The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This section contains the following topics:
A hosted application is a software as a service solution that runs remotely using commands.
Provides a platform for administrators to leverage their own tools and utilities.
Application hosting is a platform capability that:
enables deployment and management of third-party applications on network devices,
provides virtualized runtime environments for applications, and
extends device functionality beyond traditional networking capabilities.
Application hosting is a platform that:
enables administrators to leverage their own tools and utilities on network devices,
provides reusable, portable, and scalable applications for virtual environments, and
supports third-party off-the-shelf applications built using Linux tool chains.
Applications hosted on network devices can serve various purposes:
Automation.
Configuration management monitoring.
Integration with existing tool chains.
Cisco devices support custom applications cross-compiled with the software development kit that Cisco provides.
IOx is a Cisco-developed end-to-end application framework that provides application hosting capabilities for different application types on Cisco network platforms.
From Cisco IOS-XE Release 17.8.1, IOx installation on IR8340 requires Cisco supported mSATA to be the storage device. There are two partitions on the mSATA. One for IOS, and the other for IOx. The IOS partition will be mounted on /mnt/msata and IOx partition will be mounted on /vol/harddisk. OIR is not supported for mSATA device. When mSATA is inserted to the router, the router needs to be reloaded to have two partitions. If mSATA is not present, bootflash is used for application hosting.
In Cisco IOS XE Release 17.7.x, SD card is used as storage device for IOx. Any upgrade from 17.7.x to 17.8.x requires all applications to be reinstalled.
Cisco application hosting is a virtualization infrastructure that:
launches designated applications in containers,
checks available resources (memory, CPU, and storage), and allocates and manages them,
provides support for console logging and CLI endpoint access, and
provides an application hosting infrastructure referred to as Cisco Application Framework (CAF).
Application hosting provides these additional services:
Helps in the setup of platform-specific networking (packet-path) via VirtualPortGroup and management interfaces.
The container is referred to as the virtualization environment provided to run the guest application on the host operating system. The Cisco IOS-XE virtualization services provide manageability and networking models for running guest applications. The virtualization infrastructure allows the administrator to define a logical interface that specifies the connectivity between the host and the guest. IOx maps the logical interface into the Virtual Network Interface Card (vNIC) that the guest application uses.
Applications to be deployed in the containers are packaged as TAR files. The configuration that is specific to these applications is also packaged as part of the TAR file.
The management interface on the device connects the application hosting network to the IOS management interface. The Layer 3 interface of the application receives the Layer 2 bridged traffic from the IOS management interface. The management interface connects through the management bridge to the container/application interface. The IP address of the application must be on the same subnet as the management interface IP address.
IOXMAN is a process that:
establishes a tracing infrastructure to provide logging or tracing services for guest applications, except Libvirt, that emulates serial devices,
operates based on the lifecycle of the guest application to enable and disable the tracing service,
sends logging data to IOS syslog, saves tracing data to IOx tracelog, and maintains IOx tracelog for each guest application.
Application hosting on the IR8340 router is a deployment capability that:
enables applications to be deployed using application hosting CLI commands,
supports deployment through Local Manager WebUI interface, and
requires WebUI to be enabled for Local Manager access.
Application hosting can be achieved using two primary methods:
Application hosting CLI commands.
Local Manager through WebUI.
To deploy applications using Local Manager, enable WebUI and then log in to Local Manager.
For Local Manager deployment you can:
Navigate to Configuration > Services > IOx from WebUI.
Log in using the configured username and password.
Follow the application lifecycle management steps. For more details, see Cisco IOx Local Manager Reference Guide.
The next section explains the deployment of an application using the application hosting CLI commands.
Application hosting on Layer 2 and Layer 3 interfaces is a network configuration approach that:
uses two interface types to support L2 and L3 traffic from LAN and WAN ports respectively,
configures L2 interfaces with AppGigabitEthernet and VLAN with IP address in the same VLAN network for forwarding L2 app traffic, and,
uses L3 gateway interfaces configured with Virtual port group and IP address in the same network as VPG for forwarding L3 traffic to applications.
For application hosting, you can configure the L2 and L3 interfaces as given:
L2 interfaces are configured with AppGigabitEthernet and VLAN with IP address in the same VLAN network, which are used or forwarding the L2 app traffic. Dedicated VLAN range 2340 - 2349 must be used for configuring L2 interfaces of application and to communicate the application for L2 traffic.
You should configure the AppGigEthernet interface as a trunk interface.
L3 interfaces or gateway interfaces are configured with Virtual port group, and IP address in the same network as VPG, which are used for forwarding the L3 traffic to applications.
A VirtualPortGroup is a software construct on Cisco IOS that:
maps to a Linux bridge IP address,
represents the switch virtual interface (SVI) of the Linux container,
connects the application hosting network to the IOS routing domain.
Each bridge can contain multiple interfaces; each mapping to a different container. Each container can also have multiple interfaces.
VirtualPortGroup interfaces are configured by using the interface virtualportgroup command. Once these interfaces are created, IP address and other resources are allocated.
The VirtualPortGroup interface connects the application hosting network to the IOS routing domain. The Layer 3 interface of the application receives routed traffic from IOS. The VirtualPortGroup interface connects through the SVC Bridge to the container/application interface.
The following graphic helps to understand the relationship between the VirtualPortGroup and other interfaces.
A vNIC is a virtual Ethernet interface that:
connects application containers to the platform dataplane for sending and receiving packets,
forms part of a virtual Ethernet pair where the other interface (vpgX) belongs to the host system, and
operates as a standard Ethernet interface inside the container with gateway, IP address, and unique MAC address assigned by IOx.
The Layer 3 routing model supports one container per internal logical interface for container lifecycle management. IOx is responsible for the gateway (VirtualPortGroup interface), IP address, and unique MAC address assignment for each vNIC in the container.
The following sections provide information about the various tasks that comprise the configuration of application hosting.
This task enables access to the IOx Local Manager. The IOx Local Manager provides a web-based user interface that you can use to manage, administer, monitor, and troubleshoot apps on the host system, and to perform a variety of related activities.
 Note |
In the steps that follow, IP HTTP commands do not enable IOx, but allow the user to access the WebUI to connect the IOx Local Manager. |
|
Step 1 |
Use the enable command to enter privileged EXEC mode. Example: |
||
|
Step 2 |
Use the configure terminal command to enter global configuration mode. Example: |
||
|
Step 3 |
Use the iox command to enable the IOx framework. Example: |
||
|
Step 4 |
Use the ip http server command to enable the HTTP server. Example: |
||
|
Step 5 |
Use the ip http secure-server command to enable the HTTPS server. Example:
|
||
|
Step 6 |
Use the username name privilege levelsecret {0 | 7 | user-password} encrypted-password command to establish a username-based authentication system. Example:
|
||
|
Step 7 |
Use the end command to exit configuration mode and return to privileged EXEC mode. Example: |
Use this task to configure the AppGigabitEthernet interface and associate it with an application for Layer 2 connectivity.
|
Step 1 |
Use the configure terminal command to enter global configuration mode. Example: |
|
Step 2 |
Use the interface AppGigabitEthernet number command to configure the interface and enter interface configuration mode. Example: |
|
Step 3 |
Use the switchport mode trunk command to set the interface to trunking mode. Example: |
|
Step 4 |
Use the exit command to return to global configuration mode. Example: |
|
Step 5 |
Use the app-hosting appid name command to configure the application and enter application hosting configuration mode. Example: |
|
Step 6 |
Use the app-vnic AppGigabitEthernet trunk command to configure a trunk port for the application. Example: |
|
Step 7 |
Use the vlan vlan-id guest-interface interface-number command to configure a VLAN guest interface. Example: |
|
Step 8 |
Use the guest-ipaddress ip-address netmask mask command to configure a static IP address for the guest interface. Example: |
|
Step 9 |
Use the end command to exit to privileged EXEC mode. Example: |
Multiple Layer 3 data ports can be routed to one or more VirtualPortGroups or containers. VirtualPortGroups and Layer 3 data ports must be on different subnets.
Note |
The ip routing command must be enabled to allow external routing on Layer 3 data ports. |
|
Step 1 |
Use the configure terminal command to enter global configuration mode. Example: |
|
Step 2 |
Use the interface virtualportgroup number command to configure the interface. Example: |
|
Step 3 |
Use the configure terminal command to enter global configuration mode. Example: |
|
Step 4 |
Use the configure terminal command to enter global configuration mode. Example: |
Use this task to specify Docker run time options for hosted applications.
|
Step 1 |
Use the configure terminal command to enter global configuration mode. Example: |
||
|
Step 2 |
Use the app-hosting appid name command to enable application hosting and enter application hosting configuration mode. Example: |
||
|
Step 3 |
Use the app-resource docker command to enter application-hosting docker-configuration mode. Example:
|
||
|
Step 4 |
Use the run-opts id options command to specify the Docker run time options. Example: |
||
|
Step 5 |
Use the end command to exit to privileged EXEC mode. Example: |
Use this task to install, activate, start, stop, deactivate, and uninstall applications on the host system.
|
Step 1 |
Use the enable command to enter privileged EXEC mode. Example: |
||
|
Step 2 |
Use the app-hosting install appid application-name package package-path command to install an application. Example: |
||
|
Step 3 |
Use the app-hosting activate appid application-name command to activate the application. Example:
|
||
|
Step 4 |
Use the app-hosting start appid application-name command to start the application. Example: |
||
|
Step 5 |
Use the app-hosting stop appid application-name command to stop the application. Example: |
||
|
Step 6 |
Use the app-hosting deactivate appid application-name command to deactivate all resources allocated for the application. Example: |
||
|
Step 7 |
Use the app-hosting uninstall appid application-name command to uninstall the application. Example:
|
Use this task to define custom resource profiles for your applications. Resource changes take effect only after the app-hosting activate command is configured.
|
Step 1 |
Use the configure terminal command to enter global configuration mode. Example: |
||
|
Step 2 |
Use the app-hosting appid name command to enable application hosting and enter application hosting configuration mode. Example: |
||
|
Step 3 |
Use the app-resource profile custom command to configure the custom application resource profile. Example:
|
||
|
Step 4 |
Use the cpu unit command to change the default CPU allocation. Example:
|
||
|
Step 5 |
Use the memory memory command to change the default memory allocation. Example: |
||
|
Step 6 |
Use the vcpu number command to change the virtual CPU (vCPU) allocation. Example: |
||
|
Step 7 |
Use the end command to exit configuration mode and return to privileged EXEC mode. Example: |
Use this task to define custom resource profiles for your applications. Resource changes take effect only after the app-hosting activate command is configured.
|
Step 1 |
Use the enable command to enter privileged EXEC mode. Example: |
||
|
Step 2 |
Use the configure terminal command to enter global configuration mode. Example: |
||
|
Step 3 |
Use the app-hosting appid name command to enable application hosting and enter application hosting configuration mode. Example: |
||
|
Step 4 |
Use the app-resource profile custom command to configure the custom application resource profile. Example:
|
||
|
Step 5 |
Use the cpu unit command to change the default CPU allocation. Example:
|
||
|
Step 6 |
Use the memory memory command to change the default memory allocation. Example: |
||
|
Step 7 |
Use the vcpu number command to change the virtual CPU (vCPU) allocation. Example: |
||
|
Step 8 |
Use the end command to exit configuration mode and return to privileged EXEC mode. Example: |
Use this task to span traffic to IOx applications. Access Control Lists (ACLs) can be applied to ERSPAN traffic similarly to FSPAN.
|
Step 1 |
Use the ip access-list extended name command to create an extended access list. Example: |
||
|
Step 2 |
Use the monitor session 1 session-id type erspan-source command for configuring ERSPAN session for LAN or WAN ports to span data to the application.
|
See the examples:
This example demonstrates the command sequence required to enable IOx functionality on a Cisco device, including the necessary HTTP server configuration and user account setup.
Device> enable
Device# configure terminal
Device(config)# iox
Device(config)# ip http server
Device(config)# ip http secure-server
Device(config)# username cisco privilege 15 secret 0 cisco
Device(config)# end
This example demonstrates the configuration steps for setting up a VirtualPortGroup interface and connecting it to a Layer 3 data port with IP addressing.
Device> enable
Device# configure terminal
Device(config)# ip routing
Device(config)# interface gigabitethernet 0/0/0
Device(config-if)# no switchport
Device(config-if)# ip address 10.1.1.1 255.255.255.0
Device(config-if)# exit
Device(config)# interface virtualportgroup 0
Device(config-if)# ip address 192.168.0.1 255.255.255.0
Device(config-if)# end
This reference provides command-line examples that demonstrate the complete lifecycle of app management, including installation, activation, start, stop, deactivation, and uninstallation of IOx applications.
Device> enable
Device# app-hosting install appid app1 package flash:my_iox_app.tar
Device# app-hosting activate appid app1
Device# app-hosting start appid app1
Device# app-hosting stop appid app1
Device# app-hosting deactivate appid app1
Device# app-hosting uninstall appid app1
This example demonstrates how to override the default app resource configuration by creating a custom profile with specific CPU, memory, and virtual CPU settings for an application.
Device# configure terminal
Device(config)# app-hosting appid app1
Device(config-app-hosting)# app-resource profile custom
Device(config-app-resource-profile-custom)# cpu 800
Device(config-app-resource-profile-custom)# memory 512
Device(config-app-resource-profile-custom)# vcpu 2
Device(config-app-resource-profile-custom)# end
Signed application support is an IOX security feature that:
requires signed verification to be enabled on the device to install signed applications,
prevents unsigned applications from being activated when verification is enabled, and
allows signed applications to move to different states regardless of the verification status.
To install a signed application, signed verification has to be enabled on the device.
You can enable or disable signed verification using the app-hosting verification {enable |disable } command.
The signed verification enabled or disabled status can be verified by the show app-hosting infra command:
# show app-hosting infra
IOX version: 2.7.0.0
App signature verification: disabled
Internal working directory: /vol/harddisk/iox
Application Interface Mapping
AppGigabitEthernet Port # Interface Name Port Type Bandwidth
1 AppGigabitEthernet0/1/1 KR Port - Internal 10G
CPU:
Quota: 99(Percentage)
Available: 99(Percentage)
Quota: 3465(Units)
Available: 0(Units)When signed verification is enabled, any unsigned app can not be activated, and signed app can move to different states irrespective of the app sign verification enabled or disabled.
After enabling the signed verification, follow the instructions in Install and uninstall apps to install the application.
Cisco Cyber Vision Center (CVC) is a network security solution that:
gives more visibility into Industrial IoT networks across Industrial Control Systems (ICS) with real-time monitoring of control and data networks,
supports integration on IoT IOS-XE platforms beginning with release 17.4 by deploying IOX Cyber Vision sensor, and
enables platforms to forward traffic from IOX applications to Cyber Vision Center for real-time monitoring and captured PCAP files to Vision center from IOX application.
The minimum Cyber Vision release is 4.1.1 to work with the IR8340. For more information about CVC, see the release notes:
https://www.cisco.com/c/en/us/support/security/cyber-vision/products-release-notes-list.html
For more information about CVC installation and ERSPAN with CVC, see the Cisco Cyber Vision Network Sensor Installation Guide for Cisco IR8340.
A Cisco ThousandEyes Enterprise Agent is a network monitoring solution that:
runs a variety of tests using agents,
provides real-time monitoring of network and application performance, and
offers multidimensional insights with routing and device data for end-to-end visibility.
The Cisco ThousandEyes Enterprise Agent enables you to view end-to-end paths across networks and services affecting your business. It actively monitors network traffic paths across internal, external, and internet networks, helping analyze network performance and application availability.
You can use application-hosting features to deploy the Cisco ThousandEyes Enterprise Agent as a container application on Cisco Industrial IoT Routers. The agent runs as a Docker container using the Cisco IOx.
Starting with Cisco IOS XE Release 17.18.2, you can configure Cisco ThousandEyes Enterprise Agent in Controller mode.
For details about configuring Cisco ThousandEyes Enterprise Agent in controller mode, see Cisco SD-WAN Systems and Interfaces Configuration Guide.
For more information about Cisco ThousandEyes Enterprise Agent, see ThousandEyes Documentation.
Feedback