Enabling Web-API Access for vNET and vNET Manager
Starting with Netvisor ONE version 7.0.0, you can access and configure vNET features by using REST API commands. This web-API support enables the Pluribus UNUM customers to access vNET, vNET Manager, and vNET resources by using the UNUM interface.
To enable web-API access through UNUNM interface, the vNET-admin must login using the mgmt IP address of the switch. Prior to version 7.0.0, Netvisor allowed the vNET-admin to login by using only the interface IP address (or vNET IP address). The vNET-admin and the users created with vNET-admin role can also access the CLI shell by logging in using the mgmt IP address of the switch.
Prior to Netvisor ONE version 7.0.0, to access vNET and it's resources, you must login into the vNET container, which is present only on the switch where vNET is created (even in the case of fabric scoped vNET). However, starting with version 7.0.0, you can access the vNET context from any of the nodes regardless of where the vNET is created.
To access vNET and vNET Manager through UNUM interface, you must enable web API on all devices by using the admin-service-modify if mgmt web command and then use the vNET credentials in the curl request.
You can access a vNET and manage the vNET resources by using the vnet-admin user and corresponding password just as similar to network-admin user. Following is an example format to log into the switch by using vnet-admin user:
Example of a GET request:
curl -s -u vn1-admin:vn1-admin -X GET http://switch-test1/vRest/port-configs
or
curl -s http://vn1-admin:vn1-admin@switch-test1/vRest/ports-phys | python -m json.tool
To access using RESTful API,
root@switch-test1:~# curl -s -u vnet-1-admin:vnet-1-admin -X GET http://192.168.22.82/vRest/vnets | python -m json.tool
{
"data": [
{
"admin": 40000,
"global": false,
"id": "c0000bf:1",
"managed-ports": "",
"name": "vnet-1",
"num-private-vlans": 0,
"num-vlans": 1,
"public-vlans": "",
"scope": "fabric",
"shared-port-vlans": "",
"shared-ports": "",
"vlan-type": "public",
"vlans": "5",
"vnet-mgr-name": "vnet-1-mgr",
"vrg-id": "c0000bf:0",
"vxlan-end": 0,
"vxlans": 0
}
],
"result": {
"result": [
{
"api.switch-name": "local",
"code": 0,
"message": "",
"scope": "local",
"status": "Success"
}
],
"status": "Success"
}
}
You can also access vNET and vNET Manager on Netvisor ONE by enabling SSH logging into the switch using one of the following methods:
- ssh vnet-admin@<switch-name>
- ssh vnet-admin@<switch mgmt IP address>
Below is an example of how to login and access using the switch name and to verify the configurations:
ssh vn1-admin@switch-test1
* Welcome to Pluribus Networks Inc. Netvisor(R). This is a monitored system. *
* ACCESS RESTRICTED TO AUTHORIZED USERS ONLY *
* By using the Netvisor(R) CLI,you agree to the terms of the Pluribus Networks *
* End User License Agreement (EULA). The EULA can be accessed via *
* http://www.pluribusnetworks.com/eula or by using the command "eula-show" *
vn1-admin@switch1's password:
Last login: Thu Jan 6 23:10:42 2021 from 10.140.0.48
Netvisor OS Command Line Interface 7.0
Connected to Switch switch-test1; nvOS Identifier:0xc0000bf; Ver: 7.0.0-7000018494
CLI (vn1-admin@switch-test1) > vnet-show
name scope vlan-type vlans public-vlans vxlans managed-ports shared-ports shared-port-vlans admin
---- ----- --------- ----- ------------ ----------------- ------------- ------------ ----------------- ---------
vn1 local private none 2000-2099 10000110-10000119 9,17 18 none vn1-admin
CLI (vn1-admin@switch-test1) > port-phy-show
port state speed eth-mode max-frame def-vlan
---- ----- ----- -------- --------- --------
9 down 10000 xfi 1540 1
17 down 10000 xfi 1540 1
18 down 10000 xfi 1540 1
Below is an example of how to login and access using the in-band IP address and to verify the configurations:
root@switch-test2:~# cli
Netvisor OS Command Line Interface 7.0
Connected to Switch switch-test2; nvOS Identifier:0xc00021d; Ver: 7.0.0-7000018494
CLI (network-admin@switch-test2) > fabric-node-show
name fab-name mgmt-ip in-band-ip in-band-vlan-type fab-tid out-port version state device-state
------------- -------- -------------- --------------- ----------------- ------- -------- ---------------- ------ ------------
switch-test2 fab-1 10.14.22.84/23 192.168.22.84/24 public 3 7.0.0-7000018494 online ok
switch-test1 fab-1 10.14.22.82/23 192.168.22.82/24 public 3 49 7.0.0-7000018494 online ok
root@switch-test1:~# ssh vnet-1-admin@192.168.22.82
The authenticity of host '192.168.22.82 (192.168.22.82)' can't be established.
ECDSA key fingerprint is SHA256:XXosFnaL8bQ/BUFbJAXP3bTXpgpwGvhrSuYvSgjmSv0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.22.82' (ECDSA) to the list of known hosts.
* Welcome to Pluribus Networks Inc. Netvisor(R). This is a monitored system. *
* ACCESS RESTRICTED TO AUTHORIZED USERS ONLY *
* By using the Netvisor(R) CLI,you agree to the terms of the Pluribus Networks *
* End User License Agreement (EULA). The EULA can be accessed via *
* http://www.pluribusnetworks.com/eula or by using the command "eula-show" *
vnet-1-admin@192.168.22.82's password:
Netvisor OS Command Line Interface 7.0
Connected to Switch switch-test1; nvOS Identifier:0xc0000bf; Ver: 7.0.0-7000018494
CLI (vnet-1-admin@switch-test1) > vnet-show
switch name scope vlan-type vlans public-vlans num-private-vlans vxlans managed-ports shared-ports shared-port-vlans admin
------------ ------ ------ --------- ----- ------------ ----------------- ------ ------------- ------------ ----------------- ------------
switch-test1 vnet-1 fabric public 5 none 0 0 none none none vnet-1-admin
switch-test2 vnet-1 fabric public 5 none 0 0 none none none vnet-1-admin
To view the details of users, use the command. For example:
CLI (network-admin@switch-test1) > user-show
switch name scope uid type login-fail-count lock-account minimum-pw-length
------------- ------------- ------ ----- -------- ---------------- ------------ -----------------
network-admin fabric 39999 netvisor 0 false 0
switch-test1 vn2-admin local 20001 netvisor 0 false 6
switch-test1 vn1-admin local 20000 netvisor 0 false 6
switch-test1 user-1 local 20002 netvisor 0 false 6
switch-test1 user-2 local 20003 netvisor 0 false 6
To view the user roles, use the command:
CLI (network-admin@switch-test1) > user-role-show
switch user-name role
------------- ------------- -------------
network-admin network-admin
switch-test1 vn2-admin vn2-admin
switch-test1 vn1-admin vn1-admin
switch-test1 user-1 vn1-admin
switch-test1 user-2 vn2-admin
Limitations and Restrictions
In cases, where the vNET container is not created and if you do not want access to vNET resources, then use the no-config-admin option along with no-create-vnet-mgr parameter while creating the vNET. For example,
To create a vNET with no-vnet-managers, no-config-admin:
CLI (network-admin@switch-test1) > vnet-create name vnet-test scope local no-create-vnet-mgr no-config-admin
The above command creates a vNET without an admin and no users are listed with vNET admin role in user-show output as below:
CLI (network-admin@switch-test1) > vnet-show name vnet-test
switch name scope vlan-type vlans public-vlans num-private-vlans vxlans managed-ports shared-ports shared-port-vlans
------------ --------- ----- --------- ----- ------------ ----------------- ------ ------------- ------------ -----------------
switch-test1 vnet-test local public 5 none 0 0 none none none
CLI (network-admin@switch-test1) > user-show
name scope uid type login-fail-count lock-account minimum-pw-length
------------- ------ ----- -------- ---------------- ------------ -----------------
network-admin fabric 39999 netvisor 0 false 0
The above configuration restricts the access of vNET with mgmt-ip/ inband-ip as there are no users on the vNET that is created.