3. My background
OSDL – Linux Foundation
Linux 2.5 network infrastructure → bridging
TCP congestion control → netem → iproute
Network performance → Marvell replacement drivers
Vyatta
Kernel performance
Quality Of Service support
4.
5.
6.
7. Vyatta versions
http://vyatta.org http://vyatta.com
Free download Subscription
livecd
Update 2x year Update 4x year
Community forums
Software or Hardware
Phone and Email
Support
Same source and features
8. Vyatta Distribution
Debian GNU/Linux
Current version based on testing → lenny
Linux kernel 2.6.24 + bugfix
Filesystems: unionfs, squashfs
Serial driver: wanpipe
Additional packages
CLI infrastructure
Configuration templates
Updated routing related packages
Quagga, SNMP, SNORT, ...
11. CLI Requirements
Router look & feel
Command completion
Roles: Administrator, operator
Configure mode
Extensible
Text based
Language neutral
Integrated with operating system
12. Vyatta
Proprietary Open
System System
Monolithic SW
Graphical User Interface
Network Apps
FusionCLITM
Internet Protocols
WAN Optimization
Open API
Load Balancing
Scalable Routing NW Functions Security
Extensible
Internet Protocols DHCP, NAT, Radius… Firewall, VPN Anti-X
PBX
Linux Kernel IDS
Unique
HW Massive
open-source
Standard HW ecosystem…
14. Demo 1: Basic interface
$ show interfaces
Interface IP Address State Link Description
eth0 192.168.111.132/24 up up
eth1 up up
lo 127.0.0.1/8 up up
lo ::1/128 up up
$ show interfaces et<tab>hernet <tab>
detail eth0 eth1
$ show interfaces ethernet eth0
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UNKNOWN qlen 1000
link/ether 00:0c:29:f6:20:9e brd ff:ff:ff:ff:ff:ff
inet 192.168.111.132/24 brd 192.168.111.255 scope global eth0
inet6 fe80::20c:29ff:fef6:209e/64 scope link
valid_lft forever preferred_lft forever
...
16. Operational template
show/interfaces/ethernet/node.tag/node.def
help: Show specified ethernet interface information
allowed: for dev in /sys/class/net/*;
do if [[ L $dev/device ]]
then if [[ $(cat $dev/type) eq 1 ]]
then echo n ${dev##*/} " "
fi
fi
done
run: vyattashowinterfaces.pl intf="$4"
17. Demo 2: Configuration
$ configure
[edit]
# set interfaces ethernet eth0 description 'Vmware NAT'
[edit]
# show interfaces ethernet eth0
address dhcp
+description "Vmware NAT"
hwid 00:0c:29:f6:20:9e
[edit]
# mount
...
unionfs on /opt/vyatta/config/tmp/new_config_5035 type unionfs
(rw,dirs=/tmp/changes_only_5035=rw:/opt/vyatta/config/active=r
o)
[edit]
vyatta@vc313# commit
18. Configuration templates
multi:
type: txt
help: Set an IP address for this interface
syntax:expression: exec "/opt/vyatta/sbin/vyattainterfaces.pl
validaddr $VAR(@) dev $VAR(../@)"
; "Invalid IP address/prefix [$VAR(@)] for interface $VAR(../@)"
update: /opt/vyatta/sbin/vyattainterfaces.pl
ethaddrupdate $VAR(@) dev $VAR(../@)
delete: /opt/vyatta/sbin/vyattainterfaces.pl
ethaddrdelete $VAR(@) dev $VAR(../@)
allowed: echo "dhcp <>"
comp_help:Possible completions:
<x.x.x.x/x> Set the IP address and prefix length
<h:h:h:h:h:h:h:h/x> Set the IPv6 address and prefix length
dhcp Set the IP address and prefix length via DHCP
19. Configuration save restore
interfaces {
ethernet eth0 {
address dhcp
duplex auto
hwid 00:0c:29:f6:20:9e
speed auto
}
loopback lo {
}
}
service {
ssh {
port 22
protocolversion v2
}
}
20.
21. Quality of Service (QoS) usage models
Real time services
VOIP
Network control plane
BGP, OSPF, STP
Fairness
Throttle batch services
P2P, backup,
26. Internals - perl code
sub update_interface {
my ($interface, $direction, $name ) = @_;
my $config = new VyattaConfig;
( $direction eq "out" ) or die "Only out direction
supported";
$config>setLevel('qospolicy');
foreach my $type ( $config>listNodes() ) {
if ( $config>exists("$type $name") ) {
my $shaper = make_policy($config, $type, $name);
delete_interface($interface, $direction);
open my $out, "|" or exec qw:sudo /sbin/tc batch :;
$shaper>commands($out, $interface);
if (! close $out) {
delete_interface($interface, $direction);
}
}
die "Unknown qospolicy $namen";
}
27. QoS traffic-shaper
# edit qospolicy trafficshaper lartc
[edit qospolicy trafficshaper lartc]
# set class 2 bandwidth 100%
[edit qospolicy trafficshaper lartc]
# set class 2 match www ip destination port 80
[edit qospolicy trafficshaper lartc]
# set class 3 bandwidth 3mbit
[edit qospolicy trafficshaper lartc]
# set class 3 ceiling 5mbit
[edit qospolicy trafficshaper lartc]
# set class 3 match smtp ip destination port 25
[edit qospolicy trafficshaper lartc]
# exit
28. Traffic-shaper continue
[edit]
# commit
qospolicy trafficshaper lartc configuration not complete: missing
default class
Commit failed
# set qospolicy trafficshaper lartc default bandwidth 1
[edit]
# commit
[edit]
# set interfaces ethernet eth0 qospolicy out
29. Result
# run show queueing ethernet eth0
eth0 Output queue:
Class QosPolicy Sent Dropped Overlimit
1: trafficshaper 11438 0 0
4 fairqueue 11438 0 0
2 fairqueue 0 0 0
3 fairqueue 0 0 0
[edit]
30. Issues
Developer documentation
Linux Kongress paper
Watch this space
Vyatta ↔ Linux management
Vyatta config ignores other changes
CLI stays loosely coupled
Vyatta package changes
Every distribution is a fork
All changes are fed to upstream
Today, I am going to talk about Vyatta's Command Line Interface. The CLI tries to integrate existing Linux projects which as they say in the US is a bit like herding cats.. Maybe that is a US expression so let me explain...
Vyatta Debian mirror repository Does include all the networking packages on livecd Does not include X / Gnome /KD Can use packages from Debian except overlaps.
Start with Linux + ipv6 + serial + bonding + bridging + vlan + QoS + Quagga + Snort + clam + ...
Command completion with TAB and ? Admin is like root Operator is the guy you only partially trust Vyatta has 4 modes: root, admin, operator, normal
IOS is monolithic. Not extensible Explain layers Marketing != reality
Use slogin to VM Show system kernel-messages Cd /opt/vyatta/share/vyatta-op/templates Cat show/kernel-messages/node.def (Explain template hierarchy and run tag) Show interfaces ethernet eth0 Cat show/interfaces/ethernet/node.tag/node.def (Explain tag nodes and allowed, etc)
Cd # home Show how values are stored Show how snapshots are done; mount Emphasize that this is internals (like .git) Explain save/load If that was all CLI could do this would be...
Use QoS as example, most familiar to me, less to audience
Mapping from policy to internals
Example from LARTC, Linux server with total of 10Mbit available bandwidth. You want to limit webserver traffic to 5Mbit, SMTP traffic to 3Mbit and everything else (unclassified traffic) to 1Kbit. In case there is unused bandwidth, you want to share it between SMTP and unclassified traffic. The &quot;total bandwidth&quot; implies one top-level class with maximum bandwidth of 5Mbit. Under the top-level class, there are three child classes. set qos-policy traffic-shaper lartc bandwidth 10mbit edit qos-policy traffic-shaper lartc set class 2 bandwidth 50% set class 2 match www ip destination port 80 set class 3 bandwidth 3mbit set class 3 ceiling 100% set class 3 match smtp ip destination port 25 Commit # Fix missing default bandwidth class for unclassified traffic is allowed to use 1K but must not exceed 5Mbit. set default bandwidth 1 set default ceiling 5mbit Exit # edit mode commit # Apply to eth0 set interfaces ethernet eth0 qos-policy out lartc commit
These are projects customers want, but upstream project is abandoned IPV6 is not really abandoned but we want to make sure it has a good home after the end of the WIDE project
Current release (3.1.3) aka Hollywood is finally out GUI is in next release along with lots more little pieces Excited about opportunity offered by MQ...