SD-WAN Viptela Collector Deployment and Configuration Guide

To perform SD-WAN collector installation process, you will need to SSH into your machines using non-root credentials for the user sevone. Before continuing, you will need to SSH into each machine that you plan to run SD-WAN collector on and change the default password for this user. This applies whether you are using a SD-WAN appliance or have deployed an .ova. You will need to do this for all nodes (control plane and all agent nodes). This is important for security reasons.

1. SSH into your SD-WAN collector machine and log in as sevone.
2. At the Password prompt, enter sevone.
3. Execute the following command:

   $ passwd
   

4. At the prompt New password, enter a new password for the sevone user.
5. At the prompt Retype new password, enter the new password again.
6. Repeat the steps above for each machine that you plan to run SD-WAN collector on.

Execute the following command to install sevone-cli using Command Line Interface.

$ sudo rpm -Uvh /opt/SevOne/upgrade/utilities/sevone-cli-*.rpm

As a security measure, fresh installations do not ship with pre-generated SSH keys. Execute the following command to generate unique SSH keys for your cluster.

$ sevone-cli cluster setup-keys

1. Please refer to SD-WAN Pre-Deployment Guide to deploy a single SD-WAN Viptela node.
2. Using ssh, log into the SD-WAN Viptela collector control plane node as sevone.

   $ ssh sevone@<SD-WAN collector 'control plane' node IP address or hostname>
   

   Example

   $ ssh sevone@10.128.9.96
   

3. Stop / reset the kubernetes.

   $ sevone-cli cluster down
   

4. Change the hostname. For details, please refer to SD-WAN Viptela Collector Use-Cases Guide > Use-Cases > section Change Hostname.

1. For a multi-node setup, repeat the steps in SD-WAN Viptela Collector Pre-Deployment Guide for each additional node in your cluster. Every SD-WAN collector node ships as a running single-node Kubernetes cluster.
2. Using ssh, log into each node and change the hostname. In order to create a multi-node cluster, you must designate one of the nodes to be your control plane node. For details on how to change the hostname, please refer to SD-WAN Viptela Collector Use-Cases Guide > section Use-Cases > subsection Change Hostname.
   Important:

   • Please make sure to set the hostname for all k3s nodes in lowercase when deploying the collector.
   • If you have created cluster or added agent nodes using the hostname method, please skip to step 7.
   • If you want to create cluster or add agent nodes using the IP address method, please perform steps 3, 4, 5, and 6.

   Example

   Important: The hostnames and IP addresses mentioned in this table are used in the examples for the steps below. Please make sure to replace the hostnames and IP addresses with your machine's hostnames and IP addresses.

   Hostname	IP Address	Role
   sdwan-node01	10.123.45.67	control plane
   sdwan-node02	10.123.45.68	agent1
   sdwan-node03	10.123.45.69	agent2

3. Using ssh, log into SD-WAN collector control plane node as sevone.

   $ ssh sevone@<SD-WAN collector 'control plane' node IP address or hostname>
   

   Example

   $ ssh sevone@10.123.45.67
   

4. Add nodes.

   $ sevone-cli cluster worker add <IP address for node 1>
   

   Important:

   • When adding a new agent node to your cluster, please repeat steps 4, 5, and 6 every time. Please add agent nodes using the IP address only.
   • Please do not run sevone-cli cluster worker remove command when there is no k3s cluster running.
5. Stop / reset the kubernetes.

   $ sevone-cli cluster down
   

6. The following spins up your Kubernetes cluster.

   $ sevone-cli cluster up
   

   Important: The message FAILED - RETRYING: Wait for k3s server to be up means that k3s is trying to come up and it may take a long time. If all retries are exhausted and k3s is unable to come up, the command will fail automatically. Please contact IBM SevOne Support for help.
7. Verify that your control plane and agent node(s) are Ready and have been added to the Kubernetes cluster.

   $ kubectl get nodes
   
   NAME                             STATUS   ROLES    AGE     VERSION
   <your 'control plane' hostname>  Ready    master   2m45s   v1.27.1+k3s1
   <your 'agent1' hostname>         Ready    <none>   2m45s   v1.27.1+k3s1
   <your 'agent2' hostname>         Ready    <none>   2m45s   v1.27.1+k3s1
   ...
   <your 'agent<n>' hostname>       Ready    <none>   2m45s   v1.27.1+k3s1
   

   Example

   $ kubectl get nodes
   
   NAME           STATUS   ROLES    AGE       VERSION
   sdwan-node01   Ready    master   2m45s     v1.27.1+k3s1
   sdwan-node02   Ready    <none>   2m45s     v1.27.1+k3s1
   sdwan-node03   Ready    <none>   2m45s     v1.27.1+k3s1
   

1. Using ssh, log into SD-WAN Viptela collector control plane node as sevone.

   $ ssh sevone@<SD-WAN collector 'control plane' node IP address or hostname>
   

   Example

   $ ssh sevone@10.49.12.64

2. Copy SSH keys to SevOne NMS and install GUI.

   $ ssh-copy-id support@<SevOne NMS IP Address> && sevone-cli solutions guii
   

   Example

   $ ssh-copy-id support@10.49.13.68 && sevone-cli solutions guii
   

   Important: Please provide the SSH password when prompted.

   Example: The command returns the following

   
   ╒═════════════════════════════════════════════════════════════╕
   │ SEVONE GUI INSTALLER                                        │
   ╞═════════════════════════════════════════════════════════════╡
   │ Please open https://10.49.12.64:3000 in your web browser to │
   │ access the GUI Installer.                                   │
   ├─────────────────────────────────────────────────────────────┤
   │ Your credentials are:                                       │
   │ - Username: admin                                           │
   │ - Password: B=|,DQ!qA,                                      │
   ├─────────────────────────────────────────────────────────────┤
   │ If you ever lose your credentials, they're stored in:       │
   │ /etc/sevone-guii/creds                                      │
   ╘═════════════════════════════════════════════════════════════╛
   

   You are now ready to install using the Graphical User Interface Installer.

3. Using a web browser of your choice, enter the URL the setup script has returned. For example, https://10.49.12.64.
   Note: You will also need the credentials (Username and Password) that the setup script returns. These credentials are also stored in /etc/sevone-guii/creds file.

   Example

   $ cat /etc/sevone-guii/creds | jq 
   
   {
     "password": "B=|,DQ!qA,",
     "tokenSecret": "yfqPaemMVeCRaOPjcxguPdfuqdjbFjWR",
     "username": "admin"
   }
   

4. Click Update Cluster to install SD-WAN Viptela Collector.
5. Enter the credentials returned to perform the Self-Service Upgrade. For example, Username: admin and Password: B=|,DQ!qA,
   
   Note: To use the Graphical User Interface installer in dark theme, click next to SevOne logo.

   For help on what each upgrade step does, click button in the upper-right corner.

   Important: All the screenshots below are based on the example being used to write this document. Your total number of tasks passed (ok), skipped, failed, ignored, unreachable, or unexecuted will vary based on your setup. The tasks failed must be addressed as ansible has not ignored them.
6. Enter username & password and then click Login. The graphical user interface installer checks the Current Version and allows you to proceed with the installation.
   Note: Example

   Current Version is on SD-WAN Viptela Collector 7.0.0+63.

   You can proceed with redeploy/install.

   Important: During the Self-Service Upgrade, if you experience network connectivity issue or the upgrade has been halted for any reason, the self-service upgrade will resume from the step where it left off after the issue is resolved. However, if you are at the Deploy step and the self-service upgrade has been halted for any reason, self-service upgrade will show a message requesting you to contact IBM SevOne Support.
   
   To resume with the Self-Service Upgrade, using a web browser of your choice, re-enter the URL the setup script has returned. For example, https://10.49.12.64:3000.
7. Click the Continue to Configure button to configure SD-WAN Viptela solution. Using GUI, you can configure only basic settings for your collector. To configure the advanced settings, please refer to section Configure.
   1. From Configuration drop-down, choose a configuration file from the list. The default configuration file is solutions-sdwan-viptela_custom_guii.yaml. Provide inputs for all mandatory fields.
      Important: Once you provide inputs for all mandatory fields, error messages will no longer appear.
      
   2. Show advanced config - Select the check box to show advanced configuration variables. For more details, please refer to SD-WAN Viptela Collector Advanced Use-Cases Guide > section Advanced Configuration Settings.
   3. Collector Service
      • Credentials (All values must be base64-encoded format)
        • Controller Credentials
          • Username - The username for Viptela vManage credentials with admin-level read privilege.
          • Password - The password for Viptela vManage.
        • NMS Credentials
          • NMS API Credentials
            • Username - The SevOne NMS user name for an administrator-level account.
            • Password - The SevOne NMS password.
          • SSH Credentials
            • Username - The SevOne NMS user name for ssh access to the appliance. It is recommend to set to support in base64-encoded format.
            • Password - The SevOne NMS password for support user.
        • DI Credentials
          • DI API Credentials
            • Username - The SevOne Data Insight user name for an adminstrator-level account.
            • Password - The SevOne Data Insight password.
   4. Collector Configuration
      • MSP Name - The Managed Service Provider (MSP) name for this instance. MSP is a grouping of one or more tenants.
   5. Log
      • Log Level - Defines the log-level for the collector. Value can be info, debug, warning, or error.
   6. Jaeger
      • Disabled - Select the check box to disable Jaeger tracing.
   7. Load Reports
      • Disabled - Select the check box to not import TopN views and OOTB reports.
   8. Vendor Controller Settings
      • Viptela vManage Controller Settings
        • vManage API URL - The API URL of vManage.
        • Insecure TLS - Select the check box to enable insecure TLS connection by skipping certification verification. This is necessary for servers with self-signed server certificates.
   9. NMS
      • NMS API Settings
        • NMS API IP / Hostname - The hostname or IP address for SOA and REST API endpoints. i.e., targeted SevOne NMS.
        • Insecure TLS - Select the check box to enable insecure TLS connection by skipping certification verification. This is necessary for servers with self-signed server certificates.
      • DI
        • DI API Settings - The hostname or IP address for targeted SevOne Data Insight.
        • Insecure TLS - Select the check box to enable insecure TLS connection by skipping certification verification. This is necessary for servers with self-signed server certificates.
        • Tenant - Tenant name for this SevOne Data Insight instance. This is an internal name used to keep settings and cached data segregated by tenant. Default value is SevOne.
   10. Flow Augmentor Service Settings
       • Enable - Select the check box to enable Flow Augmentor installation.
       • Flow Receiver Port - The port on which Flow Augmentor listens for inbound flows. The port number can range from 9000 - 33000.
   11. Flow Augmentor Configuration
       • Flow Augmentor Sender Configuration
         • Flow Augmentor Sender Buffer Size - Sender output buffer size in number of packets.
         • DNC IP - IP address of the DNC, where the augmented flows are sent.
         • Port No - Port of DNC, where the the augmented flows are sent.
8. Click Save. Configuration is saved in /opt/SevOne/chartconfs/solutions-sdwan-viptela_custom_guii.yaml.
   Important: Once the configuration is saved, click Continue button to upgrade SOA.
9. Click Continue button to Upgrade SOA.
   Note: SOA version
   SOA must be on the latest version on all appliances in SevOne NMS cluster.
   
   If your peers are on SevOne NMS 7.x or above, skip the following command. However, if your peers are on SevOne NMS 6.x,

   • Command Line Interface (CLI) must be used to upgrade SOA on all peers as the graphical user interface (GUI) only upgrades SOA for the NMS appliance you are connected to.
   • Add flag --all-peers if you want to install SOA on all peers in the cluster.

   
   $ sevone-cli soa upgrade \
   /opt/SevOne/upgrade/utilities/SevOne-soa-*.rpm \
   <enter SevOne NMS IP address> --all-peers
   

   
10. You are now ready to upgrade SOA. Click Run Upgrade SOA button. This can take a few minutes to run.
11. Click the Continue button to Pre-Check.
    Note: Pre-Check step runs various checks to ensure that SD-WAN Viptela collector cluster is healthy before the deployment.
    
12. You are now ready to run the pre-check. Click the Run Pre-Check button.
    Note: To view the logs for a task, click for the task you need the details for. The pop-up has Copy to clipboard button which allows you to copy all the contents in the pop-up and paste it into a file.
13. Click the Continue button to Deploy.
14. Click the Run Deploy button to run the upgrade. This can take a few minutes to run.
15. Click the Continue button to Post-Check.
16. Click the Run Post-Check button to run the post-check. This can take a few minutes to run.
17. Click the Continue button.
    Important: This indicates that the installation has completed successfully. It typically takes around 30-40 minutes for the data to become visible in SevOne NMS.

The collector configuration is defined in YAML format. Each setting may be one of the following.

$ echo -n "admin" | base64
YWRtaW4=

my_setting:
- value1
- value2

collectorService:
  secrets:
    controller:
      # vManage credentials.
      username: ZGV2ZWxvcA==
      password: RGV2VGVhbTEyMw==
    nms:
      ssh:
      # NMS ssh credentials.
        username: cm9vdA==
        password: ZFJ1bSY1ODUz
      api:
        # NMS API credentials.
        username: YWRtaW4=
        password: U2V2T25l
    di:
      # DI API credentials list.
      api:
        - username: YWRtaW4=
          password: U2V2T25l

Example# 2: Variable names starting with 'collectorConfig'

collectorConfig:
  # MSP name.  Short and descriptive name for the collector that becomes part# of the generated NMS configuration, such as the "<MSP>::SDWAN" device# group that contains all collected devices.## Must be unique per tenant.
  msp_name: VIPTELA
  nms:
    api:
      # NMS server name or IP address.
      host: 10.129.25.196
  di:
    api:
      - host: 10.128.10.20  # DI server name or IP address
        tenant: SevOne  # DI tenant (default: SevOne)# Tenant name for multitenant deployments.  Short and descriptive internal name.## Must be unique per tenant.
  tenant_name: Tenant 1

Check the pods - must be Running or Completed.

$ kubectl get pods

NAME                                                 READY   STATUS      RESTARTS   AGE
solutions-sdwan-viptela-create-keys-1-4r888          0/1     Completed   0          13m
solutions-sdwan-viptela-redis-node-0                 2/2     Running     0          13m
solutions-sdwan-viptela-redis-node-1                 2/2     Running     0          13m
solutions-sdwan-viptela-redis-node-2                 2/2     Running     0          13m
solutions-sdwan-viptela-aug-655b76dc54-ffkrc         1/1     Running     0          13m
solutions-sdwan-viptela-collector-85fd8f4488-jrzqt   1/1     Running     0          13m

$ kubectl get services
 
NAME                                     TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)              AGE
kubernetes                               ClusterIP   192.168.96.1      <none>        443/TCP              16m
solutions-sdwan-viptela-redis-headless   ClusterIP   None              <none>        6379/TCP,26379/TCP   14m
solutions-sdwan-viptela                  ClusterIP   192.168.111.203   <none>        80/TCP               14m
solutions-sdwan-viptela-redis            ClusterIP   192.168.111.179   <none>        6379/TCP,26379/TCP   14m
solutions-sdwan-viptela-flowservice      NodePort    192.168.108.213   <none>        9995:9995/UDP        14m

1. Obtain the node IP where the collector pod is running for SD-WAN Viptela collector to check the logs.

   Example

   $ kubectl get pods -o wide
   
   NAME                                                 READY   STATUS      RESTARTS   AGE   IP              NODE        NOMINATED NODE   READINESS GATES
   solutions-sdwan-viptela-create-keys-1-4r888          0/1     Completed   0          14m   192.168.80.6    sevonek8s   <none>           <none>
   solutions-sdwan-viptela-redis-node-0                 2/2     Running     0          14m   192.168.80.9    sevonek8s   <none>           <none>
   solutions-sdwan-viptela-redis-node-1                 2/2     Running     0          14m   192.168.80.11   sevonek8s   <none>           <none>
   solutions-sdwan-viptela-redis-node-2                 2/2     Running     0          14m   192.168.80.13   sevonek8s   <none>           <none>
   solutions-sdwan-viptela-aug-655b76dc54-ffkrc         1/1     Running     0          14m   10.49.12.64     sevonek8s   <none>           <none>
   solutions-sdwan-viptela-collector-85fd8f4488-jrzqt   1/1     Running     0          14m   192.168.80.7    sevonek8s   <none>           <none>
   

   Note:

   • The pod name for SD-WAN Viptela collector returned is solutions-sdwan-viptela-collector-85fd8f4488-jrzqt.
   • The node IP for SD-WAN Viptela collector returned is 192.168.80.7.
2. Check the logs for SD-WAN Viptela collector, for example.
   1. Using ssh, log into SD-WAN Viptela collector node as sevone.

      $ ssh sevone@<SD-WAN Viptela collector node IP address>
      

      Example

      $ ssh sevone@192.168.80.7

   2. Change directory to /var/log/sdwan-viptela/<collector_name>/<build_version>.

      $ cd /var/log/sdwan-viptela/<collector_name>/<build_version>
      

      Example

      $ cd /var/log/sdwan-viptela/viptela/7.0.0-build.<###>/
      

      You should see the following folders in this directory. The main folder displays all common logs, whereas agent-specific logs can be found within their respective folders.

      • ApprouteEventAgent
      • DeviceHealthAgent
      • InstallerAgent
      • InterfaceStatAgent
      • MetadataAgent
      • NextHopTableAgent
      • PolicyParserAgent
      • DeviceDescriptionAgent
      • FlowAgent
      • InterfaceQueueAgent
      • main
      • MigrationAgent
      • ObjectDescriptionAgent
      • TunnelStatAgent
   3. Check logs for InstallerAgent. Similarly, you can check logs for all other agents.

      Example

      $ cat InstallerAgent/viptela_InstallerAgent_7.0.0-build.<###>.log
      
      2023-08-28T04:55:18Z INF Sending SOA request... agent=InstallerAgent endpoint=/sevone.api.v3.Metadata/ObjectTypes requestId=8
      2023-08-28T04:55:18Z INF Received SOA response agent=InstallerAgent elapsed=15.050577ms requestId=8
      2023-08-28T04:55:18Z INF Sending SOA request... agent=InstallerAgent endpoint=/sevone.api.v3.Metadata/IndicatorTypes requestId=9
      2023-08-28T04:55:18Z INF Received SOA response agent=InstallerAgent elapsed=10.454609ms requestId=9
      2023-08-28T04:55:18Z INF Run agent start agent=InstallerAgent
      2023-08-28T04:55:18Z INF Sending request... agent=InstallerAgent method=POST requestId=10 url=<vManage IP>/j_security_check
      2023-08-28T04:55:18Z INF Received response agent=InstallerAgent elapsed=3.194398ms requestId=10 status="200 OK"
      2023-08-28T04:55:18Z INF Successfully logged into vManage agent=InstallerAgent
      2023-08-28T04:55:18Z INF Sending request... agent=InstallerAgent method=GET requestId=11 url=<vManage IP>/dataservice/client/server
      2023-08-28T04:55:18Z INF Received response agent=InstallerAgent elapsed=1.228017ms requestId=11 status="200 OK"
      2023-08-28T04:55:18Z INF Found vManage platform version: 19.2.31 agent=InstallerAgent
      ...
      ...
      ...
      

Once the collector has been running for 15 to 20 minutes, data should appear in SevOne NMS. Perform the following steps to verify this.

• Log into SevOne NMS.
• From the navigation bar, go to Administration, select Object Types from Monitoring Configuration. Filter to xStats.
• From the navigation bar, go to Devices, select Grouping, and then select Device Groups.
• From the navigation bar, go to Devices, select Grouping, and then select Object Groups.
• From the navigation bar, go to Administration and select Metadata Schema. Click on Add Namespace to check metadata creation.
• If enable_flow_view_creation and flow_enabled are set to true, then the user will be able to see the created SDWAN:Viptela:AugmentedFlow view. To see the created view, from the navigation bar go to Administration, select Flow Configuration, and then select FlowFalcon View Editor.