Skip to content
Jul 18 / thebrotherswisp

The Brothers WISP 140 – Plooza Meetup, Travel Kit, MTK cAP XL AC

This week we have Greg, Mike, and Colin comin in hot and shootin that shot.

**Sponsors**
Sonar.software
Kwikbit.com
Towercoverage.com
**/Sponsors**

This week we talk about:
Anyone going to ‘Plooza this year…Greg is thinking about it?
New Mikrotik cAP XL AC is a pretty beefy antenna…not sure what the gain is yet, but it’s chonky
Do you use a travel AP/router on the road?
What’s in your work travel bag(you are taking a flight)?
What kind of bag do you use for travel?
Digital business cards
Datasheets
Deleting Posts on Vendor Forums
Facebook trolling
Customer touches
Many more things that I can’t remember

Here’s the video:(if you don’t see it, hit refresh)

Jun 30 / Greg

Windows Updates With Snapshots Using Ansible Automation Platform

I was recently asking my teammate Jimmy(who’s brilliant BTW) what he shows as a compelling demo with Ansible and Windows, and he he had a more complicated version of what I’m about to show(most of his stuff is over the top(with Stallone)).

Video Demo

Playbook

Playbooks for Windows found here.

In this simple demo I’ll connect to my VMWare Vcenter and perform a snapshot with memory.
I have a next step of putting the system in maintenance mode in monitoring to stop notifications.
I’ll then perform a simple Windows update in a Windows server using WinRM. I do this from inside of a block. I do this because a block has some special functionality as in “rescue” and “always”.
I use a rescue block which is called if anything inside of the block fails. So, if my Windows host fails to update for any reason, it will call this rescue block which will rollback the snapshot to undue any potential damage caused.
My following step is to delete the snapshot(at this point I’m done with it). Take note that since I did a memory snapshot also, the machine will cleanly keep running. If you fail to add the memory option and restore the VM will restore in a stopped state.
The last step would be to remove the host from maintenance mode.

Conclusion

This isn’t something that’s relegated to just updates. Any potentially failure inducing operation could be protected against using this. This simple method could be used to protect anything, often even appliances could take advantage.

Let me know if you have any questions or comments.
Thanks and happy automating.

Jun 19 / thebrotherswisp

The Brothers WISP 138 – Active vs PON, Terragraph Teaser, Batfish

This week we have Greg, Chad Wachs, and new face Colin Zapalac talking about talking.

**Sponsors**
Sonar.software
Kwikbit.com
Towercoverage.com
**/Sponsors**

This week we talk about:
Active vs PON deployment – why am I seeing so much active fiber being deployed? What am I missing?
Brownfield deployment options when you don’t have aerial ability
It’s getting HOT. Anyone protecting gear from heat? Routers hitting 220F internal temps
Colin: DDB enclosures with Pentair AC, mini-splits in MDF’s
Preview Siklu Terragraph test?
Peltier cooling
MTK newsletter 100
Colin’s automated edgeswitch update script
batfish
Mikrotik Knots tracking

Here’s the video:(if you don’t see it, hit refresh)

Jun 6 / thebrotherswisp

The Brothers WISP 137 – Local Proxy ARP, Carrier Ethernet Drop, GPEN21 CPE

This week we have Greg and Nick A. catching up after skipping an episode…did anyone notice?

**Sponsors**
Sonar.software
Kwikbit.com
Towercoverage.com
**/Sponsors**

This week we talk about:
L2 isolation addition – Mikrotik introduced Local Proxy Arp – MTK responds to all ARP requests on an interface.
Using a switch to connect border/core services – eases transition, can be complicated with direct BGP peer flaps.
UBNT 60LR? Carrier Ethernet Drop
Cisco EEM for flapping a port
AutoIT for scripting
GPEN21 as FTTH CPE
OEO kit
FS switches for FTTH project

Here’s the video:(if you don’t see it, hit refresh)

May 25 / Greg

Cyberark Per Host Password Lookup In The Ansible Automation Platform

Cyberark Central Credential provider has some killer features with one of particular interest(for this article that is) which is the ability to have a different password per host. It seems pretty bonkers to think you can maintain separate passwords for 100 different devices, but CA does it, and not only that, it has facilities that can change the password each time it’s used *galaxy brain*.

This post demonstrates how to do a per-host lookup inside the Tower/Control environment.

Demo Video

Cyberark Setup

In my CA environment I have a safe named “test” that I’m using.
In the root folder of test I’ve created three password objects, each for the switches I plan to connect to. Each object is named the same as the inventory hostname from ansible: sw1, sw2, sw3.

All of the connection info along with the walkthrough is in my CA AIM blog post.

Playbook

I’m first going to say that given my drothers I would have used the Cyberark lookup plugin, but you have to have the Central Credential software installed on your server, and I’ve yet to get a copy of it. The playbook to make that work is here:

I instead used the cyberark collection that contains the cyberark_credential module.

Looking at the playbook above I have a variable that I’ve setup(and I’m replacing at runtime from my tower environment) named ca_base_url.
The other cyberark info is just presented plain text, but notice that I had to supply my cert and key. This is why I wanted to use the lookup plugin, so I wouldn’t have to put a link to the cert/key anytime I wanted to use it…but I digress.

The real magic happens in the query section of the first task:

1
query: "Safe=test;Object={{ inventory_hostname }}"

I’m connecting to the safe named “test” and for each host in the current run I’m pulling the password object that is named the same as their “inventory_name”. Having these two match is how I key the two items together(the host to their respective password).

I next set the ansible_password variable for each host based on the password I just looked up. Now, when ansible subsequently attempts to connect to any inventory host it will do so via the password that was just pulled.

Make note that any task that either did the lookup or set the variables also had the no_log option set to true so that the passwords are never exposed in the logging.

Conclusion

The Cyberark per-host lookup process isn’t too difficult, it’s just a slight mind-shift from what we are used to. If you have any questions or comments, please let me know. Thanks and happy automating!

May 24 / Greg

Using Collections With Ansible Tower/Ansible Control

Collections are the new hotness for ansible, so you should start adjusting to it now…that means I’ll have to start converting my playbooks little by little now. That’s because ansible 2.9 allows for both standard modules and collections to work in tandem. So do the thing if you haven’t already.

You have multiple options when trying to install collections into your tower environment, and I’m going to cover a couple here.

Manual collection install

If you are going to manually install these files from the CLI, keep in mind that Tower runs as the AWX user, so you will need to su awx before doing most of these installs.
First you can pull collections straight from Ansible galaxy.

1
ansible-galaxy collection install my_namespace.my_collection

You can also download the archive file and do an offline install:

1
ansible-galaxy collection install my_namespace-my_collection-1.0.0.tar.gz -p ./collections

You can download certified collections via the automation hub(it allows you to grab them as archives right off the cloud.redhat.com site). After that the install process is just the same.

Automatic collection install

The best way to automatically pull collections is via a requirements file.

First, in your git repository(or other SCM system) create a folder called “collections” and add a file inside named “requirements.yml”
So I wanted to dynamically pull the Arista EOS collection so I did it as follows(/collections/requirements.yml):

1
2
3
4
---
collections:
# Install the Arista EOS collection
- arista.eos

Now when I run the playbook it will reach out to the repository in question and pull the content.
Keep in mind that it doesn’t fully install the collection. I can’t create a new repo with playbooks and start using that collection without either a manual install or a requirements file. It’s for this reason that in my lab environment I simply do a manual install so I can use it in all of my playbooks without keeping track.

If you are using certified content and you want to pull directly from the Automation hub, look at this documentation; it walks through the settings required.
In newer versions of Tower/control the “Primary Galaxy Server” options are no longer present and that portion will be completed via custom credentials as shown in this video.
Here’s the screen shots from my machine:
First I created two credentials:

The first connects to the automation hub:

Galaxy Server URL:

1
https://cloud.redhat.com/api/automation-hub/

Auth Server URL:

1
https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token

I then create a credential to connect to the standard public galaxy servers:

I now set the Tower/control server to use these creds:


The order in which you select them is the order in which the server will check for download. In my case I want to ensure that my automation hub link is set first, so it will check there, then fall back to checking galaxy. That means I’ll unselect them both, then add them back in the correct order:

Good luck and happy automating!

May 23 / thebrotherswisp

The Brothers WISP 136 – Network Compliance, Labs, 100Gb Mikrotik

This week we have Greg and Nick A. catching up after skipping an episode…did anyone notice?

**Sponsors**
Sonar.software
Kwikbit.com
Towercoverage.com
**/Sponsors**

This week we talk about:
Network compliance detection/alerting via Ansible
Wispamerica update from anyone that went?
Arista vEOS lab eddition free if you just create a guest account!
Mikrotik home app
MLAG on Mikrotik V7
Router OS 7.1beta6 has included a new model number(supposing it isn’t a joke) crs520-4xs-16xq – 4x 25gbit + 16x 100gbit
John Oz says that HE rebuilds their filters once a day, so you better hope you are advertising at that time LOL
Wonder how hard that would be to do via automation…hmmmm

Here’s the video:(if you don’t see it, hit refresh)