Intersight接続用のスタンドアロンNexusの設定と要求

Switch# run bash ip netns exec management openssl s_client -connect svc.intersight.com:443
CONNECTED(00000004)
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, CN = Amazon RSA 2048 M01
verify return:1
depth=0 CN = us-east-1.intersight.com
verify return:1
---
Certificate chain
 0 s:CN = us-east-1.intersight.com
   i:C = US, O = Amazon, CN = Amazon RSA 2048 M01
 1 s:C = US, O = Amazon, CN = Amazon RSA 2048 M01
   i:C = US, O = Amazon, CN = Amazon Root CA 1
 2 s:C = US, O = Amazon, CN = Amazon Root CA 1
   i:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
 3 s:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
   i:C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGfzCCBWegAwIBAgIQD859tBjpT+QUyVOXqkG2pzANBgkqhkiG9w0BAQsFADA8
MoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Kg
UlNBIDIwNDggTTAxMB4XDTIzMDQwNTAwMDAwMFoXDTI0MDUwMzIzNTk1OVowIzEh
MB8GA1UEAxMYdXMtZWFzdC0xLmludGVyc2lnaHQuY29tMIIBIjANBgkqhkiG9w0B
AoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Kn
BDM+MCNnvmgNDlGnU6/t1jOC780QpKXr2ksbGC0FzHfMvNjEk9kMCUe179dummrs
pOOFzvIrJGqYvkIXT5WLtiU9aP3+VSEWQO1kTeDHoDfLLJLON42cKjskYt0jCTwE
poKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0KI
elf3tYBhuQK3y4DoSqg1/gptnUOlNwSqMu4zXjI7neGyHnzjsPUyI8qilXbPS9tV
KoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Kw
HwYDVR0jBBgwFoAUgbgOY4qJEhjl+js7UJWf5uWQE4UwHQYDVR0OBBYEFM7X7s7c
NoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Kp
Z2h0LmNvbYIac3ZjLXN0YXRpYzEuaW50ZXJzaWdodC5jb22CGioudXMtZWFzdC0x
LoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0K1
Y3MtY29ubmVjdC5jb22CE3N2Yy51Y3MtY29ubmVjdC5jb22CDmludGVyc2lnaHQu
Y29tghJzdmMuaW50ZXJzaWdodC5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
MBQGCCsGAQUFBwMBBggrBgEFBQcDAjA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8v
YoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0KI
BgZngQwBAgEwdQYIKwYBBQUHAQEEaTBnMC0GCCsGAQUFBzABhiFodHRwOi8vb2Nz
coKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Ku
cjJtMDEuYW1hem9udHJ1c3QuY29tL3IybTAxLmNlcjAMBgNVHRMBAf8EAjAAMIIB
fgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdwDuzdBk1dsazsVct520zROiModGfLzs
3oKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0K5
CSFqTpBjlOdOLQ4YuQIhAO10VDrLJMM+9EtOwmZd8Q1MRHJlOlr2VWmOTF6GGkCV
AHUAc9meiRtMlnigIH1HneayxhzQUV5xGSqMa4AQesF3crUAAAGHUp9iOwAABAMA
RjBEAiAFPPLvt7TN7mTRnQZ+FZLGR/G04KQqSjYuszDNPArT3wIgf/sQbQqNjCk7
joFUuL9cEPYfNm7n1nZIFIRAK6UqwG0AdgBIsONr2qZHNA/lagL6nTDrHFIBy1bd
LoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0K8
MXtts5t/C5lYw5peGAIgK0eFmxTptEfMkBZti39vepUxb5meDvKaZdtXVvFpkCMw
DQYJKoZIhvcNAQELBQADggEBANl6HKZ9P6AIufr7qdNCcW+DXClY6dqX1KN0sCh+
UoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0KM
z5R1VV+81gN2HHiuUsEOFwHDbbhiGBJiJteFm0blpruKHennx8HQYfC7bup4N5JH
YoKXXrXrkESkWgbQadlEo3H545Zsix+mu83r7Gmv5L3+WFKzfUmLgeB2+z1Dk0Kb
LKFl6c+EN0Y76YaCV8doujG3qD/bO9VDx7dhvbSEECYuzbYyPDGnb7Drmhny0Eki
smLUZ3TVcCvPc+1dE/jrbBzPeIY7jGr8eL7masFCuZZn2lM=
-----END CERTIFICATE-----
subject=CN = us-east-1.intersight.com

issuer=C = US, O = Amazon, CN = Amazon RSA 2048 M01

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5754 bytes and written 442 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 66D0B69FAA7EB69FAA7EC54C9764966ED9A1289650B69FAA7EB69FAA7E9A5FD5ADE
    Session-ID-ctx:
    Master-Key: B69FAA7E45891555D83DFCAEB69FAA7EB69FAA7EA3A99E7689ACFB69FAA7EAD7FD93DB69FAA7EB1AF821
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 86400 (seconds)
    TLS session ticket:
    0000 - 36 12 b2 36 b3 53 07 29-54 ac 56 f0 06 83 4f b1   6..6.S.)T.V...O.
    0010 - 49 35 51 40 22 07 bd 7e-59 d7 7e 44 29 ff c6 2a   I5Q@"..~Y.~D)..*
    0020 - ec bc 11 e1 d3 5d 69 e8-7a d2 f1 c2 08 f6 5b 8f   .....]i.z.....[.
    0030 - 2c 5b 5e 50 e3 e2 8f e7-c4 44 8f e4 6d 45 d2 64   ,[^P.....D..mE.d
    0040 - 93 98 f5 e8 b0 f7 1d 00-26 4b 88 ea 2d 7d 42 58   ........&K..-}BX
    0050 - 05 9f 71 3a fe ac f0 15-a5 5c 1d 74 74 bf 32 1b   ..q:.....\.tt.2.
    0060 - d8 a8 23 84 08 cc f9 3e-54                        ..#....>T

    Start Time: 1707515659
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---

# run bash ip netns exec management curl -v -I -L -X POST https://svc.intersight.com:443 --proxy http://proxy.esl.cisco.com:80
Trying 10.201.255.40:80...
* Connected to proxy.esl.cisco.com (10.201.255.40) port 80 * CONNECT tunnel: HTTP/1.1 negotiated
* allocate connect buffer
* Establish HTTP proxy tunnel to svc.intersight.com:443
> CONNECT svc.intersight.com:443 HTTP/1.1
> Host: svc.intersight.com:443
> User-Agent: curl/8.4.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established HTTP/1.1 200 Connection established
< snip >

curl -v --noproxy '*' \
     --location 'http://10.1.1.3:80/ins' \
     --header 'Content-Type: application/json' \
     --header 'Authorization: Basic YWRtaW46Y2lzY28hMTIz' \
     --data '{
                "ins_api": {
                    "version": "1.0",
                    "type": "cli_show",
                    "chunk": "0",
                    "sid": "sid", 
                    "input": "show clock",
                    "output_format": "json"
                 }
            }'

* Trying 10.1.1.3...
* TCP_NODELAY set
* Connected to 10.1.1.3 (10.1.1.3) port 80 (#0)
> POST /ins HTTP/1.1
> Host: 10.1.1.3
> User-Agent: curl/7.61.1
> Accept: */*
> Content-Type: application/json
> Authorization: Basic YWRtaW56Y2lzY28hBNIz
> Content-Length: 297
>
* upload completely sent off: 297 out of 297 bytes
< HTTP/1.1 200 OK
< Server: nginx/1.19.6
< Date: Fri, 09 Feb 2024 23:17:10 GMT
< Content-Type: text/json; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Set-Cookie: nxapi_auth=dzqnf:xRYwR0l1Tra64VfOMVuD4oI4=; Secure; HttpOnly;
< anticsrf: /i3vzCvxhOr4w2IrKP+umbDnzHQ=
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< Content-Security-Policy: block-all-mixed-content; base-uri 'self'; default-src 'self'; script-src 'self' 'nonce-zHx12KP1tervan1s6lrFQz7N6PF0rh'; style-src 'self' 'nonce-zHx12KP1tervan1s6lrFQz7N6P40rh'; img-src 'self'; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; form-action 'self'; frame-ancestors 'self';
<
{
    "ins_api":    {
        "type":    "cli_show",
        "version":    "1.0",
        "sid":    "eoc",
        "outputs":    {
            "output":    {
                "input":    "show clock",
                "msg":    "Success",
                "code":    "200",
                "body":    {
                    "simple_time":    "23:17:10.814 UTC Fri Feb 09 2024\n",
                    "time_source":    "NTP"
                }
            }
        }
    }
* Connection #0 to host 10.1.1.3 left intact
}%

---
all:
  hosts:
    switch1:
      ansible_host: "10.1.1.3"
      intersight_src: "mgmt0"
      intersight_vrf: "management"

  vars:
      ansible_user: "admin"
      ansible_password: "cisco!123"
      ansible_connection: ansible.netcommon.network_cli 
      ansible_network_os: cisco.nxos.nxos
      ansible_httpapi_use_proxy: False
      remote_tmp: "/bootflash"
      proxy_env:
         - no_proxy: "10.1.1.3/24"
      intersight_proxy_host: 'proxy.cisco.com'
      intersight_proxy_port: '80'


      api_key_id: "5fcb99d97564612d33fdfcal/5fcb99d97564612d33fdf1b2/65c6c09d756461330198ce7e"
      api_private_key: "/home/admin/ansible-intersight-nxos/my_intersight_private_key.txt"
...

❯ ansible-playbook -i inventory.yaml playbook.yaml

PLAY [all] *********************************************************************************************************************************************************

TASK [Enable feature intersight] ***********************************************************************************************************************************
[WARNING]: To ensure idempotency and correct diff the input configuration lines should be similar to how they appear if present in the running configuration on
device
changed: [switch1]

TASK [Configure proxy] *********************************************************************************************************************************************
ok: [switch1]

TASK [Unconfigure proxy] *******************************************************************************************************************************************
skipping: [switch1]

TASK [Configure src interface] *************************************************************************************************************************************
ok: [switch1]

TASK [Unconfigure src interface] ***********************************************************************************************************************************
skipping: [switch1]

TASK [Configure src vrf] *******************************************************************************************************************************************
ok: [switch1]

TASK [Unconfigure src vrf] *****************************************************************************************************************************************
skipping: [switch1]

TASK [Await connection to Intersight] ******************************************************************************************************************************
FAILED - RETRYING: [switch1]: Await connection to Intersight (10 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (9 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (8 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (7 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (6 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (5 retries left).
FAILED - RETRYING: [switch1]: Await connection to Intersight (4 retries left).
ok: [switch1]

TASK [Get show system device-connector claim-info] *****************************************************************************************************************
ok: [switch1]

TASK [Set claiminfoDict] *******************************************************************************************************************************************
ok: [switch1] => (item=SerialNumber: FDO21112E2L)
ok: [switch1] => (item=  SecurityToken: 0A70886FE1B8)
ok: [switch1] => (item=  Duration: 599)
ok: [switch1] => (item=  Message: )
ok: [switch1] => (item=  Claim state: Not Claimed)

TASK [claim device - PROXY] ****************************************************************************************************************************************
skipping: [switch1]

TASK [claim device - NO PROXY] *************************************************************************************************************************************
changed: [switch1]

PLAY RECAP *********************************************************************************************************************************************************
switch1                    : ok=8    changed=2    unreachable=0    failed=0    skipped=4    rescued=0    ignored=0

 - name: Get intersight info
    nxos_command:
      commands:
      - show system internal intersight info
    register: intersightInfo_claimed
    retries: 10
    delay: 10
    until: intersightInfo.stdout is search("Connecte")

  - name: Display intersight info
    vars:
      msg: |-
           output from {{ inventory_hostname }}:
           {{ intersightInfo_claimed.stdout | join("") }}
    debug:
      msg: "{{ msg.split('\n') }}"

TASK [Get intersight info] ***************************************************************************************************
ok: [switch1]

TASK [Display intersight info] ***********************************************************************************************
ok: [switch1] => {
    "msg": [
        "output from switch1:",
        "Intersight connector.db Info:",
        "ConnectionState         :Connected",
        "ConnectionStateQual     :",
        "AccountOwnershipState   :Claimed",
        "AccountOwnershipUser    :vricci@cisco.com",
        "AccountOwnershipTime    :2024-02-10T01:00:28.516Z",
        "AccountOwnershipId      :vricci",
        "DomainGroupMoid         :5fcb98d97565612d33fdf1ae",
        "AccountMoid             :5fcb98d97565612d33fdf1ac",
        "CloudDns                :svc.intersight.com",
        "CloudDnsList:           ",
        "        1.              :svc.intersight.com",
        "        2.              :svc-static1.intersight.com",
        "        3.              :svc.ucs-connect.com",
        "        4.              :svc-static1.ucs-connect.com",
        "Identity                :65c6caac6f72613901f841c1",
        "CloudEnabled            :true",
        "ReadOnlyMode            :false",
        "LocalConfigLockout      :false",
        "TunneledKVM             :false",
        "HttpProxy:              ",
        "        ProxyHost       :proxy.cisco.com",
        "        ProxyPort       :80",
        "        Preferenc       :0",
        "        ProxyType       :Manual",
        "    Target[1]:          ",
        "        ProxyHost       :proxy.cisco.com",
        "        ProxyPort       :80",
        "        Preference      :0",
        "LogLevel                :info",
        "DbVersion               :1",
        "AutoUpgradeAdminState   :Automatic"
    ]
}