Cisco IQ Link - Install and Configure

Hi everyone, Steve Paul here. I'm a principal architect in Cisco customer experience or CX product management, and I'm part of the team that helps with Cisco IQ. And in today's video I want to walk through showing how to set up IQ link, which is basically our remote appliance or our proxy that bridges connectivity from your premise and the devices on.00:03Your premise that might not be controller managed or if there's controllers on your premise like Catalyst Center or Nexus dashboard, fabric controller, and being able to pull information from those devices and then go send that back to the IQ, the IQ cloud instance. So we're gonna be walking through specifically in this video how to install IQ link.00:23So where to go to download that, how to install the the VM, how to set up the network settings, and then we're gonna walk through the credential management, adding a device, a direct device connection and getting that device discovered through the scheduled process that IQ Link runs.00:41We'll show how you can change how often you want to schedule the ability to go collect information from that device. And then finally I'll walk through some of the just the general settings and Cisco IQ link for you to be aware of. So with that, let's get into it. So there are a couple ways that I can get the IQ link software. The easiest way is to go into system settings here.00:59Go to the software catalog option.01:19And then I presented with the IQ link software that I can download, so I can click details if I want to see some information essentially the release notes for the release, so I can consume that. You can see specifically here we support ESXi, hyper V and KVM currently as virtualization platforms. We are also working.01:21On supporting Nutan access a platform in an upcoming release.01:41So then based off of that I'll click download options and then because this is a greenfield install I don't already have IQ link installed. I'm going to choose installation packages. If I wanted to download the update package, I could download that and that would be helpful if I needed to like sneaker net it over to the appliance, but if the appliance can reach out to the internet, if IQ Link can reach out to the.01:46Internet, IQ Link will be able to update itself and you'll see that later on this video. So I'm gonna choose installation packages and then it's gonna ask me the the hypervisor that I'm gonna use, which for my scenario in my lab, I'm gonna use KVM because I'm I'm running it virtualized within.02:06A Linux server, and then I'm gonna choose the current version which we are currently running one one is the latest release, but 110 is the latest base release that I can install for greenfield. And then once I install, you'll see it'll prompt me to update to 111. So I'm gonna choose this.02:22I'm gonna click download and then it's gonna go and, and then download this file to my desktop, and then I'm going to go follow whatever my process is to take that file and go stick that into my virtualization hypervisor environment to then go get that booted up as a VM.02:39I can also grab the file another way in data connectors when I go and click add Cisco IQ link, presented with this wizard, which we're gonna use in a second, and I can also do the same thing. Choose my hypervisor, my version, click download and get the file there. Okay, so now I'm going to boot up my virtual machine.02:57In my virtualized hypervisor environment, and then when that boots up I can either connect via console or I can SSH into the device if it's able to pull a DHCP address and if I know what address it obtains, then I can SSH into the device.03:13With the username admin and the password of admin and be able to get in that way depending on whether you have DHCP enabled or not at this point. We'll be setting the IP settings through the console or the SSH connection anyway, so if you need to change those at a later point, it's gonna be easy to do that.03:30Okay, so if DHCP pulled an IP address and I know it, I can SSH into the device, log in with admin as a username admin as a password. Otherwise I can pull up my virtualization console and be able to get in that way and log in again with admin and admin.03:51And then I'm going to configure network settings. So I log in, I'm presented with this menu, I'm gonna select one to configure network settings, and now I'm gonna go through and I'm gonna fill out my information here. So I'm gonna fill out an IP address with the subnet mask, the default gateway.04:07And my DNS servers. I'm gonna put in my DNS search domain and the time server, and then I'm also gonna say whether the time server needs authentication or not. And then I'm gonna specify a strong complex password.04:24And then I'm gonna say yes to apply this network configuration and it's gonna go run through this configuration process. This is gonna take about 20 min as it's gonna go pull some information down as it goes and does this. I've sped up this process in this video. I do recommend that you check your network settings and connectivity from this VM out to the device before running.04:42Through the setup process because if you get it wrong, you have to wait ten or 20 min before it gives you feedback that you've got connectivity issues, so it is beneficial if you can to ensure that you've got that information and the reachability is accurate before going through the network configuration wizard.05:01Okay, so when it's done, we can hit enter the return to the main menu or it's gonna confirm the network settings we just configured. You can see up top, we wanna open our browser and navigate to cIQ-infra-host. That's a local URL that we're gonna use to access the web UI now in order to finish the configuration.05:16So I'm gonna hit Q and I'm gonna exit out of this menu and open a web browser. Alright, I'm gonna open in a web browser, that address that we just saw. I'm gonna select my region for IQ link where it needs to register into, and I'm gonna start through this wizard. The 1st thing that's gonna do is.05:32Connectivity check to make sure that IQ link can reach out to the internet to register to the cloud services for IQ once it checks that.05:52Then it's going to present a device ID and a claim code, and we're gonna use those codes to register IQ link to our cloud IQ instance. Okay, so back in the wizard that I pulled up from the data connectors page to add an IQ Link instance, I'm gonna check that I'm ready to pair and install the IQ Link instance.05:59Into my account, and I'm gonna click next. I'm gonna give it a host name so that I can identify inside my IQ account which IQ link instance this is because I can have multiple IQ link appliances registered into.06:17My account and now I'm gonna go take my codes that are available from the IQ link user interface, and I'm going to paste those into my cloud instance configuration.06:33It's gonna say that IQ link has been added. So now I'm gonna switch back over one more time to my IQ link appliance user interface, and you can see that it's just checking network requirements, and then it's asking me if I need to configure internal network, which in most circumstances you can use the default that.06:50Here, you can read the notice around how if you can't use NAT, you might need to manually specify that. And now it's going to go through and complete the installation by standing up some Kubernetes containers.07:09And set up some other information on the server. This process will take roughly about an hour. When you see the loading application screen, this should redirect you to a login page. If you don't see this redirect, make sure that you did access the IQ Link user interface.07:21Through the host name that was provided in the setup instructions and not through the IP address. If you're accessing through the IP address, it'll prevent that redirect from working and you'll have to open a new browser and access via the host name in order to get the login prompt. Okay, so once the installation is finished, I can now go to the URL that was provided in the setup again.07:39Then and it'll prompt me with the login screen to log into the local IQ link web browser.07:59So that username is always gonna be admin admin for the username and then the password's gonna be whatever I set up earlier in the command line setup wizard. So I want to go put my credentials in and log in to IQ link. Alright, so I can see if I'm interested in release notes, I can consume the release notes of IQ link here.08:04So talking about the initial capabilities, and if you want to get more detailed documentation, you can pull down this operations guide as well. And then this is a PDF that has a bunch more information in this, so this is way more extensive than the Getting started guide is. So once you're able to install and get to the web browser.08:24Now you can understand how to go and add your devices, but I'll walk you through some of this in a second. Just wanted you to be familiar with how to go get this documentation once you get the, the appliance installed. Okay, so to add devices, we're gonna go over into our system settings on IQ link.08:45And you can see we've got this connection management page and there's a few things that we can do here. The 1st thing I'm gonna do is set up my credentials. So I'm gonna go to add credentials, and I'm going to add.09:01I'm gonna add SNMP V two and I'm gonna add SSH to this credential, and to keep things easy, I'm gonna have Cisco as a community string for my lab, and then for SSH, again, I have Cisco and Cisco.09:16And I've got level 15 access on this user, so I don't need to set enable the username and password, but if you have different levels to get into the router and then to elevate to level to execute privileges, at level 15, you might need to set a separate enable username and password.09:33That's gonna be good enough for me for my lab, so, and then I'm going to apply this to every IP address in the range. Now, if I had certain devices, I could specifically include the IP range of the devices that this credential is particularly applied for.09:51In my lab, everything's gonna follow that same credential. So I'm just going to say, ok, any IP address on any device, go use these credentials. But if it was split up, you would specify this accordingly and then specify either the discrete IPs comma separated or or specify this range accordingly.10:08So I'm gonna hit save. Now my credentials in there. Okay, so now I'm gonna go add my devices in. I wanna go back to connections to do this and go to direct connection because I'm gonna talk directly to the devices. You can see that's it's reminding me to add credentials already if I haven't yet, but I have, so I'm gonna close that.10:26And I could download the template if I wanted to. You could see downloaded a CSV file, and then I could go fill out that template and then I could go upload that. So if I'm uploading a bunch of devices, that's the process I'd likely follow, and then I could like export an asset inventory from my CMDB, maybe ServiceNow or something like that or netbox, and then.10:44Sanitize that into that CSV format and go upload that. But here I'm working with a lab. I've just got three routers I'm gonna go add in. So I'm gonna go add these devices in, and this is gonna be in a comma separated format, and I've got three routers here. Alright, so I've added my three devices.11:05And now it's going through and trying to reach out to these devices and discovering them. If you want to add devices that are controlled through Catalyst Center, through IQ Link, you use this option right here and you put in your IP address of Catalyst Center.11:23And then you'd select your credential that you've defined. And you can see that only HTTP credentials are supported for Catalyst Center, so let's go over the credentials section and show you, I would create a catalyst center, credential, and then you'd select HTTP.11:40HTTPS and then you put in the basic HTTP authentication, so this is gonna be your system username and password for catalyst center and then it'll authenticate to catalyst center's rest API and get a token back from that username and password session, and then it'll use that token with the API calls. So it's just a matter of putting these credentials in.11:58And then, and then you'd on the next screen, so I'll just, you know, let's say it's admin. And then on the next screen, you'd go and put in your catalyst center IP, so whatever that is, and then when you go into your connections.12:17You'll go in and put in your catalyst center IP, whatever I forget what address I put in there before, but make sure that it matches on the previous screen and then you match your your catalyst center credential, and then you'd have that set up and then you'd see that instant show showing here.12:33And then you can see, you'll see these device this device count. Of course, this isn't a real catalyst center IP. I'm just demonstrating how you set that up, but then otherwise, the device sync and all that information will flow just like it will with the direct connection that we demonstrated this video. While I wait for my devices to get discovered and.12:49To pull information. Let me walk through some stuff that we can also do in the rest of the IT link user interface. So we've got our activity and audit logs here. If you need some traceability around like who's accessing the system and stuff like that, you've got some basic logs that you can review here. And then in the system configuration, we've got a bunch of settings that I can walk through.13:08If you needed to, you could define a banner and have a banner pop up on IQ link. So if you have some people logging into IQ Link, but maybe you're planning to take a maintenance and push an update to IQ link, you could go put a banner up or you could just have like a terms of use banner up nailed over the top.13:27If you need to do that from a compliance perspective. You also configure an identity provider instead of using local administrator accounts on IQ Link, you want to integrate it in with single sign on, you've got the ability to go do that, so you could go and add your identity provider in and then walk through the configuration to go and do that.13:43We can also take a look at our IQ connectivity. You can see here that I'm registered to a demo account we've got on Cisco IQ and you can see who registered the account in, which was me. If you registered through a proxy or if a proxy settings changed, you can go to connectivity settings and then you can define the proxy settings and the authentication settings for that.14:00If those change at some point in the future. If you need to change your password, you can do it here in the local admin security and then you can also set up security questions in case you need recovery assistance for forgetting your password in the future. We can also reconfigure the NTP servers that we defined during the IQ link setup. So if I need to change those, this is where I do that.14:18Also, we can point IQ Link to an external SCP server, so if you want to host your update files for IQ link over on another server, this is where you go to go put that external information in, and then when you go and update IQ link, it'll use that SCP server to go pull that file across. We can also sign and apply certificates on the device. So by default it's gonna use a self signed certificate.14:38That you're gonna have to accept when you access the webpage. So if you've got a signed certificate from a trusted CA in your enterprise and you want to apply that to IQ Link to get rid of that certificate trust warning, every time you log in, this is the place you'll go to go do that.14:58So you can generate this signing request and then you can upload the certificate here. If for compliance reasons, you need to take the logs that are showing up on IQ link and deliver those to an external syslog server that might be collecting your audit and compliance information, then you can, you can add up the two syslog servers that we can.15:12We can send the logs from my quelink downstream to another syslog listening service, so we would just put in.15:32That's syslog information and then those logs would get streamed over to it. And then finally in system management, you can see some information here. You can see it actually picked up an update. We released a couple of days ago, 1.1 .1 version, so it's a patch from the 1.1 point oh base release that I installed and I'm currently running. So if you pull down the install, it's gonna check for an update and you can.15:37See that it scheduled the update. I can change when I want the update to happen.15:57I could say update later and then I can schedule this to maybe go and do an update tonight, so I'm gonna go and just specify for this to go at, let's do it at 10:00 P.M. at night So now that'll be scheduled and then that should take that update. You can see that it's scheduled about a month in advance by default.16:02Pull that update window in. And I can specify a maintenance window so I could say well maybe every Friday, so if I say 09:00 P.M. on Fridays, we'll authorize that and then if another patch gets applied in the future, it'll go and push it during my authorized maintenance window, so you'd set that for a time that it's quietest for your network.16:22Alright, so let's go back and take a look at our asset discovery status.16:42Okay, so now if I go back into my assets table, I can see that the discovery looks good. I've got this nice blue check mark around these assets. If they're doing discovery, I'll just go ahead and do a rediscovery on one. You'll see this purple ellipsis if it's in process. And then if the discovery fails for some reason, you'll see a warning icon, you'll see maybe an amber exclamation point if it's got partial access, if it's on.16:47Able to connect via SNMP basically through the credentials that I've defined, then it'll give you a warning error and then you can make sure that you've got the right configuration on the device. You can consult the operations guide for more information around the device configuration.17:07And how to set those up, but in our case, if I refresh this page, that discovery should have gone through and everything should be back to a blue check mark, which it is. So we're looking good. Let's go over to the main IQ account and see if our assets are showing up over there now.17:19Okay, so once I give it a minute for the device inventory to sync as well as to reach out to the devices and go grab their configuration information, IQ link should start stashing those assets up into the inventory page. So you can see here I've got.17:35This router that it discovered. So this is my router one where we added that 198-18-1101 device, you can see that's now in there. It's pulling the active software release. You can see that as of today, it pulled active telemetry and you can see that the source is from Cisco IQ. So everything on this device from this year, this point forward would be congruent with the capabilities that we talked.17:51About other videos for Cisco IQ. So I can see here software life cycle information as well as my product alerts, and I can go to assessments and maybe we'll go to findings by asset, and then we'll see what findings we have on this device.18:11And you can see that it found some security advisories that have exposure and confirming that this device, that this vulnerability specifically affected based off the configuration that's able to pull, it was able to see that this one has exposure as well as.18:30Some field notices that are potentially affected as well.18:47