WEBVTT

00:00:01.040 --> 00:00:01.760
In this demo,

00:00:01.760 --> 00:00:05.210
we will see how to configure VyOS API northbound

00:00:05.210 --> 00:00:08.260
interface to enable programmatic access,

00:00:09.440 --> 00:00:14.660
then we'll learn how to make API calls by means of simple Python scripts.

00:00:16.540 --> 00:00:19.830
Let me tell you why we are focusing on VyOS

00:00:19.830 --> 00:00:22.150
configuration with a programmatic approach.

00:00:22.940 --> 00:00:26.560
The legacy or non‑API approach is CLI based.

00:00:26.940 --> 00:00:29.760
The CLI approach is based on a manual approach.

00:00:30.140 --> 00:00:33.290
You have the operator to which SSH to the router

00:00:33.550 --> 00:00:36.050
and issue a sequence of commands.

00:00:37.240 --> 00:00:39.460
Such an approach is error prone.

00:00:39.840 --> 00:00:42.650
I mean if you have multiple devices to configure,

00:00:42.880 --> 00:00:46.560
you have to repeat the same process manually many times,

00:00:47.040 --> 00:00:50.360
and the risk of doing a configuration error increases.

00:00:50.840 --> 00:00:51.410
Finally,

00:00:51.410 --> 00:00:55.210
this approach is time consuming and does not allow for real‑time

00:00:55.210 --> 00:00:58.360
configuration as a response to some event.

00:00:59.440 --> 00:01:00.510
On the other hand,

00:01:00.520 --> 00:01:04.730
an API approach allows for programmatic configuration done

00:01:04.739 --> 00:01:08.330
by an application which communicates with the device by

00:01:08.330 --> 00:01:10.260
means of its API interface.

00:01:11.340 --> 00:01:14.290
This approach allows you to create templates,

00:01:14.460 --> 00:01:19.730
resulting in an overall configuration process which is less error prone,

00:01:19.840 --> 00:01:24.790
and you can configure many devices, or your entire infrastructure,

00:01:24.870 --> 00:01:25.950
at the same time.

00:01:26.640 --> 00:01:27.350
And finally,

00:01:27.350 --> 00:01:31.270
you are able to operate a real‑time configuration as a response to

00:01:31.270 --> 00:01:34.460
some event which occurs in your infrastructure.

00:01:36.440 --> 00:01:39.480
The home lab starting configuration is the one we have

00:01:39.480 --> 00:01:42.860
successfully configured in our previous module.

00:01:43.240 --> 00:01:46.270
In the current lab what we are going to do is focus

00:01:46.270 --> 00:01:49.150
in on VyOS API configuration.

00:01:51.240 --> 00:01:56.850
The first thing that we have to do is to enable VyOS API interface.

00:01:57.540 --> 00:02:01.350
We need to provide a key for our VyOS API.

00:02:01.740 --> 00:02:07.260
Just remember that this key has to travel along with your API calls.

00:02:08.340 --> 00:02:17.160
Then we have to specify that our API is exposed on HTTPS protocol on port 8080.

00:02:18.040 --> 00:02:20.350
Then we have to set up certificates.

00:02:20.840 --> 00:02:21.850
Unfortunately,

00:02:21.850 --> 00:02:27.260
release 1.3 does not allow for a complete public key infrastructure suite,

00:02:27.740 --> 00:02:32.030
so we have to settle for locally self‑generated certificates.

00:02:32.940 --> 00:02:34.830
Then we create a virtual host,

00:02:34.930 --> 00:02:40.350
which exposes API over HTTPS protocol on port 8080,

00:02:40.940 --> 00:02:45.260
and bind the API to VyOS outer interface.

00:02:46.040 --> 00:02:50.000
The last command is used to assign a fully qualified

00:02:50.000 --> 00:02:52.250
domain name to the virtual host.

00:02:53.940 --> 00:02:57.800
Never forget the commit command, which applies the configuration,

00:02:57.940 --> 00:03:02.850
and the save command, which makes the configuration permanent at reboot.

00:03:03.440 --> 00:03:04.660
Now the fun part.

00:03:05.140 --> 00:03:09.920
let us learn how to craft API calls with the simple Python scripts.

00:03:10.540 --> 00:03:15.060
Let's start with an API call which reads the current configuration.

00:03:15.640 --> 00:03:19.150
The script should contain at least the following elements,

00:03:19.740 --> 00:03:21.730
the import request model,

00:03:21.740 --> 00:03:27.050
which is a Python model which deals with RESTful APIs; the url,

00:03:27.050 --> 00:03:33.030
which points to the IP address where the interface is exposed; and the endpoint,

00:03:33.030 --> 00:03:35.460
which, in this case, is retrieve.

00:03:35.940 --> 00:03:40.390
And then we have a payload where operation is set to showConfig,

00:03:40.770 --> 00:03:44.460
and the key is set to the string we have configured

00:03:44.460 --> 00:03:48.570
doing the setup of VyOS API interface.

00:03:49.940 --> 00:03:54.760
If we run this script, we receive a non‑formatted JSON string.

00:03:55.840 --> 00:03:58.680
Now we have many ways to deal with JSON.

00:03:58.680 --> 00:04:02.420
In this lab I will use an online service which

00:04:02.420 --> 00:04:05.050
makes this JSON easy to understand.

00:04:05.840 --> 00:04:10.860
All you have to do is to copy and paste the non‑formatted JSON response

00:04:11.070 --> 00:04:15.050
in the Text tab and then switch to the Viewer tab.

00:04:15.940 --> 00:04:20.170
We can see that now we can browse across VyOS configuration,

00:04:20.370 --> 00:04:23.920
and we can confirm that the configuration is correct,

00:04:23.920 --> 00:04:27.660
you can see the IP address of the outer interface.

00:04:28.640 --> 00:04:33.650
And now it's time to issue a configuration command by means of API calls.

00:04:34.640 --> 00:04:38.360
In this script we will configure a loopback interface.

00:04:38.840 --> 00:04:43.160
As you can see, there are two main variations in respect to the previous script.

00:04:44.690 --> 00:04:48.060
Url is now set with the configure endpoint,

00:04:49.140 --> 00:04:52.460
and in the payload part, operation is set,

00:04:53.040 --> 00:04:57.150
and the path contains the loopback interface configuration commands.

00:04:58.540 --> 00:05:02.620
If we run this script, we'll receive a response which says success.

00:05:02.770 --> 00:05:04.490
Let me remark here with something.

00:05:04.720 --> 00:05:06.880
Even if not specified anywhere,

00:05:06.920 --> 00:05:12.380
we have that the commit command is implicit here whenever we show

00:05:12.380 --> 00:05:16.450
configuration command by means of an API interface.

00:05:17.240 --> 00:05:22.250
In case we want further confirmation that correct configuration is in place,

00:05:22.640 --> 00:05:26.060
we can give another go to the read configuration script.

00:05:26.540 --> 00:05:31.780
Import the response in the JSON Viewer and browse the configuration to

00:05:31.780 --> 00:05:35.360
confirm that the new loopback interface is present.

00:05:36.640 --> 00:05:39.550
The final step is the save configuration.

00:05:40.040 --> 00:05:43.780
Save configuration is done by a dedicated API call

00:05:43.780 --> 00:05:47.490
where operation is set to save,

00:05:47.630 --> 00:05:52.360
and we have the startup configuration file location passed as a parameter.

00:05:53.840 --> 00:05:58.090
If we run this script, a success response is returned,

00:05:58.230 --> 00:06:02.450
and this confirms that the operation was performed correctly.

00:06:03.440 --> 00:06:04.790
In the next demos,

00:06:04.940 --> 00:06:09.160
we'll see how VyOS can be used to deploy a scenario with

00:06:09.160 --> 00:06:12.650
network segmentation and network segregation.