = requests.post("{0}://{1}/api/node/mo/uni/tn-acme/ap-Accounting/epg-Payroll.json".format(protocol, host), cookies=cookies, data=json.dumps(jsondata), verify=False)
    print result.status_code
    print result.text

def add_EPG2(apic,cookies):
    jsondata = {"fvAEPg":{"attributes":{"dn":"uni/tn-acme/ap-Accounting/epg-Bills","name":"Bills","rn":"epg-Bills","status":"created"},"children":[{"fvCrtrn":{"attributes":{"dn":"uni/tn-acme/ap-Accounting/epg-Bills/crtrn","name":"default","rn":"crtrn","status":"created,modified"},"children":[]}}]}}
    result = requests.post("{0}://{1}/api/node/mo/uni/tn-acme/ap-Accounting/epg-Bills.json".format(protocol, host), cookies=cookies, data=json.dumps(jsondata), verify=False)
    print result.status_code
    print result.text

if __name__ == "__main__":
    protocol = 'http'
    host = '192.168.10.1'
    apic = '{0}://{1}'.format(protocol, host)
    cookies = get_cookies(apic)
    add_tenant(apic,cookies)
    add_application_profile(apic,cookies)
    add_EPG1(apic,cookies)
    add_EPG2(apic,cookies)
    rsp = get_tenants(apic,cookies)

rsp_dict = json.loads(rsp)
tenants = rsp_dict['imdata']

for tenant in tenants:
    print tenant['fvTenant']['attributes']['name']

Python

Integers and Floats

Integer = number
int (pi) ==3
Float = decimal number
float(answer) == 42.0

Strings

String = text
"Hello World"

"hello" .capitalize() == "Hello"
"hello" .replace("e" ,"a" ) == "hallo"
"hello" .isalpha() == True
"123" .isdigit() == True 
"some,csv,values" .split(",") == ["some", "csv", "values"]

name = "Martin"machine = "Hal"print ("Nice to meet you {0}. I am {1}".format(name,machine))

Boolean and None

python_course = True

int (python_course) == 1

If Statements

number = 5

if number == 5:

      print ("Number is 5")

else:

      print ("Number is NOT 5")

Lists (mutable, ordered)

student_names = ["John", "Paul", "George","Ringo"]

student_names[0] == "John"
! List values start at 1
student_names[-1] == "Ringo"

! Minus sign reads values from the right of the list

len(student_names) == 4

del student_names[2]

! Remove George from list

Dictionaries (mutable, associative array)

Device = {"hostname":"router1","OS":"v15.5,"location":"London")

Tuple (sequence of immutable objects)

Credentials = ("hostname","username","password")

Sets (unordered collection of unique and immutable objects) 

Loops

for name in student_names

     print ("Student name is {0}" .format(name))

For Loop

student_names = ["John", "Paul", "George","Ringo"]

for name in student_names:

  if name == "John":

  print("Found him! " + name)

  break 

Challenges:

Challenge 1:

#!/usr/bin/env python2.7

def devices():
 routers = ["router1","router2","router3"]
 print routers

def security():
 credentials = {"router1":"passw0rd1","router2":"passw0rd1","router3":"passw0rd1"}
 print credentials

def combined():
 devices()
 security()

if __name__ == "__main__":
 print "The routers are:"
 devices()
 
 print "The credentials are:"
 security()

 print "All data is:"
 combined()

ACI Deep Dive

• TEP address pool should not overlap with internal address space
• /16 address space is default for TEP pool

Switch discovery

• LLDP between switch and APIC
• DHCP request from switch for lo0
• ISIS between leaf and spine
• IFM = inter fabric messaging (secured with x.509 certificates) 
• VXLAN tunnels built for connectivity to all other leaf / spine switches

Useful Commands

! Show switches in fabric

#acidiag fnvread

#acidiag verifyapic

#acidiag avread

! NXOS like interface

#vsh

#vsh_lc
#show cli list

! overlay-1 is the "underlay"

#show ip interface vrf overlay-1
#show ip route vrf overlay-1

https://<apic-ip>/visore

#moquery

! query faults - uses http port 777
#icurl


#show system internal epm endpoint mac aaaa.bbbb.cccc

! Leaf command to ping (vrf aware unlike native linux)
#iping

! TCPDUMP can be used for control plane traffic only
#tcpdump -i eth0 

ELAM - data plane traffic capture

! See denied packet between EPGs
#show logging ip access-list internal packet-log deny
#show logging ip access-list cache deny

vzAny - contract for an EPG to consume everything in a VRF

! Like BGP debug
#show bgp event-history events

My Five Most Annoying IOS Features

That is Cisco IOS by the way - if you think this is anything to do with iphones I suggest you run along because Cisco have been calling it IOS since Apple was just a sapling.

I like Cisco IOS but there are just a few annoying "features" than continually annoy / baffle me. There are probably legitimate reasons for their existence but to me they just seem like little flaws that could be easily ironed out but we have all just learned to live with.

1. Context sensitive help and autocomplete do not work in configuration mode
   Being lazy by nature I always type as little as I need to which is why autocomplete is great. I can type "sh int" and I get a list of the interfaces on the router. If I am not sure if that is the command I want I can hit tab and it will show me the autocomplete entry for what I have typed so far:
   
   R1#sh int <Press TAB>
   R1#sh interfaces
   
   If there are multiple autocomplete entries for what I have typed so far tab does nothing but a question mark will show me what my options are:
   
   R1#sh in <Press TAB>
   R1#sh in <Press TAB again, slightly harder while frowning>
   R1#sh in?
   interfaces  inventory
   That's all great. Now let's go into configuration mode. We can use the "do" command to enter exec level commands when in configuration mode:
   
   R1#conf t
   Enter configuration commands, one per line.  End with CNTL/Z.
   R1(config)#do sh int
   This works, but only because "show interfaces" is the only autocomplete option for "sh int". Forgotten the command? Hard luck:
   
   R1(config)#do sh in <Press TAB>
   R1(config)#do sh in? <Press ENTER>
   LINE    <cr>
   <Bang head on keyboard - what the hell does LINE mean???>
   So you are stuck in a weird situation where, if you know the full command or the only viable autocomplete option then you can enter it, otherwise you get no help. This seems very obtuse to me - it is like IOS knows what you want but will only help you when it feels like it. Would it really be so hard to fix this?
2. You must write the full interface name in the extended ping
   Not a huge labour but a bit irksome. When you run an extended ping and specify the source interface in the shortened form IOS gets all sniffy and makes you write the whole thing. It takes me about 4 hours for me to type "gigabitethernet"
   
   Protocol [ip]:
   Target IP address: 1.2.3.4
   Repeat count [5]:
   Datagram size [100]:
   Timeout in seconds [2]:
   Extended commands [n]: y
   Source address or interface: fa0/0
   Translating "fa0/0
   % Invalid source. Must use IP address or full interface name without spaces (e.g. Serial0/1)Source address or interface: fastethernet0/0
3. Sometimes you have to add a parameter when it should really be done automatically
   Some commands only take one keyword as a parameter but IOS forces you to put it there even though there are no other options than having it - so why not put it there automatically?
   
   An example:
   
   R1(config-if)#ip nbar ?
     protocol-discovery  Enable NBAR protocol discovery
   
   R1(config-if)#ip nbar
   % Incomplete command.
   
   R1(config-if)#ip nbar ?
     protocol-discovery  Enable NBAR protocol discovery
   
   R1(config-if)#ip nbar protocol-discovery ?
     <cr>
   
   Here we have the command "ip nbar" which only takes the parameter "protocol-discovery". You can't leave it off and it is the only parameter it can take. So why not just fill it in? Like I haven't got enough to do in my busy day...
4. Going in to configuration mode and not making changes is still logged as you making changes
   I am sure there is a good reason for this one but I can't put my finger on it. If you go in to configuration mode and then just exit out again without making any changes it is logged in the log as you having made a change. Watch this:
   
   R1#sh clock
   *07:11:35.710 UTC Fri Mar 1 2002
   R1#conf t
   Enter configuration commands, one per line.  End with CNTL/Z.
   R1(config)#^Z
   R1#
   *Mar  1 07:11:38.986: %SYS-5-CONFIG_I: Configured from console by bob on console
   R1#sh log
   *Mar  1 07:11:38.986: %SYS-5-CONFIG_I: Configured from console by bob on console
   
   This is written to the log file and also added to the top of the running config. In a multi user environment this can lead to much finger pointing when things go wrong:
   dim-witted non-technical management type: Bob, it says you changed the config yesterday a few hours before that network meltdown we had.
   bob: No, I did not change anything.
   dim-witted non-technical management type: Well it says here that you were the last person to change the config
   bob: No honestly I did not change anything. I just entered configuration mode and then exited it.
   dim-witted non-technical management type: Clear your desk bob
5. Pipe include sometimes lies
   You can use the pipe command to filter the results of a command to make it easier to read. The pipe include command says only shows the lines including a certain string except sometimes it lies. Consider this:
   
   R1#sh ip route | inc .1.0
   C    192.168.11.0/24 is directly connected, FastEthernet0/0
   C    192.168.1.0/24 is directly connected, FastEthernet0/0
   
   The string here is ".1.0" which is in the second line but not in the first. I don't know why this happens - I assume it must be ignoring the trailing . for some reason. 

Cisco Default Values

HSRP

Hello = 3 seconds
Dead = 10 seconds

#interface fa0
#standby <group> timers x y

Where x is a value between <1-254> seconds
Where y is a value between <2-255> seconds

#show standby

=========================
EIGRP

Hello = 5 seconds
Dead = 15 seconds 

#interface fa0
#ip hello-interval eigrp <AS> x
#ip hold-time eigrp <AS> x

Where x is a value between <1-65535> seconds

#show ip eigrp interfaces detail fa0

=========================
OSPF

Ethernet:
Hello = 10 seconds
Dead = 40 seconds
Wait = 40 seconds
Retransmit = 5 seconds
(Dead time is automatically set to 4 x the hello interval)

Non-broadcast:
Hello = 30 seconds
Dead = 120 seconds

#interface fa0
#ip ospf hello-interval x
#ip ospf dead-interval x
#ip ospf retransmit-interval x

Where x is a value between <1-65535> seconds

=========================
BGP Route Selection Criteria

1 Weight
2 Local Preference
3 Network or Aggregate
4 Shortest AS_PATH
5 Lowest origin type
6 Lowest multi-exit discriminator (MED)
7 eBGP over iBGP
8 Lowest IGP metric
9 Multiple paths
10 External paths
11 Lowest router ID
12 Minimum cluster list
13 Lowest neighbor address

=========================

Routing Administrative Distance

Connected interface	0
Static route	1
Enhanced Interior Gateway Routing Protocol (EIGRP) summary route	5
External Border Gateway Protocol (BGP)	20
Internal EIGRP	90
IGRP	100
OSPF	110
Intermediate System-to-Intermediate System (IS-IS)	115
Routing Information Protocol (RIP)	120
Exterior Gateway Protocol (EGP)	140
On Demand Routing (ODR)	160
External EIGRP	170
Internal BGP	200
Unknown*	255