Ascender for Networking

anything and everything very nice Mr Ford welcome back hey good afternoon I'd look at the time again so uh good afternoon Michael Ford based out of Chicago part of the sales team here at ciq and also helping Jimmy a little bit with uh a center and development as well fantastic Greg I think most people have seen your stuff now but introduce yourself again yeah for sure I'm Greg Soule I'm a principal specialist engineer uh here at ciq as well and uh I do all the things and I make the videos and the blog posts and uh I basically ride uh Jimmy and Ford's coattails kind

of one after the other so it's fantastic it's a good role it's the best so networking comes up a lot when it comes to a sender I know they're talk to people over the last couple of weeks that have tons of devices hundreds of devices thousands of devices actually in the last couple weeks we've been talking to people that have hundreds of thousands of network devices it's always the same question what can I do with it so that's a really generic question I'm gonna let you guys answer that okay what can you do with it as you say I won't stop talking so somebody else

talk first I'll talk first briefing then I'll let Greg go have at it so I mean honestly I think the better question is what can't you do because I think that list is a lot shorter um I might have talked about this before but you know a lot of things with you know that you want to do in the beginning if someone's new in their automation Journey uh what are the things that you can do that won't require making any changes so anything from just gathering information which Ansel refers to as fax using that information to build reports whether it's PDF format email um web

so I use S3 bucks a lot for that kind of stuff so information gathering anything from one-off configurations if you want to get to that by yourself in your own little sandbox lab to large scale configurations at an Enterprise level and that's something where a center automation will be a lot better because you can have more guided card railed automation at scale and I think that's my short answer before gray goes into more detail it's it's tough because it's so comprehensive yeah yeah I mean of course Michael always says it so eloquently um I'll be dirty about it and just say what are some of

the things like as a network engineer coming in like I've never done any automation you know what what can I expect obviously there's low hanging fruit like Michael said you can go and collect information which is great uh you know you're developing reports you're looking for compliance stuff right so I got to make sure that this thing is configured on all of my equipment right I've got these specific settings whether it's security or DNS or whatever it happens to be it's great for just running reports and keeping those people off your backs right like the compliance people um it's also great for discrete changes right

so crawl walk run a lot of people crawl right they start pulling information walk you're going to start generally doing discrete changes right so I will change all the DNS servers for North America right and then oh my gosh that worked that was amazing you know and then I'll just start kind of layering on additional things right and then really I think you almost say the Holy Grail but not necessarily the Holy Grail is uh doing firmware updates right I'm an organization I've got 10 000 switches and I've got to do firmware updates there's a cve that just came out I mean how many human

hours does that consume right yeah on average 15 minutes per device it's going to take a human to not only push all those configuration changes but verify everything after it's working and then I guarantee by the time they hit the 30th they're not checking very hard whether everything is working really well you just you just don't have time for that right so when you can start using automation for that and using it in an intelligent fashion so we talk about crawl walk run you could do that in your automations as well so one of the things I like to do is the batching aspect of

pushing against hosts so say I've got 100 hosts I want to operate against I can run in a batch fashion so I'll say run it against one host make sure it goes all the way through okay that worked now run it against 10 more hosts make sure that goes through all right now run it against fifty percent of the remaining inventory once that works successfully running against 100 right so I can kind of Step through slowly and make sure that everything's working and when I say working part of my automations are not just update the firmware but after that do this giant battery of tests

right can I get to it can I get through it all that stuff and so you can really verify that your equipment's working and you can do it in a vice uh easy fashion so uh I can I can fully admit that I am not perfect my configurations sometimes have mistakes and it's nice when the automation will catch those mistakes before I ruin an entire production environment um I say that you know the old saying is especially networking everybody's got a test network not everybody's also got a production Network so you know I mean generally it's really awesome to do that stuff so to me

that's kind of the the crawl walk run method now when I say holy grail oftentimes in networking people are referring to configuration is code that's where I basically store my configuration somewhere for what this switch this router this firewall whatever is to be it's supposed to look like this and then I just run the Automation and it will make it so right it will connect to that device and make any changes as required right it's on my configuration that I've got stored here the cool thing is ansible has this concept of item potency which means I will make a change if I need to if

I don't I won't and guess what I can rerun that piece of automation over and over and it doesn't break stuff unlike every script I've ever written in the past by hand ansible can really take that stuff into account and I have seen item potency being baked into devices that don't natively have it so uh oh and point that direction down there Jimmy uh he actually baked in most of the item potents into some of our lab stuff using some Microtech equipment which was awesome I'd be I think it would be really cool if he would kind of Step through the process that we used

to follow when we were like doing changes and maybe a little bit about how you kind of baked some of that in there oh yeah sure so and stepping back to the original question you know what can you do with a sender for networking you know a cinder itself was more of a framework we don't try to him haul you into all you can only do automation this way you can only do this little thing here it's a framework it allows you to build the automation the way you want to do it something that works with your processes that works with your internal guidelines with

your security considerations and all that it's just basically a framework that allows you to build the automation for yourself you know so talking about how we did our lab before you know we had a lab we actually still have another a large lab of me and Greg share with a couple other people and within there you know I don't want to be managing the firewall for all these different people and every time let Greg Smith a new test machine and wants you know to pop a hole into firewall to get access to that I don't want to have to even though he technically does have

access to the firewall but and can do it himself but he always comes to me for everything for some reason but I don't want to have to sit there and do this for them all the time so instead what I did was use you know standard infrastructure as code practices to where I have a git repository inside that git repository or different variable files inside that I have my entire firewall configuration so you know if I need a port open to the external from here to there if I need it and add it over to this port over here you know all that can be

done in the configuration itself and that entire git repository points back to Ascender so every time you make a change within that firewall config file uh it points and it's just a simple yaml file so it's plain text based there's no programming or anything else in there as soon as you make a change to that it get kicks off uh calls over to a sender says Hey somebody made a change it goes through the process of looking at all the firewall rules you know it gets again because Microtech routers don't have any item plugins built in you know you're going to be running direct commands

on everything there's not a lot of stuff built in for that so instead it looks through every single firewall rule make sure it matches to what we have in our configuration if it doesn't match it changes at the match if it's someone removed config or a role it removes it you know it's such for it but going through the lab and actually building that out and doing that for not only just firewall rules for DNS for DHCP for literally everything else we use within there just making it easy to wear and one place we can manage it but we also have that backup of now

all this stuff isn't git so that you know our firewall itself dies all you gotta is Rerun that Playbook on it it's going to reset everything up exactly how we want it yeah and and you you kind of hinted at it too that becomes part of the change controls procedure right one person does a PR and then somebody else has to look at it and verify it right yep I go in I look at it say yo why is he doing this oh no I'm not gonna allow that deny that and then go have a talk with Greg about proper adequate I think it's less

talks with Greg it's more about talking to me what are you doing in here why are you trying to do so that's usually what it is no but it really does make it part of kind of like a a cohesive like Flow Part of your ecosystem I think it's it's really cool how it can kind of bake in your change control as well as kind of like you know your configs are in here you can see who changed what and you know the rationale behind their changes like it's all kind of right there and even all the history and everything else with it and also

empowers everybody else so like Michael you know Michael isn't in there say he doesn't know anything about networking at all you know I can allow him to go in there and actually modify firewall roles for his devices and add them in very easily if I just modifying a text file he doesn't have to touch the firewall I don't have to give him access to the fireball rule the automation does the process for it so you're doing a little more sophisticated Jimmy sorry Michael yeah yeah and so I'm not a Microtech person and and I think that we've done this in real life where I have

no clue what's going on in micro tick and you've done exactly that where you just present here is the variable fund I need to change to add what I want for those firewall rules or whatever I need to change and that's exactly how it works I don't have to be you know knowledgeable about any particular Network platform at all I can just be presented with whatever you want and then we can make the changes and you can trust that it's going to work properly so Jimmy stepping away from the infrastructure's code piece could is there a way you could actually just create a web form

so somebody could come in oh yeah exactly I wouldn't do that just because then there's no checks and balances behind it I mean put something less important like just DNS entries internally sure you need to do DNS entry just fill out this form boom it's doing the same thing I could have it even just add it to that particular file if I wanted to and then have the regular process go or you know it can direct access and run this thing uh sender itself is going to log every change is made it's going to have the details of who ran it what ran what they've

inputted so you still get all that yeah to that point you could also integrate with say like servicenow so in Jimmy's example of a DNS entry you could have a form and service now where you fill out all the details you submitted it goes into the servicenow approval system somebody will say yeah that looks good the calls the sender and takes care of everything yeah are you extracted even further and say okay we just build it into our entire process you know we don't have someone going and request a fireball role instead they go in and they request a web server when they request a

web server it kicks off the Playbook to add the fire portal you know you tie it to the actual service they need oh go ahead no I was going to change subjects a little bit so go ahead no no I was just going to say the cool part of that is if you make the automation that will allow you to manually do it so I'm going to go in there you can also tie that into a workflow and use it in all kinds of different places right it becomes really flexible so Jimmy I know you and I were with a customer that had a massive

environment at one point uh and they had one guy and his whole job was to patch stuff all day I'm not going to say what the vendor was not going to say who it was but something like this and kind of to what Greg alluded to earlier being able to actually have that firmware there to you can pull it out pass whatever you need to do instead of that guy having to spend 13 hours a day seven days a week just patching the same thing over and over could he have automated that oh yeah and you know and automation is made for things exactly like

that you know another client I had where literally the they had one guy in there who I mean it was a Windows client they had one guy in there and he had you know 8 000 different random Windows Powershell scripts he wrote to do everything that guy literally got hit by a bus he didn't he didn't die he was in the hospital for a bit but he literally got hit by a bus so that's why I use that example all the time and they brought us in and said hey you know we need to do something about this because we don't want this to happen

again so we went through the process of helping them actually take those you know even though the existing work he's already done and integrated into the automation so that he doesn't have to be there to push the button to run the script anybody can do it wouldn't it have been simpler just to teach that guy how to walk across the street and look both ways yeah sure maybe but I imagine you got some alert and he had to look at his phone at the time when you're that important oh man oh man buddy so Michael good thing you're gonna ask a question there there are

a lot of different things that take place in a network environment like there are a lot of different pieces and I as things change and as customers grow and prices change and everything right they start doing Network migrations so switching vendors is a sender something that could help if you're going through a whole scale switch of a vendor could you use something like a sender to help streamline that process and make that migration easier I would see absolutely and there's so I'll say this there's different ways to tackle that problem so I don't know if Greg or Jimmy has thoughts on what to do but

honestly I go back to capturing information back Gathering because of that nature if you understand networking is networking right so we're all dealing with routing is the same um IP addresses the same all that stuff's not going anywhere so if you understand the principles of what's happening on your particular device you can always pull that information there are ansible modules for uh just about every different platform you can think of the ones that I think of obviously are things like Juniper and Cisco and apparently microtic which I know is Big I'm just not you know super familiar with that in my in my own personal

experience but that's a great example of capturing information putting it in a data file and I'm just saying data file as a as a kind of General uh General terminology but as long as you have the data you can use whatever appropriate models to pull information from your old environment push it out elsewhere as long as you have the idea of you know what it's going to perhaps what model numbers go into you know what operating system version you're dealing with all that kind of stuff so absolutely that's something that we can do if you have the playbooks for it right so that's the thing

that you might have to write but a lot of the stuff's already out there I think we talked about this before where I really build something from scratch I usually take something that's out on GitHub but the short answer is yes we can do that absolutely that can be done with the center yeah for sure well I um I think in Practical terms how would you how would you actually do that um so when you're talking about networking with ansible um most of the vendors have kind of a specific set of modules right and modules are kind of like pre-written chunks of code that are

going to perform some kind of task for you right that that's one of the beauty parts of using ansible right is that it kind of makes it simple so you don't have to know how to program a python or this stuff you just got to know the right module to call and then fill in the blanks from there but you have like command config so command is going to be I'm issuing like a show command config is like I'm throwing raw CLI commands at it facts together facts specifically from Network modules but we also have resource modules resource modules have gotten really intelligent I love

the direction we're going with them these days in that you can take a resource module say for like vlance right there's ones generally specifically for configuring vlans on a on a switch or ACLS ACLS is actually a better example because that gets more Flex so for configuring access lists and what these resource modules can do is you can take kind of a show run version of your config you can take the resource module and ingest it and it will take it and turn it into a data model for you so you could store say a single access list in a data model which means you'll

have like this gigantic list of here's the source IP here's the destination IP Source Port destination Port whether it's permit or deny and you know so it gets really hairy fast whereas if you say that as an ACL line that's one little line right Engineers are used to looking at that stuff this is what we like you know it's what we're accustomed to seeing and so the resource modules will take that ACL and the way you're normally accustomed to seeing it ingest it as a data model so I could ingest Cisco ACL pull it into a data model then I could use the Arista resource

module take that same data model that I just stuck in memory and shove it into an Arista device right so it starts making it vendor agnostic so I mean I know that's not the way you want to do it you want to like store your configs and you know Juno's format and then use that to push into an Arista I I wouldn't suggest doing that long term but like in a migration sort of scenario it should be able to do that and you can even couple that with say ztp zero touch provisioning the idea where you take a raw Network device you plug it in

the network it'll look I've even made demos for this where it looks up the MAC address in the cmdb figures out what device it is and will take its config that you store and get repository excuse me in a git repository and then shove that on the device so a lot of like really interesting ways my brain just wants to solve these weird crazy puzzles and so it sounds like a really fun challenge to try and do go ahead Jimmy I was just going to say my brain's the same way just tell me something is impossible and that's what I'm going to be working on

you got to solve Greg's repository problem it's a new word I know my my voice stopped working for a moment there it's great Rose did you have a question I think I cut you off earlier I'm sorry yeah I know totally I think I got a little like sidetracked with the bus story Jimmy and that really that really uh and I got thrown off and then you know Greg's like let's teach the guy to to walk I was like that real that's that actually I I see the way that your brain works now right like you're going back to what is the actual problem like

let's stop putting Band-Aids on things um and like go back backtrack to what the actual issue is and so I I mean I'm curious and again it kind of goes back to like when we're talking about Ascender we're talking about automation all the different things that it can do I'm curious as to what you guys have found because you've been doing this for a while and you've talked to a lot more companies than I have um about automation like what what are the blockers for people like what would what would kind of make them hesitate at implementing this kind of uh what sounds magical uh

resource I would say the first blocker that I see people running to is just having time not really to set it all up but to start building the automation because you spend so much time you know fighting the fires and everything else in your day-to-day job you know nowadays we're all understaffed and underpaid and everything else so finding the time to do all the work that should have been done two weeks ago is difficult but what generally I talk to those people and you know the way I explain it is find a task even a small task something that you just have to do repetitively

over and over and over and over again something that you know it may take you 30 seconds but you may have to do it you know 20 times in a week automate that one single task and now you're just freed up that time right there to then automate something else and then continue on to something else to the point where you have you know all the different things within that you have to do all the fires you have to fight everything else within your your day automated which you know brings you back to your real job your job isn't really there most of the time

to fight the fires your job is to go in and think of the Big Ideas build a new product projects continue the company forward versus have to put around put out the little things that pop up I would say just some of the other things I apologize Greg for interrupting yeah someone think of that I think might be blockers I think Jimmy's absolutely right with you know the people that are actually going to be authoring the automation there's a challenge between doing your day job and also getting the thing off the ground I think philosophically especially I think very really do you have a large

organization that's going to all flip over at once generally in my experience you want to talk to one team at a time that's having problems not problems but like opportunities to implement ansible Automation and and should I tackle from there and then I turn around and be Champions to the rest of the organization to start to have more of them adopt I think the last thing and I'll be quiet Greg if you want to add anything on top of that is I think security becomes a really big issue because now all of a sudden forgive me if I said this before but I know I've

heard someone call ansible um just something that can be very destructive if put in the wrong hands so instead of just letting it go free and manage everything at once it's really important to have those discussions with imposec so they can understand what is it going to touch where the guardrails are going to put in place what if we have a bad actor inside of the organization how are we going to prevent them from doing something that could really stop business processing so I think that's a really big another kind of challenge just a hurdle to overcome I think uh you get like Jimmy and

Ford spoke to already there there are challenges and I think also depending on what Silo you're coming from those challenges are going to look different so we're talking about networking today and for me one of the biggest challenges I've noticed for networking engineers is they've been CLI Cowboys their entire career right they just know banging on a keyboard they probably aren't from like a computer science background necessarily so like programming or scripting maybe not kind of like the thing that's like immediately in their wheelhouse right so I'm a network engineer I I come from this world as well and uh as I like to say

my caveman brain was capable of learning ansible um and it does kind of seem overwhelming right like there's this new thing I've got to learn and is it going to take my job right because that's sometimes in the back of people's heads um but as Jimmy said your job is not to sit there and constantly be fighting fires right you want to do the things that prevent the fires to begin with right you also want to be doing stuff that's fun and interesting and to me like always being in a state of panic was never an enjoyable place to be so learning to do some

automation a little at a time you know how do you an elephant one bite at a time right so you just kind of start slowly start building up especially when you um commit to it as an organization right to me the way you really get it in there is it's kind of a top-down approach right when management believes in it and you know they can kind of help Foster that in the environment it really can grow but imagine getting a chunk of your day back right to me uh in my early career The partially the way I measured my self-worth was how I did at

work and all of a sudden uh imagine yourself worth being so much better because you're able to automate and do more fun and interesting things no no I'm not trying to say automation's gonna like you know make you uh more zen-like in general but it can really help you get your hands around stuff and it's not as scary as it seems it really will enrich your life and I'm a firm believer if you build yourself build your resume you're going to be more valuable to the company more valuable as an asset maybe moving anywhere in your career yes sir Michael yeah and so I want

to kind of take this back to the topic at hand too talking about a center for networking I think I mentioned in my previous statement like we have one team at a time we might go in with and I think networking is a prime opportunity to have that discussion because I Greg and Jimmy and I have all said this in one way shape or form there is so much opportunity to look at something where it's very simple to do a single time on a single switch but it's a pain in the butt to do at scale and you know that's that's why networking I think

is very attractive uh excuse me automation is very attractive to networking teams because it lets them get rid of all that toil and focus on the things that are business impacting and that really cannot be automated so I just want to put that out there too I'm gonna ask this question because I know Jimmy has been spending time on it so have you Michael especially around a networking team A lot of times the networking folks to Greg's Point earlier they're not command line jockeys they're not Linux people installing this stuff is very intimidating for them I know it's actually kept people from going and automating

like I don't have time to figure out how to install and run this I don't really want to rely on the Linux team to own and manage it what are we doing to make that better yeah so we're building I guess you could call it more of a universal installer because again you know installing it you know I used to sell you know automation to Windows people is one of my big uh markets I used to work within and within there you know they're not command line junkies either they're not Linux guys either so we've tried to explain to them you know well this is

how you access h to a machine and they're like what is that so the ability to install this thing is one of the key Porsches we're working on it and making it Universal where it doesn't matter where you're trying to install it you know it runs on kubernetes itself but we want to be able to run on any kubernetes anywhere so we're making an installer to where it doesn't matter if you have a blank VM that has nothing on it while it can install uh k3s for you do you have a k8s already out there do you have Amazon do you have Google whatever you

may have the ability to install it pretty much anywhere is where we're going and we're getting pretty close to done with the installer it's excellent yeah that's one of the things it's always been a topic that comes up is do I have to pay somebody to install this it seems like it's really complicated so it's fantastic it's a good thing you edit a text file just to put in some information such as where I'm going to install it at my username password that sort of things and then you just run a setup file that's it which also makes it so that you don't have to

know kubernetes to go do this you can just run the script yep exactly fantastic Michael I know you've been working that too thank you I was going to say yeah so I I have the this is the fun part for me I get to play with I've not been able to play with kubernetes a lot as of late so I get to play with it now as I'm authoring this but exactly to your point the goal is to be able to extract that away so that if you you know fill in that variable file and say this is where I'm putting it these are my

credentials that I want to use all that jazz you're none the wiser everything will just run so we have another question but I want to make sure we're covering your topics here so kind of to the earlier point if a Linux team has Automation and an application team has Automation and the network team has automation can they tie it all together does it have to just be the network team off doing their own thing the windows team for Jimmy's stuff can they work together and say how how much together do they have to be I was gonna say Greg you already kind of alluded to

this I don't know if you want to talk about that with uh workflows and all that jazz yeah yeah yeah that's the um one of the beauty Parts is that um you really can segregate right we have role-based access control or our back it's generally what we refer to it as and it's really just a permission system inside right so generally what you're going to have is you're going to have your groups or your silos right you'll have your network team uh you'll have your Ops Team Dev team XYZ insert whatever you want in there and they will create automations they'll have their own sets

of credentials to log into those devices they'll have their own git repositories with their files well what they're going to do is they're going to create automations in there what we call Job templates it's where you kind of bring it all together into these job templates and they can perform all kinds of interesting tasks now I have those they're great they're easy for my organization to consume we can share it amongst each other cool part is we can share these job templates with other folks so the operations guys whenever they want to provision a machine well they want to provision it all the way through

but then they want to add the networking portion too right so I can share a job template that allows them to execute only so I'll allow them to pass in some variables maybe this is the host this is the interface it's on this is the VLAN it should be on right they'll pass that to the to the job template and they'll be able to execute that it'll perform that update and that's it they can't make any modifications to my stuff they can't look at my playbooks if I don't want them to they can't touch my credentials so basically I could put guard rails around any

piece of automation I want to share with another group in there and honestly as Michael said earlier we can create these things called workflows and it's really just a visual Builder where you I mean you're playing Minecraft you're snapping together little Lego bricks right you're just lining things up in there and they'll run and each little brick is just a new piece of automation it could be one I've created could be one somebody else created but they've given me execute permissions I can add it in there Bob's your uncle it's you're basically done I love it I'm sure I always love that phrase oh it's

a lot of British television it's infected my brain project magical so I'm going to ask the question that of course we're gonna get asked um we know that Ascender is open source you can go get it and we will put the link in the comments and all over the place and it's on our website ciq.com um Jimmy you said that you're working on an installer is that like a ciq engaged with us thing or is that something that also is going to be open source or we have have we not yet it'll be open source also okay that is that's a huge benefit to the

community and super exciting so thank you so much for working on that and obviously we will all be super excited um I imagine that for the networking people something like Ledger would be important as well so that they can in my mind Ledger is is probably a lot of things Jimmy um Greg and Michael but I imagine to me it's like a way to see everything that has happened right to like run the reports and make sure that everything is good in the hood and have some like human eyes on it is that accurate yeah so what you're basically grew out of the original project

I open sourced and then I kind of brought it in the house and started making a lot of changes to it so what it is Ascender itself has a lot of data lots and lots of data literally every change has happened on every single system and every change that didn't happen things we didn't have to change but the idea was basically to Pare down all that data that we have in Ascender to something that's usable that I can actually see what I want because searching within there is not the greatest thing at the current point which is one of the the points I plan on

helping to work on on the open source side but within here basically we can export all the data that's coming out of the sender into a cinder Ledger and it basically ingests these logs looks through it it pulls out all the important data about all my machines so every single host I have in there I have all the facts and all the data within there for those machines so I can start building my own reports off them makes it really easy to go and say okay I need to see the kernel virtual on every single one of my server it's there the data's there because

it collected automatically when it ran the playbooks but also I have kind of a rolling change log of every change that's happened on my network as it's happened with all the data within there so for instance I find a server and I know somebody changed say the um resolve.com for one of my servers and I'm trying to figure out who actually did that I can easily go in there and just type in resolve.com and it's going to pull up all the different servers that has changed on recently I can narrow it down to Justice whenever I want I click on there it shows me all

the data about What playbook that ran in what job that ran in including a link back to a sender with the actual job at randomly so it makes it really easy to kind of track down and see what's happening on there and changes as they occur versus just this huge log stream of everything that was an excellent description thank you and thanks for working on that super cool so I think we have a question from art I believe yes Arthur Todd what's up thanks for watching can you comment on a sender and terraform in the same context such as cloud so I'll say this Natalie

can I comment on it I've done this in real life uh not a production but done in real life so I will say this I'm a big fan of using the right tool the right job and I'm going to just speak for myself and in my experience the one of the things that I like about terraform is it's stateful so it's very good at instantiating infrastructures code the sender an ansible can also do it very well but if I had to choose a strength I think of configuring after the fact is where it's super strong so I've done exactly that where I deploy everything I

need to and by the way you're still using a sender to be a central logic orchestrator so I don't want to take a sender out of the equation whatsoever so we can still use two or four models in advance of a Playbook to call terraform scripts save the staple file even used here from Enterprise if you were so inclined so if you put the state if you want to put the state file on the cloud different Enterprise you can still do that as well but then after that now you have the infrastructure you can take a sender to do configuration after the fact and that's

just an example of using something you know that's staple to setup code or set infrastructure in the using a sender afterwards I'm actually doing that now not so much with terraform uh and I'm going to switch to that but for example I can use uh CTL which is the package that allows me to spin up eks clusters so I went through all the pain and trouble of setting up policies and roles and everything to set up an eks cluster to install a sender well I don't want to do all this all over again so I have an answer on the Playbook that actually in invokes

EKF CTL to and to set that up similar to terraform in that I'm saving state so all the infrastructure is set up but then I'm using a sender afterwards to do things like um install a sender set it up do all that stuff so the short answer part is we can absolutely do that we have done it um and also I'll expand that to if you have something else that you're using and we have a lot of organizations that do that too they might have some that aren't using for automation we're not interested in introducing pain to clients we want if you want to use

something to start with just because it's been there and it would cause some pain to just rip it out that's not the goal uh and terraform is something I've seen quite a bit in that context it's only stop here I don't know if Greg or Jimmy has any thoughts on that afterwards but no no perfect good I do know that Greg has something he would like to show us though yes yes I do let me uh screen share going to get a card trick uh uh of sorts huzzah the trick is whether I can get the screen share to function probably the card trick to

get screen sharing to work what's up there it is all right so I have a a configuration as code kind of demo here and so we talked earlier about what is configure's code I stored the configuration right this is what I want it to look like and I tell it to push but I'm doing it with a sender and I'm doing it against let me hide that I'm doing it against uh Cisco kit right so it's actually known equipment that you've are probably familiar with if you're listening to this not everybody's heard of micro tick but everybody's heard of Cisco if you look right here

I've got a whole bunch of job templates those are basically individual playbooks you see I have a bunch of them that are doing very discreet tasks so that's what I try and do right the cic stuff it's very discreet tasks as in traditionally when I used to write playbooks I would have them do a whole bunch of stuff right I'd configure all these different things in there now when I write them I write them to do little bite-sized pieces right so this is just configuring the access list DNS settings interface settings ntp settings because it starts making them those Lego bricks where I can take

them and reuse them in different places and in this example I'm going to go ahead and fire this Joker off right here it is the workflow and as soon as I fire it off it's going to run into the workflow visualizer it lets me well first it's actually got a server that's prompting me where the configs that we're going to be running this from right so tonight's uh change is actually coming out of this repository and I can paste in whatever I want all of my stuff's in public repos so feel free to get in there and take a look at what I'm doing but

I'm going to launch this job and it runs into the visualizer so remember we talked about build things into workflows and have them break out and do interesting individual things well this is it each one of these squares is a different Playbook right it's a different job template that's going to do something the very first thing I do is I do a backup right that's uh something you should probably perform before you do your uh networking as well as you can schedule just backups on kind of an even interval but what I'm doing a little bit different in this one is I'm doing a backup

to a git repository right so again this is a public get repo you probably don't want to do this with your production stuff but it backs up to a git repository but I'm doing a point in time snapshot so what that does is it does a backup and it actually creates point in time tag so here's my repo where it's backing up if in GitHub you've ever noticed this little tag section over here if I click it you see it just completed uh creating one right 817 1840 that's the time now so it actually created that now this is the date you could actually have

it be meaningful to whatever change you're actually performing right now but ultimately it's so I can do a rollback in case things don't quite go right well in my case everything did go right but is anybody who's really run big networks and done it over time everything will go right all of my testing will look good until my users show up at 8 AM and then my phone starts going crazy it's blowing up whatever configuration I did to the core router to whatever it happened to be the firewall things are broken uh I think the last one I did where I screwed things up it

was an MTU adjustment that I put in there wrong and you know everything's on fire I need to roll back well how do I do that right if it was normal change procedures I'd have this rollback I would go and I'd grab the config files and I'd do all these things while I'm scrambling and my brain is fried and I'm trying to figure out what's going on but with point in time backups I come in here and I look at the tag release I have I will copy that tag release go back into my Ascender interface here and I happen to have a Nexus config

rollback I'm going to fire that off it's going to ask me what's the repo tag I'll give it the repo tag we just created and I'll launch it so now what it's going to do instead of using my here's my change control window git repository it's actually going to reach out to my backup repo it's going to grab that specific tag right that point in time before I broke everything it's going to pull those files and it's using the exact same playbooks again I don't have to modify these playbooks I don't have to change them in any way it's using those same playbooks to actually

do my rollback right and you can tell this configuration looks almost identical it's just not doing a backup before it does this right so whatever the effective devices are I just run it against those affected devices say use this point in time and I've instantly rolled back and I've undone all my changes now you can see I made those changes oh I would say with the backup included it took about 50 seconds now I just did the rollback took about 20.

so now my users should be back online it's performing post-provisioning testing making sure everything's good and we're we're done we're clean we're back out like it never happened and then I get all these calls like oh you fixed it great great great and uh I'll secretly just myself I'll just say oh yeah I just undid everything I did to break it the first time around so so the main thing is you break things on purpose to look good well there's this old saying like uh if everything's broken they look at you and say what do we even need you for you know nothing's working but

when you're doing your job and everything's working like what do we even need you for nothing's ever broken so uh sometimes you got to remind them why you're there I think is ultimately what it is but I love this because it does so many things it does my backups right I actually have backups with if they're in a git repository I see revision history I can see what changed right what flipped at what time I got my point in time snapshot so I can actually do rollbacks or you know five months from now I can see um if I have a lab environment I can

just pull that shove it into that lab environment build that back up and see what I was doing there there's just a lot of possibilities in there it's also good for compliance anybody who has any controls they have to test against that's really convenient way of doing it and honestly it's something at the time of like when I first got into automation I even know this sort of thing was possible like I didn't know you could really do things like this so it was kind of a game changer for me that's very cool thank you for showing that Greg for sure Michael do you want

to add something no I think that was it um I'm trying to think if there's anything well I will say this we've been talking about um Hardware network devices but one thing that I will say as well is I don't want to limit this to just Hardware if you're talking about whether you want to manage just Cloud elements in general so if you want to deal with like AWS load balancers vpcs everything within there you can uh or if you're let's say you're a Cisco customer and you want to use uh virtual assistant and whatever Cloud you choose we can do that as well with

ansible playbooks in a sender uh I don't want to limit this conversation to just Hardware networking because that's not the case we can do whatever we want wherever we want and I'll say for myself too maybe if I'm testing something I you know I'm a big uh just test things in the cloud version so I might choose a few Cisco csr1000 knees and throw those up in AWS maybe that's my test number I'm written by the way I can use either uh ansible or Ascender to spin that stuff up do whatever I need to do my testing operational testing like Greg was talking about and

then either roll things back tear things down um honestly whatever you want to do you can so but I just want to throw that Wrinkle in there too not just Hardware networking that's a question for you guys I know back when I was having to deal with networking I'm not a network guy so it was always fun for me to not have to do that but we always had to deal with tools like IDs IPS so the all the security tools that sat on the network as well they always seem to fall into a network Realm is that someone else you can do with a

sender so I'm not only just traditional network devices but also the security appliances that get thrown in the mix I was going to say do we I don't know what we want to do I'll do we'll do the regular thing I'll go and then Greg will clean it up uh to answer yes absolutely and I'll say this too going back to the conversation that we were having in in my experience those might be two separate teams so you might have a canvas networking team that's in charge of routing and switching you might have a different team that's more security focused so they might be dealing

with more everything that protects the organization inside and outside firewalls being among them logging aggregators like a Splunk or anything else like that so absolutely you can do it they might have let's say for example if they want to have their own sets of git repositories that they author and manage maybe the networking team can't touch the security teams repositories and vice versa because they have different kinds of expertise you can honestly keep those things separate if you want and they can have their own job templates and do a lot of stuff with the word I use usually in this case is holistically typically if

you're deploying an app it's holistic it's on the networking team and the security team are usually involved whether that's uh punching holes into firewalls uh could be a number of other things from a security perspective then you can use things like workflows so that when the time comes to put that stuff together you can um so just speaking from a high level perspective absolutely I've done a lot of stuff with Palo Alto in in the past for myself Jimmy obviously does things in the lab for his devices I don't know Jimmy feels a micro tick as well or something else this is the thing it's

ansible so I don't have to know but long and short of it is uh short answer is yes I would say the short answer is if there's a way to connect into the device whether it's an API whether it's SSH whether it's even just telnet you can generally find a way to automate well you're talking about um kind of an IDs like intrusion detection like a lot of times we see security teams use this they're using it as glue like they're using a sender to be the glue between things right so your IDs picks up something anomalous well it can actually call the Ascender API

which will then Connect into your firewall um increase the logging level for maybe the specific IP subnet that's getting hammered or it sees anomalous right that'll increase the logging you'll actually be able to uh you know what do you call that enrichment I think they usually call that investigation enrichment inside of the security world so that's going to be able to give you a whole lot more information that you're gonna be able to come through as soon as you are complete you've closed out that ticket you can have the automation then push load the logging back down right but keep in mind that you don't

always have to be the one pushing the button or touching the things if you have systems that can detect something and can make a call out they're going to be able to take advantage of automation right to connect all these interesting pieces together in very interesting ways yeah I think Jimmy you and I talked to a customer who was doing this they would detect an attempt they would put into a file and every five minutes they would push the Blacklist out to 6 000 firewalls globally so nobody to touch it just did it on its own it's very cool we're getting close to time guys

is there any topic we didn't talk about I know we kind of talked about a lot of different stuff but any anything that we didn't talk about that we should have oh okay yeah I was gonna say I heard Jimmy say that you know that um people are understaffed and underpaid and I was thinking well if Zane you wanted to pay us more you know we could discuss that right now I was waiting for somebody to say I was like wow I was waiting she's just dropping a hints live on air team call tomorrow [Laughter] come prepared yeah Jimmy anything else you want to add

nope just watch out for buses definitely buses do run on the schedule so yes the jaywalker the jaywalker so if somebody did want um our help so from ciq where they're like okay this is interesting I want to talk more about it um obviously you guys reach out to us right go to our website ciq.com there is a million ways literally on every single page you could go in there and put in your information and an email will get sent usually to me so I am more than happy to reach out and we can schedule a call and I'll grab one of these guys to

come chat about your environment and what's going on um but we are we are here right like you can go play with a sender right now you can go and grab it Jimmy's working on um you know some other other things so that it's you know easy install and that will be out soon uh there's links all over the place we we want we want to hear from you we want to hear what it is that you guys are doing the questions that you have um and and chat with you about that so definitely come and see us very exciting and if they want help

kind of implementing and setting it up like we do that right absolutely yeah we'll send Zane out I'll go hang out like I said I made it easy exactly so easy Zing can do it the goal is awesome cool all right well um we will be back here same time same place every week we are live we are so excited for your guys's questions and your interest reach out to us at ciq.com and we'll see you next week same time same place thanks guys and thanks for all of your work it's amazing thank you everyone thanks everybody [Music] thank you