Network services (DNS, syslog, SNMP, NTP...)

[ipspace]

The "add a generic network services module" idea has been on my backburner for at least a year (probably much longer), and now @snuffy22 gave me the much-needed kick in the **** ;)

The "only" question is the data model:

• I would go for a single "service" module (having a separate module for each tiny service seems a bit of an overkill)
• Do have have a top-level property for each service (dns, syslog, ntp...) or do we have services.dns, services.syslog? I'll assume the second approach for the rest of this dump-of-thoughts, but have no opinion either way.
• On the client side, it seems to make most sense to configure services.dns.server to be the node ID of the DNS server (resolved into ipv4 and ipv6 keywords that could also be specified manually) and then use things like services.dns.domain and services.dns.vrf (for VRF-based DNS servers)

However, how do we specify that a device is a DNS server? Do we use services.server list to list the services we want to have running on the node? For example, services.server: [ dns, ntp ]?

Finally, I love the @sdargoeuves idea of running DNS (as well as syslog) servers as tools. With the right magic (not there yet), enabling the DNS tool could add services.dns.ipv4 and services.dns.vrf entries to the node data (and likewise for syslog).

Feedback (as always) is highly appreciated! /cc @DanPartelly @sdargoeuves @snuffy22 @jbemmel @ssasso

[DanPartelly]

Im Ok with the schema you proposed, including services.server: [ dns, ntp ]

One observation: syslog should use an optional per-lab RW bind mount to save the logs and reuse them, at least as a clab provider feature.
a bool - services.syslog.persist_logs - should turn the feature on/off.

I know this is not really services related, but I really want scappy with the ability to set a interface and replay a capture, and be driven by a python scriptlet.

[ipspace]

Im Ok with the schema you proposed, including services.server: [ dns, ntp ]

This will have to be turned into a dictionary

One observation: syslog should use an optional per-lab RW bind mount to save the logs and reuse them, at least as a clab provider feature. a bool - services.syslog.persist_logs - should turn the feature on/off.

Absolutely no problem with that. Mapping a local file to the logging destination should do the trick. However, as this needs to be configured on the server, it should be services.server.syslog.persist_logs

I know this is not really services related, but I really want scappy with the ability to set a interface and replay a capture, and be driven by a python scriptlet.

You're a tool definition away from having it ;)) Look at how @ubaumann implemented the NUTS tool

[sdargoeuves]

I have no strong opinion on the schema we could/should use for defining those services.
I'm trying to get my head around how it could work:

• Syslog:
  • client: configure devices to send their logs to a server (host, vrf, protocol, port, origin-id...)
  • server: tool creating a syslog receiver (i.e. Loki, Splunk, ELK...)
• NTP:
  • client: configure the ntp server (vrf, source-intf, version...)
  • server: tool creating an NTP server
• SNMP
  • client: configure the snmp server (community, contact, location, source-intf, vfr, host, traps, version, users, view, group...)
  • server: tool creating an SNMP receiver
• DNS
  • client: configure the dns stuff (server, domain, source-intf, vrf...)
  • server: tool creating a DNS server (what are the IPs we should collect from the netlab files: devices mgmt IP, loopback, 'dataplane' server/clients IPs...

If we are using the tool mechanism to create a docker image outside of netlab (like graphite or suzieQ), is there a way of knowing what IP it will have, so we can configure the right syslog/ntp/dns during the lab creation?

[ipspace]

I have no strong opinion on the schema we could/should use for defining those services. I'm trying to get my head around how it could work:

You got it.

If we are using the tool mechanism to create a docker image outside of netlab (like graphite or suzieQ), is there a way of knowing what IP it will have, so we can configure the right syslog/ntp/dns during the lab creation?

Yes. Container IPs can be static. However, I'm not sure we have the information right now, so I'll start with an in-lab implementation first.

[sdargoeuves]

I was curious what AI would generate if I ask nicely to define a data model for those networks services. Each one seems to be its own can of worms🪱!!

# =============================================================================
# Network Services Configuration
# Common management services: Syslog, NTP, SNMP, DNS
#
# Field naming borrowed from ietf-system (RFC 7317), ietf-syslog (RFC 9742),
# ietf-snmp (RFC 7407) and openconfig-system, flattened for practical use.
#
# Inheritance rule: service-level vrf / source_interface / source_address are
# defaults; any server/target may override them. `null` = inherit.
# Port defaults are per-transport (see comments) and only needed if overridden.
# =============================================================================

network_services:

  # ---------------------------------------------------------------------------
  syslog:
    enabled: true
    origin_id:                     # how this device identifies itself in msgs
      type: hostname               # hostname | ip | string
      value: null                  # required iff type: string, else must be null
                                   # NB: custom string not supported on all vendors (Junos/EOS)
    facility_default: local7
    # service-level defaults
    vrf: MGMT
    source_interface: Loopback0
    source_address: null
    servers:
      - address: 10.0.0.10
        transport: udp             # udp | tcp | tls
        port: 514                  # default 514 (udp/tcp), 6514 (tls)
        facility: local7
        severity: informational    # emergency..debug
        structured_data: false     # true -> RFC 5424 format, false -> RFC 3164
        vrf: null                  # inherit MGMT
        source_interface: null     # inherit Loopback0
        source_address: null
      - address: logs.your.domain
        transport: tls
        port: 6514
        facility: local7
        severity: warning
        structured_data: true
        vrf: MGMT
        source_interface: Loopback0
        source_address: null

  # ---------------------------------------------------------------------------
  ntp:
    enabled: true
    vrf: MGMT
    source_interface: Loopback0
    source_address: null
    servers:
      - address: pool.ntp.org
        association_type: pool     # server | peer | pool
        port: 123
        prefer: false
        key_id: null               # auth key reference, if configured
        vrf: null
        source_interface: null
        source_address: null
      - address: 10.0.0.5
        association_type: server
        port: 123
        prefer: true
        key_id: 1
        vrf: MGMT
        source_interface: Loopback0
        source_address: null

  # ---------------------------------------------------------------------------
  snmp:
    enabled: true
    engine_id: null
    location: "DC1 - Rack A12"
    contact: "netops@your.domain"
    vrf: MGMT
    source_interface: Loopback0
    communities:
      - name: public
        access: read-only          # read-only | read-write
    users:                         # SNMPv3 (USM); empty if only v1/v2c
      - name: netops
        auth_protocol: sha         # md5 | sha | sha256 | ...
        priv_protocol: aes         # des | aes | aes256 | ...
        security_level: authPriv   # noAuthNoPriv | authNoPriv | authPriv
    # target security binding is mutually exclusive:
    #   version v1/v2c -> community required, user must be null
    #   version v3     -> user required, community must be null
    targets:                       # trap / inform receivers
      - address: 10.0.0.20
        transport: udp             # udp | tls | dtls | ssh
        port: 162                  # 162 traps/informs (161 = polling)
        type: trap                 # trap | inform
        version: v2c               # v1 | v2c | v3
        community: public          # for v1/v2c
        user: null                 # for v3
        vrf: null
        source_interface: null
      - address: 10.0.0.21
        transport: udp
        port: 162
        type: inform
        version: v3
        community: null
        user: netops
        vrf: MGMT
        source_interface: Loopback0

  # ---------------------------------------------------------------------------
  dns:
    enabled: true
    vrf: MGMT
    source_interface: Loopback0
    source_address: null
    search_domains:
      - your.domain
      - corp.your.domain
    servers:
      - address: 10.0.0.53
        transport: udp             # udp | tcp | tls (DoT)
        port: 53                   # default 53 (udp/tcp), 853 (tls / DoT)
        vrf: null
      - address: 10.0.0.54
        transport: tls             # DoT: modern firewalls; needs fallback on legacy routers
        port: 853
        vrf: MGMT