Step 1

Install a supported version of VMware ESXi on the machine you plan to use as the Crosswork server.

Step 2

From Cisco Software Central, download the latest version of the Cisco Crosswork platform image file to a storage location on the same system: cnc-advantage-single-node-deployment-7.1.0-48.ova.

Step 3

With VMware ESXi running, log into the VMware vSphere Web Client. On the left navigation pane, choose the ESXi host where you want to deploy the VM.

Step 4

In the vSphere UI, go to Host > Configure > Networking > Virtual Switches and select the virtual switch for the Management Network that will be used to access the UI of the VM. In the virtual switch, select Edit > Security, and configure the following DVS port group properties:

Step 5

Review and confirm that your network settings meet the requirements.

Step 6

Choose Actions > Deploy OVF Template.

Step 7

The VMware Deploy OVF Template window appears, with the first step, 1 - Select an OVF template, highlighted. Click Choose Files to navigate to the location where you downloaded the OVA image file and select it. Once selected, the file name is displayed in the window.

Step 8

Click Next. The Deploy OVF Template window is refreshed, with 2 - Select a name and folder now highlighted. Enter a name and select the respective data center for the Cisco Crosswork VM you are creating.

Step 9

Click Next. The Deploy OVF Template window is refreshed, with 3 - Select a compute resource highlighted. Select the host for your Cisco Crosswork VM.

Step 10

Click Next. The VMware vCenter Server validates the OVA. Network speed will determine how long validation takes. After the validation is complete, the Deploy OVF Template window is refreshed, with 4 - Review details highlighted.

Step 11

Review the OVF template that you are deploying. This information is gathered from the OVF, and cannot be modified.

Step 12

Click Next. The Deploy OVF Template window is refreshed, with 5 - License agreements highlighted. Review the End User License Agreement and if you agree, click the I accept all license agreements checkbox. Otherwise, contact your Cisco Experience team for assistance.

Step 13

Click Next The Deploy OVF Template window is refreshed, with 6 - Configuration highlighted. Choose the desired deployment configuration.

Step 14

Click Next. The Deploy OVF Template window is refreshed, with 7 - Select Storage highlighted. Choose the relevant option from the Select virtual disk format drop-down list. From the table, choose the datastore you want to use, and review its properties to ensure there is enough available storage.

Note

For production deployment, choose the Thick Provision Eager Zeroed option because this will preallocate disk space and provide the best performance. For lab purposes, we recommend the Thin Provision option because it saves disk space. Crosswork does not support the 2TB option for single VM installations.

Step 15

Click Next. The Deploy OVF Template window is refreshed, with 8 - Select networks highlighted. From the Destination Network drop-down list, select the proper networks for the Management Network and the Data Network.

Step 16

Click Next. The Deploy OVF Template window is refreshed, with 9 - Customize template highlighted.

1. Expand the Management Network settings. Provide information for the IPv4 and/or IPv6 deployment (as per your selection) such as IP address, IP netmask, IP gateway, virtual IP address, and virtual IP DNS name.

2. Expand the Data Network settings. Provide information for the IPv4 and/or IPv6 deployment (as per your selection) such as IP address, IP netmask, IP gateway, virtual IP address, and virtual IP DNS name.

3. Expand the Deployment Credentials settings. Enter relevant values for the VM Username and Password.

   Note

   Avoid using passwords that resemble dictionary words (for example, 'Pa55w0rd!') or easily guessable patterns. While such passwords might meet the initial criteria, they are considered weak and could cause the VM setup to fail without a clear explanation. To ensure a successful installation, use a complex password with a minimum of 8 characters that combines uppercase and lowercase letters, numbers, and special characters in a non-predictable sequence.

4. Expand the DNS and NTP Servers settings. According to your deployment configuration (IPv4 and/or IPv6), the fields that are displayed are different. Provide information in the following three fields:

   • DNS IP Address: The IP addresses of the DNS servers you want the Cisco Crosswork server to use. Separate multiple IP addresses with spaces.

   • NTP Servers: The IP addresses or host names of the NTP servers you want to use. Separate multiple IPs or host names with spaces.

   • DNS Search Domain: The name of the DNS search domain.

   • Timezone: Enter the timezone details. Default value is UTC.

   Note	The DNS and NTP servers must be reachable using the network interfaces you have mapped on the host. Otherwise, the configuration of the VM will fail.

5. Expand the Disk Configuration settings. Provide relevant values for these fields:

   • Logfs Disk Size

   • Datafs Disk Size

   • Corefs Partition Size

   • High Speed Disk Size

   • Minium backup partition size

   The default disk configuration settings should work for most environments. Change the settings only if you are instructed to by the Cisco Customer Experience team.

6. Expand Crosswork Configuration and enter your legal disclaimer text (users will see this text if they log into the CLI).

7. Expand Crosswork Cluster Configuration. Provide relevant values for these fields:

   • VM Type: Choose Hybrid.

   • Cluster Seed node: Choose True.

   • Crosswork Management Cluster Virtual IP: Enter virtual IP of the management network.

   • Crosswork Management Cluster Virtual IP Name: Enter DNS hostname of virtual IP interface of the management network.

   • Crosswork Data Cluster Virtual IP: Enter virtual IP of the data network.

   • Crosswork Data Cluster Virtual IP Name: Enter DNS hostname of virtual IP interface of the data network.

   • Initial hybrid node count: Set to 1.

   • Initial total node count: Set to 1.

   • Location of VM: Enter the geographical location of VM.

   • Disclaimer: Enter your legal disclaimer text (users will see this text if they log into the CLI).

   • Installation type: Not applicable to single VM deployment. Do not select any checkbox.

   • Enable Skip Auto Install Feature: Set to True.

   • Auto Action Manifest Definition: Use the default value (Empty).

   • Product specific definition: Enter the product specific definition.

   • Ignore Diagnostic Failure?: Use the default value (False).

Step 17

Click Next. The Deploy OVF Template window is refreshed, with 10 - Ready to Complete highlighted.

Step 18

Review your settings and then click Finish if you are ready to begin deployment. Wait for the deployment to finish before continuing. To check the deployment status:

1. Open a VMware vCenter client.

2. In the Recent Tasks tab of the host VM, view the status of the Deploy OVF template and Import OVF package jobs.

Step 19

Once the deployment is completed, right-click on the VM and select Edit Settings. The Edit Settings dialog box is displayed. Under the Virtual Hardware tab, update these attributes:

Step 20

Power on the Crosswork VM. To power on, expand the host’s entry, click the Cisco Crosswork VM, and then choose Actions > Power > Power On.

Step 1

In your Docker-capable machine, create a directory where you will store everything you will use during this installation.

Step 2

From https://software.cisco.com/download/home, download the Crosswork platform installer bundle (.tar.gz) and OVA image file to the directory you created previously: CW-CWM-Solutions-Advantage-2.0.0-14-SVM-7.1.0-48-ova.signed.bin.

Step 3

Use the following command to extract the installer bundle:

tar -xvf cnc-advantage-single-node-docker-deployment-7.1.0-48.tar.gz

Step 4

Review the contents of the README file to understand everything that is in the package and how it will be validated in the following steps.

Step 5

If you don't already know the version of python installed on your workstation, use the following command to detect it: python --version

Step 6

Use the following command to verify the signature of the installer image:

python cisco_x509_verify_release.py -e filename.cer -i filename.tar.gz -s Signaturefilename.tar.gz
-v dgst -sha512

python3 cisco_x509_verify_release.py3 -e filename.cer -i filename.tar.gz -s Signaturefilename.tar.gz
-v dgst -sha512

Step 7

Use the following command to load the installer image file into your Docker environment.

docker load -i filename.tar.gz

docker load -i cw-na-cnc-advantage-svm-installer-7.1.0-48-releasecnc710-250606.tar.gz

Step 8

Run the Docker image list or Docker images command to get the "image ID" (which is needed in the next step).

docker images

My Machine% docker images
REPOSITORY                        TAG                                                     IMAGE ID       CREATED        SIZE
dockerhub.cisco.com/cw-installer  cw-na-cnc-advantage-svm-7.1.0-48-releasecnc710-250606   a4570324fad30  7 days ago     276MB

Step 9

Launch the Docker container using the following command:

docker run --rm -it -v `pwd`:/data image id of the installer container

docker run --rm -it -v `pwd`:/data a4570324fad30

% docker run --rm -it -v `pwd`:/data a45
docker: invalid reference format: repository name must be lowercase.
See 'docker run --help'

docker: Error response from daemon: Mounts denied: approving /Users/Desktop: file does not exist
ERRO[0000] error waiting for container: context canceled

Step 10

Navigate to the directory with the VMware template:

Step 11

Copy the template file found under /opt/installer/deployments/7.1.0/vcentre/deployment_template_tfvars to the /data folder using a different name.

Step 12

Using a text editor of your choice, open the template file you copied to the /data directory and edit it to match the properties for your planned deployment.

Cw_VM_Image = ""    # Line added automatically by installer.
ClusterIPStack        = "IPv4"
ManagementVIP         = "10.78.103.198"
ManagementIPNetmask   = "255.255.255.0"
ManagementIPGateway   = "10.78.103.1"
DataVIP               = "192.168.100.198"
DataIPNetmask         = "255.255.255.0"
DataIPGateway         = "0.0.0.0"
DNS                   = "72.163.128.140"
DomainName            = "cisco.com"
CWPassword            = "*****!"
VMSize                = "XLarge"
NTP                   = "ntp.esl.cisco.com"
Timezone              = "America/Los_Angeles"
EnableSkipAutoInstallFeature = "True"
CwVMs = {
    "0" = {
      VMName              = "SVM198",
      ManagementIPAddress = "10.78.103.197",
      DataIPAddress       = "192.168.100.197",
      NodeType            = "Hybrid"
    }
}
VCenterDC = {
  VCenterAddress = "10.64.80.220",
  VCenterUser = "vcenterUsername",
  VCenterPassword = "vCenterPassword",
  DCname = "Crosswork-Single-VM",
  MgmtNetworkName = "VM Network",
  DataNetworkName = "CW-7.1-VLAN21",
  VMs = [
      {
        HostedCwVMs = ["0"],
        Host = "10.78.103.62",
        Datastore = "5.2TB-SSD-62-2",
        HSDatastore="5.2TB-SSD-62-2"
      }
  ]
}
SchemaVersion = "7.1.0"

Step 13

From the /opt/installer directory, run the installer.

./cw-installer.sh install -m /data/template file name -o /data/filename.ova

./cw-installer.sh install -m /data/deployment.tfvars -o /data/cnc-advantage-single-node-deployment-7.1.0-48.ova

Step 14

The installer will display the End User License Agreement (EULA). Read, and then enter "yes" if you accept the EULA. Otherwise, exit the installer and contact your Cisco representative.

Step 15

When prompted, enter "yes" to begin the installation operation.

Step 16

To track creation of the VM and success of the installation, follow the steps in Monitor Crosswork Server Activation.

Step 17

When the installation operation exits, confirm the successful installation or re-run a failed installation, as follows:

Warning: Line 119: No space left for device '8' on parent controller '3'.
Warning: Line 114: Unable to parse 'enableMPTSupport' for attribute 'key' on element 'Config'.

cw_vms = .......
INFO: Copying day 0 state inventory to CW
INFO: Waiting for deployment status server to startup on ip address. Elapsed time 0s, retrying in 30s
Crosswork deployment status available at http://ipaddress:30602/d/NK1bwVxGk/crosswork-deployment-readiness?orgId=1&refresh=10s&theme=dark 
Once deployment is complete login to Crosswork via: https://ipaddress:30603/#/logincontroller 
INFO: Cw Installer operation complete.

Step 1

Prepare a config IOS file ovf-env.xml) to use when installing the Crosswork VM.

<Environment
     xmlns="http://schemas.dmtf.org/ovf/environment/1"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:oe="http://schemas.dmtf.org/ovf/environment/1"
     xmlns:ve="http://www.vmware.com/schema/ovfenv"
     oe:id=""
   <PlatformSection>
      <Kind>KVM</Kind>
      <Version>7.1.0</Version>
      <Vendor>KVM</Vendor>
      <Locale>en</Locale>
   </PlatformSection>
    <PropertySection>
         <Property oe:key="CWPassword" oe:value="**********"/>
         <Property oe:key="CWUsername" oe:value="cw-admin"/>
         <Property oe:key="ClusterCaKey" oe:value=""/>
         <Property oe:key="ClusterCaPubKey" oe:value=""/>
         <Property oe:key="CwInstaller" oe:value="False"/>
         <Property oe:key="DNSv4" oe:value="171.70.168.183"/>
         <Property oe:key="DNSv6" oe:value="::0"/>
         <Property oe:key="DataIPv4Address" oe:value="192.168.5.48"/>
         <Property oe:key="DataIPv4Gateway" oe:value="192.168.5.1"/>
         <Property oe:key="DataIPv4Netmask" oe:value="255.255.255.0"/>
         <Property oe:key="DataIPv6Address" oe:value="::0"/>
         <Property oe:key="DataIPv6Gateway" oe:value="::1"/>
         <Property oe:key="DataIPv6Netmask" oe:value="64"/>
         <Property oe:key="DataPeerIPs" oe:value=""/>
         <Property oe:key="DataVIP" oe:value="192.168.5.51"/>
         <Property oe:key="DataVIPName" oe:value=""/>
         <Property oe:key="Deployment" oe:value="cw_ipv4"/>
         <Property oe:key="Disclaimer" oe:value="Cisco Crosswork"/>
         <Property oe:key="Domain" oe:value="cisco.com"/>
         <Property oe:key="EnableSkipAutoInstallFeature" oe:value="True"/>
         <Property oe:key="EnforcePodReservations" oe:value="True"/>
         <Property oe:key="IgnoreDiagnosticsCheckFailure" oe:value="True"/> 
         <Property oe:key="InitMasterCount" oe:value="1"/>
         <Property oe:key="InitNodeCount" oe:value="1"/>
         <Property oe:key="IsSeed" oe:value="True"/>
         <Property oe:key="K8Orch" oe:value=""/>
         <Property oe:key="K8sPodNetworkV4" oe:value="10.244.0.0"/>
         <Property oe:key="K8sServiceNetworkV4" oe:value="10.96.0.0"/>
         <Property oe:key="ManagementIPv4Address" oe:value="10.19.70.148"/>
         <Property oe:key="ManagementIPv4Gateway" oe:value="10.19.70.1"/>
         <Property oe:key="ManagementIPv4Netmask" oe:value="255.255.255.0"/>
         <Property oe:key="ManagementIPv6Address" oe:value="::0"/>
         <Property oe:key="ManagementIPv6Gateway" oe:value="::1"/>
         <Property oe:key="ManagementIPv6Netmask" oe:value="112"/>
         <Property oe:key="ManagementVIP" oe:value="10.19.70.151"/>
         <Property oe:key="ManagementVIPName" oe:value=""/>
         <Property oe:key="ManagerPeerIPs" oe:value=""/>
         <Property oe:key="NTP" oe:value="ntp.esl.cisco.com"/>
         <Property oe:key="Timezone" oe:value="US/Pacific"/>
         <Property oe:key="VMLocation" oe:value="default"/>
         <Property oe:key="VMType" oe:value="Hybrid"/>
         <Property oe:key="bckup_min_percent" oe:value="35"/>
         <Property oe:key="corefs" oe:value="18"/>
         <Property oe:key="ddatafs" oe:value="485"/>
         <Property oe:key="logfs" oe:value="20"/>
         <Property oe:key="ramdisk" oe:value="0"/>
         <Property oe:key="ssd" oe:value="15"/>
         <Property oe:key="VMSize" oe:value="XLarge"/>
         <Property oe:key="ThinProvisioned" oe:value="False"/>
         <Property oe:key="UseNonDefaultCalicoBgpPort" oe:value="False"/>
         <Property oe:key="bootOptions.efiSecureBootEnabled" oe:value="True"/>
   </PropertySection>
</Environment>

Step 2

Update the ovf-env.xml file you created using the parameter values you gathered for your KVM deployment (see General parameters).

$ cat ovf-env.xml

Step 3

Generate the ISO file.

$ mkisofs -R -relaxed-filenames -joliet-long -iso-level 3 -l -o cnc1.iso ovf-env.xml

Step 4

From https://software.cisco.com/download/home, download the latest version of the Cisco Crosswork platform qcow2.tar.gz file to a storage location on your KVM host: CW-CWM-Solutions-Advantage-2.0.0-14-SVM-7.1.0-48-qcow2.signed.bin.

Step 5

Extract the tar.gz file using the following command:

tar -xvf cnc-advantage-single-node-deployment-7.1.0-48-qcow2.tar.gz

Step 6

Navigate to the required installation folder and create three disks.

cd cnc1/
qemu-img create -f qcow2 disk3 20G
qemu-img create -f qcow2 disk4 485G
qemu-img create -f qcow2 disk6 15G

ls -1
cw_dockerfs.vmdk.qcow2
cw_extrafs.vmdk.qcow2
cw_rootfs.vmdk.qcow2
disk3
disk4
disk6

Step 7

Install the Crosswork VM using either network bridge or SRIOV.

Step 8

To track creation of the VM and success of the installation, follow the steps in Monitor Crosswork Server Activation.

Step 1

On a remote host accessible by HTTP, HTTPS or SCP from your Crosswork VM host, create a storage directory to contain the download you will use in this procedure.

Step 2

From https://software.cisco.com/download/home, download to the remote host the Cisco Crosswork Workflow Manager Advantage Platform Deployment file appropriate for the VM deployment you chose:

Step 3

Use the following command to extract the tar.gz installer bundle from the appropriate signed.bin file:

sh CW-CWM-Solutions-Advantage-2.0.0-14-SVM-7.1.0-48-ova.tar.gz

sh CW-CWM-Solutions-Advantage-2.0.0-14-SVM-7.1.0-48-qcow2.tar.gz

Step 4

Log in to Crosswork using an admin ID and select Administration > Crosswork Manager > Application Management.

Step 5

Click Add new file and select Upload CAPP file (.tar.gz).

Step 6

Using the Add File (.Tar.Gz) page, first select the Protocol you want to use to add the CWM CAPP file to the system. Then:

1. If you selected URL: Enter the URL for the remote host where the CAPP file is stored (including the path to the tar.gz file), as shown in the following figure. If the Basic Auth checkbox is selected, enter the Username and Password needed to access the remote host.

2. If you selected SCP: Enter the file's Server path/Location on the remote host, the remote host server's Host name/IP address, the Port, and the login Username and Password.

Step 7

Click Add. You can select the Job History option to monitor the progress of the CAPP file upload.

Step 8

When the upload completes, the Workflow Manager tile appears on the Applications page, indicating that the application is ready to install, as shown in the following figure.

Step 9

Click the More icon (three dots) on the Workflow Manager tile to display the Workflow Manager installation pop up, then click Install. When installation is complete, the Applications Management > Job History tab should display an "Activation Successful" message.

Step 10

Verify successful installation by choosing Administration > Crosswork Manager > Crosswork Health > Workflow Manager. The Microservices tab should list the 10 microservices shown in the following figure, all with Healthy showing in the Status column.

Step 1

If you have not already done so, log in to Crosswork using an admin ID and select Administration > Crosswork Manager > Application Management.

Step 2

Click Add new file and select Upload CAPP file (.tar.gz).

Step 3

Using the Add File (.Tar.Gz) page, first select the Protocol you want to use to add the CWM Solutions CAPP file to the system. Then:

1. If you selected URL: Enter the URL for the remote host where the CAPP file is stored (including the path to the tar.gz file), as shown in the following figure. If the Basic Auth checkbox is selected, enter the Username and Password needed to access the remote host.

2. If you selected SCP: Enter the file's Server path/Location, the server's Host name/IP address, Port, and the login Username and Password.

Step 4

Click Add. You can select the Job History option to monitor the upload while it proceeds.

Step 5

When the addition completes, the Workflow Manager Solutions tile appears on the Applications page at the far right, next to the Workflow Managertile, indicating that the Workflow Manager Solutions application is ready to install.

Step 6

Click the More icon (three dots) on the Workflow Manager Solutions tile to display the installation pop up menu, then click Install.

Step 7

When installation is completed, the Application Management > Job History tab should display an "Activation of application Workflow Manager Solutions Successful" message.

Step 8

Application Management > Applications tab should show that both Workflow Manager and Workflow Manager Solutions are up.

Step 9

Choose Administration > Crosswork Manager > Crosswork Health > Workflow Manager Solutions. The Microservices tab should show all five CWM Solutions microservices are in a Healthy state.

Step 10

Finally, CWM Solutions will add three dynamic service pods to CWM. These are worker pods for the three CWM adapters that CWM Solutions installed automatically. You will find them under Administration > Crosswork Manager > Crosswork Health > Workflow Manager (not under Workflow Manager Solutions).

Step 1

Log in to Crosswork and select Device Management > Credential Profiles. Crosswork displays the Credential Profiles list.

Step 2

Create the NSO provider credential profile as follows:

1. Click + to add a credential profile for the NSO provider.

2. Complete the fields on the Add New Profile window as follows:

   In this field...	Enter or select:
   Profile name	NSO-Credentials (or any unique name you find meaningful)
   Connectivity type	SSH
   User name	The username for an SSH admin user on the NSO server. This user name can be a dedicated CWM Solutions user name with admin privileges that you create on the NSO server. In any case, this admin user name must be one that is in the ncsadmin group on the NSO server.
   Password	The password for this user name.
   Confirm password	The same password you entered in Password.
   Enable password	Leave this field blank.

3. Click + Add another to display another set of connectivity protocols to add to the same NSO credential profile. This time, select HTTPS as the Connectivity type, and enter the same NSO user and password information for this protocol, just as you did for Step 2b. For example:

   

4. When you are finished, click Save to save the NSO credential profile. You should see the Profile name you specified appear on the Credential Profiles list.

Step 3

(Optional) Repeat Step 2 to create another credential profile for your devices. You will want to add as many device login credentials and protocols as are appropriate for the devices you intend to manage using Crosswork Workflow Manager Solutions. Don't add protocols to a credential profile if the devices you are managing are not using those protocols. The following table provides a survey of all the protocols you can add to a Crosswork credential profile and the kinds of device functions they support.

Protocol	Used For
SSH	Devices providing IoT device control and secure file transfer. Common used protocol for device management.
NETCONF	Remote configuration and RPC exchange, typically used with SSH.
HTTP	Hosts providing insecure web resource access.
HTTPS	Hosts providing secure, encrypted web resource exchange.
SCP	Devices providing secure, encrypted file exchange relying on SSH.
TELNET	A common protocol for console access, used for most Cisco XR, Cisco XE, and Juniper Junos devices.
SNMPv2	Standard protocol for device management, used with many devices.
gRPC	Devices participating in high-performance distributed systems. It allows client applications to directly invoke remote procedure calls on server applications as if they were local. An alternative to REST.
SNMPv3	Latest version of the standard protocol for device management, used with some newer devices.
gNMI	Devices providing real-time network monitoring, telemetry and device management in secure streaming format. Often used in place of SNMP by data centers and service providers.

The following figure shows how you might create a single device credential profile that for two of the most commonly used protocols. You might create multiple credential profiles like this if you have groups of devices using the same two protocols but with different credentials.

Step 1

Install the following Python packages on the NSO server:

~$ sudo pip install textfsm
~$ sudo pip install jinja2
~$ sudo pip instapp pyyaml
~$ sudo pip install pycryptodome

Step 2

Edit the NSO ncs.conf file as shown below to enable REST support. The <ssl> block is optional and shown below in italics to distinguish it from REST and other commands. For example:

sudo vi /etc/ncs/ncs.conf
 
 <webui>
    <enabled>true</enabled>
    <transport>

<ssl>
  <enabled>true</enabled>
  <ip>0.0.0.0</ip>
  <port>8888</port>
  <key-file>${NCS_CONFIG_DIR}/ssl/cert/host.key</key-file>
  <cert-file>${NCS_CONFIG_DIR}/ssl/cert/host.cert</cert-file>
  <extra-listen>
    <ip>::</ip>
    <port>8888</port>
  </extra-listen>
      </ssl>
    </transport>
 
    <cgi>
      <enabled>true</enabled>
      <php>
        <enabled>false</enabled>
      </php>
    </cgi>
  </webui>
 
  <restconf>
    <enabled>true</enabled>
  </restconf>

Step 3

When you have finished the edit, save the ncs.conf file and restart NSO. For example:

sudo systemctl restart ncs

Step 4

Using an admin user ID, verify that REST is working correctly on your NSO installation. For example:

admin1@ncs% run show ncs-state rest
ncs-state rest listen ssl
 ip   ::
 port 8888
ncs-state rest listen ssl
 ip   0.0.0.0
 port 8888

Step 5

Specify the following NSO global configuration settings:

admin1@ncs% show devices global-settings
connect-timeout 600;
read-timeout    600;
write-timeout   600;
ssh-algorithms {
    public-key [ ssh-rsa ];
}
trace           pretty;
}

Step 6

Add the ulimit values for the Linux operating system before the commented line #End of file if it’s not already there. For example:

1. Check the /etc/security/limits.conf file:

   $ grep hard /etc/security/limits.conf
   $ grep soft /etc/security/limits.conf 

2. If not configured, edit the /etc/security/limits.conf file and add the following lines:

   * soft nproc 65535
    * hard nproc 65535
    * soft nofile 65535
    * hard nofile 65535
    * soft memlock 65535
    * hard memlock 65535 

3. Run the sysctl -p script to set the parameters.

4. Log out of the system and log in again to apply the new values.

5. Verify that the ulimit values for the Linux operating system are applied.

   $ ulimit -a core file size          (blocks, -c) 0 
   data seg size           (kbytes, -d) unlimited 
   scheduling priority             (-e) 0 
   file size               (blocks, -f) unlimited 
   pending signals                 (-i) 95697 
   max locked memory       (kbytes, -l) 65536 
   max memory size         (kbytes, -m) 
   unlimited open files                      (-n) 65535 
   pipe size            (512 bytes, -p) 8 
   POSIX message queues     (bytes, -q) 819200 
   real-time priority              (-r) 0 
   stack size              (kbytes, -s) 8192 
   cpu time               (seconds, -t) 
   unlimited max user processes              (-u) 65535 
   virtual memory          (kbytes, -v) unlimited 
   file locks                      (-x) unlimited 

Step 7

Ensure that the NETCONF Access Control Model (NACM) rule list grants the ncsadmin and Linux users permissions to perform functions on NSO. For example:

admin1@ncs% show nacm
read-default     deny;
write-default    deny;
exec-default     deny;
groups {
    group ncsadmin {
        user-name [ admin1 private ];
    }
    group ncsoper {
        user-name [ public ];
    }
}

Step 8

Determine the devices you will be supporting using Fleet Upgrade, then install the NSO Network Element Drivers (NEDs) appropriate for those devices, as follows:

1. Using the URLs on the NED license certificates supplied by your account team, download the NEDs for your devices from Cisco Software Download to a resource on your NSO host. The NEDs are signed.bin files that you must run to validate and extract the NED code.

2. Verify, extract and install the downloaded NEDs as explained in the he NSO Administration Guide topic Install New NEDs.

3. When you have finished installing the new NEDs, restart NSO. For example:

   sudo systemctl restart ncs

Step 1

Log in to Crosswork and select Administration > Manage Provider Access.

Step 2

Click + to add an NSO provider.

Step 3

Complete the first set of fields on the Add New Profile window as follows:

Step 4

Complete the fields on the Connection type(s) section as follows:

Step 5

Entries in the Provider Properties section are optional. If needed, enter one or more of the following key/value pairs:

Example (for RFS node 1): 
input_url_prefix: /rfc-1

Step 6

Complete the fields in the Model Prefix Info section as follows:

Step 7

When you are finished, click Save to save the NSO Provider profile. After a delay while Crosswork attempts to reach NSO, you should see the profile appear on the Manage Provider Access list.

Step 1

Contact your Cisco Sales team to identify and download the Cisco NSO Network Element Drivers (NEDs) required for your network environment. Before proceeding, install these NEDs on your NSO server, as explained in Install New NEDs.

Step 2

Once the NEDs are installed: Log in to Crosswork Workflow Manager and choose Administration > Crosswork Manager > NSO Deployment Manager.

Step 3

Under NSO Deployment Manager, choose the NSO function pack bundles tab and click the check box next to CWM SOLUTIONS FPS. Then click the Deploy button to start the deployment process.

Step 4

When prompted on the first Provide credentials page, provide the SSH User name, password and Sudo password credentials.

Step 5

On the Deployment target page, select Non-HA in the High Availability column, as shown below.

Step 6

When prompted on the Review & Deploy page, click Deploy.

Step 7

Click the Job History tab to monitor the NSO deployment as it proceeds. You will see the packages listed in the Job Details window for the running job.

Step 8

When the job is listed as Succeeded, click the Installed NSO function packs tab and expand the NSO provider to verify that the packages are all installed.

The package list should look like the illustration below.

admin1@ncs% run show packages package oper-status | tab         
                                                                 
                           PROGRAM                              
                           CODE     JAVA           PYTHON       
NAME                   UP  ERROR    UNINITIALIZED  UNINITIALIZED 
-----------------------------------------------------------------
cisco-ios-cli-6.107    X   -        -              -              
cisco-iosxr-cli-7.62   X   -        -              -             
cisco-ztp              X   -        -              -             
dlm-svc                X   -        -              -              
fleet-upgrade          X   -        -              -              
goldenconfig           X   -        -              -              
inventory              X   -        -              -             
inventory-junos        X   -        -              -             
juniper-junos-nc-4.18  X   -        -              -              
resource-manager       X   -        -              -              
 
admin1@ncs% run show packages package package-version  | tab
                       PACKAGE
NAME                   VERSION
--------------------------------
cisco-ios-cli-6.107    6.107.2
cisco-iosxr-cli-7.62   7.62
cisco-ztp              2.0.0
dlm-svc                7.1.0
fleet-upgrade          2.0.0
goldenconfig           2.0.0
inventory              2.0.0
inventory-junos        2.0.0
juniper-junos-nc-4.18  4.18.8
resource-manager       4.2.9

Step 9

If you haven't already done so, log in to NSO and set the following device global settings in configuration mode. These NSO settings are required for Fleet Upgrade.

admin@ncs% set devices global-settings connect-timeout 600
admin@ncs% set devices global-settings read-timeout 600
admin@ncs% set devices global-settings write-timeout 600
admin@ncs% set devices global-settings ssh-algorithms public-key ssh-rsa
admin@ncs% set devices global-settings trace pretty
admin@ncs% set devices global-settings ned-settings 
                           cisco-iosxr read admin-show-running-config false
admin@ncs% commit
 
admin@ncs% show devices global-settings
connect-timeout 600;
read-timeout    600;
write-timeout   600;
ssh-algorithms {
    public-key [ ssh-rsa ];
}
trace           pretty;
ned-settings {
    cisco-iosxr {
        read {
            admin-show-running-config false;
        }
    }
}

Step 10

Note that NETCONF Access Control Model (NACM) is required for NSO. Ensure that the NACM rule list grants ncsadmin and the Linux user rights to perform functions on NSO. For example:

admin@ncs% set nacm groups group ncsadmin user-name admin
admin@ncs% commit
 
 
admin@ncs% show nacm
read-default     deny;
write-default    deny;
exec-default     deny;
groups {
    group ncsadmin {
        user-name [ admin private ];
    }
    group ncsoper {
        user-name [ public ];
    }
}

Step 11

Copy the ncs_backup.sh, ncs_restore.sh and get_technical_support_data.sh scripts from the provided bundle to the scripts directory under the NCS_RUN_DIR, and update the permissions of the copied scripts to make them executable.

# Locate the NCS_RUN_DIR using the following command
cat /etc/systemd/system/ncs.service | grep NCS_RUN_DIR=
 
# Update the permissions
chmod +x ncs_backup.sh ncs_restore.sh get_technical_support_data.sh