First steps with Unetlab

Andrea, the guy behind the great IOU-WEB, has released Unetlab (Unified Networking Lab). It's still in beta at the moment, but I thought I would have a look.

Even though I have not finished my CCIE R&S yet, I am looking towards the Service Provider CCIE, which I plan to do straight after the R&S. With the SP track (as it stands at the moment), you need to get your hands on the XRv. This will run, happily, on ESXi, and can be connected to IOU, or even into GNS3 (using VirtualBox). I had started to play around with this, but it's not exactly the easiest thing in the world. So I was very pleased when Unetlab came out, as everything can be within one environment.

So I decided to get my hands dirty and have a go.

I am using an ESXi server, with 32GB ram, but it'll run in VMWare player, workstation, Fusion, and VirtualBox as well.

Once I had downloaded it (its about 300Mb give or take), and imported it into ESXi, I followed the Unetlab install guide. It's a simple process, and you are guided through it. It's well worth doing an update as well to get the home page displayed below.

The interface is sparse (at the moment, remember this is a beta), but has everything that I need at the moment.

My first step was to import the IOU images. The caveat here is that you need to generate the IOU license, I won't go into details, but it's easy to google how to do this. The only gotcha I came across was that the images must have a .bin extension - so make sure that you add this first.

Following the install doc I copied the files, using FileZilla, to /opt/unetlab/addons/iol/bin, and fixed the permissions using the command "/opt/unetlab/wrappers/unl_wrapper -a fixpermissions". Then I went back into the gui and created my first lab.

From the Actions menu, I create a new lab, and call it IOL test

From the Actions menu, I then create a network:

Then I add a Node, also from the Actions menu:

I add 2 nodes, and from the drop down select an IOL image (that I have already uploaded through FileZilla):

My two nodes appear on the screen:

I then right click on a node, and select "Interfaces", and point R1 to use the network I just created:

My first node is added to the network

I then repeat on R2, and my two nodes are connected:

From the Actions menu I then select "Open this Lab", and now I can start my two routers:

If you havn't followed the guide on the website, then you will find that the nodes do not start, so please do follow the guides to the letter.

Give them a few minutes to fire up, assign an IP address, and all works well:

So far memory usage is pretty good (remember that this is on a 4GB VirtualBox VM):

Let's add the XRv image.

This is slightly more complex, but again the documentation for importing XRv into Unetlab explains every step.

Now I can add multiple XRv routers, and connect them to the IOU images.

I am going to edit my original lab, so we need to go to the Actions menu, and select "Edit this lab":

I then add the XRv router:

Connect to interfaces to our network

Once we add the network to the new router, and also set another interface on both of the IOL routers, we get something like this:

Going back to the Actions menu, select Open this lab, and start the router. Here I did see an error, but after a few attempts, it did start:

Memory usage has now pretty much hit the ceiling, as the XRv takes quite a chunk (3GB), but nonetheless, it serves to prove that the system works. Adding more memory is clearly required here if you want to run a decent sized topology with a range of devices.

It takes a long time for the XRv to fire up, again this is down to the memory I have available, it worked much better on my ESXi server, but it does work:

It's a little untidy at the moment, so let's do a bit of reconfiguration:

We'll add a new network, and set the XRv to use this, as well as moving the E0/1 interface of both the IOL routers to use this:

Now the topology looks much cleaner!

 Still, let's clean it up even more, and add another network, and reconfigure it a bit:

Much cleaner!

CDP looks a bit funky, and pings don't work, but then I think I just need to play around with it a bit. It's only my first real go at playing with this, so there are bound to be teething troubles!

With this in mind, I shut everything down, and fired them all up again. Now things look much better:

RP/0/0/CPU0:XRv-1(config)#interface Gi0/0/0/0
RP/0/0/CPU0:XRv-1(config-if)#ipv4 address 10.1.1.1 255.255.255.0
RP/0/0/CPU0:XRv-1(config-if)#cdp
RP/0/0/CPU0:XRv-1(config-if)#no shut
RP/0/0/CPU0:XRv-1(config-if)#int gi 0/0/0/1
RP/0/0/CPU0:XRv-1(config-if)#ipv4 address 10.1.2.1 255.255.255.0
RP/0/0/CPU0:XRv-1(config-if)#cdp
RP/0/0/CPU0:XRv-1(config-if)#no shut
RP/0/0/CPU0:XRv-1(config-if)#exit
RP/0/0/CPU0:XRv-1(config)#cdp
RP/0/0/CPU0:XRv-1(config)#commit
RP/0/0/CPU0:XRv-1(config)#exit
RP/0/0/CPU0:XRv-1#sh ip int bri
Wed Feb 18 13:18:20.485 UTC

Interface                      IP-Address      Status         Protocol
MgmtEth0/0/CPU0/0              unassigned      Shutdown       Down
GigabitEthernet0/0/0/0         10.1.1.1        Up             Up
GigabitEthernet0/0/0/1         10.1.2.1        Up             Up
GigabitEthernet0/0/0/2         unassigned      Shutdown       Down
RP/0/0/CPU0:XRv-1#ping 10.1.1.2
Wed Feb 18 13:18:26.475 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/61/279 ms
RP/0/0/CPU0:XRv-1#ping 10.1.2.2
Wed Feb 18 13:18:32.994 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/9/29 ms
RP/0/0/CPU0:XRv-1#sh cdp neigh
Wed Feb 18 13:22:11.959 UTC
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater

Device ID       Local Intrfce    Holdtme Capability Platform  Port ID
R1              Gi0/0/0/0        163     R          Linux Uni Et0/1
R2              Gi0/0/0/1        138     R          Linux Uni Et0/1
RP/0/0/CPU0:XRv-1#


R2#sh ip int bri | e unas
Interface                  IP-Address      OK? Method Status  Protocol
Ethernet0/0                192.168.1.2     YES NVRAM  up      up
Ethernet0/1                10.1.2.2        YES NVRAM  up      up

R2#ping 10.1.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/14 ms
R2#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
R2#

R1#sh ip int bri | e unas
Interface                  IP-Address      OK? Method Status  Protocol
Ethernet0/0                192.168.1.1     YES NVRAM  up      up
Ethernet0/1                10.1.1.2        YES NVRAM  up      up

R1#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/6 ms
R1#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/10 ms
R1#

There we have it, two IOL routers, one XRv router, all communicating happily, all contained within one environment.

Where Unetlab is superb, is that everything is within the same environment. There is no mucking about with creating multiple networks in VMWare. To be honest, some will probably find that easy, but I like to have it all contained, like Unetlab does.

Running two XRv routers did cause the default memory to top out, so I shut down the VM, and increased the memory to 20GB. Now I can run loads of routers, and the memory usage (as reported on the "Home" page remains within reasonable levels. Please note though that I am showing screenshots from a VirtualBox install, with a lower amount of memory.

So what's next?

The vendor support in Unetlab is very wide-ranging. I havn't tried all of them, but will add some dynamips images, CSR1000v and the vIOS images this week.

At the moment the supported images are:

• Aruba ClearPass
• Alcatel 7750 SR
• Arista vEOS
• CheckPoint Security Gateway VE
• Cisco ASA (porting)
• Cisco ASAv
• Cisco CSR 1000V
• Cisco IPS (porting)
• Cisco IOS 1710 (dynamips, ethernet only)
• Cisco IOS 3725 (dynamips, ethernet only)
• Cisco IOS 7206VXR (dynamips, ethernet only)
• Cisco IOL (for Cisco internal use only)
• Cisco Titanium (for VIRL customers only)
• Cisco vIOS (for VIRL customers only)
• Cisco vIOS L2 (for VIRL customers only)
• Cisco XRv
• F5 BIG-IP LTM VE
• Fortinet FortiGate (new)
• HP VSR1000
• Juniper Olive (porting)
• Juniper vSRX
• Palo Alto VM-100 Firewall
• VyOS

The scope of Unetlab is immense. Clearly this will work well for when I do the SP track, as the IOL and XRv images are supported, and work nicely.

This also gives scope for the Security track as well. It will "natively" run the ASAs and the IPS, and you can connect clouds to run things like an Active Directory server, WSA (Web Security Appliance), ACS (Access Control Server), WLC (Wireless Lan Controller), ISE, and all the rest (there is a LOT of components in the Security track). I would probably need to invest in a second ESXi server in order to run all of the above, but then for the sum of £200, it's a worthwhile investment.

Unetlab is superb, already, and it is still very early days. While the interface can be a little slow to update  (such as moving objects around, but then this is less of a concern than the amazing functionality that it offers), Andrea has excelled himself again, he deserves a big thanks for all his hard work and dedication to the community. It's just a shame that he hasn't done a kickstarter, like GNS3 did as I am sure that people would support him. I'd certainly give him some money!

Cisco VIRL is out! It's not free!

Cisco VIRL has been released today.

After waiting for what seems like ages, since it was first mentioned, it is finally here.

You can get it from http://virl.cisco.com.

The rumours were that is would be free, and would run up to fifteen (15) nodes, that could be either IOSV, IOS XRv, NX-OSv, or the CSR1000v.

While the capabilities remain the same, it is not free. It costs $199.99 PER YEAR.

This does seem to be a bit of a kick to the groin, really. Whilst this is the true, Cisco virtual environment, with all the support and abilities needed (obviously barring a few layer 2 technologies), $200 a year is a little costly.

For a limited time you can get $50 off using the code "VIRL50" at checkout. Which still makes it $150. It's not a bad price I suppose, but many people did expect this to be released without an associated cost.

I think I will stick with IOU and GNS3 for the moment!

HSRP, Cisco Emulation software and ASICs

I wrote sometime back about how to implement HSRP using Cisco IOU and in GNS3, but it has been pointed out that even though it might look like it works, in fact it's actually a little more hit and miss, with some people having issues, such as not being able to ping the Virtual IP address configured on the HSRP standby group - check out the comments to follow the reference, hopefully you'll understand why I am writing this subsequent post.

A recap on HSRP

HSRP (Hot Standby Routing Protocol) allows you to set up the same SVI (Switched Virtual Interface) on a pair of switches so that you have some redundancy, in the event that one switch is unavailable then the virtual IP address assigned to the standby group will still be available. The virtual IP address is given the same MAC address, which is a combination of the well-known HSRP MAC address (0000:0c07:ac) and the standby group number (in our case this is 10, which is 0a in hexadecimal).

HSRP is Cisco specific, other vendors user the industry standard of VRRP (Virtual Router Redundancy Protocol), there is also GLBP (Gateway Load Balancing Protocol) for routers.

We will be using two different versions of GNS3 for this, the first is the publicly available 0.8.6 version, because that can still use qemu, which means that we can use the IOSv images to try this out on, as well as the image c3660-is-mz.124.25b referenced in the first article. If you haven't checked out how to get the IOSv images from onePK into GNS3 then you might want to have a quick read of it.

So the goals for this post are to prove that we can get HSRP working between two devices. One should show up as the active and one as the standby, and we should be able to ping the virtual IP assigned to the HSRP group. As per the original post we need to create a multi-layer switch to enable the required functions, this still holds true today, so do have a read over the original article.

For each example we will have an HSRP group, number 10, one switch will use the IP address 10.10.1.2/24, the other will use 10.10.1.3/24 and they will have a virtual IP address of 10.10.1.1. The HSRP MAC address will be 0000.0c07.ac0a, so this is what we will be looking for in our ARP table.

Let's check out GNS3 first.

HSRP using native GNS3

Once we have set up our multi-layer switch in GNS3, the configurational steps for our first switch are as follows:

R4#vlan database
R4(vlan)#vlan 10
VLAN 10 added:
    Name: VLAN0010
R4(vlan)#exit
APPLY completed.
Exiting....   
*Mar  1 00:00:35.719: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
R4#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R4(config)#int vlan 10
R4(config-if)#ip add 10.10.1.2 255.255.255.0
R4(config-if)#standby 10 ip 10.10.1.1
R4(config-if)#standby 10 pri 150
R4(config-if)#standby 10 preem del min 60
R4(config-if)#no shut
R4(config-if)#int fa 1/10
R4(config-if)#switchport mode trunk
*Mar  1 00:02:00.087: %DTP-5-TRUNKPORTON: Port Fa1/10 has become dot1q trunk
*Mar  1 00:02:00.563: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
R4(config-if)#no shut
R4(config-if)#
*Mar  1 00:02:30.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
*Mar  1 00:02:30.695: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
R4(config-if)#
*Mar  1 00:02:51.699: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby
*Mar  1 00:02:52.199: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Standby -> Active
R4(config-if)#exit
R4(config)#exit
R4#
*Mar  1 00:03:34.879: %SYS-5-CONFIG_I: Configured from console by console
R4#

So far our first device is looking healthy for HSRP. The second switch is very similar:

R5#vlan database
R5(vlan)#vlan 10
VLAN 10 added:
    Name: VLAN0010
R5(vlan)#exit
APPLY completed.
Exiting....
R5#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R5(config)#int fa1/10
R5(config-if)#switchport mode trunk
*Mar  1 00:02:45.687: %DTP-5-TRUNKPORTON: Port Fa1/10 has become dot1q trunk
*Mar  1 00:02:46.159: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
R5(config-if)#no shut
R5(config-if)#exit
R5(config)#int vlan 10
R5(config-if)#
*Mar  1 00:02:53.711: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
R5(config-if)#ip add 10.10.1.3 255.255.255.0
R5(config-if)#standby 10 ip 10.10.1.1
R5(config-if)#standby 10 pri 90
R5(config-if)#
*Mar  1 00:03:16.291: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
R5(config-if)#
*Mar  1 00:03:40.299: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby
R5(config-if)#

With our trunk setup to carry the VLAN information, as well as the HSRP multicast, we should be able to check that everything is in order. Using the command "sh standby vlan" with the vlan number we can check the HSRP settings and status. Let's check to see if we have everything we are hoping for, including the correct ARP entries and making sure that the interfaces are pingable:

R4#sh standby vlan 10
Vlan10 - Group 10
  State is Active
    2 state changes, last state change 00:03:19
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.724 secs
  Preemption enabled, delay min 60 secs
  Active router is local
  Standby router is 10.10.1.3, priority 90 (expires in 7.344 sec)
  Priority 150 (configured 150)
  IP redundancy name is "hsrp-Vl10-10" (default)
R4#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               -   0000.0c07.ac0a  ARPA   Vlan10
Internet  10.10.1.2               -   cc04.38a1.0000  ARPA   Vlan10
R4#ping 10.10.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R4#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               -   0000.0c07.ac0a  ARPA   Vlan10
Internet  10.10.1.3               0   cc05.38a1.0000  ARPA   Vlan10
Internet  10.10.1.2               -   cc04.38a1.0000  ARPA   Vlan10
R4#

R5#sh standby vlan 10
Vlan10 - Group 10
  State is Standby
    1 state change, last state change 00:03:22
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.992 secs
  Preemption disabled
  Active router is 10.10.1.2, priority 150 (expires in 7.376 sec)
  Standby router is local
  Priority 90 (configured 90)
  IP redundancy name is "hsrp-Vl10-10" (default)
R5#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.3               -   cc05.38a1.0000  ARPA   Vlan10
R5#ping 10.10.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/21/24 ms
R5#ping 10.10.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/21/24 ms
R5#sh arp        
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               0   0000.0c07.ac0a  ARPA   Vlan10
Internet  10.10.1.3               -   cc05.38a1.0000  ARPA   Vlan10
Internet  10.10.1.2               0   cc04.38a1.0000  ARPA   Vlan10
R5#

So arp looks good and we can ping the Virtual IP address for the standby group, with no problems here. Let's check out HSRP on IOU next.

HSRP using IOU

With the same configuration (apart from the priority of 150 on the first device) as before running on the IOU routers do we have the same level of visibility?

Switch#sh standby vlan 10
Vlan10 - Group 10
  State is Active
    2 state changes, last state change 00:00:34
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a (MAC In Use)
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.984 secs
  Preemption enabled, delay min 60 secs
  Active router is local
  Standby router is 10.10.1.3, priority 90 (expires in 9.904 sec)
  Priority 100 (default 100)
  Group name is "hsrp-Vl10-10" (default)
Switch#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               -   0000.0c07.ac0a  ARPA   Vlan10
Internet  10.10.1.2               -   aabb.cc80.0100  ARPA   Vlan10
Internet  10.10.1.3               0   aabb.cc80.0200  ARPA   Vlan10
Switch#ping 10.10.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
Switch#sh ver | i IOS
Cisco IOS Software, Solaris Software (I86BI_LINUXL2-IPBASEK9-M), Experimental Version 15.1(20130124:233217) [dstivers-jan24-2013-team_track 101]
Switch#sh ip int bri     
Interface              IP-Address      OK? Method Status                Protocol
Ethernet0/0            unassigned      YES unset  up                    up      
Ethernet0/1            unassigned      YES unset  up                    up      
Ethernet0/2            unassigned      YES unset  up                    up      
Ethernet0/3            unassigned      YES unset  up                    up      
Vlan10                 10.10.1.2       YES manual up                    up      
Switch#

Switch2#sh standby vlan 10
Vlan10 - Group 10
  State is Standby
    1 state change, last state change 00:00:29
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a (MAC Not In Use)
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.912 secs
  Preemption disabled
  Active router is 10.10.1.2, priority 100 (expires in 9.696 sec)
  Standby router is local
  Priority 90 (configured 90)
  Group name is "hsrp-Vl10-10" (default)
Switch2#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.3               -   aabb.cc80.0200  ARPA   Vlan10
Switch2#ping 10.10.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
Switch2#ping 10.10.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
Switch2#sh ver | i IOS
Cisco IOS Software, Solaris Software (I86BI_LINUXL2-IPBASEK9-M), Experimental Version 15.1(20130124:233217) [dstivers-jan24-2013-team_track 101]
Switch2#

Again arp looks good and we can ping the virtual IP address again.

EDIT:-

It just goes to show that image is everything. As Maureen (in the comments below) has pointed out whilst following this blog and my posts about HSRP, nothing is 100% guaranteed when using a virtualized environment.

If you try adding a guest to the mix then it probably won't be able to ping the standby address, and if you do, it probably won't last. I will go into it in more depth in my post about IOU Images and functions.

Finally lets check out IOSv.

HSRP using IOSv on GNS3

HSRP is slightly different on IOSv, there are no vlan commands, and instead everything is performed under the interface, so technically it's not enabling redundancy for a vlan, it's enabling it for the interface, but the principal remains the same, it still requires the same coding within IOS for the feature to work, and multicast for the communication to flow over. I am including it here because of this. 

SW1(config)#int gi 0/0
SW1(config-if)#ip add 10.10.1.2 255.255.255.0
SW1(config-if)#standby 10 ip 10.10.1.1
SW1(config-if)#standby 10 pri 150
SW1(config-if)#standby 10 preem delay min 60
SW1(config-if)#no shut
SW1(config-if)# 
*May 11 16:11:44.818: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
*May 11 16:11:45.818: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*May 11 16:12:05.647: %HSRP-5-STATECHANGE: GigabitEthernet0/0 Grp 10 state Standby -> Active
SW1(config-if)#exit
SW1(config)#exit
SW1#sh standby
*May 11 16:12:25.655: %SYS-5-CONFIG_I: Configured from console by consoleand 
GigabitEthernet0/0 - Group 10
  State is Active
    2 state changes, last state change 00:00:27
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.272 secs
  Preemption enabled, delay min 60 secs
  Active router is local
  Standby router is 10.10.1.3, priority 90 (expires in 9.232 sec)
  Priority 150 (configured 150)
  Group name is "hsrp-Gi0/0-10" (default)
SW1#

SW2(config)#int gi 0/0
SW2(config-if)#ip add 10.10.1.3 255.255.255.0
SW2(config-if)#standby 10 ip 10.10.1.1
SW2(config-if)#standby 10 pri 90      
SW2(config-if)#no shut
SW2(config-if)#
*May 11 16:11:44.460: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
*May 11 16:11:45.460: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*May 11 16:12:29.371: %HSRP-5-STATECHANGE: GigabitEthernet0/0 Grp 10 state Speak -> Standby
SW2(config-if)#
SW2(config-if)#exit
SW2(config)#exit
SW2#sh stand
GigabitEthernet0/0 - Group 10
  State is Standby
    1 state change, last state change 00:00:23
  Virtual IP address is 10.10.1.1
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.744 secs
  Preemption disabled
  Active router is 10.10.1.2, priority 150 (expires in 10.480 sec)
  Standby router is local
  Priority 90 (configured 90)
  Group name is "hsrp-Gi0/0-10" (default)
SW2#

So it certainly looks like HSRP works on IOSv, let's make sure by looking at arp, and seeing if we can ping the virtual IP address:

SW1#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               -   0000.0c07.ac0a  ARPA   GigabitEthernet0/0
Internet  10.10.1.2               -   00ab.60a2.3000  ARPA   GigabitEthernet0/0
SW1#ping 10.10.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 3/8/11 ms
SW1#ping 10.10.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
SW1#sh ver | i Version
Cisco IOS Software, IOSv Software (VIOS-ADVENTERPRISEK9-M), Version 15.4(1.24)T0.9, MAINTENANCE INTERIM SOFTWARE
SW1#

SW2#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.2               0   00ab.60a2.3000  ARPA   GigabitEthernet0/0
Internet  10.10.1.3               -   00ab.1061.0700  ARPA   GigabitEthernet0/0
SW2#ping 10.10.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/7/11 ms
SW2#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.1.1               0   0000.0c07.ac0a  ARPA   GigabitEthernet0/0
Internet  10.10.1.2               0   00ab.60a2.3000  ARPA   GigabitEthernet0/0
Internet  10.10.1.3               -   00ab.1061.0700  ARPA   GigabitEthernet0/0
SW2#sh ver | i Version
Cisco IOS Software, IOSv Software (VIOS-ADVENTERPRISEK9-M), Version 15.4(1.24)T0.9, MAINTENANCE INTERIM SOFTWARE
SW2#

So again, all good and we are three for three.

So why am I going over this again, if actually I am only proving that it does work? Well, it's all to do with mileage, and your mileage may vary. Remember we are dealing with emulated, or virtualized hardware, so there will be issues, especially when we come across things that the router, or more specifically switch, generally offload to ASICs. With all the benefits that Cisco emulation software offers, the one thing it cannot do is truly emulate the functions contained within the ASIC.

What's a running shoe brand got to do with Cisco emulation software?

An ASIC is an Application-Specific Integrated Circuit, not to be confused with ASICS the running shoe manufacturer. These ASICs are so complex that they can (depending on the type of ASIC) be referred to as a system on a chip. It is this off-loading that makes running a virtualised switch, with the full functionality and speed as a proper hardware one, extremely difficult to implement.

The most common Cisco specific ASIC you will encounter is the port ASIC, and these handle traffic forwarding, QoS and ACL lookups. A number of switches have within these port ASICs their TCAM, which holds the IPv4 and IPV6 addresses, MAC addresses, and Access Control Entries.

For a greater understanding of packet flow within a switch and how this is governed by the ASIC then have a look at this PDF from Cisco Live.

So in short, we can get close, but close is a very relative term, finding the right IOU or GNS3 image can be a bit of a mission.

It will be interesting to see how CML stands up to higher-level switch functionality when it is finally released. One would think that as it is the basis for the new version of the CCIE exam then it will be supported. Time will tell on that!

In an ideal world we would all have the required hardware, it wouldn't cost more than a cup of coffee, and it would fit into your pocket. But for the moment we'll have to see how far our mileage gets us.

IOSv in GNS3

Following on from the Cisco ViRL - a first taste! post where I said that I was going to try and get the IOSv image working in GNS3 I have done a bit of playing around. After a few misses I finally got it working. So here is my walk through.

Firstly you need to get the ova file out of the onePk image - once you have loaded the onePk vm you can connect to it using WinSCP and get the ova file from /usr/share/vmcloud/data/images/vios.ova.

Importing the onePK vIOS ova file into VirtualBox

I first tried setting the IOSv image up as a VirtualBox guest and adding it to GNS3 that way. No go, and it bluescreened my laptop. DONT TRY THIS AT HOME KIDS!

Creating a vIOS Qemu guest (attempt 1)

Secondly I tried to create a Qemu guest by extracting the files from the ova and running a bunch of qemu commands to create an img file. I didn't get a bluescreen, and the image loaded, but nothing much happened after that, and I couldn't console onto it. So it was pretty useless.

Creating a vIOS Qemu guest (attempt 2)

The second attempt, and the one that works it to first extract the contents of the ova file. make sure that the Qemu settings in GNS3 work, so the All-in-One version of the GNS3 software is best, so that you get all the Qemu goodness.

The resulting vmdk can be run directly as a qemu guest. So with the following settings:

Qemu-flavor: -x86_64
Identifier name: anything you like
Binary Image: the extracted vmdk file
RAM: 384Mb works well, though Cisco recommend 512Mb
Number of Nics: anyting up to 8
NIC Model: e1000

You can then drag a Qemu guest onto GNS3. If you want one, drag on two and delete the first one, for some reason it didnt seem to like the first one, probably due to a numbering thing with the telnet ports.

When you click on boot the Qemu screen will come up, it will appear to hang at "Booting 'IOSv', this is fine, you should now be able to console onto the devices. I added one 7200 router (R1) with two gigabit ethernet interfaces (1.1.1.1/24 and 2.2.2.1/24) and three vIOS images (deleting the first one). The IOSv images had IP addresses 1.1.1.2 and 2.2.2.2 connecting them to the 7200 via gi 0/1, and 3.3.3.1 and 3.3.3.2 connecting them to each other vis gi 0/0. CDP worked, and so did ping:

I have uploaded a video showing all of the steps.

Enjoy your brand new IOSv!