CLI for VMware Virtual Distributed Switch

A few weeks ago I have been asked by one of my customers if VMware Virtual Distributed Switch (aka VDS) supports Cisco like command line interface. The key idea behind was to integrate vSphere switch with open-source tool Network Tracking Database (NetDB) which they use for tracking MAC addresses within their network. I have been told by customer that NetDB can telnet/ssh to Cisco switches and do screen scraping so would not it be cool to have the most popular switch CLI commands for VDS? These commands are

• show mac-address-table
• show interface status

The official answer is NO, but wait a minute. Almost anything is possible with VMware API. So my solution is leveraging VMware's vSphere Perl SDK to pull information out of Distributed Virtual Switches. I have prepared PERL script vdscli.pl which currently supports two commands mentioned above. It goes through all VMware Distributed Switches on single vCenter.

Script along with shell wrappers are available on GITHUB here https://github.com/davidpasek/vdscli

See screenshots below to get an idea what script does.

The output of the command

vdscli.pl --server=vc01.home.uw.cz --username readonly --password readonly --cmd show-port-status

looks as depicted in screenshot below.

and output of the command
vdscli.pl --server=vc01.home.uw.cz --username readonly --password readonly --cmd show-mac-address-table

So now we have Perl scripts to get information from VMware Distributed Virtual Switch which is nice, however, we would like to have Interactive CLI to have the same user experience as we have on physical switches CLI, right? For Interactive CLI I have decided to use Python ishell (https://github.com/italorossi/ishell) to emulate Cisco like CLI. To start interactive VDSCLI shell you must have Python with iShell installed and then you can simply run script

./vdscli-ishell.py

which is just a wrapper around vdscli.pl The screenshot of VDSCLI shell is in the figure below

VDSCLI Interactive Shell

And the last step is to allow SSH or Telnet access to VDSCLI shell. It can be very easily done via standard Linux possibility to change a shell for the particular user. The VDSCLI over ssh is depicted on the screenshot below.

VDSCLI Interactive Shell over SSH

To operationalize all these scripts, I would highly encourage you to read my another blog post ...
"CLI for VMware Virtual Distributed Switch - implementation procedure".

Hope somebody else in VMware community will find it useful.

Best Practices for Faster vSphere SDK Scripts

Source at http://www.virtuin.com/2012/11/best-practices-for-faster-vsphere-sdk.html 

The VMware vSphere API is one of the more powerful vendor SDKs available in the Virtualization Ecosystem.  As adoption of VMware vSphere has grown over the years, so has the size of Virtual Infrastructure environments.  In many larger enterprises, the increasing number of VirtualMachines and HostSystems is driving the architectural requirement to deploy multiple vCenter Servers.
In response, the necessity for automation tooling has grown just as quickly.  Automation to create daily reports, perform bulk operations, and aggregate data from large, distributed Virtual Infrastructure environments is a common requirement for managing the increasing virtual sprawl.
In a Virtual Infrastructure comprised of thousands of objects, even a simple script to list all VirtualMachines and their associated HostSystem and Datastores can result in very slow runtime execution.  Developing automation with the following, simple best practices can take orders of magnitude off your vSphere API tool's runtime.

 READ FULL ARTICLE

VMware Perl SDK - SSL Certificate verification

PROBLEM:

[root@MON-PROXY vm]# ./vminfo.pl --url https://10.10.4.70/sdk/vimService --username dpasek -vmname mon_proxy
Enter password:
Server version unavailable at 'https://10.10.4.70:443/sdk/vimService.wsdl' at /usr/lib/perl5/5.8.8/VMware/VICommon.pm line 545, line 1.

SOLUTION:

[root@MON-PROXY vm]# export PERL_LWP_SSL_VERIFY_HOSTNAME=0
[root@MON-PROXY vm]# ./vminfo.pl --url https://10.10.4.70/sdk/vimService --username dpasek -vmname mon_proxy

How to install Apache with perl modules on CENTOS

1/ Install Apache
yum install httpd

2/ Configure Apache on startup
chkconfig httpd on

3/ Allow port 80 and 443 in IPTABLES firewall
edit conf file /etc/sysconfig/iptables and add folowing lines before last reject line

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

4/ Install PERL modules


rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

yum list *NCFTP*

yum install ncftp

perl -MCPAN -e shell
cpan> install XML::Simple

PERL Getopt and GetOptions

When you code unix program first of all you need to get user options. Two Perl modules (Getopt and Getoptions::Long) work to extract program flags and arguments much like Getopt and Getopts do for shell programming. The Perl modules, especially GetOptions::Long, are much more powerful and flexible.

See full article at http://aplawrence.com/Unix/perlgetopts.html

Internet FailOver script for FreeBSD written in Perl

I wrote Perl script to automatically detect internet uplink failure and switch over to backup internet link. When primary link is up again script will switch it back. Script must be run in crontab as often as you wish.

#!/usr/bin/perl
use Net::Frame::Device;
use Net::Ping;

$uplink1_interface="sis0";
$uplink2_interface="sis1";
$lan_interface="sis2";
$primary_gateway="10.0.3.1";
$secondary_gateway="10.10.1.1";

# print current date and time
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = gmtime(time);
$year=$year+1900;
print "GMT Time: $year-$mon-$mday $hour:$min:$sec\n";

my $device_uplink1 = Net::Frame::Device->new(dev => $uplink1_interface);
my $device_uplink2 = Net::Frame::Device->new(dev => $uplink2_interface);
my $device_lan = Net::Frame::Device->new(dev => $lan_interface);

print "Current default gateway:", $device_lan->gatewayIp, "\n";
print "Primary default gateway:", $primary_gateway, "\n";
print "Secondary gateway:", $secondary_gateway, "\n";

print "Checking primary internet uplink ...\n";
if (check_uplink($primary_gateway)) {
if ($device_lan->gatewayIp ne $primary_gateway) {
# set default route to $primary_gateway
`route delete default`;
`route add default $primary_gateway`;

# Change uplink interface to uplink1_interface
change_nat_interface($uplink1_interface);

# restart IPFW and NATD daemon
`/etc/rc.d/ipfw restart`;

print "Default gateway has been changed to $primary_gateway via interface $uplink1_interface\n";
} else {
print "Current default gateway is set to primary gateway and is ok\n";
}
} elsif (check_uplink($secondary_gateway)) {
if ($device_lan->gatewayIp ne $secondary_gateway) {
# set default route to $secondary_gateway
`route delete default`;
`route add default $secondary_gateway`;

# Change uplink interface to uplink2_interface
change_nat_interface($uplink2_interface);

# restart IPFW and NATD daemon
`/etc/rc.d/ipfw restart`;

print "Default gateway has been changed to $secondary_gateway via interface $uplink2_interface\n";
} else {
print "Current default gateway is set to secondary gateway and is ok\n";
}
} else {
print "Any uplink is up and working\n";
}

print "----\n";

######################################################
# Ping IP address and decide if it's reachable or not
# 1.parameter: IP
######################################################
sub check_uplink {
my ($ip) = @_;

my $p = Net::Ping->new("icmp");
my $ok = $p->ping($ip);
$p->close();

return $ok; # 0 - false; 1 - true
}

######################################################
# Change NATD interface file
# 1.parameter: network interface
######################################################
sub change_nat_interface {
my ($nat_if) = @_;

$filename="/tmp/natd_iface";
if (open(F, "> $filename")) {
print "change_nat_iface: writing $nat_if to $filename\n";
print F $nat_if;
close F;
} else {
print "change_nat_iface: Cannot write to $filename\n";
return 0;
}

return 1; # 0 - false; 1 - true
}