Chapter 1. Overview of Cisco Crosswork Optimization Engine

This section provides the following topics:

- Overview of Cisco Crosswork Optimization Engine

- Segment Routing Path Computation Element (SR-PCE)

- Audience

Overview of Cisco Crosswork Optimization Engine

Cisco Crosswork Optimization Engine is part of the Cisco Crosswork Network Automation suite of products. Cisco Crosswork Optimization Engine provides real-time network optimization allowing operators to effectively maximize network utilization as well as increase service velocity.

Crosswork Optimization Engine provides the following:

- A topology map that gives valuable real-time visualization of devices, links, link utilization, and Segment Routing (SR) policies in the network.

- A UI that allows for easy manageability of SR policies. Crosswork Optimization Engine enables the network operator to perform the following tasks:

- Provision SR policies and modify or remove them using an intuitive workflow

- Continuously track SR policy dynamic path computations to maintain SLA objectives

- Preview an SR policy before deploying it to the network

- Crosswork Optimization Engine function packs (with correct licensing) that provide closed-loop optimization to define the optimization intent, implement the intent, and continuously monitor, track, and react to maintain the original intent.

- A framework that enables other function packs that can be developed in the field to support additional use cases that are not available out of the box. By leveraging SDKs and APIs, network operators can build additional function packs to support more optimization workflows.

Segment Routing Path Computation Element (SR-PCE)

Crosswork Optimization Engine uses the combination of telemetry and Cisco Segment Routing Path Computation Element (SR-PCE) to analyze and compute optimal SR policy paths.

Cisco SR-PCE (formerly Cisco XR Traffic Controller (XTC)) runs on the Cisco IOS XR operating system. SR-PCE provides stateful PCE functionality that helps control and move SR policies to optimize the network. PCE describes a set of procedures by which a Path Computation Client (PCC) can report and delegate control of head-end tunnels sourced from the PCC to a PCE peer. The PCC and PCE establish a Path Computation Element Communication Protocol (PCEP) connection that SR-PCE uses to push updates to the network.

Crosswork Optimization Engine discovers all devices that are part of the IGP domain including those that do not establish PCEP peering with SR-PCE. However, PCEP peering is required to deploy SR policies to the device.

Audience

This guide is for experienced network administrators who want to use Cisco Crosswork Optimization Engine in their network. This guide assumes that you are familiar with the following topics:

- Networking technologies and protocols (BGP-LS, IGP (OSPF and IS-IS), PCEP, model-driven telemetry, and so on)

- Cisco IOS XR Traffic Controller (XTC) or Segment Routing Path Computation Element (SR-PCE) functionality

- Segment routing (SR) and SR policy provisioning

Chapter 2. Installation Requirements

This section provides general guidelines and minimum requirements for individual components installed on a single server, unless otherwise specified.

This section contains the following topics:

- Virtual Machine (VM) Requirements

- Cisco IOS XR Software Version Support

- Cisco NSO and NED Requirements

- Device and SR Policy Scale Support

- IGP and Inter-AS Support

- Supported Web Browsers

- Ports Used

- Collection Modes

Virtual Machine (VM) Requirements

You can deploy Cisco Crosswork Optimization Engine as a VM on a host that meets the following minimum requirements.

Requirement

Description

Hypervisor and vCenter

- VMware ESXi 6.5 Update 2d or later.

- VMware vCenter Server 6.5 Update 2d or later.

Memory

96 GB

Storage

1 TB, but see the volume requirements displayed in the VMware GUI when configuring disk space, as shown in Install Cisco Crosswork Optimization Engine. Thin provisioning is recommended, but the provisioning choice will not affect solution performance. Solid state drives are preferred over hard disk drives. If using HDD, minimum speed should be 10,000 RPM.

vCPU

16 vCPUs

Interfaces

Dual virtual interfaces in the VM:

- One virtual interface for management network traffic, including SSH and GUI access to the VM. The DNS and NTP servers, and the default gateway, must be reachable via this interface.

- One virtual interface for data traffic. Managed devices and providers must be reachable via this interface (routable).

The installation can also be performed using a single virtual interface. Both management and data traffic will flow though this single interface.

Cisco recommends dual interfaces. If there are two interfaces, telemetry configuration will use the data interface IP to configure on devices.

IP Addresses

Two IPv4 addresses: One public IP for the management network virtual interface and one public or private IP for the data network virtual interface.

The DNS and NTP servers, and the default gateway, must be reachable via the management network IP address. The data network IP address must be able to reach managed devices, and be reachable by the servers of the providers you plan to use.

You will only need one IPv4 address if you plan to use a single virtual interface, which Cisco does not recommend.

NTP Servers

The IPv4 addresses or host names of the NTP servers you plan to use. If you want to enter multiple NTP servers, separate them with spaces. These should be the same NTP servers you use to synchronize devices, clients, and servers across your network.

DNS Servers

The IPv4 addresses of the DNS servers you plan to use. These should be the same DNS servers you use to resolve host names across your network. Confirm that the DNS servers are reachable from Cisco Crosswork Optimization Engine after configuration or installation will fail.

DNS Search Domain

The search domain you want to use with the DNS servers (for example, cisco.com). You can only have one search domain.

Private Key

This is a 32-byte Unicode text string, used to encrypt the critical inventory database. For example: CrossworkEncryptInventory123456!. Make sure it is a key you can remember.

Disclaimer

The text of the legal disclaimer displayed to clients accessing the VM via the command line. Consult your organization's IT or legal department for the content of this text.

Important Notes

- The VM runs Ubuntu Server 18.04.1 (ubuntu-18.04.1-server).

- Kubernetes runs within the Cisco Crosswork Optimization Engine VM and uses Docker for containerization. The number of containers varies as applications are added or deleted.

Cisco IOS XR Software Version Support

Cisco Crosswork Optimization Engine supports the following Cisco IOS XR software versions.

Cisco IOS XR Software Versions

Platform

PCC/Headend Software Version

SR-PCE Software Version

Telemetry

Cisco ASR 9000

- 6.5.3 + SMU (CSCvp83001)

- 6.6.2 + SMU (CSCvq82324)

6.6.2 + SMU (CSCvq82324)

- Encoding—KVGPB

- Transport—TCP

Cisco XRv 9000[1]

- 6.5.3 + SMU (CSCvp83001)

- 6.6.2 + SMU (CSCvq82324)

Cisco NCS 5500 series[2]

6.6.25 + SMU (CSCvq82324)

[1] Segment Routing Traffic Matrix (SRTM) not supported

[2] SRTM not supported

Note

Software Maintenance Updates (SMUs) are required for both PCC/Headend and SR-PCE versions indicated in the table. To download the Cisco IOS XR versions and updates, see the IOS XR Software Maintenance Updates (SMUs) document. The correct SMUs to download will have the associated bug ID number appended to the filename. For example: asr9k-x64-6.6.2.CSCvq82324.tar.

Cisco NSO and NED Requirements

Software/Driver

Version

Cisco Network Services Orchestrator (Cisco NSO)

4.4.5.3

Cisco IOS XR Network Element Driver (NED)

6.6.1

Cisco IOS Network Element Driver

5.9.2

Device and SR Policy Scale Support

The following number of devices and SR policies are supported.

Device and SR Policy Scale Support

Feature

Devices

SR Policies

SR Policy Visualization and Provisioning

1,000 nodes

10,000 interfaces

2,000 SR policies

Note

This encompasses all SR policies (including those created by Function Packs).

Topology Visualization

5,000 nodes

Not applicable

IGP and Inter-AS Support

The following table captures the IGP and inter-AS features that Cisco Crosswork Optimization Engine supports.

IGP and Inter-AS Support

Feature

OSPF

IS-IS

Inter-AS

Topology Visualization (including SR Policies)

Supported

Supported

Egress Peer Engineering (EPE) is limited to EPE adjacency segment IDs (SIDs)

SR Policy Creation, Modification, and Deletion

Supported

Supported

EPE is limited to EPE adjacency SIDs

Bandwidth on Demand Function Pack

Supported

Supported

Not Supported

Bandwidth Optimization Function Pack

Only single area is supported

Only single level is supported

Not Supported

Supported Web Browsers

This version of Cisco Crosswork Optimization Engine supports the web browsers shown in the table below.

Recommended display resolution: 1600 x 900 pixels or higher (minimum: 1366 x 768).

Browser

Version

Google Chrome

(recommended)

75 or later

Mozilla Firefox

60 or later

Ports Used

As a general policy, any ports that are not needed should be disabled. You need to know which ports are enabled, and then decide which of those ports may be safely disabled without disrupting the normal functioning of Cisco Crosswork Optimization Engine. You can decide by listing the ports that are open and comparing it with the list of ports that are needed for Cisco Crosswork Optimization Engine. To view a list of all open listening ports, log in as a Linux CLI admin user and run the netstat -aln command.

In addition to the ports listed in the following tables: All client desktops accessing geographical map information in the Cisco Crosswork Optimization Engine topology maps must be able to reach the mapbox.com map data URL directly, via the standard HTTPS port 443. Similar guidance may apply if you choose a different map data provider, as explained in "Configure Geographical Map Settings" in the Cisco Crosswork Optimization Engine User Guide .

The following table lists the external ports that are open on the Cisco Crosswork Optimization Engine VM.

External Ports That Are Open on the VM

Port

Protocol

Usage

22

TCP

Remote SSH traffic

323

UDP

Network Time Protocol (NTP) listener

30162

UDP

SNMP trap port to receive trap notifications

30603

TCP

User interface (NGINX server listens for secure connections on port 443)

31500:31502

TCP, UDP

MDT collector

The following table lists the destination ports on external devices that may be protected by a firewall. Cisco Crosswork Optimization Engine uses these ports to connect to network devices. You must open the required ports to allow Cisco Crosswork Optimization Engine to connect to these devices.

Destination Ports Used by Cisco Crosswork Network Automation

Port

Protocol

Usage

7

TCP/UDP

Discover endpoints using ICMP

22

TCP

Initiate SSH connections with managed devices

23

TCP

Communicate with managed devices using Telnet

53

TCP/UDP

Connect to DNS

123

UDP

Network Time Protocol (NTP)

161

UDP

Poll using SNMP

830

TCP

Initiate NETCONF

Collection Modes

You may choose one of the following modes for device management collection during installation.

Single Collection Mode

In single collection mode, only one MDT collector is used for devices. Consider the following information when choosing single collection mode:

- The maximum number of MDT capable devices that can be managed is 500.

- If you do not plan to use Cisco NSO, choose single collection mode. Devices cannot be mapped to Cisco NSO.

- Telemetry configuration will not be automatically pushed by Cisco Crosswork Optimization Engine to devices. You must push the telemetry configuration to devices. See the "Prerequisites for Device Telemetry" topic in the Cisco Crosswork Optimization Engine User Guide.

- The default MDT collector port is 31500.

- Changing from single to multiple collection mode requires help from a Cisco representative.

Multiple Collection Mode

In multiple collection mode, multiple MDT collectors are enabled depending on the number of MDT devices that are added. For the first 500 devices, default 31500 ports will be configured to reach the first MDT collector. The next 500 devices, 31503 ports will be configured to reach the second collector, and so on.

Note

If devices are deleted and then added to Cisco Crosswork Optimization Engine again, then original port assignments will change.

Consider the following information when choosing multiple collection mode:

- More than 500 MDT capable devices can be managed.

- You must add a Cisco NSO provider and map devices to it.

Chapter 3. Installation Tasks

This section contains the following topics:

- Install Cisco Crosswork Optimization Engine

- Verify the VM Configuration

- Log In to the UI From a Browser

- Troubleshoot the Installation

Install Cisco Crosswork Optimization Engine

Before you begin, ensure that:

- You are creating the Cisco Crosswork Network Automation VM on VMware ESXi 6.5 (Update 2d or later), and using the VMware vCenter Server 6.5 (Update 2d or later). .

- The Cisco Crosswork Network Automation VM has allocated to it a minimum of 96 GB of RAM, 16 vCPUs, and 1 TB of hard drive space.

- You have a public IPv4 address to assign to the Cisco Crosswork Network Automation VM's management network virtual interface. The DNS and NTP servers, and the default gateway, must be reachable via this IP address.

- You have a public or private IPv4 address to assign to the Cisco Crosswork Network Automation VM's data network virtual interface. This IP address must be able to reach your managed devices, and be reachable by Cisco Network Services Orchestrator.

During installation, Cisco Crosswork Optimization Engine creates two special administrative IDs:

1. The virtual machine (VM) administrator, with the username cw-admin, and the default password cw-admin. Data center administrators use this ID to log in to and troubleshoot the Cisco Crosswork Network Automation VM hosting the Cisco Crosswork Optimization Engine server. You will use it to verify that the VM has been properly set up (see Verify the VM Configuration).

2. The Crosswork administrator, with the username admin and the default password admin. Product administrators use this ID to log in to and configure the Cisco Crosswork Optimization Engine user interface, and to perform special operations, such as stopping and restarting services.

These two administrative usernames are reserved and cannot be changed. The first time you log in using either of these administrative IDs, you will be prompted to change that ID's password.

While this section describes installation, you must also set up Cisco SR-PCE in order to use Cisco Crosswork Optimization Engine. Refer to the appropriate device configuration guide (for example, Segment Routing Configuration Guide for Cisco ASR 9000 Series Routers).

Procedure

Step 1

Download the latest available Cisco Crosswork Optimization Engine image file (*.ova) to your system.

Warning

The default VMware vCenter deployment timeout is 15 minutes. The total time needed to deploy the OVA image file may take much longer than 15 minutes, depending on your network speed and other factors. If vCenter times out during deployment, the resulting VM will be unbootable. To prevent this, Cisco recommends that you either set the vCenter deployment timeout to a much longer period (such as one hour), or unTAR the OVA file before continuing and then deploy using the OVA's three separate Open Virtualization Format and Virtual Machine Disk component files: cw.ovf, cw_rootfs.vmdk, and cw_dockerfs.vmdk.

Step 2

With VMware ESXi running, log in to the VMware vSphere Client or vSphere Web Client. Then select Actions > Deploy OVF Template, as shown in the following figure.

Step 3

The VMware Deploy OVF Template wizard appears and highlights the first step, 1 - Select an OVF Template, as shown in the following figure. Click Browse to navigate to the location where you downloaded the OVA image file and select it. Once selected, the file name is displayed in the window.

Step 4

Click Next to go to 2 - Select a name and folder, as shown in the following figure. Enter a name for the Cisco Crosswork Network Automation VM you are creating. In the Select a location for the virtual machine list, choose the location under which the Cisco Crosswork Network Automation VM will reside.

Cisco recommends that you include the Cisco Crosswork Optimization Engine version and build number in the name (for example: CW_VM-1.0.0_400).

VM Name

Step 5

Click Next to go to 3 - Select a compute resource, as shown in the following figure. Choose the Cisco Crosswork Network Automation VM’s host.

Step 6

Click Next. The VMware vCenter Server validates the OVA. Network speed will determine how long validation takes. When validation is complete, the wizard moves to 4 - Review details, as shown in the following figure. Take a moment to review the OVF template you are deploying. Note that this information is gathered from the OVF and cannot be modified.

Step 7

Click Next to go to 5 - License Agreements. Review the End User License Agreement and ensure that the I accept all license agreements checkbox is checked before you continue.

Step 8

Click Next to go to 6 - Configuration, as shown in the following figure. Select the number of interfaces (VMNICs) to use. Cisco recommends that you choose the default Dual Interface configuration.

Step 9

Click Next to go to 7 - Select Storage, as shown in the following figure. Cisco recommends that you select Thin Provision from the Select virtual disk format drop-down list. From the table, choose the datastore you want to use and review its properties to ensure there is enough available storage.

Step 10

Click Next to go to 8 - Select networks, as shown in the following figure. In the dropdown table at the top of the page, choose the appropriate destination network for the source Data Network and Management Network, respectively.

Step 11

Click Next to go to 9 - Customize template, with the Management IPv4 Address settings already expanded, as shown in the following figure. Make entries in both fields:

- The Management IPv4 Address is the IP address for managing and interacting with the Cisco Crosswork Optimization Engine user face. Enter it in CIDR format.

- The Management IPv4 Gateway is the IPv4 address of the primary gateway to the Cisco Crosswork Optimization Engine management IP and the management network.

Step 12

Expand the Data Network IPv4 Address settings, as shown in the following figure. Make entries in both fields:

- The Data IPv4 Address is the IP address for managing and interacting with the managed devices and with Cisco Crosswork Optimization Engine providers. Enter it in CIDR format.

- The Data IPv4 Gateway is the IPv4 address of the primary gateway to the Cisco Crosswork Optimization Engine data IP address, and to the managed devices and providers.

Step 13

Expand the DNS and NTP Servers settings, as shown in the following figure. Make entries in three fields:

- DNS IPv4 Address: The IPv4 addresses of the DNS servers you want the Cisco Crosswork Optimization Engine server to use. Separate multiple IP addresses with spaces.

- DNS Search Domain: The name of the DNS search domain.

- NTP Servers: The IP addresses or host names of the NTP servers you want to use. Separate multiple IPs or host names with spaces.

Step 14

Expand the Disk Configuration settings, as shown in the following figure. Make entries in all three fields. . The settings shown in the figure should work for most environments.

Step 15

Expand the Crosswork Configuration settings, as shown in the following figure. Make entries in both fields. The Private Key encrypts the inventory database.

Step 16

Expand the Crosswork Collection Configuration settings, as shown in the following figure.

Check this option if you plan to use Cisco NSO and want to manage more than 500 MDT capable devices. By selecting this option, you will have enabled the multiple collection mode which uses multiple MDT collectors (depending on the number of devices that are added). Do not check this option if you do not plan to add Cisco NSO as a provider. When this option is deselected, you will have enabled the single collection mode where only one MDT collector is used and Cisco NSO cannot be mapped to devices. For more guidance and information on which mode to select, see Collection Modes).

Step 17

Click Next to go to 10 - Ready to Complete, as shown in the following figure. Review your settings and then click Finish if you are ready to begin deployment.

Step 18

Wait for the deployment to finish before continuing. To check on the deployment status:

1. Open a VMware vCenter client.

2. In the Recent Tasks tab for the host VM, view the status for the Deploy OVF template and Import OVF package jobs, as shown in the following figure.

Step 19

After the deployment tasks are complete, edit the host's VM settings to permit boot from EFI Firmware:

1. On the host VM Summary tab, below the VM Hardware table, click Edit Settings, as shown in the following figure.

2. On the Edit Settings page, click the VM Options tab.

3. Expand the Boot Options dropdown list and change the Firmware setting to EFI, as shown in the following figure. When you are finished, click OK. You may want to take a snapshot of the VM at this point.

Step 20

You can now power on the Cisco Crosswork Network Automation VM to complete the deployment process. Expand the host’s entry so you can click the Cisco Crosswork Network Automation VM and then choose Actions > Power > Power On, as shown in the following figure.

Power On

From this point, it will take 20 minutes for the Cisco Crosswork Network Automation VM to become operational. Please wait for the process to finish before continuing.

Verify the VM Configuration

Before trying to log in to the new installation, verify that the VM is properly configured. You will be prompted to change the VM administrator's password during first login via the console.

Procedure

Step 1

Connect to the Cisco Crosswork Optimization Engine VM via SSH, as follows:

Enter the SSH command using he default VM administrator user name (cw-admin) and the IPv4 management network address you specified when deploying the Cisco Crosswork Optimization Engine image, as follows:

ssh cw-admin@ManagementNetworkIP

Where ManagementNetworkIP is the management network IPv4 address. For example:

ssh cw-admin@1.1.1.1

When prompted, enter the default cw-admin user password, cw-admin.
If you cannot connect to the VM at all, see Troubleshoot the Installation.

Step 2

When prompted to change the cw-admin user's password, enter the default password again for verification. Then enter and confirm the new password as prompted.

Step 3

Shift to sudo user access (sudo su), then enter the following commands to verify the Cisco Crosswork Optimization Engine VM:

- ifconfig eth0—Shows the management network IP address of the VM. This should match the management network IP address you entered during the installation.

- ifconfig eth1—Shows the data network IP address of the VM. This should match the data network IP address you entered during the installation.

- kubectl get nodes—Checks the Kubernetes cluster and shows the VM IP address with a Ready status.

If the IP addresses do not match what you entered, or you do not get a Ready status, see Troubleshoot the Installation.

Log In to the UI From a Browser

To log in to the Cisco Crosswork Optimization Engine web-based user interface from a browser, perform these steps. If you are unable to display the user interface, see Troubleshoot the Installation.

Before you begin

Connect to the virtual machine and verify that it is properly configured before attempting to log in to the user interface (see Verify the VM Configuration).

Procedure

Step 1

Launch one of the supported browsers (see Supported Web Browsers).

Step 2

In the browser's address bar, enter:

https://<Crosswork_VM_management_IP_adddress>:30603/

The Log In window opens, as shown in the following figure.

Cisco Crosswork Optimization Engine Log In Window

When you access Cisco Crosswork Optimization Engine for the first time, some browsers display a warning that the site is untrusted. When this happens, follow the prompts to add a security exception and download the self-signed certificate from the Cisco Crosswork Optimization Engine server. After you add a security exception, the browser accepts the server as a trusted site in all future login attempts. If you want to use a CA signed certificate, see the "Manage Certificates"section in the Cisco Crosswork Optimization Engine User Guide.

Step 3

Log into Cisco Crosswork Optimization Engine as follows:

1. Enter the Cisco Crosswork Network Automation administrator username admin and the default password admin.

2. Click Log In.

3. When prompted to change the Cisco Crosswork Network Automation administrator's default password, enter the new password in the fields provided and then click OK.

Step 4

To exit the web GUI, close the browser window or click at the top right of the home page and choose Log out.

Troubleshoot the Installation

The following table lists common problems experienced while installing Cisco Crosswork Optimization Engine, and approaches to identifying the source of the problem and solving it.

Troubleshoot the Installation

Issue

Action

Cannot Connect to the VM

VM cannot be reached by the provided gateways due to IP misconfiguration

1. You will see error messages in the login banner indicating this problem when you try to connect to the VM via SSH following the steps in as explained in Verify the VM Configuration.

2. Redeploy the VM from scratch, using the correct IP configuration.

VM cannot be reached by the provided gateways due to other network issues

1. Log into the VM via the VMware console.

2. Change the IP settings as needed to fix the issue.

Cannot Display the User Interface

Browser does not display the login screen.

1. Make sure you are using a supported browser (see Supported Web Browsers and that you entered the correct IP address in the browser (this should be the same as the management IP4 address you entered during installation).

2. Log in to the VM using SSH, as explained in Verify the VM Configuration.

3. At the prompt, enter the command collect.

4. Contact Cisco TAC.

Running kubectl get nodes does not display the correct VM IPv4 management and data addresses.

1. While connected to the VM, open the file /etc/resolve.conf file and check that it contains the correct DNS name server and search domain.

2. If it does not, redeploy the VM using the correct DNS name server and search domain configuration.

Running kubectl get nodes does not display a Ready status for the VM IPv4 address.

1. While connected to the VM, check the login banner for any error messages.

2. If there are error messages in the login banner, they will be recorded in /var/log/firstBoot.log file, along with recommended remediation steps. Open the log and follow the steps given for the error message found in the banner.

3. If this does not help, run kubectl get pods --namespace kube-system and look for mismatched Ready counts.

Running kubectl get pods --namespace kube-system displays one or more mismatched Ready status counts (for example: 2/3 Ready or 0/1 Readyinstead of 3/3 Ready or 1/1 Ready).

1. Check for user input errors in the /var/log/boot.log file and perform the log's recommended remediation steps.

2. If this does not help, redeploy the VM.

Able to Display the User Interface

I cannot log in.

1. Make sure you are using the Crosswork administrator default user ID and password (admin and admin).

2. If the Crosswork administrator default password has already been changed, use the new password.

I can log in but cannot access some features.

Make sure all the applications and their underlying services are up and running by selecting Admin > Crosswork Manager and checking the status of the applications and services. See the Cisco Crosswork Optimization Engine User Guide topic "Monitor Cisco Crosswork Infrastructure and Resources".

Crosswork Manager shows one or more applications or their underlying services are not running.

1. In Crosswork Manager, check the description of the application or service issue and, if possible, try restarting the application or service. See the Cisco Crosswork Optimization Engine User Guide topic "Monitor Cisco Crosswork Infrastructure and Resources".

2. Gather log and metric information about the application or service with issues. See the User Guide topic "View, Control and Log Cisco Crosswork Applications and Services".

3. Contact Cisco TAC.