- Now before we get into the video,
I created this video before this announcement from Cisco.
Cisco have announced that the VIRL 2 name
is gonna be replaced with the name CML-P,
or Cisco Modeling Labs-Personal edition.
So I'll be using the name VIRL 2 in this video,
because I recorded it before this name change.
I'll probably still use that name by mistake
'cause it'll take me a while
to get used to the new name CML-P.
So just be aware that I've recorded this video
before the product has been released.
I've got a pre-release version of Cisco VIRL
or CML personal edition.
Okay, so let's get started.
(bright upbeat music)
In this video, I'm gonna show you how to use the VIRL 2,
breakup tool, which I think is a fantastic feature
in Cisco VIRL.
One of the things that the VIRL developers
have done really well in Cisco VIRL 2
is that you only have to open port 443 on the VIRL server.
In other words, you only have to permit SSL
or TLS traffic to the VIRL server.
You can close all other ports on your firewalls
and only permit that one port.
But, how do I tell it as an example,
or SSH from this Windows computer to my VIRL server,
if I've locked down all the ports except Port 443.
Well, that's where this local breakout tool gets used.
What it allows me to do basically
is set up PuTTY sessions, so Telnet sessions,
to a local proxy server running on my laptop,
and then that proxies or tunnels the session
to the VIRL server using TLS.
So in this example,
I'm running the Cisco VIRL server on my Mac
within VMware Fusion.
I'm going to run the local breakout tool
on the Windows computer,
install a piece of software on the Windows computer
that sets up this proxy Telnet
using PuTTY on my Windows computer to this breakout tool,
which then basically tunnels my session using TLS
or HTTPS to the VIRL server.
So I can load this VIRL server on a server somewhere
or in the cloud.
And all I need to permit is Port 4432, to that VIRL server,
I can set up my console sessions
or my VNC sessions to the VIRL server,
and only allow Port 443.
So again, basically, the breakout tool
is a piece of software that I install on my client.
It runs locally, I download that software
from the VIRL server, install it locally.
And then when I set up a session using PuTTY as an example
to my local host, it tunnels the session
using TLS to the consoles of devices running within VIRL.
I think this is a fantastic feature once again,
because all I need to permit on my firewalls is Port 443.
All other ports can be blocked and I only permit
HTTPS traffic to my VIRL server.
But I can still connect to multiple consoles
on the VIRL server using this local breakout
application running locally on my PC.
Okay, so let's get started
and I'll show you how to set this up on a Windows computer.
Where I've got the breakout tool on Windows,
the VIRL server on a Mac.
The breakout application is supported on Windows,
Mac and Linux.
(upbeat music)
Okay, so once again,
Cisco VIRL is running in VMware Fusion on my Mac,
I'm gonna connect to the VIRL server
from my Windows computer.
But just to make the recordings easier for me,
I'm going to be controlling
that Windows computer using VNC from my Mac,
but I am recording locally on the Windows computer
so you can see what I'm doing.
So firstly, on my Mac, my VIRL server has booted,
has IP address 1921681102.
Now I'm not currently in my studio in the UK.
I'm in South Africa,
currently in lockdown because of this virus,
these two devices
are connected to this little wireless router.
So the laptop is connecting via wireless
to the VIRL server via this little router.
Okay, so the VIRL server has been given
IP address 1921681102 via DHCP.
Now one of the things I like about VIRL
is, can use DHCP.
I haven't got a client that's configured
to talk to the VIRL server
that has to have a static IP address.
This can change while I'm traveling.
It's not a problem.
Okay, so on Windows, I'm going to open Google Chrome
and I'm gonna browse to that IP address
192 168 1102.
VIRL prompt is displayed.
I'm gonna login with my username, admin password,
Cisco 123.
Now I've shown you in previous videos such as this one,
how to get VIRL working.
So I'm not gonna show you that here again.
I'm assuming in this example
that you've got VIRL up and running.
So under Tools, I'm going to go to breakout tool.
And I'm told briefly what the breakout utility does.
So the firewall to breakout utility
provides users connectivity to device console ports
that are operating in a lab environment.
It acts like a local terminal server
that embeds the various serial ports/lines
into a single HTTPS connection.
Console access is done via Telnet
and the graphics frame buffer is accessed
via the VNC protocol.
So we can use our favorite terminal emulators here
such as PuTTY or secure CRT to access VIRL devices.
Okay, so I'm going to scroll right down to the bottom
of this page.
And I'm going to download this breakout utility for Windows.
As you can see, once again, they've got a Linux utility
and a Mac OS utility.
But I'm only interested in the windows utility.
I wanna keep that executable.
Okay, so typically,
you would double click on an executable to start it.
But that's not what we're going to do here.
What I'm going to do is open up a command prompt.
I'm gonna go to my Downloads directory,
Dir shows me that the application is available
in my Downloads directory.
If I run the application without any options,
I get help information.
And I'm told to use either config, init, run or UI.
UI is the easiest option to use.
And that's what I'm going to use here
to show you how to get this application working.
So what I need to do
is run that executable with the UI option.
So I'm going to clear the screen,
run the application again, but use UI.
And as you can see,
we told that the system cannot find this labs yaml file,
but it's running a server on the loopback address,
Port 8080.
Okay, so the next step is to browse
using HTTP to the localhost
Port 8080.
Now, you may get an error here,
but don't worry too much about that.
What we need to do is configure the breakout tool
to use HTTPS.
Make sure that you use HTTPS,
and then the IP address of the VIRL server.
So back on my Mac VIRL server IP address is 1921681102.
So on the Windows computer,
I'm gonna configure it to use HTTPS 1921681102.
I'm not going to verify the certificate
because I'm using a self signed certificate here.
Now you can populate all the nodes if you want to.
Basically, when you enable this,
it fetches all available nodes from the controller.
Otherwise only started nodes will be included.
So you can specify whether you want to include all
or only started nodes.
For the moment, I'll only include started nodes.
The username that I'm using is admin.
Password is going to be Cisco 123,
console start port,
I'm gonna leave everything at defaults.
And I'm gonna click Save.
The configuration has now been saved.
But what you need to do now
for things to work is you need to shut down the application.
So back in my console,
you can see a bunch of stuff has been happening.
I'm gonna press Ctrl C,
to stop the application.
And then I'm gonna run it again.
So if you make changes through the GUI,
you need to stop the application and then start it up again.
You can use a config or CLI option,
which is more powerful,
but we're not gonna do it that way.
We're gonna keep things simple.
Okay, it says empty lab list
suggest to refresh list from controller.
So if I click Refresh there, nothing happens.
But notice this option,
refresh lab data from controller.
Now we seeing no data.
And that's probably because we have no node started
on the VIRL server.
Notice nothing has started here.
I see three devices,
but they all stopped here three devices, they all stopped.
So what I'll do is start my asa lab.
So as you can see, these three devices are now starting up.
So back on the breakout tool,
if I press refresh,
okay, so I can see my asa lab.
This is the ID.
Here's the title.
I need to enable the lab.
So make sure you click on this.
And then you can click on the lab,
I can see that this serial port is connected,
this serial port is connected,
and this serial port is connected.
I can see the port numbers
that I need to use to access the devices.
I can see those port numbers are enabled.
So all I need to do now is open up PuTTY,
or my favorite terminal emulation application.
So you could use secure CRT for this if you wanted to.
But I'll just use PuTTY to make it simple.
And all I need to do now is connect to localhost.
So my local computer,
using Telnet on Port 9000.
So that's the port that should connect me to my Cisco asa.
I'm gonna click Open.
And notice, when I press enter,
I've connected to the asa running in Cisco VIRL.
Now just to prove the point,
I'm gonna jump back to my Mac.
So on my Mac, I'm gonna open chrome.
VIRL is running once again, on this local Mac.
I'm gonna browse to 1921681102,
which is my VIRL server.
Login is admin,
Cisco 123.
Go to my asa lab.
So here's my asa lab.
And I'll connect to the console of my asa.
Okay, so I'm recording now on my Mac.
Notice you'll see the output on the PuTTY session,
as well as the console session
running within my web browser on my Mac.
I'll jump back to the PC now.
So show interface,
summary as an example.
So I typed the command show interface summary.
Back on my Mac in Chrome,
I can see the output of that command.
So basically, this breakout tool
is authenticating remote sessions.
It's encrypting the traffic
and it's multiplexing sessions together.
So let's go back to the Windows computer
just to show you what's possible.
So, once again, that's my asa.
What I'll do is open a new PuTTY session,
so new session, and I'll connect to the first router
so localhost Port 9001 using Telnet.
Click Open.
And notice there,
I'm connected to router one back on my Mac.
If I click on the first router,
I see the same output on both consoles.
I see it in PuTTY
and I see on my MAC console running within my browser.
Back on the Window's computer,
notice what I've got here is I've got
a PuTTY session to my router,
and I've got a PuTTY session to my asa.
So lets start a new session.
The connection is Port 9003 on the local host.
So, 9003 is Telnet.
I'm gonna Telnet to my local host,
and click open.
And what you'll notice is I've connected to router two.
So I'm Telnetting to a local server
running on this Window's computer,
which is then proxying those sessions
across TLS to the VIRL server
running on my Window's computer.
So, because none of us
believe what the developers tell us,
let's run Wireshark.
And let's capture traffic on the wireless network.
So, wifi network, let's see if we can see Telnet traffic.
Notice there's no Telnet traffic.
Even though I'm Telnetting,
to this router,
on Cisco VIRL.
So I could type my passwords, etc.
That information is hidden because it's not using Telnet.
But if I search TLS,
I can see a lot of traffic between two IP addresses.
192168101 and 192168102.
So I can see all this traffic,
going between these two IP addresses.
We can see it's transport layer security,
TLS 1.2,
traffic is encrypted, however HTTP over TLS,
all of this is encrypted.
So I can't see the actual traffic here.
It's been encrypted from that PC to this PC.
And just to prove it once again,
notice the Window's computer has IP address 1921681101.
And if I jump back to my VIRL interface,
IP address is 1921681101.
So it's doing what it's suppose to be doing.
Another test we can do,
is lets stop the breakout tool.
So I'm gonna simply, press control C, on the breakout tool,
and if I refresh this page in my browser,
nothing's gonna happen
because the local proxy has been stopped.
And on my PuTTY sessions, notice,
I'm losing my PuTTY sessions.
PuTTY sessions are disconnected.
I've lost my connections to the VIRL devices,
because I've closed or stopped the local breakout tool.
Now I can still access devices directly,
using my web browser.
So I could open up a console,
and go and access the devices through my web browser.
But if you want to use an application,
such as secure CRT or Solar-PuTTY,
where you can have multiple tabs,
then the local breakout tool is great.
It allows you to access
the devices in your VIRL server using TLS or HTTPS,
using a local application such as secure CRT or Solar-PuTTY.
So basically, once again,
you're Telnetting to a local proxy server,
which then tunnels your traffic using TLS,
across the internet or whatever link you're using
to get you to your VIRL server.
Okay, so I'm hoping you enjoyed this demonstration.
If you did,
please consider subscribing to my YouTube channel.
Please like this video,
and please click on the bell
to get notifications when I post a new video.
I'm David Bomble,
Wanna wish you all very the best.
(upbeat music)