Backgroound Image

Cisco ISR Project – ISR 4331 base config (5 of?)

On to the CLI config of the ISRs.  For this portion we are simply going to get the basic configuration done so we can SSH into the routers.

Connect a console cable (or USB cable) to the device and open up your favorite terminal emulator, then boot the router.  Eventually you should get a set up prompt.  If you don’t and you get a Router> prompt type these two commands:

enable

setup

The setup wizard is pretty straightforward.  Follow the prompts and enter the information needed.  Note that GigabitEthernet0 is the management interface.

ISR setup

When you are done with the IP addressing it will ask if you want to run the auto secure wizard.  I recommend running that, as it disables some unneeded services, and applies more secure policies.  When prompted for SSH, make sure you enable that.

Unfortunately, the setup process does not create a SSL certificate for SSH.  To create the certificate use this command from a config prompt (enable, conf t):

cyrpto key generate rsa

Then it will prompt for a bit size.  I used 1024 in this example.

RSA key generation

 After generating the key make sure to save the config.  From the config prompt, it’s quickest to just type this command:

do wr

Otherwise ‘do write mem’ or ‘do copy run start’ would work.  You could also exit the config session and do ‘wr’ or any other variant at the enable prompt.

The other thing that you may need to do is enable routing on the management VRF if you will be connecting from a different network.  From a config prompt use this command:

ip route 0.0.0.0 0.0.0.0 Gateway IP

This will route all traffic to the default gateway that you specify.  Again, save the changes, then test the SSH connection to the management IP.

The next step will be getting the licenses installed.  The first thing we will need is the UDI.  From an enable prompt run this command:

show license udi

Make a note of the PID and SN. They will be needed to get the license registered.  Now go to the Cisco licensing portal (https://tools.cisco.com/SWIFT/LicensingUI/Quickstart) and select the PAK you want to use, then Get New License.  Follow the prompts, making sure to set the quantity, enter the PID and SN, then accept the agreement.  This will allow you to download the license file.

Before we can continue, we need a way to move the license file.  My personal favorite is the SolarWinds free TFTP server that can be found here: http://www.solarwinds.com/products/freetools/free_tftp_server.aspx

As a side note, if you’re not familiar with Thwack, the SolarWinds user community you should check it out.  There’s a lot of good information about both SolarWinds products, but also some general IT info.  Plus they have some pretty awesome contests.  Check it out: https://thwack.solarwinds.com

Place the downloaded license file (should be a .lic file, so you may need to unzip) into the TFTP root folder and start the TFTP server.  Then run the following from an enable prompt:

license install tftp://IP of the TFTP server/license file name.lic

You will of course need to enter the IP of your TFTP server, and the license file name including extension.  The process should be pretty quick, and you will get a result that looks like this:

ISR license install

Repeat that process for all licenses needed.

The last step of the base setup of the device will be to get the firmware to the right level.  I decided to match my ISRs and CSRs on 3.16.  First, you’ll need to find the current firmware version.  You can do that with this command:

show ver

The version should be listed at or near the top of the result.  You will also want to make a note of the System image file name and path.  If you are going to upgrade the firmware then you will need to download if from Cisco if you haven’t already.  When you have the firmware you want you will need to place the .bin file in your TFTP root folder.  Then you copy the file to the bootflash directory on the router using this command:

copy tftp://IP of the TFTP server/firmware file name.bin bootflash:

Again, set the IP of your TFTP server, and the firmware file name of the firmware downloaded.  It will prompt to confirm the file name, and you can just accept the default, which keeps the same name.  The copy process will take a while to complete.  When it completes we will verify the file integrity by running this command from and enable prompt:

verify bootflash:firmware file name.bin

This will also take some time to complete.  Now we want to check if there is an existing setting for the firmware boot.  Run this command from an enable prompt:

show run | in boot system

If nothing is displayed then you are good to move on, but if something is displayed you’ll need to note it and then we will clear it out by running this at a config prompt:

 no boot system firmware file location:firmware file name.bin

You could also simply copy the output from the show command, then from a config prompt type “no ” and then paste the command.

The next step is to set the system to boot from that image by issuing this command from a config prompt:

boot system bootflash:firmware file name.bin

Now it’s just a matter of saving the config and reloading the router.

When the router is done booting you can verify the new firmware by logging and running ‘show ver’ again.  Verify that the firmware is now the desired version.

Lastly, if you want to clean up the router you can delete the old image file.  From an enable prompt type this command:

delete old firmware file location:old firmware file name.bin

You should have the file name and location from the output of the ‘show ver’ command that was done to find the firmware version initially.

Now, one very important note- If this is being done in a lab, and private IP addresses are being used there could be an issue caused by the auto secure script.  During the auto secure script it asks if an interface is internet facing.  For interfaces that are listed as internet facing it configures the interface to drop packets from private IPs.  Since I’m using private IPs to create a virtual internet the auto secure script caused major problems since it effectively dropped all traffic.  To check if this could be a problem run this:

show run interface gi0/0/X

 In the command replace “X” with the interface that might be internet facing.  If this line is present int the config “ip verify unicast source reachable-via rx” then it will cause issues.  To remove that command go to a config prompt, then the interface in question, and run this command:

no ip verify unicast source reachable-via rx

The Cisco guide for the ISR initial config can be found here: http://www.cisco.com/c/en/us/td/docs/routers/access/4400/hardware/installation/guide4400-4300/C4400_isr/initconfig.html#45656

Firmware update guide: https://supportforums.cisco.com/document/98421/how-upgrade-or-downgrade-ios-isr-or-similar-router

Cisco Prime Infrastructure VM error – INIT: Id “S0” respawning too fast: disabled for 5 minutes

If you run Cisco Prime there’s a chance you’ve seen the error “INIT: Id “S0″ respawning too fast: disabled for 5 minutes” come up on the console.  If not, this is what it looks like:

INIT: Id “S0” respawning too fast: disabled for 5 minutes

It doesn’t seem to cause any issues other than noise on the console screen, but that’s too much annoyance for me.  It seems there’s an easy fix.

  1. Shut down the Prime VM
  2. In VMware go into the VM settings
  3. Add a serial port (I set it to output to a .txt file in the VM’s folder)
  4. Restart the VM.

It seems that this is an issue with the serial port not being seen when expected.  You could also attempt to remove the serial interface from the OS, but I thought adding it to the VM was much easier.

Cisco ISR Project – Cisco Prime Infrastructure deployment (4 of ?)

After the OVA is deployed it’s time to set up Cisco Prime.  Prime will be the monitoring and management software for the IWAN deployment, so it’s a logical place to start.

Before starting the process, we will fix an issue discussed in my post here: https://www.mytechgnome.com/2016/02/cisco-prime-infrastructure-vm-error.html

Edit the settings of the VM and add a serial port.  (I just set it to output to a .txt file in the VM’s folder)

Time to power up the VM and connect to the console.

Prime Setup

To begin the setup, type “setup”

Prime config

Then you will get a series of prompts to configure the device.  Most are self explanatory, except the timezone.  Cisco has a list of accepted timezone names, which can be found here: http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/user/guide/pi_ug/timezones.html  It’s also worth noting that the ‘admin’ account entered here is for CLI access.  A web user is added later.

Prime config

The setup process will enable the network interface and run a few tests.  After that you will receive a notification that the install completed and it will ask if this is for an HA node.  I’m not setting up an HA node, so I entered “no” and continued on.

Prime Config

The default admin account on the web interface is ‘root’ so here you set the password.  After that you’ll get a prompt confirming that all is well.  After confirmation the server will finish the setup script and reboot.  This process takes a while, like 10-15 minutes.

While this is working, it would be a good opportunity to get the license key for Prime downloaded, as well as the patches and tech pack.  There is a bug in the licensing that will report the license is invalid (https://tools.cisco.com/bugsearch/bug/CSCuw89435)

The patches and tech pack can be found here: https://software.cisco.com/download/release.html?mdfid=286285348&flowid=76142&softwareid=284272933&release=3.0.2&relind=AVAILABLE&rellifecycle=&reltype=latest (note that they need to be installed in order – 3.0.2, tech pack, 3.0.2 update 2)

The device pack can be found here: https://software.cisco.com/download/release.html?mdfid=286285348&flowid=76142&softwareid=286208063&release=3.0.3&relind=AVAILABLE&rellifecycle=&reltype=latest

When the Prime startup is complete you should be able to access it from a web browser.

Prime web UI login

Remember that the login name is ‘root’ and the password is what you set for the root account, not the admin account.

After logging in you will see an icon in the top left to open a menu.  Click that, then Administration > Software Update.

Prime Menu

 In the Software Update window there is a link to upload files.  Click that, browse to the update you want, and then upload it.

Prime Software Update

After the file is uploaded you will have an Install button next to the file.  Click Install and it will confirm the install and inform you if a reboot is required.

If a reboot is required go back to console of the Prime VM and log in.  To restart Prime there are two commands needed:

ncs stop

ncs start 

And the link to the Cisco document on restarting Prime: http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-2/administrator/guide/PIAdminBook/maint_sys_health.html#pgfId-1088333

The restart will ofcourse take about 10 minutes, and you will need to do it multiple times to get the patches installed.

When all the patches are installed then the license(s) can be installed.  However, before starting that, grab the UDI of the VM.  Click the menu button in the top left, then Administration > Appliance

Prime Appliance settings

The UDI is in the right column, in the middle.  You will want to make note of the product ID and serial number.  Those may be needed to license a PAK.

After downloading the licenses from the PAK registrations (they may be in .zip files, and if so, they need to be extracted) the keys can be installed.  Again, open the menu at the top left, the Administration > Licenses.

Prime Appliance settings

To load a license click Files > License Files on the left side.  Then click Add and browse to the license file (it should be a .lic file).  Repeat those steps to install all the Prime licenses.

That will get Prime installed, patched, and on the network.  Adding devices into Prime will be covered later.

Cisco ISR Project – Deploying the OVAs (3 of ?)

The next stage of the process is relatively straight forward.  The deployment of the OVAs for the virtual appliances.

First and foremost is the resource requirements.  Each OVA will be unpacked into a VM in the environment, so we need to make sure there are sufficient resources.

Name vCPU GB vRAM GB Disk (thin) GB Disk (thick) Notes
vCM 100 2 2 1.6 254
vWAAS 2500 4 8 1.5 754
vNAM 2 4 100 Thin not available
LiveAction 4 16 230 Thin not available
Prime Infrastructure – Express  4 12 300 Thin TBD
Prime Infrastructure – Express-Plus 8 16 600 Thin TBD
Prime Infrastructure – Standard  16 16 900 Thin TBD
Prime Infrastructure – Professional 16 24 1200 Thin TBD
CSR 1000V – Small 1 4 0.6 8.3
CSR 1000V – Medium 2 4 0.6 8.3
CSR 1000V – Large 4 4 0.6 8.3
CSR 1000V – Large w/ DRAM upgrade 4 8 0.6 8.3 Requires DRAM SKU

   

For Cisco Prime, the Scaling information can be found in the Quickstart guide here: http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/quickstart/guide/cpi_qsg.html#pgfId-67786

For the OVA deployment it should be pretty self-explanatory.  From the vSphere client click File – Deploy OVF Template.

From the VMware vSphere Web Client select your cluster, then on the top bar click the Actions drop down and select Deploy OVF Template.

Now it’s just a matter of following the prompts based on the environment.  Find the OVA file, name the VM, set the appropriate host, network, and datastore, and the rest of the things the wizard asks for.

The CSR will prompt for a bunch of information for the setup.

CSR OVA properties

The PNSC and Intercloud settings can be left blank.  The rest depends on your environment.  I would recommend enabling SSH, so you will need to have a domain name configured for the key generation.

Cisco ISR project – Licensing (2 of ?)

After the hardware has been purchased comes what might be the most difficult part of the project – sorting out Cisco licenses.

Hopefully you’re well aware of the Cisco licensing and support process.  I’ll try and make this clear as mud…

First and foremost, you need a Cisco account.  If you don’t have one you can go here: https://tools.cisco.com/IDREG/guestRegistration.do?exit_url=https%253A%252F%252Fslogin.cisco.com%252Fwaa%252FauthJump.do&locale=en_US   Your account will need to be associated with the business you work for, so this can get more complicated.  If you get stuck, contact your reseller.

For reasons beyond me, Cisco likes to send out the cardboard mailers with the PAK licenses (and EULA, and paper license, and sometimes T&Cs on a CD…).  Sort through the material you receive and find everything that lists a PAK.  Also, be careful to actually look at each piece of paper, as sometimes there are specific instructions for product access.

To register a PAK you need to go to: https://tools.cisco.com/SWIFT/LicensingUI/Quickstart

Again, you’ll need to log in with a Cisco account.  When you are logged in you will be able to register the PAK.

You should be able to follow the instructions to register the PAK.  I would suggest waiting on actually generating licenses until you are ready to use the specific product.  Some require the SN or UDI of the device the license is applied to.  It’s easier to just do that when you are ready.  So, now the PAKs should be done.

But wait, there’s more!  You still need to register your support contract.

Log into your Cisco account, and at the top of the screen click “Account” then “Customer Profile Manager”  (Note: the link at the bottom for Cisco Service Contract Center is very helpful.  It will show all the contracts and details that are linked to your account)

Under your account you can add access to your Cisco contract.  Click the “Access” tab at the top and this will list your contracts and allow you to add more by clicking the “Add Access” button.

Typically, I just use the Full Support option, as that allows me to download software and open TAC cases for the products.

The next page can be difficult.  I use a Cisco reseller, so the Bill-to ID on my orders is for my reseller.  Usually, I just open a chat session and provide the agent with my Cisco SO# (it can be found on the packing slip, in the eDelivery e-mail, or it will be listed in the licensing page when you activate a PAK).  The agent then can find the specific contract number(s) to add.

After the contracts are added you should be able to download firmware for the hardware.

Here are the links for what I downloaded:

CSR 1000V

ISR 4331

ISR 4351

Prime

Prime vNAM

vWAAS

It seems that vCM OVA isn’t downloadable, but media for that should be sent with the PAK.  The vCM can be upgraded by using the “Universal Binary Image” which can be downloaded from the WAAS software location

LiveAction

VMware vSphere

Cisco USB console driver Not needed, but it’s nice to have the USB console driver

Cisco ISR project – IWAN, WAAS, UCS-E, Prime, and more (1 of ?)

This is the start of a series of posts about my adventures in getting a Cisco IWAN project deployed.

To start with, the new gear order was as follows:

  • HQ
    • Two Cisco ISR 4331 routers (Cisco ONE for WAN license)
      • One to terminate MPLS and one for Internet
    • Two CSR 1000V routers in an HA pair
    • Cisco WAAS virtual central manager (vCM)
    • Cisco WAAS virtual application engine (AE)
    • Cisco Prime VM
    • Cisco virtual network analysis module (vNAM)
    • LiveAction Pro
  • Site 1 (MPLS only)
    • Cisco ISR 4351 (Cisco ONE for WAN license)
    • UCS E-160D-M2 server
      • 64GB RAM
      • 3x 900GB drives in RAID 5
  • Site 2 (Dual connected)
    • Two Cisco ISR 4351 (Cisco ONE for WAN license)
    • Two UCS E-160D-M2 servers
      • 64GB RAM
      • 3x 900GB drives in RAID 5
  • Site 3 (VPN Only)
    • Cisco ISR 4351 (Cisco ONE for WAN license)
    • UCS E-160D-M2 server
      • 64GB RAM
      • 3x 900GB drives in RAID 5

For the remote sites, this will completely replace any routers, firewalls, servers, and/or WAN accelerators deployed.  From the HQ side this will augment the existing environment, as the current hardware still needs to support sites that aren’t migrating to the ISR solution yet.

IWAN topology

There were a few iterations of the design process.  I would recommend working with your Cisco partner to figure out what the best design would be for your environment