How to connect from ydk-py to Cisco CSR 1000v deployed on EC2 NETCONF sessions

Question

I'm running docker Yang Development Kit for python ydk-py in my remote server Linux Ubuntu. I would like to Establish a connection using the following command in there.

(ydk-py)samples$ ./bgp.py --host <ip-address-of-netconf-server> -u <username> -p <password> --port <port-number>

Where the host is an EC2 instance in AWS. I used to access in EC2 instance via ssh from my machine, where I got the downloaded ssh key.

The following parameters are known --host <ip-address-of-netconf-server> -u <username> but how can I get the password and the port?

In an another word, how to establish NETCONF sessions remove server to Cisco CSR 1000v using the downloaded RSA key?

Answer 1

Oaky, I'm going to have a stab at an answer. This might not get you all the way but hopefully it's a starting point.

EC2

I think the problem you are actually facing is AWS require you to authenticate to your v1000 instance with a key, but YDK is built with password authentication in mind. You could try to hack the instance and enable password authentication, but I wouldn't say this is preferable.

Looks like Netconf runs on port 830 but all the AWS guides that touch on SSH access refer to shelling into the linux instance itself, unless I've misunderstood.

Cisco's guide has a section on Connecting to the CSR 1000v Instance using SSH:

The Cisco CSR 1000v instance on AWS requires SSH for console access. To access the Cisco CSR 1000v AMI, perform the following steps [snip]

ssh -i pem-file-name ec2-user @[public-ipaddress | DNS-name ]

This doesn't mention anything about port 830

Configuring the keys for this, which is mentnioned earlier in the guide, sounds similar to setting up keys for any EC2 linux instance, and should probably work with an IAM user for that purpose as you mention.

YANG

I've searched all around for information on ydk-py and key authentication but found nothing. There is some mention of keys, but usually for accessing the system which hosts ydk-py not the connection to the Cisco box.

However the repo you linked appears to be using ydk.providers.NetconfServiceProvider which is a Python wrapper for C++ NetconfServiceProvider. According to this link, keys are supported:

• private_key_path – (str) Path to private key file. Requires public_key_path field. Doesn’t allow password field.
• public_key_path – (str) Path to public key file. Requires private_key_path field. Doesn’t allow password field.

Let's have a look at how bgp.py implements this. It's actually in the file session_mgr.py. This code processes the arugments you pass on the command line:

    parser = OptionParser(usage, formatter=HelpFormatterWithLineBreaks())
    parser.add_option("-v", "--version", dest="version",
                      help="force NETCONF version 1.0 or 1.1")
    parser.add_option("-u", "--user", dest="username", default="admin")
    parser.add_option("-p", "--password", dest="password", default="admin",
                      help="password")
    parser.add_option("--proto", dest="proto", default="ssh",
                      help="Which transport protocol to use, one of ssh or tcp")
    parser.add_option("--host", dest="host", default="localhost",
                      help="NETCONF agent hostname")
    parser.add_option("--port", dest="port", default=830, type="int",
help="NETCONF agent SSH port")

Then just below, an instance is created.

ne = NetconfServiceProvider(address=o.host,
                            port=o.port,
                            username = o.username,
                            password = o.password,
                            protocol = o.proto)

So at this stage you could try passing in private_key_path set to the PEM file of your AMI user.

However this then raises the question: why the default port 830? It seems this might be a separate keypair from what was set up previously. Or maybe I'm not understanding. Is the shell access granted to the AMI image actually netconf with keys? Perhaps someone with more Cisco knowledge could contribute to this.

Searching for documenation on changing the netconf credentials on this AWS version of CSRV1000 doesn't bring up much either. As I mentioned in the comments, there is a guide which suggests the combo is cisco1/cisco1.

Not a full solution but hopefully this is of some assistance.

Answer 2

I have managed to find the solution.

In the router:

(config)#user any-user-name privilege 15 secret supersecretpassword

Then, it worked! Thanks to anyone who tried to help :)