Cisco NXOS Ansible 활용 - 유용한 Adhoc 명령

Playbook을 통한 구성정보를 확인하는 것도 큰 도움이되지만 Ad Hoc명령을 사용하면 , 네트워크의 다양한 정보를 확인 할 수 있다.

Cisco NXOS Ansible Module을 호출해서 사용하는 방식으로,  NXOS Command 모듈을 호출해서 사용하면 콘솔에 접속하지 않아도 한꺼번에 다양한 정보를 추출해 올 수 있다.

또한 Ad Hoc에서는 결과 값들에 대한 자동파싱을 통해서 결과를 출력해 준다.

아래 유용한 명령어 모음을 몇가지 정리하였다.

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show ver'" -i ./hosts NXOS-SPINE-1001

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show cdp neighbor'" -i ./hosts all

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show lldp neighbor'" -i ./hosts all

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show interface brief | grep up'" -i ./hosts NXOS-SPINE-1001

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show interface brief'" -i ./hosts NXOS-SPINE-1001

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show ip route vrf all'" -i ./hosts all

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show vlan brief'" -i ./hosts all

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show spanning-tree vlan 1 detail'" -i ./hosts all

하드웨어 버전와 소프트웨어 버전 확인 하기.

Nexus Switch의 하드웨어 정보와 소프트웨어 정보, Kernel정보들을 확인 할 수 있다.

인벤토리 Option에서 all을 지정하면, 인벤토리에 지정된 모든 Nexus Switch의 정보를 한꺼번에 파싱값을 얻을 수 있는 유용한 명령이다.

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show ver'" -i ./hosts NXOS-SPINE-1001

생략...

"stdout_lines": [

        [

            "Cisco Nexus Operating System (NX-OS) Software",

            "TAC support: http://www.cisco.com/tac",

            "Copyright (C) 2002-2018, Cisco and/or its affiliates.",

            "All rights reserved.",

            "The copyrights to certain works contained in this software are",

            "owned by other third parties and used and distributed under their own",

            "licenses, such as open source.  This software is provided \"as is,\" and unless",

            "otherwise stated, there is no warranty, express or implied, including but not",

            "limited to warranties of merchantability and fitness for a particular purpose.",

            "Certain components of this software are licensed under",

            "the GNU General Public License (GPL) version 2.0 or ",

            "GNU General Public License (GPL) version 3.0  or the GNU",

            "Lesser General Public License (LGPL) Version 2.1 or ",

            "Lesser General Public License (LGPL) Version 2.0. ",

            "A copy of each such license is available at",

            "http://www.opensource.org/licenses/gpl-2.0.php and",

            "http://opensource.org/licenses/gpl-3.0.html and",

            "http://www.opensource.org/licenses/lgpl-2.1.php and",

            "http://www.gnu.org/licenses/old-licenses/library.txt.",

            "",

            "Software",

            "  BIOS: version 07.65",

            " NXOS: version 9.2(2)",

            "  BIOS compile time:  09/04/2018",

            "  NXOS image file is: bootflash:///nxos.9.2.2.bin",

            "  NXOS compile time:  11/4/2018 21:00:00 [11/05/2018 15:11:06]",

            "  NXOS boot mode: LXC",

            "",

            "",

            "Hardware",

            "  cisco Nexus9000 C9372PX chassis ",

            "  Intel(R) Core(TM) i3- CPU @ 2.50GHz with 16400304 kB of memory.",

            "  Processor Board ID SAL1934MR1X",

            "",

            "  Device name: NXOS-SPINE-1001",

            "  bootflash:   53298520 kB",

            "Kernel uptime is 49 day(s), 9 hour(s), 21 minute(s), 9 second(s)",

            "",

            "Last reset at 506661 usecs after Fri Apr 26 16:55:15 2019",

            "  Reason: Reset Requested by CLI command reload",

            "  System version: 9.2(2)",

            "  Service: ",

            "",

            "plugin",

            "  Core Plugin, Ethernet Plugin",

            "",

            "Active Package(s):"

        ]

CDP(Cisco Discovery Protocol)을 통해서 장비에 연결된 장비 목록을 확인하기.

CDP 명령을 통해 이웃해 있는 장비와 연결 상태 등을 한꺼 번에 조회 할 수 있다.

인벤토리에서 all 을 실행하면, 인벤토리에 포함된 모든 자원에서 연결된 목록도 확인할 수 있다.

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show cap neighbor'" -i ./hosts NXOS-SPINE-1001

생략…

"stdout_lines": [

        [

            "Capability Codes: R - Router, T - Trans-Bridge, B - Source-Route-Bridge",

            "                  S - Switch, H - Host, I - IGMP, r - Repeater,",

            "                  V - VoIP-Phone, D - Remotely-Managed-Device,",

            "                  s - Supports-STP-Dispute",

            "",

            "Device-ID          Local Intrfce  Hldtme Capability  Platform      Port ID",

            "NXOS-LEAF-1003(SAL1940QA3Y)",

            "                    Eth1/1         173    R S I s   N9K-C9372PX   Eth1/1        ",

            "NXOS-LEAF-1004(SAL1935N8D4)",

            "                    Eth1/2         173    R S I s   N9K-C9372PX   Eth1/1        ",

            "NXOS-LEAF-1005(FDO21282LQD)",

            "                    Eth1/3         148    R S I s   N9K-C9372TX-E Eth1/1        ",

            "NXOS-LEAF-1006(SAL1920F54X)",

            "                    Eth1/4         167    R S I s   N9K-C9372TX   Eth1/1        ",

            "N6001-A(FOC1802R03B)",

            "                    Eth1/41        122    R S I s   N6K-C6001-64P Eth1/41       ",

            "N6001-B(FOC1802R045)",

            "                    Eth1/42        148    R S I s   N6K-C6001-64P Eth1/41       ",

            "NXOS-SPINE-1002(SAL1940Q7XL)",

            "                    Eth1/48        135    R S I s   N9K-C9372PX   Eth1/48       ",

            "",

            "Total entries displayed: 7"

        ]

    ]

lldp(link layer discovery protocol)을 통해서 장비에 연결된 장비 목록을 확인하기.

CDP와 유사하지만, 최근에는 호스트 서버들의 NIC에서 LLDP가 지원되는 경우들이 제법 있다.

이 경우에는 네트워크 장비 이외에도 연결된 정보를 한꺼 번에 볼 수 있으므로, 서버, 스토리지, 네트워크 자원 연결 상태를 한꺼번에 확인 할 수 있다.

$ ansible -m nxos_command -c network_cli -u admin -k -a "commands='show lldp neighbor'" -i ./hosts all

생략…

"stdout_lines": [

        [

            "Capability codes:",

            "  (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device",

            "  (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other",

            "Device ID            Local Intf      Hold-time  Capability  Port ID  ",

            "N6001-A              mgmt0           120        B           Eth101/1/16   ",

            "NXOS-LEAF-1003       Eth1/1          120        BR          Ethernet1/1   ",

            "NXOS-LEAF-1004       Eth1/2          120        BR          Ethernet1/1   ",

            "NXOS-LEAF-1005       Eth1/3          120        BR          Ethernet1/1   ",

            "NXOS-LEAF-1006       Eth1/4          120        BR          Ethernet1/1   ",

            "N6001-A              Eth1/41         120        B           Eth1/41       ",

            "N6001-B              Eth1/42         120        B           Eth1/41       ",

            "NXOS-SPINE-1002      Eth1/48         120        BR          Ethernet1/48  ",

            "Total entries displayed: 8"

        ]

    ]

이하 생략...

링크 연결 상태를 확인

네트워크 장비에서는 매우 빈번하게 사용하는 명령이지만, 한꺼번에 모든 스위치의 링크 상태를 보기 위해서 불편하기도 하다.

grep을 조합해서 사용하면 현재 interface가 up 되어 있는 것들만 출력해서 볼 수 있다.

ansible -m nxos_command -c network_cli -u admin -k -a "commands='show interface brief | grep up'" -i ./hosts all

생략

    "stdout_lines": [

        [

            "mgmt0  --           up     10.72.86.144                            1000    1500    ",

            "Eth1/1        1       eth  access up      none                        10G(D) --",

            "Eth1/2        1       eth  access up      none                        10G(D) --",

            "Eth1/3        1       eth  access up      none                       1000(D) --",

            "Eth1/4        1       eth  access up      none                       1000(D) --",

            "Eth1/41       1       eth  access up      none                        10G(D) --",

            "Eth1/42       1       eth  access up      none                        10G(D) --",

            "Eth1/48       1       eth  access up      none                        10G(D) --"

        ]

    ]

이하 생략.

라우팅 테이블 확인하기.

네트워크 장비에서 라우팅 테이블을 조회해서 장애시 경로에 대한 분석은 매우 흔히 있는 일이다.

장비별로 보는 것이 아니라 Ansible을 통해 인벤토리에서 한꺼번에 출력도 가능하며, 특정 장비 그룹들만도 조회가 가능하다.

ansible -m nxos_command -c network_cli -u admin -k -a "commands='show ip route vrf all'" -i ./hosts all

생략

"stdout_lines": [

        [

            "IP Route Table for VRF \"default\"",

            "'*' denotes best ucast next-hop",

            "'**' denotes best mcast next-hop",

            "'[x/y]' denotes [preference/metric]",

            "'%<string>' in via output denotes VRF <string>",

            "",

            "",

            "IP Route Table for VRF \"management\"",

            "'*' denotes best ucast next-hop",

            "'**' denotes best mcast next-hop",

            "'[x/y]' denotes [preference/metric]",

            "'%<string>' in via output denotes VRF <string>",

            "",

            "0.0.0.0/0, ubest/mbest: 1/0",

            "    *via 10.72.86.1, [1/0], 5w1d, static",

            "10.72.86.0/24, ubest/mbest: 1/0, attached",

            "    *via 10.72.86.148, mgmt0, [0/0], 7w0d, direct",

            "10.72.86.148/32, ubest/mbest: 1/0, attached",

            "    *via 10.72.86.148, mgmt0, [0/0], 7w0d, local"

        ]

    ]

이하 생략

VLAN 정보 확인하기.

VLAN 설정에 대한 정보도 한꺼번에 조회가 가능하고, 특정 장비에서만 추출도 가능하다.

ansible -m nxos_command -c network_cli -u admin -k -a "commands='show vlan brief'" -i ./hosts all

"stdout_lines": [

        [

            "VLAN Name                             Status    Ports",

            "---- -------------------------------- --------- -------------------------------",

            "1    default                          active    Eth1/1, Eth1/2, Eth1/3, Eth1/4",

            "                                                Eth1/5, Eth1/6, Eth1/7, Eth1/8",

            "                                                Eth1/9, Eth1/10, Eth1/11",

            "                                                Eth1/12, Eth1/13, Eth1/14",

            "                                                Eth1/15, Eth1/16, Eth1/17",

            "                                                Eth1/18, Eth1/19, Eth1/20",

            "                                                Eth1/21, Eth1/22, Eth1/23",

            "                                                Eth1/24, Eth1/25, Eth1/26",

            "                                                Eth1/27, Eth1/28, Eth1/29",

            "                                                Eth1/30, Eth1/31, Eth1/32",

            "                                                Eth1/33, Eth1/34, Eth1/35",

            "                                                Eth1/36, Eth1/37, Eth1/38",

            "                                                Eth1/39, Eth1/40, Eth1/41",

            "                                                Eth1/42, Eth1/43, Eth1/44",

            "                                                Eth1/45, Eth1/46, Eth1/47",

            "                                                Eth1/48, Eth1/49, Eth1/50",

            "                                                Eth1/51, Eth1/52, Eth1/53",

            "                                                Eth1/54",

            "10   VLAN0010                         active    ",

            "11   VLAN0011                         active    ",

            "12   VLAN0012                         active    ",

            "13   VLAN0013                         active    ",

            "14   VLAN0014                         active    ",

            "15   VLAN0015                         active    ",

            "16   VLAN0016                         active    ",

            "17   VLAN0017                         active    ",

            "18   VLAN0018                         active    ",

            "19   VLAN0019                         active    ",

            "20   VLAN0020                         active    ",

            "21   mercury                          active    ",

            "22   venus                            active    ",

            "23   earth                            active    ",

            "24   mars                             active    ",

            "25   jupiter                          active    ",

            "26   saturn                           active    ",

            "27   uranus                           active    ",

            "28   neptune                          active"

        ]

    ]

Spanning Tree정보 확인하기

데이터센터 장애 가운데 가장 많이 차지하는 네트워크 장애는 Layer2의 Spanning Tree장애이다.

이때 가장 많이 사용되는 명령어 조합으로, 이 명령을 통해 그룹화된 STP 이슈를 손쉽게 분석 할 수 있다.

ansible -m nxos_command -c network_cli -u admin -k -a "commands='show spanning-tree vlan 1 detail'" -i ./hosts all

생략

"stdout_lines": [

        [

            "VLAN0001 is executing the rstp compatible Spanning Tree protocol",

            "  Bridge Identifier has priority 32768, sysid 1, address 84b8.02ca.cc81",

            "  Configured hello time 2, max age 20, forward delay 15",

            "  Current root has priority 32769, address 002a.6a74.ae7c",

            "  Root port is 1 (Ethernet1/1), cost of root path is 6",

            "  Topology change flag not set, detected flag not set",

            "  Number of topology changes 14 last change occurred 363:02:41 ago",

            "          from Ethernet1/1",

            "  Times:  hold 1, topology change 35, notification 2",

            "          hello 2, max age 20, forward delay 15 ",

            "  Timers: hello 0, topology change 0, notification 0",

            "",

            " Port 1 (Ethernet1/1) of VLAN0001 is root forwarding ",

            "   Port path cost 4, Port priority 128, Port Identifier 128.1",

            "   Designated root has priority 32769, address 002a.6a74.ae7c",

            "   Designated bridge has priority 32769, address 5897.bd0a.31ab",

            "   Designated port id is 128.4, designated path cost 2, Topology change is set",

            "   Timers: message age 17, forward delay 0, hold 0",

            "   Number of transitions to forwarding state: 1",

            "   Link type is point-to-point by default",

            "   BPDU: sent 6, received 1836066",

            "",

            " Port 2 (Ethernet1/2) of VLAN0001 is alternate blocking ",

            "   Port path cost 4, Port priority 128, Port Identifier 128.2",

            "   Designated root has priority 32769, address 002a.6a74.ae7c",

            "   Designated bridge has priority 32769, address 84b2.6154.357d",

            "   Designated port id is 128.4, designated path cost 2, Topology change is set",

            "   Timers: message age 16, forward delay 0, hold 0",

            "   Number of transitions to forwarding state: 1",

            "   Link type is point-to-point by default",

            "   BPDU: sent 4, received 2134032",

            "",

            " Port 12 (Ethernet1/12) of VLAN0001 is designated forwarding ",

            "   Port path cost 4, Port priority 128, Port Identifier 128.12",

            "   Designated root has priority 32769, address 002a.6a74.ae7c",

            "   Designated bridge has priority 32769, address 84b8.02ca.cc81",

            "   Designated port id is 128.12, designated path cost 6",

            "   Timers: message age 0, forward delay 0, hold 0",

            "   Number of transitions to forwarding state: 1",

            "   Link type is point-to-point by default",

            "   BPDU: sent 1314843, received 0",

            "",

            " Port 48 (Ethernet1/48) of VLAN0001 is alternate blocking ",

            "   Port path cost 2, Port priority 128, Port Identifier 128.48",

            "   Designated root has priority 32769, address 002a.6a74.ae7c",

            "   Designated bridge has priority 32769, address 3890.a526.05b1",

            "   Designated port id is 128.48, designated path cost 6",

            "   Timers: message age 16, forward delay 0, hold 0",

            "   Number of transitions to forwarding state: 0",

            "   Link type is point-to-point by default",

            "   BPDU: sent 1, received 2134021"

        ]

    ]

Ad hoc에서 사용되는  Cisco Nexus OS command 모듈은, NXOS에서 사용되는 명령어를 대부분 사용 할 수 있다.

특히 show 로 정의되는 상태 조회는 대부분 사용이 가능하고, “ | “ 와 grep 및 정규식 표현으로도 적용이 가능하므로 매우 다양하게 사용할 수 있으므로, 강력하게 추천한다.