NVIDIA® NetQ™ is a scalable, modern network operations tool set that provides visibility into your overlay and underlay networks, enabling troubleshooting in real-time. NetQ delivers data and statistics about the health of your data center—from the container, virtual machine, or host, all the way to the switch and port. NetQ correlates configuration and operational status, and tracks state changes while simplifying management for the entire Linux-based data center. With NetQ, network operations change from a manual, reactive, node-by-node approach to an automated, informed, and agile one. Visit Network Operations with NetQ to learn more.

This user guide provides documentation for network administrators who are responsible for deploying, configuring, monitoring, and troubleshooting the network in their data center or campus environment.

For a list of the new features in this release, see What's New. For bug fixes and known issues, refer to the release notes.

This page summarizes new features and improvements for the NetQ 4.5 release. For a complete list of open and fixed issues, see the release notes.

What’s New in NetQ 4.5.0

NetQ 4.5.0 includes the following new features and improvements:

• Access credentials that can be applied to individual switches for better security and increased flexibility
• RoCE check and show commands that display priority code point (PCP) and switch priority (SP) mapping misconfigurations and recommendations
• Lifecycle management for NVUE-enabled upgrades to Cumulus Linux 5.0.0 and later
• Initial support for Precision Time Protocol monitoring via the UI and CLI (not intended for use in production)
• User guide enhancements, including a NetQ troubleshooting guide and updated command line reference

Upgrade Paths

NetQ 4.5.0 images have been upgraded to Ubuntu 20.04.

To upgrade to NetQ 4.5.0, you must back up your current NetQ data and perform a new installation of NetQ 4.5.0. This process is supported when upgrading from NetQ 4.3.0 or above.

Upgrades from releases earlier than NetQ 4.3.0 require an incremental upgrade to version 4.3.0 before you back up your data and perform a new installation of NetQ 4.5.0.

The NetQ Hardware Appliance is no longer available for purchase. For existing customers, contact NVIDIA support for assistance upgrading to 4.5.

Compatible Agent Versions

NetQ 4.5.0 is compatible with NetQ Agent versions 4.4.0 and above. You can install NetQ Agents on switches and servers running:

• Cumulus Linux 3.7.16 and later
• SONiC 202012
• CentOS 7
• RHEL 7.1
• Ubuntu 18.04

You must upgrade to the latest agent version to enable 4.5 features.

This section describes NetQ components and deployment models. It also outlines how to get started with the NetQ user interface and command line.

This section provides an overview of the NetQ hardware, software, and deployment models.

NetQ contains the following applications and key components:

• Telemetry data collection and aggregation via
  • NetQ switch agents
  • NetQ host agents
  • Database
• Data streaming
• Network services
• User interfaces

While these functions apply to both the on-premises and cloud solutions, they are configured differently, as shown in the following diagrams.

NetQ Agents

NetQ Agents are installed via software and run on every monitored node in the network—including Cumulus® Linux® switches, Linux bare metal hosts, and virtual machines. The NetQ Agents push network data regularly and event information immediately to the NetQ Platform.

Switch Agents

The NetQ Agents running on Cumulus Linux or SONiC switches gather the following network data via Netlink:

• Interfaces
• IP addresses (v4 and v6)
• IP routes (v4 and v6)
• IP nexthops (v4 and v6)
• Links
• Bridge FDB (MAC address table)
• ARP Entries/Neighbors (IPv4 and IPv6)

for the following protocols:

• Bridging protocols: LLDP, STP, MLAG
• Routing protocols: BGP, OSPF
• Network virtualization: EVPN, VXLAN

Host Agents

The NetQ Agents running on hosts gather the same information as that for switches, plus the following network data:

• Network IP and MAC addresses
• Container IP and MAC addresses

The NetQ Agent obtains container information by listening to the Kubernetes orchestration tool.

The NetQ Agent is supported on hosts running Ubuntu 18.04, Red Hat® Enterprise Linux 7, and CentOS 7.

NetQ Core

The NetQ core performs the data collection, storage, and processing for delivery to various user interfaces. It consists of a collection of scalable components running entirely within a single server. The NetQ software queries this server, rather than individual devices, enabling greater system scalability.

Data Aggregation

The data aggregation component collects data coming from all of the NetQ Agents. It then filters, compresses, and forwards the data to the streaming component. The server monitors for missing messages and also monitors the NetQ Agents themselves, sending notifications about events when appropriate. In addition to the telemetry data collected from the NetQ Agents, the aggregation component collects information from the switches and hosts, such as vendor, model, version, and basic operational state.

Data Stores

NetQ uses two types of data stores. The first stores the raw data, data aggregations, and discrete events needed for quick response to data requests. The second stores data based on correlations, transformations, and raw-data processing.

Real-time Streaming

The streaming component processes the incoming raw data from the aggregation server in real time. It reads the metrics and stores them as a time series, and triggers alarms based on anomaly detection, thresholds, and events.

Network Services

The network services component monitors protocols and services operation individually and on a networkwide basis and stores status details.

User Interfaces

NetQ data is available through several interfaces:

• NetQ CLI (command-line interface)
• NetQ GUI (graphical user interface)
• NetQ RESTful API (representational state transfer application programming interface)

The CLI and UI query the RESTful API to present data. NetQ can integrate with event notification applications and third-party analytics tools.

This section describes three common data center deployment types for network management:

• Out-of-band management (recommended)
• In-band management
• High availability

Out-of-band Management Deployment

NVIDIA recommends deploying NetQ on an out-of-band (OOB) management network to separate network management traffic from standard network data traffic.

The physical network hardware includes:

• Spine switches: aggregate and distribute data; also known as an aggregation switch, end-of-row (EOR) switch or distribution switch
• Leaf switches: where servers connect to the network; also known as a top-of-rack (TOR) or access switch
• Server hosts: host applications and data served to the user through the network
• Exit switch: where connections to outside the data center occur; also known as Border Leaf or Service Leaf
• Edge server (optional): where the firewall is the demarcation point, peering can occur through the exit switch layer to Internet (PE) devices
• Internet device: where provider edge (PE) equipment communicates at layer 3 with the network fabric

The following figure shows an example of a Clos network fabric design for a data center using an OOB management network overlaid on top, where NetQ resides. The physical connections (shown as gray lines) between Spine 01 and four Leaf devices and two Exit devices, and Spine 02 and the same four Leaf devices and two Exit devices. Leaf 01 and Leaf 02 connect to each other over a peerlink and act as an MLAG pair for Server 01 and Server 02. Leaf 03 and Leaf 04 connect to each other over a peerlink and act as an MLAG pair for Server 03 and Server 04. The Edge connects to both Exit devices, and the Internet node connects to Exit 01.

The physical management hardware includes:

• OOB management switch: aggregation switch that connects to all network devices through communications with the NetQ Agent on each node
• NetQ Platform: hosts the telemetry software, database, and user interfaces

These switches connect to each physical network device through a virtual network overlay, shown with purple lines.

In-band Management Deployment

While not recommended, you can implement NetQ within your data network. In this scenario, there is no overlay and all traffic to and from the NetQ Agents and the NetQ Platform traverses the data paths along with your regular network traffic. The roles of the switches in the Clos network are the same, except that the NetQ Platform performs the aggregation function that the OOB management switch performed. If your network goes down, you might not have access to the NetQ Platform for troubleshooting.

High Availability Deployment

NetQ supports a high availability deployment for users who prefer a solution in which the collected data and processing provided by the NetQ Platform remains available through alternate equipment should the platform fail for any reason. In this configuration, three NetQ Platforms are deployed, with one as the master and two as workers (or replicas). NetQ Agents send data to all three switches so that if the master NetQ Platform fails, one of the replicas automatically becomes the master and continues to store and provide the telemetry data. The following example is based on an OOB-management configuration, and modified to support high availability for NetQ.

In either in-band or out-of-band deployments, NetQ offers networkwide configuration and device management, proactive monitoring capabilities, and network performance diagnostics.

The NetQ Agent

From a software perspective, a network switch has software associated with the hardware platform, the operating system, and communications. For data centers, the software on a network switch is similar to the following diagram:

The NetQ Agent interacts with the various components and software on switches and hosts and provides the gathered information to the NetQ Platform. You can view the data using the NetQ CLI or UI.

The NetQ Agent polls the user space applications for information about the performance of the various routing protocols and services that are running on the switch. Cumulus Linux supports BGP and OSPF routing protocols as well as static addressing through FRRouting (FRR). Cumulus Linux also supports LLDP and MSTP among other protocols, and a variety of services such as systemd and sensors. SONiC supports BGP and LLDP.

For hosts, the NetQ Agent also polls for performance of containers managed with Kubernetes. This information is used to calculate the network’s health and check if the network is configured and operating correctly.

The NetQ Agent interacts with the Netlink communications between the Linux kernel and the user space, listening for changes to the network state, configurations, routes, and MAC addresses. NetQ sends notifications about these changes so that network operators and administrators can respond quickly when changes are not expected or favorable.

The NetQ Agent also interacts with the hardware platform to obtain performance information about various physical components, such as fans and power supplies, on the switch. The agent measures operational states and temperatures, along with cabling information to allow for proactive maintenance.

The NetQ Platform

After the collected data is sent to and stored in the NetQ database, you can:

• Validate configurations and identify misconfigurations in your current network or in a previous deployment.
• Monitor communication paths throughout the network.
• Notify users of network issues.
• Anticipate the impact of connectivity changes.

Validate Configurations

The NetQ CLI lets you validate your network’s health through two sets of commands: netq check and netq show. They extract the information from the network service component and event service. The network service component is continually validating the connectivity and configuration of the devices and protocols running on the network. Using the netq check and netq show commands displays the status of the various components and services on a networkwide and complete software stack basis. netq check and netq show commands are available for the following components and services:

Monitor Communication Paths

The trace engine validates the available communication paths between two network devices. The corresponding netq trace command enables you to view all of the paths between the two devices and if there are any breaks in the paths. For more information about trace requests, refer to Verify Network Connectivity.

View Historical State and Configuration Info

You can run all check, show, and trace commands for current and past statuses. To investigate past issues, use the netq check command and look for configuration or operational issues around the time that NetQ timestamped event messages. Then use the netq show commands to view information about device configurations. You can also use the netq trace command to see what the connectivity looked like between any problematic nodes at a particular time.

For example, the following diagram shows issues on spine01, leaf04, and server03:

An administrator can run the following commands from any switch in the network to determine the cause of a BGP error on spine01:

cumulus@switch:~$ netq check bgp around 30m
Total Nodes: 25, Failed Nodes: 3, Total Sessions: 220 , Failed Sessions: 24,
Hostname          VRF             Peer Name         Peer Hostname     Reason                                        Last Changed
----------------- --------------- ----------------- ----------------- --------------------------------------------- -------------------------
exit-1            DataVrf1080     swp6.2            firewall-1        BGP session with peer firewall-1 swp6.2: AFI/ 1d:2h:6m:21s
                                                                      SAFI evpn not activated on peer              
exit-1            DataVrf1080     swp7.2            firewall-2        BGP session with peer firewall-2 (swp7.2 vrf  1d:1h:59m:43s
                                                                      DataVrf1080) failed,                         
                                                                      reason: Peer not configured                  
exit-1            DataVrf1081     swp6.3            firewall-1        BGP session with peer firewall-1 swp6.3: AFI/ 1d:2h:6m:21s
                                                                      SAFI evpn not activated on peer              
exit-1            DataVrf1081     swp7.3            firewall-2        BGP session with peer firewall-2 (swp7.3 vrf  1d:1h:59m:43s
                                                                      DataVrf1081) failed,                         
                                                                      reason: Peer not configured                  
exit-1            DataVrf1082     swp6.4            firewall-1        BGP session with peer firewall-1 swp6.4: AFI/ 1d:2h:6m:21s
                                                                      SAFI evpn not activated on peer              
exit-1            DataVrf1082     swp7.4            firewall-2        BGP session with peer firewall-2 (swp7.4 vrf  1d:1h:59m:43s
                                                                      DataVrf1082) failed,                         
                                                                      reason: Peer not configured                  
exit-1            default         swp6              firewall-1        BGP session with peer firewall-1 swp6: AFI/SA 1d:2h:6m:21s
                                                                      FI evpn not activated on peer                
exit-1            default         swp7              firewall-2        BGP session with peer firewall-2 (swp7 vrf de 1d:1h:59m:43s
...
 
cumulus@switch:~$ netq exit-1 show bgp
Matching bgp records:
Hostname          Neighbor                     VRF             ASN        Peer ASN   PfxRx        Last Changed
----------------- ---------------------------- --------------- ---------- ---------- ------------ -------------------------
exit-1            swp3(spine-1)                default         655537     655435     27/24/412    Fri Feb 15 17:20:00 2019
exit-1            swp3.2(spine-1)              DataVrf1080     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp3.3(spine-1)              DataVrf1081     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp3.4(spine-1)              DataVrf1082     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp4(spine-2)                default         655537     655435     27/24/412    Fri Feb 15 17:20:00 2019
exit-1            swp4.2(spine-2)              DataVrf1080     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp4.3(spine-2)              DataVrf1081     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp4.4(spine-2)              DataVrf1082     655537     655435     13/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp5(spine-3)                default         655537     655435     28/24/412    Fri Feb 15 17:20:00 2019
exit-1            swp5.2(spine-3)              DataVrf1080     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp5.3(spine-3)              DataVrf1081     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp5.4(spine-3)              DataVrf1082     655537     655435     14/12/0      Fri Feb 15 17:20:00 2019
exit-1            swp6(firewall-1)             default         655537     655539     73/69/-      Fri Feb 15 17:22:10 2019
exit-1            swp6.2(firewall-1)           DataVrf1080     655537     655539     73/69/-      Fri Feb 15 17:22:10 2019
exit-1            swp6.3(firewall-1)           DataVrf1081     655537     655539     73/69/-      Fri Feb 15 17:22:10 2019
exit-1            swp6.4(firewall-1)           DataVrf1082     655537     655539     73/69/-      Fri Feb 15 17:22:10 2019
exit-1            swp7                         default         655537     -          NotEstd      Fri Feb 15 17:28:48 2019
exit-1            swp7.2                       DataVrf1080     655537     -          NotEstd      Fri Feb 15 17:28:48 2019
exit-1            swp7.3                       DataVrf1081     655537     -          NotEstd      Fri Feb 15 17:28:48 2019
exit-1            swp7.4                       DataVrf1082     655537     -          NotEstd      Fri Feb 15 17:28:48 2019

Manage Network Events

The NetQ notifier lets you capture and filter events for devices, components, protocols, and services. This is especially useful when an interface or routing protocol goes down and you want to get them back up and running as quickly as possible. You can improve resolution time significantly by creating filters that focus on topics appropriate for a particular group of users. You can create filters for events related to BGP and MLAG session states, interfaces, links, NTP and other services, fans, power supplies, and physical sensor measurements.

The following is an example of a Slack message received on a netq-notifier channel indicating that the BGP session on switch leaf04 interface swp2 has gone down:

For more information, refer to Events and Notifications.

Timestamps in NetQ

Every event or entry in the NetQ database is stored with a timestamp that reports when the NetQ Agent captured an event on the switch or server. This timestamp is based on the switch or server time where the NetQ Agent is running, and is pushed in UTC format.

Interface state, IP addresses, routes, ARP/ND table (IP neighbor) entries and MAC table entries carry a timestamp that represents the time an event occurred (such as when a route is deleted or an interface comes up).

Data that is captured and saved based on polling has a timestamp according to when the information was captured rather than when the event actually happened, though NetQ compensates for this if the data extracted provides additional information to compute a more precise time of the event. For example, BGP uptime can be used to determine when the event actually happened in conjunction with the timestamp.

Exporting NetQ Data

You can export data from the NetQ Platform in the CLI or UI:

• In the CLI, use the json option to output command results to JSON format for parsing in other applications
• In the UI, expand the cards to a full-screen, tabular view and select export

Important File Locations

The following configuration and log files can help with troubleshooting:

The NetQ user interface (UI) lets you access NetQ through a web browser, where you can visualize your network and interact with the display using a keyboard and mouse.

The NetQ UI is supported on Google Chrome and Mozilla Firefox. It is designed to be viewed on a display with a minimum resolution of 1920 × 1080 pixels.

• Access the NetQ UI
• Application Layout
• Focus Your Monitoring Using Workbenches
• Access Data with Cards
• Set User Preferences

This page describes how to log in and out of NetQ.

Log In to NetQ

1. Open a new Chrome or Firefox browser window or tab.

2. Enter the following URL into the address bar:

   • NetQ On-premises Appliance or VM: https://<hostname-or-ipaddress>:443
   • NetQ Cloud Appliance or VM: https://netq.nvidia.com

   

3. Log in.

   The following are the default usernames and passwords for UI access:

   • NetQ On-premises: admin, admin
   • NetQ Cloud: Use the credentials you created during setup. You should receive an email from NVIDIA titled NetQ Access Link.

Log Out of NetQ

1. Select User Settings in the top-right corner of NetQ.

2. Select Log Out.

Related Information

• Set User Preferences
• Add and Manage Accounts

The NetQ UI contains two main areas:

• Application Header: Contains the main menu, NetQ version, search, validation summary, local time zone, premises list, and account information.

  

• Workbench: Contains a task bar and content cards (with status and configuration information about your network and its various components).

Main Menu

Found in the application header, click Menu to navigate to:

Header

Menu

Search: a search bar to quickly find an item on the main menu Favorites: contains link to the user-defined favorite workbenches; Home points to the NetQ Workbench until reset by a user Workbenches: contains links to all workbenches Network: contains links to tabular data about various network elements and the What Just Happened feature Notifications: contains link to threshold-based event rules and notification channel specifications Admin: contains links to application management and lifecycle management features (only visible to users with Admin access role)

Search

You can search for devices and cards in the Global Search field in the header. It behaves like most searches and can help you quickly find device information.

NVIDIA Logo

Clicking the NVIDIA logo takes you to your favorite workbench. For details about specifying your favorite workbench, refer to Set User Preferences.

Validation Summary

Found in the header, the validation summary displays the overall health of your network.

Workbenches

A workbench comprises a given set of cards. A pre-configured default workbench, NetQ Workbench, is available to get you started. You can customize your workbenches by adding or removing cards. For more detail about managing your data using workbenches, refer to Focus Your Monitoring Using Workbenches.

Cards

Cards display information about your network. Each card describes a particular aspect of the network and can be expanded to display information and statistics at increasingly granular levels. You can add and remove cards from a workbench, move between cards and card sizes, and make copies of cards to show different levels of data at the same time. For details about working with cards, refer to Access Data with Cards.

User Settings

Each user can customize the NetQ application display, time zone and date format; change their account password; and manage their workbenches. This is all performed from User Settings > Profile & Preferences. For details, refer to Set User Preferences.

Workbenches are dashboards where you collect and view data. Two types of workbenches are available:

• Default: Provided by NVIDIA; you cannot save changes you make to these workbenches
• Custom: Created by the user; changes made to these workbenches are saved automatically

Both types of workbenches display a set of cards. Default workbenches are public (accessible to all users), whereas custom workbenches are private (viewing is restricted to the user who created them).

Default Workbenches

The default workbench contains Device Inventory, Switch Inventory, Events, and Validation Summary cards, giving you an overview of how your network is operating.

Upon initial login, the NetQ Workbench opens. Upon subsequent logins, the last workbench you viewed opens.

Custom Workbenches

People with either administrative or user roles can create and save an unlimited number of custom workbenches. For example, you might create a workbench that:

• Shows network statistics for the past week alongside network statistics for the past 24 hours.
• Only displays data about virtual overlays.
• Displays switches that you are troubleshooting.
• Is focused on application or account management.

Create a Workbench

1. Select New in the workbench header.

2. Enter a name for the workbench and choose whether to set it as your default home workbench.

3. Select the cards you would like displayed on your new workbench.

   

4. Click Create.

Refer to Access Data with Cards for information about interacting with cards on your workbenches.

Clone a Workbench

To create a duplicate of an existing workbench:

1. Select Clone in the workbench header.

2. Name the cloned workbench and select Clone.

Remove a Workbench

Admins can remove any workbench, except for the default NetQ Workbench. User accounts can only remove workbenches they have created.

To remove a workbench:

1. Select User Settings in the top-right corner.

2. Select Profile & Preferences.

3. Locate the Workbenches card.

4. Hover over the workbench you want to remove, and click Delete.

Open an Existing Workbench

There are several options for opening workbenches:

• Open through the Workbench header
  • Click next to the current workbench name and locate the workbench
    • Under My Home, click the name of your favorite workbench
    • Under My Most Recent, click the workbench if in list
    • Search by workbench name
    • Click All My WB to open all workbenches and select it from the list
• Open through the main menu
  • Expand the Menu and select the workbench from the Favorites or Workbenches sections
• Open through the NVIDIA logo
  • Click the logo in the header to open your favorite workbench

Manage Auto-refresh

You can specify how often to update the data displayed on your workbenches. Three refresh rates are available:

• Analyze: updates every 30 seconds
• Debug: updates every minute
• Monitor: updates every 2 minutes

By default, auto-refresh is configured to update every 30 seconds.

To modify the auto-refresh setting:

1. Select the dropdown next to Refresh.

2. Select the refresh rate. A check mark indicates the current selection. The new refresh rate is applied immediately.

   

To disable auto-refresh, select Pause. When you’re ready for the data to refresh, select Play.

Cards present information about your network for monitoring and troubleshooting; each card describes a particular aspect of the network. Cards are collected onto a workbench where all data relevant to a task or set of tasks is visible. You can add and remove cards from a workbench, increase or decrease their sizes, change the time period of the data shown on a card, and make copies of cards to show different levels of data at the same time.

Available Cards

Each card focuses on a particular aspect of your network. They include:

• Validation summary: overview of your network’s health
• Events: system events and anomalies
• What Just Happened: network issues and packet drops
• Device groups: distribution of device components
• Trace request: discovery workflow for paths between two devices in the network fabric
• MAC move commentary: info about changes to a MAC address on a specific VLAN
• Network services cards: BGP, MLAG, EVPN, OSPF, and LLDP
• Inventory cards: Devices, Switches, DPUs, and Hosts

Card Sizes

Cards are available in 4 sizes. The granularity of the content on a card varies with the size of the card, with the highest level of information on the smallest card to the most detailed information on the full-screen card.

Card Size Summary

Card Actions

Add Cards to Your Workbench

1. Click Add card in the header.

2. Select the card(s) you want to add to your workbench.

3. When you have selected the cards you want to add to your workbench, select Open cards:

   

The cards are placed at the end of the set of cards currently on the workbench. You might need to scroll down to see them. Drag and drop the cards on the workbench to rearrange them.

Add Switch Cards to Your Workbench

You can add switch cards to a workbench through the Devices icon on the header or by searching for it in the Global Search field. To add a switch card from the header:

1. Click Devices, then select Open a device card.

2. Select the device from the suggestions that appear:

   

3. Choose the card’s size, then select Add.

Remove Cards from Your Workbench

To remove all the cards from your workbench, click the Clear icon in the header. To remove an individual card:

1. Hover over the card you want to remove.

2. Click (More Actions menu).

3. Select Remove.

   

The card is removed from the workbench, but not from the application.

Change the Size of the Card

1. Hover over the top portion of the card until you see a rectangular box divided into four segments.

2. Move your cursor over the box until the desired size option is highlighted.

   

   One-quarter width opens a small card. One-half width opens a medium card. Three-quarters width opens a large card. Full width opens a full-screen card.

3. Select the size. When the card changes to the selected size, it might move to a different area on the workbench.

Change the Time Period for the Card Data

All cards have a default time period for the data shown on the card, typically the last 24 hours. You can change the time period to view the data during a different time range to aid analysis of previous or existing issues.

To change the time period for a card:

1. Hover over the top portion of the card and select the clock icon .

2. Select a time period from the dropdown list.

   

Table Settings

You can manipulate the tabular data displayed in a full-screen card by filtering and sorting the columns. Hover over the column header and select it to sort the column. The data is sorted in ascending or descending order: A-Z, Z-A, 1-n, or n-1. The number of rows that can be sorted is limited to 10,000.

To reposition the columns, drag and drop them using your mouse. You can also export the data presented in the table by selecting Export.

The following icons are common in the full-screen card view:

Icon	Action	Description
	Select All	Selects all items in the list.
	Clear All	Clears all existing selections in the list.
	Add Item	Adds item to the list.
	Edit	Edits the selected item.
	Delete	Removes the selected items.
	Filter	Filters the list using available parameters.
,	Generate/Delete AuthKeys	Creates or removes NetQ CLI authorization keys.
	Open Cards	Opens the corresponding validation or trace card(s).
	Assign role	Opens role assignment options for switches.
	Export	Exports selected data into either a .csv or JSON-formatted file.

When there are many items in a table, NetQ loads up to 25 rows by default and provides the rest in additional table pages, accessible through the pagination controls. Pagination is displayed under the table.

Each user can customize the NetQ application display, change their account password, and manage their workbenches.

Configure Display Settings

The Display card contains the options for setting the application theme (light or dark), language, time zone, and date formats.

To configure the display settings:

1. Select User Settings in the top-right corner.

2. Select Profile & Preferences.

3. Locate the Display card:

   

4. In the Theme field, click to select either dark or light theme. The following figure shows the light theme:

   

5. In the Time Zone field, click to change the time zone from the default.

   By default, the time zone is set to the user’s local time zone. If a time zone has not been selected, NetQ defaults to the current local time zone where NetQ is installed. All time values are based on this setting. This is displayed (and can also be changed) in the application header, and is based on Greenwich Mean Time (GMT). If your deployment is not local to you (for example, you want to view the data from the perspective of a data center in another time zone) you can change the display to a different time zone.

6. In the Date Format field, select the date and time format you want displayed on the cards.

   

Change Your Password

1. Click User Settings in the top-right corner.

2. Click Profile & Preferences.

3. In the Basic Account Info card, select Change password.

   

4. Enter your current password, followed by your new password.

5. Select Save.

To reset the password for an admin account, follow these instructions.

Manage Your Workbenches

A workbench is similar to a dashboard. This is where you collect and view the data that is important to you. You can have more than one workbench and manage them with the Workbenches card located in Profile & Preferences. From the Workbenches card, you can view, sort, and delete workbenches. For a detailed overview of workbenches, see Focus Your Monitoring Using Workbenches.

The NetQ CLI provides access to all network state and event information collected by NetQ Agents. It behaves similarly to typical CLIs, with groups of commands that display related information, and help commands that provide additional information. See the command line reference for a comprehensive list of NetQ commands, including examples, options, and definitions.

CLI Access

When you install or upgrade NetQ, you can also install and enable the CLI on your NetQ server or appliance and hosts.

To access the CLI from a switch or server:

1. Log in to the device. The following example uses the default username of cumulus and a hostname of switch:

   <computer>:~<username>$ ssh cumulus@switch
   

2. Enter your password to reach the command prompt. The default password is CumulusLinux!

3. You can now run commands:

   cumulus@switch:~$ netq show agents
   cumulus@switch:~$ netq check bgp
   

Command Line Basics

This section describes the core structure and behavior of the NetQ CLI.

Command Line Structure

The NetQ command line has a flat structure as opposed to a modal structure: you can run all commands from the standard command prompt instead of only in a specific mode, at the same level.

Command Syntax

All NetQ CLI commands begin with netq. NetQ commands fall into one of four syntax categories: validation (check), monitoring (show), configuration, and trace.

netq check <network-protocol-or-service> [options]
netq show <network-protocol-or-service> [options]
netq config <action> <object> [options]
netq trace <destination> from <source> [options]

For example, in the netq check command:

• [<hostname>] is an optional parameter with a variable value named hostname

• <network-protocol-or-service> represents a number of possible keywords, such as agents, bgp, evpn, and so forth

• <options> represents a number of possible conditions for the given object, such as around, vrf, or json

Examples of valid commands include:

• netq show bgp
• netq config restart cli
• netq trace 10.0.0.5 from 10.0.0.35

Command Output

The command output presents results in color for many commands. Results with errors appear in red, and warnings appear in yellow. Results without errors or warnings appear in either black or green. VTEPs appear in blue. A node in the pretty output appears in bold, and angle brackets (< >) wrap around a router interface. To view the output with only black text, run the netq config del color command. You can view output with colors again by running netq config add color.

All check and show commands have a default timeframe of now to one hour ago, unless you specify an approximate time using the around keyword or a range using the between keyword. For example, running netq check bgp shows the status of BGP over the last hour. Running netq show bgp around 3h shows the status of BGP three hours ago.

Command Prompts

NetQ code examples use the following prompts:

• cumulus@switch:~$ indicates the user cumulus is logged in to a switch to run the example command
• cumulus@host:~$ indicates the user cumulus is logged in to a host to run the example command
• cumulus@netq-appliance:~$ indicates the user cumulus is logged in to either the NetQ Appliance or NetQ Cloud Appliance to run the command
• cumulus@hostname:~$ indicates the user cumulus is logged in to a switch, host or appliance to run the example command

To use the NetQ CLI, the switches must be running the Cumulus Linux or SONiC operating system, NetQ Platform or NetQ Collector software, the NetQ Agent, and the NetQ CLI. The hosts must be running CentOS, RHEL, or Ubuntu OS, the NetQ Agent, and the NetQ CLI. Refer to Install NetQ for additional information.

Command Completion

As you enter commands, you can get help with the valid keywords or options using the tab key. For example, using tab completion with netq check displays the possible objects for the command, and returns you to the command prompt to complete the command:

cumulus@switch:~$ netq check <<press Tab>>
    agents      :  Netq agent
    bgp         :  BGP info
    cl-version  :  Cumulus Linux version
    clag        :  Cumulus Multi-chassis LAG
    evpn        :  EVPN
    interfaces  :  network interface port
    mlag        :  Multi-chassis LAG (alias of clag)
    mtu         :  Link MTU
    ntp         :  NTP
    ospf        :  OSPF info
    sensors     :  Temperature/Fan/PSU sensors
    vlan        :  VLAN
    vxlan       :  VXLAN data path
cumulus@switch:~$ netq check

Command Help

As you enter commands, you can get help with command syntax by entering help at various points within a command entry. For example, to find out which options are available for a BGP check, enter help after entering some of the netq check command. In the following example, you can see that there are no additional required parameters and you can use three optional parameters — hostnames, vrf, and around — with a BGP check:

cumulus@switch:~$ netq check bgp help
Commands:
    netq check bgp [label <text-label-name> | hostnames <text-list-hostnames>] [vrf <vrf>] [check_filter_id <text-check-filter-id>] [include <bgp-number-range-list> | exclude <bgp-number-range-list>] [around <text-time>] [json | summary]
   netq show unit-tests bgp [check_filter_id <text-check-filter-id>] [json]

To see an exhaustive list of commands, run:

cumulus@switch:~$ netq help list

To get usage information for NetQ, run:

cumulus@switch:~$ netq help verbose

Command History

The CLI stores commands issued within a session, which lets you review and rerun commands that you already ran. At the command prompt, press the Up Arrow and Down Arrow keys to move back and forth through the list of commands previously entered. When you have found a given command, you can run the command by pressing Enter, just as you would if you had entered it manually. You can also modify the command before you run it.

Command Categories

While the CLI has a flat structure, NetQ commands are conceptually grouped into the following functional categories:

• Validation Commands
• Monitoring Commands
• Configuration Commands
• Trace Commands

Validation Commands

The netq check commands validate the current or historical state of the network by looking for errors and misconfigurations in the network. The commands run fabric-wide validations against various configured protocols and services to determine how well the network is operating. You can perform validation checks for the following:

• addresses: IPv4 and IPv6 addresses duplicates across devices
• agents: NetQ Agents operation on all switches and hosts
• bgp: BGP (Border Gateway Protocol) operation across the network fabric
• clag: Cumulus Linux MLAG (multi-chassis LAG/link aggregation) operation
• cl-version: Cumulus Linux version
• evpn: EVPN (Ethernet Virtual Private Network) operation
• interfaces: network interface port operation
• mlag: Cumulus MLAG (multi-chassis LAG/link aggregation) operation
• mtu: Link MTU (maximum transmission unit) consistency across paths
• ntp: NTP (Network Time Protocol) operation
• ospf: OSPF (Open Shortest Path First) operation
• roce: RoCE (RDMA over Converged Ethernet) configurations
• sensors: Temperature/Fan/PSU sensor operation
• vlan: VLAN (Virtual Local Area Network) operation
• vxlan: VXLAN (Virtual Extensible LAN) data path operation

The commands take the form of netq check <network-protocol-or-service> [options], where the options vary according to the protocol or service.

cumulus@switch:~$ netq check bgp
bgp check result summary:

Checked nodes       : 8
Total nodes         : 8
Rotten nodes        : 0
Failed nodes        : 0
Warning nodes       : 0

Additional summary:
Total Sessions      : 30
Failed Sessions     : 0

Session Establishment Test   : passed
Address Families Test        : passed
Router ID Test               : passed

cumulus@switch:~$ netq check bgp json
{
    "tests":{
        "Session Establishment":{
            "suppressed_warnings":0,
            "errors":[

            ],
            "suppressed_errors":0,
            "passed":true,
            "warnings":[

            ],
            "duration":0.0000853539,
            "enabled":true,
            "suppressed_unverified":0,
            "unverified":[

            ]
        },
        "Address Families":{
            "suppressed_warnings":0,
            "errors":[

            ],
            "suppressed_errors":0,
            "passed":true,
            "warnings":[

            ],
            "duration":0.0002634525,
            "enabled":true,
            "suppressed_unverified":0,
            "unverified":[

            ]
        },
        "Router ID":{
            "suppressed_warnings":0,
            "errors":[

            ],
            "suppressed_errors":0,
            "passed":true,
            "warnings":[

            ],
            "duration":0.0001821518,
            "enabled":true,
            "suppressed_unverified":0,
            "unverified":[

            ]
        }
    },
    "failed_node_set":[

    ],
    "summary":{
        "checked_cnt":8,
        "total_cnt":8,
        "rotten_node_cnt":0,
        "failed_node_cnt":0,
        "warn_node_cnt":0
    },
    "rotten_node_set":[

    ],
    "warn_node_set":[

    ],
    "additional_summary":{
        "total_sessions":30,
        "failed_sessions":0
    },
    "validation":"bgp"
}

Monitoring Commands

The netq show commands let you view details about the current or historical configuration and status of various protocols and services. You can view the configuration and status for the following:

• address-history: Address history info for an IP address/prefix
• agents: NetQ Agents status on switches and hosts
• bgp: BGP status across the network fabric
• cl-btrfs-info: BTRFS file system data for monitored Cumulus Linux switches
• cl-manifest: Information about the versions of Cumulus Linux available on monitored switches
• cl-pkg-info: Information about software packages installed on monitored switches
• cl-resource: ACL and forwarding information
• cl-ssd-util: SSD utilization information
• clag: CLAG/MLAG status
• dom: Digital Optical Monitoring information
• ecmp: Equal-cost multi-path routing
• ethtool-stats: Interface statistics
• events: Display changes over time
• events-config: Event suppression configuration
• evpn: EVPN status
• interfaces: Interface information
• interface-stats: Interface performance statistics
• interface-utilization: Interface statistics plus utilization
• interfaces: network interface port status
• inventory: hardware component information
• ip: IPv4 status
• ipv6: IPv6 status
• job-status: status of upgrade jobs running on the appliance or VM
• kubernetes: Kubernetes cluster, daemon, pod, node, service, and replication status
• lldp: LLDP status
• mac-commentary: MAC commentary info for a MAC address
• mac-history: Historical information for a MAC address
• macs: MAC table or address information
• mlag: MLAG status (an alias for CLAG)
• neighbor-history: Neighbor history info for an IP address
• notification: Notifications sent to various channels
• ntp: NTP status
• opta-health: Display health of apps on the OPTA
• opta-platform: NetQ Appliance version information and uptime
• ospf: OSPF status
• ptp: Precision Time Protocol status
• recommended-pkg-version: Current host information to be considered
• resource-util: Display usage of memory, CPU and disk resources
• roce-config: Display RoCE configuration
• roce-counters: Displays RDMA over Converged Ethernet counters for a given switch
• sensors: Temperature/Fan/PSU sensor status
• services: System services status
• stp topology: Spanning Tree Protocol topology
• tca: Threshold crossing alerts
• trace: Control plane trace path across fabric
• unit-tests: Show list of unit tests for netq check
• validation: Scheduled validation check
• vlan: VLAN status
• vxlan: VXLAN data path status
• wjh-drop: dropped packet data from NVIDIA® Mellanox® What Just Happened®

The commands take the form of netq [<hostname>] show <network-protocol-or-service> [options], where the options vary according to the protocol or service. You can restrict the commands from showing the information for all devices to showing information only for a selected device using the hostname option.

cumulus@switch:~$ netq show agents
Matching agents records:
Hostname          Status           NTP Sync Version                              Sys Uptime                Agent Uptime              Reinitialize Time          Last Changed
----------------- ---------------- -------- ------------------------------------ ------------------------- ------------------------- -------------------------- -------------------------
border01          Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:04:54 2020  Tue Sep 29 21:24:58 2020  Tue Sep 29 21:24:58 2020   Thu Oct  1 16:07:38 2020
border02          Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:04:57 2020  Tue Sep 29 21:24:58 2020  Tue Sep 29 21:24:58 2020   Thu Oct  1 16:07:33 2020
fw1               Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:04:44 2020  Tue Sep 29 21:24:48 2020  Tue Sep 29 21:24:48 2020   Thu Oct  1 16:07:26 2020
fw2               Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:04:42 2020  Tue Sep 29 21:24:48 2020  Tue Sep 29 21:24:48 2020   Thu Oct  1 16:07:22 2020
leaf01            Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 16:49:04 2020  Tue Sep 29 21:24:49 2020  Tue Sep 29 21:24:49 2020   Thu Oct  1 16:07:10 2020
leaf02            Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:14 2020  Tue Sep 29 21:24:49 2020  Tue Sep 29 21:24:49 2020   Thu Oct  1 16:07:30 2020
leaf03            Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:37 2020  Tue Sep 29 21:24:49 2020  Tue Sep 29 21:24:49 2020   Thu Oct  1 16:07:24 2020
leaf04            Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:35 2020  Tue Sep 29 21:24:58 2020  Tue Sep 29 21:24:58 2020   Thu Oct  1 16:07:13 2020
oob-mgmt-server   Fresh            yes      3.1.1-ub18.04u29~1599111022.78b9e43  Mon Sep 21 16:43:58 2020  Mon Sep 21 17:55:00 2020  Mon Sep 21 17:55:00 2020   Thu Oct  1 16:07:31 2020
server01          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:57 2020  Tue Sep 29 21:13:07 2020  Tue Sep 29 21:13:07 2020   Thu Oct  1 16:07:16 2020
server02          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:57 2020  Tue Sep 29 21:13:07 2020  Tue Sep 29 21:13:07 2020   Thu Oct  1 16:07:24 2020
server03          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:56 2020  Tue Sep 29 21:13:07 2020  Tue Sep 29 21:13:07 2020   Thu Oct  1 16:07:12 2020
server04          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:57 2020  Tue Sep 29 21:13:07 2020  Tue Sep 29 21:13:07 2020   Thu Oct  1 16:07:17 2020
server05          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:57 2020  Tue Sep 29 21:13:10 2020  Tue Sep 29 21:13:10 2020   Thu Oct  1 16:07:25 2020
server06          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:19:57 2020  Tue Sep 29 21:13:10 2020  Tue Sep 29 21:13:10 2020   Thu Oct  1 16:07:21 2020
server07          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:06:48 2020  Tue Sep 29 21:13:10 2020  Tue Sep 29 21:13:10 2020   Thu Oct  1 16:07:28 2020
server08          Fresh            yes      3.2.0-ub18.04u30~1601393774.104fb9e  Mon Sep 21 17:06:45 2020  Tue Sep 29 21:13:10 2020  Tue Sep 29 21:13:10 2020   Thu Oct  1 16:07:31 2020
spine01           Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:34 2020  Tue Sep 29 21:24:58 2020  Tue Sep 29 21:24:58 2020   Thu Oct  1 16:07:20 2020
spine02           Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:33 2020  Tue Sep 29 21:24:58 2020  Tue Sep 29 21:24:58 2020   Thu Oct  1 16:07:16 2020
spine03           Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:34 2020  Tue Sep 29 21:25:07 2020  Tue Sep 29 21:25:07 2020   Thu Oct  1 16:07:20 2020
spine04           Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 17:03:32 2020  Tue Sep 29 21:25:07 2020  Tue Sep 29 21:25:07 2020   Thu Oct  1 16:07:33 2020

cumulus@switch:~$ netq leaf01 show agents
Matching agents records:
Hostname          Status           NTP Sync Version                              Sys Uptime                Agent Uptime              Reinitialize Time          Last Changed
----------------- ---------------- -------- ------------------------------------ ------------------------- ------------------------- -------------------------- -------------------------
leaf01            Fresh            yes      3.2.0-cl4u30~1601410518.104fb9ed     Mon Sep 21 16:49:04 2020  Tue Sep 29 21:24:49 2020  Tue Sep 29 21:24:49 2020   Thu Oct  1 16:26:33 2020

Configuration Commands

Various commands—including netq config, netq notification, and netq install—allow you to manage NetQ Agent and CLI server configurations, configure lifecycle management, set up container monitoring, and manage notifications.

NetQ Agent Configuration

The agent commands configure individual NetQ Agents.

The agent configuration commands can add and remove agents from switches and hosts, start and stop agent operations, debug the agent, specify default commands, and enable or disable a variety of monitoring features (including Kubernetes, sensors, FRR (FRRouting), CPU usage limit, and What Just Happened).

The agent configuration commands include:

netq config (add|del|show) agent
netq config (start|stop|status|restart) agent

The following example shows how to configure the agent to send sensor data:

cumulus@switch~:$ netq config add agent sensors

The following example shows how to start monitoring with Kubernetes:

cumulus@switch:~$ netq config add agent kubernetes-monitor poll-period 15

The following example shows how to view the NetQ Agent configuration:

cumulus@switch:~$ netq config show agent
netq-agent             value      default
---------------------  ---------  ---------
enable-opta-discovery  True       True
exhibitport
agenturl
server                 127.0.0.1  127.0.0.1
exhibiturl
vrf                    default    default
agentport              8981       8981
port                   31980      31980

Refer to Manage NetQ Agents and Install NetQ Agents for additional examples.

CLI Configuration

The netq config cli configures and manages the CLI component. You can add or remove the CLI (essentially enabling/disabling the service), start and restart it, and view the configuration of the service.

The CLI configuration commands include:

netq config add cli server
netq config del cli server
netq config show cli premises [json]
netq config show (cli|all) [json]
netq config (status|restart) cli
netq config select cli premise

The following example shows how to restart the CLI instance:

cumulus@switch~:$ netq config restart cli

The following example shows how to enable the CLI on a NetQ on-premises appliance or virtual machine (VM):

cumulus@switch~:$ netq config add cli server 10.1.3.101

The following example shows how to enable the CLI on a NetQ Cloud Appliance or VM for the Chicago premises and the default port:

netq config add cli server api.netq.cumulusnetworks.com access-key <user-access-key> secret-key <user-secret-key> premises chicago port 443

NetQ System Configuration Commands

Use the following commands to manage the NetQ system itself:

• bootstrap: Loads the installation program onto the network switches and hosts in either a single server or server cluster arrangement.
• decommission: Decommissions a switch or host.
• install: Installs NetQ in standalone or cluster deployments; also used to install patch software.
• upgrade bundle: Upgrades NetQ on NetQ On-premises Appliances or VMs.

The following example shows how to bootstrap a single server or master server in a server cluster:

cumulus@switch:~$ netq bootstrap master interface eth0 tarball /mnt/installables/netq-bootstrap-4.1.0.tgz

The following example shows how to decommission a switch named leaf01:

cumulus@netq-appliance:~$ netq decommission leaf01

For information and examples on installing and upgrading the NetQ system, see Install NetQ and Upgrade NetQ.

Event Notification Commands

The notification configuration commands can add, remove, and show notification application integrations. These commands create the channels, filters, and rules needed to control event messaging. The commands include:

netq (add|del|show) notification channel
netq (add|del|show) notification rule
netq (add|del|show) notification filter
netq (add|del|show) notification proxy

An integration includes at least one channel (PagerDuty, Slack, or syslog), at least one filter (defined by rules you create), and at least one rule.

The following example shows how to configure a PagerDuty channel:

cumulus@switch:~$ netq add notification channel pagerduty pd-netq-events integration-key c6d666e210a8425298ef7abde0d1998
Successfully added/updated channel pd-netq-events

Refer to Configure System Event Notifications for additional examples.

Threshold-based Event Notification Commands

NetQ supports TCA events, a set of events that are triggered by crossing a user-defined threshold. Configure and manage TCA events using the following commands:

netq add tca [event_id <text-event-id-anchor>] [tca_id <text-tca-id-anchor>] [scope <text-scope-anchor>] [severity info | severity error] [is_active true | is_active false] [suppress_until <text-suppress-ts>] [threshold_type user_set | threshold_type vendor_set] [ threshold <text-threshold-value> ] [channel <text-channel-name-anchor> | channel drop <text-drop-channel-name>]
netq del tca tca_id <text-tca-id-anchor>
netq show tca [tca_id <text-tca-id-anchor>] [json]

Lifecycle Management Commands

The netq lcm lifecycle management commands help you efficiently manage the deployment of NVIDIA product software onto your network devices (servers, appliances, and switches).

LCM commands allow you to:

• Manage network OS and NetQ images in a local repository
• Configure switch access credentials for installations and upgrades
• Manage switch inventory and roles
• Upgrade NetQ (Agents and CLI) on switches with NetQ Agents
• Install or upgrade NetQ Agents and CLI on switches with or without NetQ Agents
• Upgrade the network OS on switches with NetQ Agents
• View a result history of upgrade attempts

The following example shows the NetQ configuration profiles:

cumulus@switch:~$ netq lcm show netq-config
ID                        Name            Default Profile                VRF             WJH       CPU Limit Log Level Last Changed
------------------------- --------------- ------------------------------ --------------- --------- --------- --------- -------------------------
config_profile_3289efda36 NetQ default co Yes                            mgmt            Disable   Disable   info      Tue Apr 27 22:42:05 2021
db4065d56f91ebbd34a523b45 nfig
944fbfd10c5d75f9134d42023
eb2b

The following example shows how to add a Cumulus Linux installation image to the NetQ repository on the switch:

netq lcm add cl-image /path/to/download/cumulus-linux-4.3.0-mlnx-amd64.bin

Trace Commands

The netq trace commands lets you view the available paths between two nodes on the network currently and at a time in the past. You can perform a layer 2 or layer 3 trace, and view the output in one of three formats: JSON, pretty, and detail. JSON output provides the output in a JSON file format for ease of importing to other applications or software. Pretty output lines up the paths in a pseudo-graphical manner to help visualize multiple paths. Detail output is useful for traces with higher hop counts where the pretty output wraps lines, making it harder to interpret the results. The detail output displays a table with a row for each path.

The trace command syntax is:

netq trace (<mac> vlan <1-4096>) from (<src-hostname>|<ip-src>) [vrf <vrf>] [around <text-time>] [json|detail|pretty] [debug]
netq trace <ip> from (<src-hostname>|<ip-src>) [vrf <vrf>] [around <text-time>] [json|detail|pretty] [debug]
netq trace (<mac> vlan <1-4096>) from <mac-src> [around <text-time>] [json|detail|pretty] [debug]

cumulus@switch:~$ netq trace 10.0.0.11 from 10.0.0.14 pretty
Number of Paths: 6
    Inconsistent PMTU among paths
Number of Paths with Errors: 0
Number of Paths with Warnings: 0
Path MTU: 9000
    leaf04 swp52 -- swp4 spine02 swp2 -- swp52 leaf02 peerlink.4094 -- peerlink.4094 leaf01 lo
                                                    peerlink.4094 -- peerlink.4094 leaf01 lo
    leaf04 swp51 -- swp4 spine01 swp2 -- swp51 leaf02 peerlink.4094 -- peerlink.4094 leaf01 lo
                                                    peerlink.4094 -- peerlink.4094 leaf01 lo
    leaf04 swp52 -- swp4 spine02 swp1 -- swp52 leaf01 lo
    leaf04 swp51 -- swp4 spine01 swp1 -- swp51 leaf01 lo

cumulus@switch:~$ netq trace 10.0.0.11 from 10.0.0.14 detail
Number of Paths: 6
    Inconsistent PMTU among paths
Number of Paths with Errors: 0
Number of Paths with Warnings: 0
Path MTU: 9000
Id  Hop Hostname        InPort          InVlan InTunnel              InRtrIf         InVRF           OutRtrIf        OutVRF          OutTunnel             OutPort         OutVlan
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
1   1   leaf04                                                                                       swp52           default                               swp52
    2   spine02         swp4                                         swp4            default         swp2            default                               swp2
    3   leaf02          swp52                                        swp52           default         peerlink.4094   default                               peerlink.4094
    4   leaf01          peerlink.4094                                peerlink.4094   default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
2   1   leaf04                                                                                       swp52           default                               swp52
    2   spine02         swp4                                         swp4            default         swp2            default                               swp2
    3   leaf02          swp52                                        swp52           default         peerlink.4094   default                               peerlink.4094
    4   leaf01          peerlink.4094                                peerlink.4094   default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
3   1   leaf04                                                                                       swp51           default                               swp51
    2   spine01         swp4                                         swp4            default         swp2            default                               swp2
    3   leaf02          swp51                                        swp51           default         peerlink.4094   default                               peerlink.4094
    4   leaf01          peerlink.4094                                peerlink.4094   default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
4   1   leaf04                                                                                       swp51           default                               swp51
    2   spine01         swp4                                         swp4            default         swp2            default                               swp2
    3   leaf02          swp51                                        swp51           default         peerlink.4094   default                               peerlink.4094
    4   leaf01          peerlink.4094                                peerlink.4094   default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
5   1   leaf04                                                                                       swp52           default                               swp52
    2   spine02         swp4                                         swp4            default         swp1            default                               swp1
    3   leaf01          swp52                                        swp52           default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------
6   1   leaf04                                                                                       swp51           default                               swp51
    2   spine01         swp4                                         swp4            default         swp1            default                               swp1
    3   leaf01          swp51                                        swp51           default                                                               lo
--- --- --------------- --------------- ------ --------------------- --------------- --------------- --------------- --------------- --------------------- --------------- -------

cumulus@switch:~$ netq trace A0:00:00:00:00:11 vlan 1001 from Server03 pretty
Number of Paths: 6
Number of Paths with Errors: 0
Number of Paths with Warnings: 0
Path MTU: 9152
    
    Server03 bond1.1001 -- swp7 <vlan1001> Leaf02 vni: 34 swp5 -- swp4 Spine03 swp7 -- swp5 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>
                                                        swp4 -- swp4 Spine02 swp7 -- swp4 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>
                                                        swp3 -- swp4 Spine01 swp7 -- swp3 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>
            bond1.1001 -- swp7 <vlan1001> Leaf01 vni: 34 swp5 -- swp3 Spine03 swp7 -- swp5 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>
                                                        swp4 -- swp3 Spine02 swp7 -- swp4 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>
                                                        swp3 -- swp3 Spine01 swp7 -- swp3 vni: 34 Leaf04 swp6 -- swp1.1001 Server03 <swp1.1001>

Related Information

• NetQ CLI Reference

This section describes how to install, configure, and upgrade NetQ.

This overview is designed to help you understand the various NetQ deployment and installation options.

Installation Overview

Consider the following before you install the NetQ system:

1. Determine whether to deploy the solution fully on premises or as a remote solution.
2. Decide whether to deploy a virtual machine on your own hardware or use one of the NetQ appliances.
3. Choose whether to install the software on a single server or as a server cluster.

The following decision tree reflects these steps:

Deployment Type: On Premises or Remote

You can deploy NetQ in one of two ways.

• Hosted on premises: Choose this deployment if you want to host all required hardware and software at your location, and you have the in-house skill set to install, configure, and maintain it—including performing data backups, acquiring and maintaining hardware and software, and integration management. This model is also a good choice if you want very limited or no access to the internet from switches and hosts in your network or you have data residency requirements like GDPR.
• Hosted remotely: Choose this deployment to host a multi-site, on-premises deployment or use the NetQ Cloud service. In the multi-site deployment, you host multiple small servers at each site and a large server and database at another site. In the cloud service deployment, you host only a small local server on your premises that connects to the NetQ Cloud service over selected ports or through a proxy server. The cloud service supports only data aggregation and forwarding locally, and the majority of the NetQ applications use a hosted deployment strategy, storing data in the cloud. NVIDIA handles the backups and maintenance of the application and storage. This remote cloud service model is often chosen when it is untenable to support deployment in-house or if you need the flexibility to scale quickly, while also reducing capital expenses.

With either deployment model, the NetQ Agents reside on the switches and hosts they monitor in your network.

System: Virtual Machine or NetQ Appliances

The next installation consideration is whether you plan to use NetQ Cloud Appliances or your own servers with VMs. Both options provide the same services and features. The difference is in the implementation. When you install NetQ software on your own hardware, you create and maintain a KVM or VMware VM, and the software runs from there. This requires you to scope and order an appropriate hardware server to support the NetQ requirements, but might allow you to reuse an existing server in your stock.

When you choose to purchase and install NetQ Cloud Appliances, the initial configuration of the server with Ubuntu OS is already done for you, and the NetQ software components are pre-loaded, saving you time during the physical deployment.

Data Flow

The flow of data differs based on your deployment model.

For the on-premises deployment, the NetQ Agents collect and transmit data from the switches and hosts back to the NetQ On-premises Appliance or virtual machine running the NetQ Platform software, which in turn processes and stores the data in its database. This data is then displayed through the user interface.

For the remote, multi-site NetQ implementation, the NetQ Agents at each premises collect and transmit data from the switches and hosts at that premises to its NetQ Cloud Appliance or virtual machine running the NetQ Collector software. The NetQ Collectors then transmit this data to the common NetQ Cloud Appliance or virtual machine and database at one of your premises for processing and storage.

For the remote, cloud-service implementation, the NetQ Agents collect and transmit data from the switches and hosts to the NetQ Cloud Appliance or virtual machine running the NetQ Collector software. The NetQ Collector then transmits this data to the NVIDIA cloud-based infrastructure for further processing and storage.

For either remote solution, telemetry data is displayed through the same user interfaces as the on-premises solution. When using the cloud service implementation of the remote solution, the browser interface can be pointed to the local NetQ Cloud Appliance or VM, or directly to netq.nvidia.com.

Server Arrangement: Single or Cluster

The next installation step is deciding whether to deploy a single server or a server cluster. Both options provide the same services and features. The biggest difference is the number of servers deployed and the continued availability of services running on those servers should hardware failures occur.

A single server is easier to set up, configure and manage, but can limit your ability to scale your network monitoring quickly. Deploying multiple servers is a bit more complicated, but you limit potential downtime and increase availability by having more than one server that can run the software and store the data. Select the standalone single-server arrangements for smaller, simpler deployments. Be sure to consider the capabilities and resources needed on this server to support the size of your final deployment.

Select the server cluster arrangement to obtain scalability and high availability for your network. The default clustering implementation has three servers: 1 master and 2 workers. However, NetQ supports up to 10 worker nodes in a cluster. When you configure the cluster, configure the NetQ Agents to connect to these three nodes in the cluster first by providing the IP addresses as a comma-separated list. If you decide to add additional nodes to the cluster, you do not need to configure these nodes again.

Cluster Deployments and Kubernetes

NetQ also monitors Kubernetes containers. If the master node ever goes down, all NetQ services should continue to work. However, keep in mind that the master hosts the Kubernetes control plane so anything that requires connectivity with the Kubernetes cluster—such as upgrading NetQ or rescheduling pods to other workers if a worker goes down—will not work.

Cluster Deployments and Load Balancers

You need a load balancer for high availability for the NetQ API and the NetQ UI.

However, you need to be mindful of where you install the certificates for the NetQ UI (port 443); otherwise, you cannot access the NetQ UI.

If you are using a load balancer in your deployment, we recommend you install the certificates directly on the load balancer for SSL offloading. However, if you install the certificates on the master node, then configure the load balancer to allow for SSL passthrough.

Where to Go Next

After you’ve decided on your deployment type, you’re ready to install NetQ.

The following sections provide installation instruction for the NetQ system and software. To install NetQ:

1. Visit Before You Install to understand the various NetQ deployments.

2. After deciding your deployment model, prepare your devices and install NetQ.

3. Next, install and configure the NetQ Agents on switches and hosts.

4. Finally, install and configure the NetQ CLI on switches and hosts.

The following table lists the various ways to install NetQ. If you are unsure which option is best for your network, refer to Before You Install.

Follow these steps to set up and configure your VM on a single server in an on-premises deployment:

1. Verify that your system meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Sixteen (16) virtual CPUs
   Memory	64 GB RAM
   Local disk storage	500 GB SSD with minimum disk IOPS of 1000 for a standard 4kb block size (Note: This must be an SSD; use of other storage options can lead to system instability and are not supported.)
   Network interface speed	1 Gb NIC
   Hypervisor	VMware ESXi™ 6.5 or later (OVA image) for servers running Cumulus Linux, CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications.

   You must open the following ports on your NetQ on-premises server:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	NetQ UI
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   30001	TCP	DPU communication
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 VMWare image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   VMware Example Configuration

   This example shows the VM setup process using an OVA file with VMware ESXi.

   1. Enter the address of the hardware in your browser.

   2. Log in to VMware using credentials with root access.

      

   3. Click Storage in the Navigator to verify you have an SSD installed.

      

   4. Click Create/Register VM at the top of the right pane.

      

   5. Select Deploy a virtual machine from an OVF or OVA file, and click Next.

      

   6. Provide a name for the VM, for example NetQ.

      Tip: Make note of the name used during install as this is needed in a later step.

   7. Drag and drop the NetQ Platform image file you downloaded in Step 2 above.

   

5. Click Next.

6. Select the storage type and data store for the image to use, then click Next. In this example, only one is available.

   

7. Accept the default deployment options or modify them according to your network needs. Click Next when you are finished.

   

8. Review the configuration summary. Click Back to change any of the settings, or click Finish to continue with the creation of the VM.

   

   The progress of the request is shown in the Recent Tasks window at the bottom of the application. This may take some time, so continue with your other work until the upload finishes.

9. Once completed, view the full details of the VM and hardware.

   

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
You are required to change your password immediately (root enforced)
System information as of Thu Dec  3 21:35:42 UTC 2020
System load:  0.09              Processes:           120
Usage of /:   8.1% of 61.86GB   Users logged in:     0
Memory usage: 5%                IP address for eth0: <ipaddr>
Swap usage:   0%
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for cumulus.
(current) UNIX password: cumulus
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Connection to <ipaddr> closed.

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
  System information as of Thu Dec  3 21:35:59 UTC 2020
  System load:  0.07              Processes:           121
  Usage of /:   8.1% of 61.86GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: <ipaddr>
  Swap usage:   0%
Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
cumulus@ubuntu:~$

cumulus@hostname:~$ sudo opta-check

cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

127.0.0.1 localhost NEW_HOSTNAME

Run the following command on your NetQ platform server or NetQ Appliance:

cumulus@hostname:~$ netq install standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

Follow these steps to set up and configure your VM for a cloud deployment:

1. Verify that your system meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Four (4) virtual CPUs
   Memory	8 GB RAM
   Local disk storage	64 GB
   Network interface speed	1 Gb NIC
   Hypervisor	VMware ESXi™ 6.5 or later (OVA image) for servers running Cumulus Linux, CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications. The OPTA must be able to initiate HTTPS connections (destination TCP port 443) to the netq.nvidia.com domain (*.netq.nvidia.com). You must also open the following ports on your NetQ OPTA:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	Nginx
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 VMWare Cloud image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   VMware Example Configuration

   This example shows the VM setup process using an OVA file with VMware ESXi.

   1. Enter the address of the hardware in your browser.

   2. Log in to VMware using credentials with root access.

      

   3. Click Storage in the Navigator to verify you have an SSD installed.

      

   4. Click Create/Register VM at the top of the right pane.

      

   5. Select Deploy a virtual machine from an OVF or OVA file, and click Next.

      

   6. Provide a name for the VM, for example NetQ.

      Tip: Make note of the name used during install as this is needed in a later step.

   7. Drag and drop the NetQ Platform image file you downloaded in Step 2 above.

   

5. Click Next.

6. Select the storage type and data store for the image to use, then click Next. In this example, only one is available.

   

7. Accept the default deployment options or modify them according to your network needs. Click Next when you are finished.

   

8. Review the configuration summary. Click Back to change any of the settings, or click Finish to continue with the creation of the VM.

   

   The progress of the request is shown in the Recent Tasks window at the bottom of the application. This may take some time, so continue with your other work until the upload finishes.

9. Once completed, view the full details of the VM and hardware.

   

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
You are required to change your password immediately (root enforced)
System information as of Thu Dec  3 21:35:42 UTC 2020
System load:  0.09              Processes:           120
Usage of /:   8.1% of 61.86GB   Users logged in:     0
Memory usage: 5%                IP address for eth0: <ipaddr>
Swap usage:   0%
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for cumulus.
(current) UNIX password: cumulus
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Connection to <ipaddr> closed.

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
  System information as of Thu Dec  3 21:35:59 UTC 2020
  System load:  0.07              Processes:           121
  Usage of /:   8.1% of 61.86GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: <ipaddr>
  Swap usage:   0%
Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
cumulus@ubuntu:~$

cumulus@hostname:~$ sudo opta-check-cloud

cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

127.0.0.1 localhost NEW_HOSTNAME

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI.

cumulus@<hostname>:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host <proxy-hostname> proxy-port <proxy-port>]

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

First configure the VM on the master node, and then configure the VM on each worker node.

Follow these steps to set up and configure your VM cluster for an on-premises deployment:

1. Verify that your master node meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Sixteen (16) virtual CPUs
   Memory	64 GB RAM
   Local disk storage	500 GB SSD with minimum disk IOPS of 1000 for a standard 4kb block size (Note: This must be an SSD; use of other storage options can lead to system instability and are not supported.)
   Network interface speed	1 Gb NIC
   Hypervisor	VMware ESXi™ 6.5 or later (OVA image) for servers running Cumulus Linux, CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications.

   You must open the following ports on your NetQ on-premises servers:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	NetQ UI
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   30001	TCP	DPU communication
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

   Additionally, for internal cluster communication, you must open these ports:

   Port	Protocol	Component Access
   8080	TCP	Admin API
   5000	TCP	Docker registry
   6443	TCP	Kubernetes API server
   10250	TCP	kubelet health probe
   2379	TCP	etcd
   2380	TCP	etcd
   7072	TCP	Kafka JMX monitoring
   9092	TCP	Kafka client
   7071	TCP	Cassandra JMX monitoring
   7000	TCP	Cassandra cluster communication
   9042	TCP	Cassandra client
   7073	TCP	Zookeeper JMX monitoring
   2888	TCP	Zookeeper cluster communication
   3888	TCP	Zookeeper cluster communication
   2181	TCP	Zookeeper client
   36443	TCP	Kubernetes control plane

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 VMWare image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   VMware Example Configuration

   This example shows the VM setup process using an OVA file with VMware ESXi.

   1. Enter the address of the hardware in your browser.

   2. Log in to VMware using credentials with root access.

      

   3. Click Storage in the Navigator to verify you have an SSD installed.

      

   4. Click Create/Register VM at the top of the right pane.

      

   5. Select Deploy a virtual machine from an OVF or OVA file, and click Next.

      

   6. Provide a name for the VM, for example NetQ.

      Tip: Make note of the name used during install as this is needed in a later step.

   7. Drag and drop the NetQ Platform image file you downloaded in Step 2 above.

   

5. Click Next.

6. Select the storage type and data store for the image to use, then click Next. In this example, only one is available.

   

7. Accept the default deployment options or modify them according to your network needs. Click Next when you are finished.

   

8. Review the configuration summary. Click Back to change any of the settings, or click Finish to continue with the creation of the VM.

   

   The progress of the request is shown in the Recent Tasks window at the bottom of the application. This may take some time, so continue with your other work until the upload finishes.

9. Once completed, view the full details of the VM and hardware.

   

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
You are required to change your password immediately (root enforced)
System information as of Thu Dec  3 21:35:42 UTC 2020
System load:  0.09              Processes:           120
Usage of /:   8.1% of 61.86GB   Users logged in:     0
Memory usage: 5%                IP address for eth0: <ipaddr>
Swap usage:   0%
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for cumulus.
(current) UNIX password: cumulus
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Connection to <ipaddr> closed.

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
  System information as of Thu Dec  3 21:35:59 UTC 2020
  System load:  0.07              Processes:           121
  Usage of /:   8.1% of 61.86GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: <ipaddr>
  Swap usage:   0%
Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
cumulus@ubuntu:~$

cumulus@hostname:~$ sudo opta-check

cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

127.0.0.1 localhost NEW_HOSTNAME

cumulus@hostname:~$ sudo opta-check-cloud

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following commands on your master node, using the IP addresses of your worker nodes:

cumulus@<hostname>:~$ netq install cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz workers <worker-1-ip> <worker-2-ip>

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

First configure the VM on the master node, and then configure the VM on each worker node.

Follow these steps to set up and configure your VM on a cluster of servers in a cloud deployment:

1. Verify that your master node meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Four (4) virtual CPUs
   Memory	8 GB RAM
   Local disk storage	64 GB
   Network interface speed	1 Gb NIC
   Hypervisor	VMware ESXi™ 6.5 or later (OVA image) for servers running Cumulus Linux, CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications. The OPTA must be able to initiate HTTPS connections (destination TCP port 443) to the netq.nvidia.com domain (*.netq.nvidia.com). You must also open the following ports on your NetQ OPTA:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	Nginx
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

   The following ports are used for internal cluster communication and must also be open between servers in your cluster:
   
   

   Port	Protocol	Component Access
   8080	TCP	Admin API
   5000	TCP	Docker registry
   6443	TCP	Kubernetes API server
   10250	TCP	kubelet health probe
   2379	TCP	etcd
   2380	TCP	etcd
   36443	TCP	Kubernetes control plane

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 VMWare Cloud image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   VMware Example Configuration

   This example shows the VM setup process using an OVA file with VMware ESXi.

   1. Enter the address of the hardware in your browser.

   2. Log in to VMware using credentials with root access.

      

   3. Click Storage in the Navigator to verify you have an SSD installed.

      

   4. Click Create/Register VM at the top of the right pane.

      

   5. Select Deploy a virtual machine from an OVF or OVA file, and click Next.

      

   6. Provide a name for the VM, for example NetQ.

      Tip: Make note of the name used during install as this is needed in a later step.

   7. Drag and drop the NetQ Platform image file you downloaded in Step 2 above.

   

5. Click Next.

6. Select the storage type and data store for the image to use, then click Next. In this example, only one is available.

   

7. Accept the default deployment options or modify them according to your network needs. Click Next when you are finished.

   

8. Review the configuration summary. Click Back to change any of the settings, or click Finish to continue with the creation of the VM.

   

   The progress of the request is shown in the Recent Tasks window at the bottom of the application. This may take some time, so continue with your other work until the upload finishes.

9. Once completed, view the full details of the VM and hardware.

   

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
You are required to change your password immediately (root enforced)
System information as of Thu Dec  3 21:35:42 UTC 2020
System load:  0.09              Processes:           120
Usage of /:   8.1% of 61.86GB   Users logged in:     0
Memory usage: 5%                IP address for eth0: <ipaddr>
Swap usage:   0%
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for cumulus.
(current) UNIX password: cumulus
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Connection to <ipaddr> closed.

$ ssh cumulus@<ipaddr>
Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
Ubuntu 20.04 LTS
cumulus@<ipaddr>'s password:
  System information as of Thu Dec  3 21:35:59 UTC 2020
  System load:  0.07              Processes:           121
  Usage of /:   8.1% of 61.86GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: <ipaddr>
  Swap usage:   0%
Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
cumulus@ubuntu:~$

cumulus@hostname:~$ sudo opta-check-cloud

cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

127.0.0.1 localhost NEW_HOSTNAME

cumulus@hostname:~$ sudo opta-check-cloud

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a
    

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI in the premise management configuration.

cumulus@<hostname>:~$ netq install opta cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> workers <worker-1-ip> <worker-2-ip> [proxy-host <proxy-hostname> proxy-port <proxy-port>]
    

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key  [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

Follow these steps to set up and configure your VM on a single server in an on-premises deployment:

1. Verify that your system meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Sixteen (16) virtual CPUs
   Memory	64 GB RAM
   Local disk storage	500 GB SSD with minimum disk IOPS of 1000 for a standard 4kb block size (Note: This must be an SSD; use of other storage options can lead to system instability and are not supported.)
   Network interface speed	1 Gb NIC
   Hypervisor	KVM/QCOW (QEMU Copy on Write) image for servers running CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications.

   You must open the following ports on your NetQ on-premises server:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	NetQ UI
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   30001	TCP	DPU communication
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 KVM image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Set up and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   KVM Example Configuration

   This example shows the VM setup process for a system with Libvirt and KVM/QEMU installed.

   1. Confirm that the SHA256 checksum matches the one posted on the NVIDIA Application Hub to ensure the image download has not been corrupted.

      $ sha256sum ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2
      $ 0A00383666376471A8190E2367B27068B81D6EE00FDE885C68F4E3B3025A00B6  ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2

   2. Copy the QCOW2 image to a directory where you want to run it.

      Tip: Copy, instead of moving, the original QCOW2 image that was downloaded to avoid re-downloading it again later should you need to perform this process again.

      $ sudo mkdir /vms
      $ sudo cp ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2 /vms/ts.qcow2

   3. Create the VM.

      For a Direct VM, where the VM uses a MACVLAN interface to sit on the host interface for its connectivity:

      $ virt-install --name=netq_ts --vcpus=16 --memory=65536 --os-type=linux --os-variant=generic --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=type=direct,source=eth0,model=virtio --import --noautoconsole

      Replace the disk path value with the location where the QCOW2 image is to reside. Replace network model value (eth0 in the above example) with the name of the interface where the VM is connected to the external network.

      Or, for a Bridged VM, where the VM attaches to a bridge which has already been setup to allow for external access:

      $ virt-install --name=netq_ts --vcpus=16 --memory=65536 --os-type=linux --os-variant=generic \ --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=bridge=br0,model=virtio --import --noautoconsole

      Replace network bridge value (br0 in the above example) with the name of the (pre-existing) bridge interface where the VM is connected to the external network.

      Make note of the name used during install as this is needed in a later step.

   4. Watch the boot process in another terminal window.

      $ virsh console netq_ts

5. Log into the VM and change the password.

   Use the default credentials to log in the first time:

   • Username: cumulus
   • Password: cumulus

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
   You are required to change your password immediately (root enforced)
   System information as of Thu Dec  3 21:35:42 UTC 2020
   System load:  0.09              Processes:           120
   Usage of /:   8.1% of 61.86GB   Users logged in:     0
   Memory usage: 5%                IP address for eth0: <ipaddr>
   Swap usage:   0%
   WARNING: Your password has expired.
   You must change your password now and login again!
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   Connection to <ipaddr> closed.
   

   Log in again with your new password.

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
     System information as of Thu Dec  3 21:35:59 UTC 2020
     System load:  0.07              Processes:           121
     Usage of /:   8.1% of 61.86GB   Users logged in:     0
     Memory usage: 5%                IP address for eth0: <ipaddr>
     Swap usage:   0%
   Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
   cumulus@ubuntu:~$
   

6. Verify the platform is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check

7. Change the hostname for the VM from the default value.

   The default hostname for the NetQ Virtual Machines is ubuntu. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames are composed of a sequence of labels concatenated with dots. For example, “en.wikipedia.org” is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels may contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

   Add the same NEW_HOSTNAME value to /etc/hosts on your VM for the localhost entry. Example:

   127.0.0.1 localhost NEW_HOSTNAME

8. The final step is to install and activate the NetQ software:

Run the following command on your NetQ platform server or NetQ Appliance:

cumulus@hostname:~$ netq install standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

Follow these steps to set up and configure your VM on a single server in a cloud deployment:

1. Verify that your system meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Four (4) virtual CPUs
   Memory	8 GB RAM
   Local disk storage	64 GB
   Network interface speed	1 Gb NIC
   Hypervisor	KVM/QCOW (QEMU Copy on Write) image for servers running CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications. The OPTA must be able to initiate HTTPS connections (destination TCP port 443) to the netq.nvidia.com domain (*.netq.nvidia.com). You must also open the following ports on your NetQ OPTA:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	Nginx
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

3. Download the NetQ images.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 KVM Cloud image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   KVM Example Configuration

   This example shows the VM setup process for a system with Libvirt and KVM/QEMU installed.

   1. Confirm that the SHA256 checksum matches the one posted on the NVIDIA Application Hub to ensure the image download has not been corrupted.

      $ sha256sum ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2
      $ FE353FC06D3F843F4041D74C853D38B0A56036C5886F6233A3ED1A9464AEB783  ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2

   2. Copy the QCOW2 image to a directory where you want to run it.

      Tip: Copy, instead of moving, the original QCOW2 image that was downloaded to avoid re-downloading it again later should you need to perform this process again.

      $ sudo mkdir /vms
      $ sudo cp ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2 /vms/ts.qcow2

   3. Create the VM.

      For a Direct VM, where the VM uses a MACVLAN interface to sit on the host interface for its connectivity:

      $ virt-install --name=netq_ts --vcpus=4 --memory=8192 --os-type=linux --os-variant=generic --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=type=direct,source=eth0,model=virtio --import --noautoconsole

      Replace the disk path value with the location where the QCOW2 image is to reside. Replace network model value (eth0 in the above example) with the name of the interface where the VM is connected to the external network.

      Or, for a Bridged VM, where the VM attaches to a bridge which has already been setup to allow for external access:

      $ virt-install --name=netq_ts --vcpus=4 --memory=8192 --os-type=linux --os-variant=generic \ --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=bridge=br0,model=virtio --import --noautoconsole

      Replace network bridge value (br0 in the above example) with the name of the (pre-existing) bridge interface where the VM is connected to the external network.

      Make note of the name used during install as this is needed in a later step.

   4. Watch the boot process in another terminal window.

      $ virsh console netq_ts

5. Log in to the VM and change the password.

   Use the default credentials to log in the first time:

   • Username: cumulus
   • Password: cumulus

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
   You are required to change your password immediately (root enforced)
   System information as of Thu Dec  3 21:35:42 UTC 2020
   System load:  0.09              Processes:           120
   Usage of /:   8.1% of 61.86GB   Users logged in:     0
   Memory usage: 5%                IP address for eth0: <ipaddr>
   Swap usage:   0%
   WARNING: Your password has expired.
   You must change your password now and login again!
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   Connection to <ipaddr> closed.
   

   Log in again with your new password.

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
     System information as of Thu Dec  3 21:35:59 UTC 2020
     System load:  0.07              Processes:           121
     Usage of /:   8.1% of 61.86GB   Users logged in:     0
     Memory usage: 5%                IP address for eth0: <ipaddr>
     Swap usage:   0%
   Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
   cumulus@ubuntu:~$
   

6. Verify the platform is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check-cloud

7. Change the hostname for the VM from the default value.

   The default hostname for the NetQ Virtual Machines is ubuntu. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames are composed of a sequence of labels concatenated with dots. For example, “en.wikipedia.org” is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels may contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

   Add the same NEW_HOSTNAME value to /etc/hosts on your VM for the localhost entry. Example:

   127.0.0.1 localhost NEW_HOSTNAME

8. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI.

cumulus@<hostname>:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host <proxy-hostname> proxy-port <proxy-port>]

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

First configure the VM on the master node, and then configure the VM on each worker node.

Follow these steps to set up and configure your VM on a cluster of servers in an on-premises deployment:

1. Verify that your master node meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Sixteen (16) virtual CPUs
   Memory	64 GB RAM
   Local disk storage	500 GB SSD with minimum disk IOPS of 1000 for a standard 4kb block size (Note: This must be an SSD; use of other storage options can lead to system instability and are not supported.)
   Network interface speed	1 Gb NIC
   Hypervisor	KVM/QCOW (QEMU Copy on Write) image for servers running CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications.

   You must open the following ports on your NetQ on-premises servers:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	NetQ UI
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   30001	TCP	DPU communication
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

   Additionally, for internal cluster communication, you must open these ports:

   Port	Protocol	Component Access
   8080	TCP	Admin API
   5000	TCP	Docker registry
   6443	TCP	Kubernetes API server
   10250	TCP	kubelet health probe
   2379	TCP	etcd
   2380	TCP	etcd
   7072	TCP	Kafka JMX monitoring
   9092	TCP	Kafka client
   7071	TCP	Cassandra JMX monitoring
   7000	TCP	Cassandra cluster communication
   9042	TCP	Cassandra client
   7073	TCP	Zookeeper JMX monitoring
   2888	TCP	Zookeeper cluster communication
   3888	TCP	Zookeeper cluster communication
   2181	TCP	Zookeeper client
   36443	TCP	Kubernetes control plane

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 KVM image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   KVM Example Configuration

   This example shows the VM setup process for a system with Libvirt and KVM/QEMU installed.

   1. Confirm that the SHA256 checksum matches the one posted on the NVIDIA Application Hub to ensure the image download has not been corrupted.

      $ sha256sum ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2
      $ 0A00383666376471A8190E2367B27068B81D6EE00FDE885C68F4E3B3025A00B6  ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2

   2. Copy the QCOW2 image to a directory where you want to run it.

      Tip: Copy, instead of moving, the original QCOW2 image that was downloaded to avoid re-downloading it again later should you need to perform this process again.

      $ sudo mkdir /vms
      $ sudo cp ./Downloads/netq-4.5.0-ubuntu-20.04-ts-qemu.qcow2 /vms/ts.qcow2

   3. Create the VM.

      For a Direct VM, where the VM uses a MACVLAN interface to sit on the host interface for its connectivity:

      $ virt-install --name=netq_ts --vcpus=16 --memory=65536 --os-type=linux --os-variant=generic --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=type=direct,source=eth0,model=virtio --import --noautoconsole

      Replace the disk path value with the location where the QCOW2 image is to reside. Replace network model value (eth0 in the above example) with the name of the interface where the VM is connected to the external network.

      Or, for a Bridged VM, where the VM attaches to a bridge which has already been setup to allow for external access:

      $ virt-install --name=netq_ts --vcpus=16 --memory=65536 --os-type=linux --os-variant=generic \ --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=bridge=br0,model=virtio --import --noautoconsole

      Replace network bridge value (br0 in the above example) with the name of the (pre-existing) bridge interface where the VM is connected to the external network.

      Make note of the name used during install as this is needed in a later step.

   4. Watch the boot process in another terminal window.

      $ virsh console netq_ts

5. Log in to the VM and change the password.

   Use the default credentials to log in the first time:

   • Username: cumulus
   • Password: cumulus

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
   You are required to change your password immediately (root enforced)
   System information as of Thu Dec  3 21:35:42 UTC 2020
   System load:  0.09              Processes:           120
   Usage of /:   8.1% of 61.86GB   Users logged in:     0
   Memory usage: 5%                IP address for eth0: <ipaddr>
   Swap usage:   0%
   WARNING: Your password has expired.
   You must change your password now and login again!
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   Connection to <ipaddr> closed.
   

   Log in again with your new password.

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
     System information as of Thu Dec  3 21:35:59 UTC 2020
     System load:  0.07              Processes:           121
     Usage of /:   8.1% of 61.86GB   Users logged in:     0
     Memory usage: 5%                IP address for eth0: <ipaddr>
     Swap usage:   0%
   Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
   cumulus@ubuntu:~$
   

6. Verify the master node is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check

7. Change the hostname for the VM from the default value.

   The default hostname for the NetQ Virtual Machines is ubuntu. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames are composed of a sequence of labels concatenated with dots. For example, “en.wikipedia.org” is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels may contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

   Add the same NEW_HOSTNAME value to /etc/hosts on your VM for the localhost entry. Example:

   127.0.0.1 localhost NEW_HOSTNAME

8. Verify that your first worker node meets the VM requirements, as described in Step 1.

9. Confirm that the needed ports are open for communications, as described in Step 2.

10. Open your hypervisor and set up the VM in the same manner as for the master node.

    Make a note of the private IP address you assign to the worker node. You need it for later installation steps.

11. Verify the worker node is ready for installation. Fix any errors indicated before installing the NetQ software.

    cumulus@hostname:~$ sudo opta-check

12. Repeat Steps 8 through 11 for each additional worker node you want in your cluster.

13. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following commands on your master node, using the IP addresses of your worker nodes:

cumulus@<hostname>:~$ netq install cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz workers <worker-1-ip> <worker-2-ip>

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

First configure the VM on the master node, and then configure the VM on each worker node.

Follow these steps to set up and configure your VM on a cluster of servers in a cloud deployment:

1. Verify that your master node meets the VM requirements.

   Resource	Minimum Requirements
   Processor	Four (4) virtual CPUs
   Memory	8 GB RAM
   Local disk storage	64 GB
   Network interface speed	1 Gb NIC
   Hypervisor	KVM/QCOW (QEMU Copy on Write) image for servers running CentOS, Ubuntu, and RedHat operating systems

2. Confirm that the required ports are open for communications. The OPTA must be able to initiate HTTPS connections (destination TCP port 443) to the netq.nvidia.com domain (*.netq.nvidia.com). You must also open the following ports on your NetQ OPTA:

   Port or Protocol Number	Protocol	Component Access
   4	IP Protocol	Calico networking (IP-in-IP Protocol)
   22	TCP	SSH
   80	TCP	Nginx
   179	TCP	Calico networking (BGP)
   443	TCP	Nginx
   2379	TCP	etcd datastore
   4789	UDP	Calico networking (VxLAN)
   5000	TCP	Docker registry
   6443	TCP	kube-apiserver
   31980	TCP	NetQ Agent communication
   31982	TCP	NetQ Agent SSL communication
   32708	TCP	API Gateway

   The following ports are used for internal cluster communication and must also be open between servers in your cluster:
   
   

   Port	Protocol	Component Access
   8080	TCP	Admin API
   5000	TCP	Docker registry
   6443	TCP	Kubernetes API server
   10250	TCP	kubelet health probe
   2379	TCP	etcd
   2380	TCP	etcd
   36443	TCP	Kubernetes control plane

3. Download the NetQ Platform image.

   1. On the NVIDIA Application Hub, log in to your account.
      
   2. Select NVIDIA Licensing Portal.
   3. Select Software Downloads from the menu.
   4. Click Product Family and select NetQ.
   5. Locate the NetQ SW 4.5 KVM Cloud image and select Download.
   6. If prompted, read the license agreement and proceed with the download.

   For enterprise customers, if you do not see a link to the NVIDIA Licensing Portal on the NVIDIA Application Hub, contact NVIDIA support.

   
   

   For NVIDIA employees, download NetQ directly from the NVIDIA Licensing Portal.

4. Setup and configure your VM.

   Open your hypervisor and set up your VM. You can use this example for reference or use your own hypervisor instructions.

   KVM Example Configuration

   This example shows the VM setup process for a system with Libvirt and KVM/QEMU installed.

   1. Confirm that the SHA256 checksum matches the one posted on the NVIDIA Application Hub to ensure the image download has not been corrupted.

      $ sha256sum ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2
      $ FE353FC06D3F843F4041D74C853D38B0A56036C5886F6233A3ED1A9464AEB783  ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2

   2. Copy the QCOW2 image to a directory where you want to run it.

      Tip: Copy, instead of moving, the original QCOW2 image that was downloaded to avoid re-downloading it again later should you need to perform this process again.

      $ sudo mkdir /vms
      $ sudo cp ./Downloads/netq-4.5.0-ubuntu-20.04-tscloud-qemu.qcow2 /vms/ts.qcow2

   3. Create the VM.

      For a Direct VM, where the VM uses a MACVLAN interface to sit on the host interface for its connectivity:

      $ virt-install --name=netq_ts --vcpus=4 --memory=8192 --os-type=linux --os-variant=generic --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=type=direct,source=eth0,model=virtio --import --noautoconsole

      Replace the disk path value with the location where the QCOW2 image is to reside. Replace network model value (eth0 in the above example) with the name of the interface where the VM is connected to the external network.

      Or, for a Bridged VM, where the VM attaches to a bridge which has already been setup to allow for external access:

      $ virt-install --name=netq_ts --vcpus=4 --memory=8192 --os-type=linux --os-variant=generic \ --disk path=/vms/ts.qcow2,format=qcow2,bus=virtio,cache=none --network=bridge=br0,model=virtio --import --noautoconsole

      Replace network bridge value (br0 in the above example) with the name of the (pre-existing) bridge interface where the VM is connected to the external network.

      Make note of the name used during install as this is needed in a later step.

   4. Watch the boot process in another terminal window.

      $ virsh console netq_ts

5. Log in to the VM and change the password.

   Use the default credentials to log in the first time:

   • Username: cumulus
   • Password: cumulus

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
   You are required to change your password immediately (root enforced)
   System information as of Thu Dec  3 21:35:42 UTC 2020
   System load:  0.09              Processes:           120
   Usage of /:   8.1% of 61.86GB   Users logged in:     0
   Memory usage: 5%                IP address for eth0: <ipaddr>
   Swap usage:   0%
   WARNING: Your password has expired.
   You must change your password now and login again!
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   Connection to <ipaddr> closed.
   

   Log in again with your new password.

   $ ssh cumulus@<ipaddr>
   Warning: Permanently added '<ipaddr>' (ECDSA) to the list of known hosts.
   Ubuntu 20.04 LTS
   cumulus@<ipaddr>'s password:
     System information as of Thu Dec  3 21:35:59 UTC 2020
     System load:  0.07              Processes:           121
     Usage of /:   8.1% of 61.86GB   Users logged in:     0
     Memory usage: 5%                IP address for eth0: <ipaddr>
     Swap usage:   0%
   Last login: Thu Dec  3 21:35:43 2020 from <local-ipaddr>
   cumulus@ubuntu:~$
   

6. Verify the master node is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check-cloud

7. Change the hostname for the VM from the default value.

   The default hostname for the NetQ Virtual Machines is ubuntu. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames are composed of a sequence of labels concatenated with dots. For example, “en.wikipedia.org” is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels may contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME

   Add the same NEW_HOSTNAME value to /etc/hosts on your VM for the localhost entry. Example:

   127.0.0.1 localhost NEW_HOSTNAME

8. Verify that your first worker node meets the VM requirements, as described in Step 1.

9. Confirm that the needed ports are open for communications, as described in Step 2.

10. Open your hypervisor and set up the VM in the same manner as for the master node.

    Make a note of the private IP address you assign to the worker node. You need it for later installation steps.

11. Verify the worker node is ready for installation. Fix any errors indicated before installing the NetQ software.

    cumulus@hostname:~$ sudo opta-check-cloud

12. Repeat Steps 8 through 11 for each additional worker node you want in your cluster.

13. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a
    

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI in the premise management configuration.

cumulus@<hostname>:~$ netq install opta cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> workers <worker-1-ip> <worker-2-ip> [proxy-host <proxy-hostname> proxy-port <proxy-port>]
    

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key  [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

This topic describes how to prepare your single, NetQ On-premises Appliance for installation of the NetQ Platform software.

Each system shipped to you contains:

• Your NVIDIA NetQ On-premises Appliance (a Supermicro 6019P-WTR server)
• Hardware accessories, such as power cables and rack mounting gear (note that network cables and optics ship separately)
• Information regarding your order

For more detail about hardware specifications (including LED layouts and FRUs like the power supply or fans, and accessories like included cables) or safety and environmental information, refer to the user manual and quick reference guide.

Install the Appliance

1. Mount the appliance in the rack.
2. Connect it to power following the procedures described in your appliance's user manual.
3. Connect the Ethernet cable to the 1G management port (eno1).
4. Power on the appliance.

If your network runs DHCP, you can configure NetQ over the network. If DHCP is not enabled, then you configure the appliance using the console cable provided.

Configure the Password, Hostname, and IP Address

Change the password and specify the hostname and IP address for the appliance before installing the NetQ software.

1. Log in to the appliance using the default login credentials:

   • Username: cumulus
   • Password: cumulus

2. Change the password using the passwd command:

   cumulus@hostname:~$ passwd
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   

3. The default hostname for the NetQ On-premises Appliance is netq-appliance. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames comprise a sequence of labels concatenated with dots. For example, en.wikipedia.org is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels can contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME
   

4. Identify the IP address.

   The appliance contains two Ethernet ports. It uses port eno1 for out-of-band management. This is where NetQ Agents should send the telemetry data collected from your monitored switches and hosts. By default, eno1 uses DHCPv4 to get its IP address. You can view the assigned IP address using the following command:

   cumulus@hostname:~$ ip -4 -brief addr show eno1
   eno1             UP             10.20.16.248/24
   

   Alternately, you can configure the interface with a static IP address by editing the /etc/netplan/01-ethernet.yaml Ubuntu Netplan configuration file.

   For example, to set your network interface eno1 to a static IP address of 192.168.1.222 with gateway 192.168.1.1 and DNS server as 8.8.8.8 and 8.8.4.4:

   # This file describes the network interfaces available on your system
   # For more information, see netplan(5).
   network:
       version: 2
       renderer: networkd
       ethernets:
           eno1:
               dhcp4: no
               addresses: [192.168.1.222/24]
               gateway4: 192.168.1.1
               nameservers:
                   addresses: [8.8.8.8,8.8.4.4]
   

   Apply the settings.

   cumulus@hostname:~$ sudo netplan apply
   

Verify NetQ Software and Appliance Readiness

Now that the appliance is up and running, verify that the software is available and the appliance is ready for installation.

1. Verify that the needed packages are present and of the correct release, version 4.5 and update 38.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

2. Verify the installation images are present and of the correct release, version 4.5.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0.tgz

3. Verify the appliance is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check

4. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your NetQ platform server or NetQ Appliance:

cumulus@hostname:~$ netq install standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

This topic describes how to prepare your single, NetQ Cloud Appliance for installation of the NetQ Collector software.

Each system shipped to you contains:

• Your NVIDIA NetQ Cloud Appliance (a Supermicro SuperServer E300-9D)
• Hardware accessories, such as power cables and rack mounting gear (note that network cables and optics ship separately)
• Information regarding your order

If you’re looking for hardware specifications (including LED layouts and FRUs like the power supply or fans and accessories like included cables) or safety and environmental information, check out the appliance’s user manual.

Install the Appliance

1. Mount the appliance in the rack.
2. Connect it to power following the procedures described in your appliance's user manual.
3. Connect the Ethernet cable to the 1G management port (eno1).
4. Power on the appliance.

If your network runs DHCP, you can configure NetQ over the network. If DHCP is not enabled, then you configure the appliance using the console cable provided.

Configure the Password, Hostname, and IP Address

1. Log in to the appliance using the default login credentials:

   • Username: cumulus
   • Password: cumulus

2. Change the password using the passwd command:

   cumulus@hostname:~$ passwd
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   

3. The default hostname for the NetQ Cloud Appliance is netq-appliance. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames comprise a sequence of labels concatenated with dots. For example, en.wikipedia.org is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels can contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME
   

4. Identify the IP address.

   The appliance contains two Ethernet ports. It uses port eno1 for out-of-band management. This is where NetQ Agents should send the telemetry data collected from your monitored switches and hosts. By default, eno1 uses DHCPv4 to get its IP address. You can view the assigned IP address using the following command:

   cumulus@hostname:~$ ip -4 -brief addr show eno1
   eno1             UP             10.20.16.248/24
   

   Alternately, you can configure the interface with a static IP address by editing the /etc/netplan/01-ethernet.yaml Ubuntu Netplan configuration file.

   For example, to set your network interface eno1 to a static IP address of 192.168.1.222 with gateway 192.168.1.1 and DNS server as 8.8.8.8 and 8.8.4.4:

   # This file describes the network interfaces available on your system
   # For more information, see netplan(5).
   network:
       version: 2
       renderer: networkd
       ethernets:
           eno1:
               dhcp4: no
               addresses: [192.168.1.222/24]
               gateway4: 192.168.1.1
               nameservers:
                   addresses: [8.8.8.8,8.8.4.4]
   

   Apply the settings.

   cumulus@hostname:~$ sudo netplan apply
   

Verify NetQ Software and Appliance Readiness

Now that the appliance is up and running, verify that the software is available and the appliance is ready for installation.

1. Verify that the required packages are present and reflect the most current version.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

2. Verify the installation images are present and reflect the most current version.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0-opta.tgz

3. Verify the appliance is ready for installation. Fix any errors before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check-cloud

4. Install and activate the NetQ software using the CLI:

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI.

cumulus@<hostname>:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host <proxy-hostname> proxy-port <proxy-port>]

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

This topic describes how to prepare your cluster of NetQ On-premises Appliances for installation of the NetQ Platform software.

Each system shipped to you contains:

• Your NVIDIA NetQ On-premises Appliance (a Supermicro 6019P-WTR server)
• Hardware accessories, such as power cables and rack mounting gear (note that network cables and optics ship separately)
• Information regarding your order

For more detail about hardware specifications (including LED layouts and FRUs like the power supply or fans, and accessories like included cables) or safety and environmental information, refer to the user manual and quick reference guide.

Install Each Appliance

1. Mount the appliance in the rack.
2. Connect it to power following the procedures described in your appliance's user manual.
3. Connect the Ethernet cable to the 1G management port (eno1).
4. Power on the appliance.

If your network runs DHCP, you can configure NetQ over the network. If DHCP is not enabled, then you configure the appliance using the console cable provided.

Configure the Password, Hostname, and IP Address

Change the password and specify the hostname and IP address for each appliance before installing the NetQ software.

1. Log in to the appliance that you intend to use as your master node using the default login credentials:

   • Username: cumulus
   • Password: cumulus

2. Change the password using the passwd command:

   cumulus@hostname:~$ passwd
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   

3. The default hostname for the NetQ On-premises Appliance is netq-appliance. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames comprise a sequence of labels concatenated with dots. For example, “en.wikipedia.org” is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels can contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME
   

4. Identify the IP address.

   The appliance contains two Ethernet ports. It uses port eno1 for out-of-band management. This is where NetQ Agents should send the telemetry data collected from your monitored switches and hosts. By default, eno1 uses DHCPv4 to get its IP address. You can view the assigned IP address using the following command:

   cumulus@hostname:~$ ip -4 -brief addr show eno1
   eno1             UP             10.20.16.248/24
   

   Alternately, you can configure the interface with a static IP address by editing the /etc/netplan/01-ethernet.yaml Ubuntu Netplan configuration file.

   For example, to set your network interface eno1 to a static IP address of 192.168.1.222 with gateway 192.168.1.1 and DNS server as 8.8.8.8 and 8.8.4.4:

   # This file describes the network interfaces available on your system
   # For more information, see netplan(5).
   network:
       version: 2
       renderer: networkd
       ethernets:
           eno1:
               dhcp4: no
               addresses: [192.168.1.222/24]
               gateway4: 192.168.1.1
               nameservers:
                   addresses: [8.8.8.8,8.8.4.4]
   

   Apply the settings.

   cumulus@hostname:~$ sudo netplan apply
   

5. Repeat these steps for each of the worker node appliances.

Verify NetQ Software and Appliance Readiness

Now that the appliances are up and running, verify that the software is available and the appliance is ready for installation.

1. On the master node, verify that the needed packages are present and of the correct release, version 4.5.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

2. Verify the installation images are present and of the correct release, version 4.5.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0.tgz

3. Verify the master node is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check

4. On one or your worker nodes, verify that the needed packages are present and of the correct release, version 4.5 and update 38 or later.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

5. Configure the IP address, hostname, and password using the same steps as for the master node. Refer to Configure the Password, Hostname and IP Address.

   Make a note of the private IP addresses you assign to the master and worker nodes. You need them for later installation steps.

6. Verify that the needed packages are present and of the correct release, version 4.5 and update 38.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

7. Verify that the needed files are present and of the correct release.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0.tgz

8. Verify the appliance is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check

9. Repeat Steps 4-9 for each additional worker node (NetQ On-premises Appliance).

10. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following commands on your master node, using the IP addresses of your worker nodes:

cumulus@<hostname>:~$ netq install cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz workers <worker-1-ip> <worker-2-ip>

cumulus@hostname:~$ netq bootstrap reset [purge-db|keep-db]

cumulus@hostname:~$ netq install standalone full interface eno1 bundle /mnt/installables/NetQ-4.5.0.tgz

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

This topic describes how to prepare your cluster of NetQ Cloud Appliances for installation of the NetQ Collector software.

Each system shipped to you contains:

• Your NVIDIA NetQ Cloud Appliance (a Supermicro SuperServer E300-9D)
• Hardware accessories, such as power cables and rack mounting gear (note that network cables and optics ship separately)
• Information regarding your order

For more detail about hardware specifications (including LED layouts and FRUs like the power supply or fans and accessories like included cables) or safety and environmental information, refer to the user manual.

Install Each Appliance

1. Mount the appliance in the rack.
2. Connect it to power following the procedures described in your appliance's user manual.
3. Connect the Ethernet cable to the 1G management port (eno1).
4. Power on the appliance.

If your network runs DHCP, you can configure NetQ over the network. If DHCP is not enabled, then you configure the appliance using the console cable provided.

Configure the Password, Hostname, and IP Address

Change the password and specify the hostname and IP address for each appliance before installing the NetQ software.

1. Log in to the appliance that you intend to use as your master node using the default login credentials:

   • Username: cumulus
   • Password: cumulus

2. Change the password using the passwd command:

   cumulus@hostname:~$ passwd
   Changing password for cumulus.
   (current) UNIX password: cumulus
   Enter new UNIX password:
   Retype new UNIX password:
   passwd: password updated successfully
   

3. The default hostname for the NetQ Cloud Appliance is netq-appliance. Change the hostname to fit your naming conventions while meeting Internet and Kubernetes naming standards.

   Kubernetes requires that hostnames comprise a sequence of labels concatenated with dots. For example, en.wikipedia.org is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters.

   The Internet standards (RFCs) for protocols specify that labels can contain only the ASCII letters a through z (in lower case), the digits 0 through 9, and the hyphen-minus character ('-').

   Use the following command:

   cumulus@hostname:~$ sudo hostnamectl set-hostname NEW_HOSTNAME
   

4. Identify the IP address.

   The appliance contains two Ethernet ports. It uses port eno1 for out-of-band management. This is where NetQ Agents should send the telemetry data collected from your monitored switches and hosts. By default, eno1 uses DHCPv4 to get its IP address. You can view the assigned IP address using the following command:

   cumulus@hostname:~$ ip -4 -brief addr show eno1
   eno1             UP             10.20.16.248/24
   

   Alternately, you can configure the interface with a static IP address by editing the /etc/netplan/01-ethernet.yaml Ubuntu Netplan configuration file.

   For example, to set your network interface eno1 to a static IP address of 192.168.1.222 with gateway 192.168.1.1 and DNS server as 8.8.8.8 and 8.8.4.4:

   # This file describes the network interfaces available on your system
   # For more information, see netplan(5).
   network:
       version: 2
       renderer: networkd
       ethernets:
           eno1:
               dhcp4: no
               addresses: [192.168.1.222/24]
               gateway4: 192.168.1.1
               nameservers:
                   addresses: [8.8.8.8,8.8.4.4]
   

   Apply the settings.

   cumulus@hostname:~$ sudo netplan apply
   

5. Repeat these steps for each of the worker node appliances.

Verify NetQ Software and Appliance Readiness

Now that the appliances are up and running, verify that the software is available and each appliance is ready for installation.

1. On the master NetQ Cloud Appliance, verify that the needed packages are present and of the correct release, version 4.5.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

2. Verify the installation images are present and of the correct release, version 4.5.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0-opta.tgz

3. Verify the master NetQ Cloud Appliance is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check-cloud

4. On one of your worker NetQ Cloud Appliances, verify that the needed packages are present and of the correct release, version 4.5 and update 34.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

5. Configure the IP address, hostname, and password using the same steps as for the master node. Refer to Configure the Password, Hostname, and IP Address.

   Make a note of the private IP addresses you assign to the master and worker nodes. You need them for later installation steps.

6. Verify that the needed packages are present and of the correct release, version 4.5.

   cumulus@hostname:~$ dpkg -l | grep netq
   ii  netq-agent   4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Telemetry Agent for Ubuntu
   ii  netq-apps    4.5.0-ub20.04u41~1677251815.f5b57862_amd64  Cumulus NetQ Fabric Validation Application for Ubuntu

7. Verify that the needed files are present and of the correct release.

   cumulus@hostname:~$ cd /mnt/installables/
   cumulus@hostname:/mnt/installables$ ls
   NetQ-4.5.0-opta.tgz

8. Verify the appliance is ready for installation. Fix any errors indicated before installing the NetQ software.

   cumulus@hostname:~$ sudo opta-check-cloud

9. Repeat Steps 4-8 for each additional worker NetQ Cloud Appliance.

10. The final step is to install and activate the NetQ software using the CLI:

Run the following command on your master node to initialize the cluster. Copy the output of the command to use on your worker nodes:

cumulus@<hostname>:~$ netq install cluster master-init
    Please run the following command on all worker nodes:
    netq install cluster worker-init c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDM2NjTTZPdVVUWWJ5c2Q3NlJ4SHdseHBsOHQ4N2VMRWVGR05LSWFWVnVNcy94OEE4RFNMQVhKOHVKRjVLUXBnVjdKM2lnMGJpL2hDMVhmSVVjU3l3ZmhvVDVZM3dQN1oySVZVT29ZTi8vR1lOek5nVlNocWZQMDNDRW0xNnNmSzVvUWRQTzQzRFhxQ3NjbndIT3dwZmhRYy9MWTU1a
    

Run the netq install cluster worker-init <ssh-key> on each of your worker nodes.

Run the following command on your NetQ Cloud Appliance with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI in the premise management configuration.

cumulus@<hostname>:~$ netq install opta cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> workers <worker-1-ip> <worker-2-ip> [proxy-host <proxy-hostname> proxy-port <proxy-port>]
    

cumulus@hostname:~$ netq bootstrap reset

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key  [proxy-host  proxy-port ]

Consider the following for container environments, and make adjustments as needed.

Calico Networking

NetQ overrides the Calico default address range and changes it to 10.244.0.0/16. To modify this range, use the netq install opta command, specifying the default address range with the pod-ip-range option. For example:

cumulus@hostname:~$ netq install opta standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0-opta.tgz config-key <your-config-key> pod-ip-range 10.255.0.0/16

Docker Default Bridge Interface

The default Docker bridge interface is disabled in NetQ. If you need to reenable the interface, contact support.

Verify Installation Status

To view the status of the installation, use the netq show status [verbose] command. The following example shows a successful on-premises installation:

State: Active
    Version: 4.5.0
    Installer Version: 4.5.0
    Installation Type: Standalone
    Activation Key: PKrgipMGEhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIixUQmFLTUhzZU80RUdTL3pOT01uQ2lnRnrrUhTbXNPUGRXdnUwTVo5SEpBPTIHZGVmYXVsdDoHbmV0cWRldgz=
    Master SSH Public Key: a3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEazliekZDblJUajkvQVhOZ0hteXByTzZIb3Y2cVZBWFdsNVNtKzVrTXo3dmMrcFNZTGlOdWl1bEhZeUZZVDhSNmU3bFdqS3NrSE10bzArNFJsQVd6cnRvbVVzLzlLMzQ4M3pUMjVZQXpIU2N1ZVhBSE1TdTZHZ0JyUkpXYUpTNjJ2RTkzcHBDVjBxWWJvUFo3aGpCY3ozb0VVWnRsU1lqQlZVdjhsVjBNN3JEWW52TXNGSURWLzJ2eks3K0x2N01XTG5aT054S09hdWZKZnVOT0R4YjFLbk1mN0JWK3hURUpLWW1mbTY1ckoyS1ArOEtFUllrr5TkF3bFVRTUdmT3daVHF2RWNoZnpQajMwQ29CWDZZMzVST2hDNmhVVnN5OEkwdjVSV0tCbktrWk81MWlMSDAyZUpJbXJHUGdQa2s1SzhJdGRrQXZISVlTZ0RwRlpRb3Igcm9vdEBucXRzLTEwLTE4OC00NC0xNDc=
    Is Cloud: False
    
    Cluster Status:
    IP Address     Hostname       Role    Status
    -------------  -------------  ------  --------
    10.188.44.147  10.188.44.147  Role    Ready
    
    NetQ... Active
    

Run the netq show opta-health command to verify all applications are operating properly. Allow 10-15 minutes for all applications to come up and report their status.

cumulus@hostname:~$ netq show opta-health
    Application                                            Status    Namespace      Restarts    Timestamp
    -----------------------------------------------------  --------  -------------  ----------  ------------------------
    cassandra-rc-0-w7h4z                                   READY     default        0           Fri Apr 10 16:08:38 2020
    cp-schema-registry-deploy-6bf5cbc8cc-vwcsx             READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-broker-rc-0-p9r2l                                READY     default        0           Fri Apr 10 16:08:38 2020
    kafka-connect-deploy-7799bcb7b4-xdm5l                  READY     default        0           Fri Apr 10 16:08:38 2020
    netq-api-gateway-deploy-55996ff7c8-w4hrs               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-address-deploy-66776ccc67-phpqk               READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-admin-oob-mgmt-server                         READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-bgp-deploy-7dd4c9d45b-j9bfr                   READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-clagsession-deploy-69564895b4-qhcpr           READY     default        0           Fri Apr 10 16:08:38 2020
    netq-app-configdiff-deploy-ff54c4cc4-7rz66             READY     default        0           Fri Apr 10 16:08:38 2020
    ...
    

After NetQ is installed, you can log in to NetQ from your browser.

After installing the NetQ software, you should install the NetQ Agents on each switch you want to monitor. You can install NetQ Agents on switches and servers running:

• Cumulus Linux 3.7.16 and later
• SONiC 202012
• CentOS 7
• RHEL 7.1
• Ubuntu 18.04

Prepare for NetQ Agent Installation

For switches running Cumulus Linux and SONiC, you need to:

• Install and configure NTP, if needed
• Obtain NetQ software packages

For servers running RHEL, CentOS, or Ubuntu, you need to:

• Verify you installed the minimum package versions
• Verify the server is running lldpd
• Install and configure NTP, if needed
• Obtain NetQ software packages

cumulus@switch:~$ sudo systemctl status ntp
[sudo] password for cumulus:
● ntp.service - LSB: Start NTP daemon
        Loaded: loaded (/etc/init.d/ntp; bad; vendor preset: enabled)
        Active: active (running) since Fri 2018-06-01 13:49:11 EDT; 2 weeks 6 days ago
          Docs: man:systemd-sysv-generator(8)
        CGroup: /system.slice/ntp.service
                └─2873 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -c /var/lib/ntp/ntp.conf.dhcp -u 109:114

cumulus@switch:~$ sudo nano /etc/apt/sources.list
...
deb https://apps3.cumulusnetworks.com/repos/deb CumulusLinux-3 netq-4.5
...

cumulus@switch:~$ sudo nano /etc/apt/sources.list
...
deb https://apps3.cumulusnetworks.com/repos/deb CumulusLinux-4 netq-4.5
...

cumulus@switch:~$ wget -qO - https://apps3.cumulusnetworks.com/setup/cumulus-apps-deb.pubkey | sudo apt-key add -

admin@switch:~$ sudo systemctl status ntp
● ntp.service - Network Time Service
     Loaded: loaded (/lib/systemd/system/ntp.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2021-06-08 14:56:16 UTC; 2min 18s ago
       Docs: man:ntpd(8)
    Process: 1444909 ExecStart=/usr/lib/ntp/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
   Main PID: 1444921 (ntpd)
      Tasks: 2 (limit: 9485)
     Memory: 1.9M
     CGroup: /system.slice/ntp.service
             └─1444921 /usr/sbin/ntpd -p /var/run/ntpd.pid -x -u 106:112

admin@switch:~$ show ntp
MGMT_VRF_CONFIG is not present.
synchronised to NTP server (104.194.8.227) at stratum 3
   time correct to within 2014 ms
   polling server every 64 s
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
-144.172.118.20  139.78.97.128    2 u   26   64  377   47.023  -1798.1 120.803
+208.67.75.242   128.227.205.3    2 u   32   64  377   72.050  -1939.3  97.869
+216.229.4.66    69.89.207.99     2 u  160   64  374   41.223  -1965.9  83.585
*104.194.8.227   164.67.62.212    2 u   33   64  377    9.180  -1934.4  97.376

root@rhel7:~# sudo yum -y install epel-release
root@rhel7:~# sudo yum -y install lldpd
root@rhel7:~# sudo systemctl enable lldpd.service
root@rhel7:~# sudo systemctl start lldpd.service
root@rhel7:~# sudo yum install wget

root@ubuntu:~# sudo apt-get update
root@ubuntu:~# sudo apt-get install lldpd
root@ubuntu:~# sudo systemctl enable lldpd.service
root@ubuntu:~# sudo systemctl start lldpd.service

root@ubuntu:~# sudo apt install chrony

root@ubuntu:~# sudo /usr/local/sbin/chronyd

root@ubuntu:~# chronyc activity
200 OK
8 sources online
0 sources offline
0 sources doing burst (return to online)
0 sources doing burst (return to offline)
0 sources with unknown address

root@ubuntu:~# chronyc sources
210 Number of sources = 8
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^+ golem.canonical.com           2   6   377    39  -1135us[-1135us] +/-   98ms
^* clock.xmission.com            2   6   377    41  -4641ns[ +144us] +/-   41ms
^+ ntp.ubuntu.net              2   7   377   106   -746us[ -573us] +/-   41ms
...

server golem.canonical.com iburst
server clock.xmission.com iburst
server ntp.ubuntu.com iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync

pool pool.ntp.org iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync

root@ubuntu:~# chronyc tracking
Reference ID    : 5BBD59C7 (golem.canonical.com)
Stratum         : 3
Ref time (UTC)  : Mon Feb 10 14:35:18 2020
System time     : 0.0000046340 seconds slow of NTP time
Last offset     : -0.000123459 seconds
RMS offset      : 0.007654410 seconds
Frequency       : 8.342 ppm slow
Residual freq   : -0.000 ppm
Skew            : 26.846 ppm
Root delay      : 0.031207654 seconds
Root dispersion : 0.001234590 seconds
Update interval : 115.2 seconds
Leap status     : Normal

root@ubuntu:~# sudo wget -O- https://apps3.cumulusnetworks.com/setup/cumulus-apps-deb.pubkey | apt-key add -

root@ubuntu:~# vi /etc/apt/sources.list.d/cumulus-apps-deb-bionic.list
...
deb [arch=amd64] https://apps3.cumulusnetworks.com/repos/deb bionic netq-latest
...

Install NetQ Agent

After completing the preparation steps, install the agent onto your switch or host.

root@ubuntu:~# sudo systemctl restart rsyslog.service

Configure NetQ Agent

After you install the NetQ Agents on the switches you want to monitor, you must configure them to obtain useful and relevant data.

netq-agent:
  netq_stream_address: 0.0.0.0

Two methods are available for configuring a NetQ Agent:

• Edit the configuration file on the switch, or
• Use the NetQ CLI

Configure NetQ Agents Using a Configuration File

You can configure the NetQ Agent in the netq.yml configuration file contained in the /etc/netq/ directory.

1. Open the netq.yml file using your text editor of choice. For example:

   sudo nano /etc/netq/netq.yml
   

2. Locate the netq-agent section, or add it.

3. Set the parameters for the agent as follows:

   • port: 31980 (default configuration)
   • server: IP address of the NetQ Appliance or VM where the agent should send its collected data
   • vrf: default (or one that you specify)

   Your configuration should be similar to this:

   netq-agent:
       port: 31980
       server: 127.0.0.1
       vrf: mgmt
   

Configure NetQ Agents Using the NetQ CLI

If you configured the NetQ CLI, you can use it to configure the NetQ Agent to send telemetry data to the NetQ Appliance or VM. To configure the NetQ CLI, refer to Install NetQ CLI.

Use the following command to configure the NetQ Agent:

netq config add agent server <text-opta-ip> [port <text-opta-port>] [vrf <text-vrf-name>]

This example uses an IP address of 192.168.1.254 and the default port and VRF for the NetQ Appliance or VM.

sudo netq config add agent server 192.168.1.254
Updated agent server 192.168.1.254 vrf default. Please restart netq-agent (netq config restart agent).
sudo netq config restart agent

Configure Advanced NetQ Agent Settings

A couple of additional options are available for configuring the NetQ Agent. If you are using VRFs, you can configure the agent to communicate over a specific VRF. You can also configure the agent to use a particular port.

Configure the Agent to Use a VRF

By default, NetQ uses the default VRF for communication between the NetQ Appliance or VM and NetQ Agents. While optional, NVIDIA strongly recommends that you configure NetQ Agents to communicate with the NetQ Appliance or VM only via a VRF, including a management VRF. To do so, you need to specify the VRF name when configuring the NetQ Agent. For example, if you configured the management VRF and you want the agent to communicate with the NetQ Appliance or VM over it, configure the agent like this:

sudo netq config add agent server 192.168.1.254 vrf mgmt
sudo netq config restart agent

Configure the Agent to Communicate over a Specific Port

By default, NetQ uses port 31980 for communication between the NetQ Appliance or VM and NetQ Agents. If you want the NetQ Agent to communicate with the NetQ Appliance or VM via a different port, you need to specify the port number when configuring the NetQ Agent, like this:

sudo netq config add agent server 192.168.1.254 port 7379
sudo netq config restart agent

Configure the On-switch OPTA

On-switch OPTA is intended for use in small NetQ Cloud deployments where a dedicated OPTA might not be necessary. If you need help assessing the correct OPTA configuration for your deployment, contact your NVIDIA sales team.

Instead of installing a dedicated OPTA appliance, you can enable the OPTA service on every switch in your environment that will send data to the NetQ Cloud. To configure a switch for OPTA functionality, install the netq-opta package.

sudo apt-get update
sudo apt-get install netq-opta

After the netq-opta package is installed, add your OPTA configuration key. Run the following command with the config-key obtained from the email you received from NVIDIA titled NetQ Access Link. You can also obtain the configuration key through the NetQ UI in the premises management configuration.

netq config add opta config-key <config_key> [vrf <vrf_name>] [proxy-host <text-proxy-host> proxy-port <text-proxy-port>] 

The VRF name should be the VRF used to communicate with the NetQ Cloud. Specifying a proxy host and port is optional. For example:

netq config add opta config-key tHkSI2d3LmRldjMubmV0cWRldi5jdW11bHVasdf29ya3MuY29tGLsDIiwzeUpNc3BwK1IyUjVXY2p2dDdPL3JHS3ZrZ1dDUkpFY2JkMVlQOGJZUW84PTIEZGV2MzoHbmV0cWRldr vrf mgmt

You can also add a proxy host separately with the following command:

netq config add opta proxy-host <text-proxy-host> proxy-port <text-proxy-port>

The final step is configuring the local NetQ Agent on the switch to connect to the local OPTA service. Configure the agent on the switch to connect to localhost with the following command:

netq config add agent server localhost vrf mgmt

Related Information

• Manage NetQ Agents

Installing the NetQ CLI on your NetQ Appliances, VMs, switches, or hosts gives you access to new features and bug fixes, and allows you to manage your network from multiple points in the network.

After installing the NetQ software and agent on each switch you want to monitor, you can also install the NetQ CLI on switches running:

• Cumulus Linux 3.7.16 and later
• SONiC 202012
• CentOS 7
• RHEL 7.1
• Ubuntu 18.04

Prepare for NetQ CLI Installation on a RHEL, CentOS, or Ubuntu Server

For servers running RHEL 7, CentOS or Ubuntu OS, you need to:

• Verify you installed the minimum service packages versions
• Verify the server is running lldpd
• Install and configure NTP, if needed
• Obtain NetQ software packages

These steps are not required for Cumulus Linux or SONiC.

Verify Service Package Versions

Verify What CentOS and Ubuntu Are Running

For CentOS and Ubuntu, make sure you are running lldpd, not lldpad. CentOS and Ubuntu do not include lldpd by default, even though the installation requires it. In addition, CentOS does not include wget, even though the installation requires it.

root@centos:~# sudo yum -y install epel-release
root@centos:~# sudo yum -y install lldpd
root@centos:~# sudo systemctl enable lldpd.service
root@centos:~# sudo systemctl start lldpd.service
root@centos:~# sudo yum install wget

root@ubuntu:~# sudo apt-get update
root@ubuntu:~# sudo apt-get install lldpd
root@ubuntu:~# sudo systemctl enable lldpd.service
root@ubuntu:~# sudo systemctl start lldpd.service

Install and Configure NTP

If NTP is not already installed and configured, follow these steps:

Get the NetQ CLI Software Package for Ubuntu

To install the NetQ CLI on an Ubuntu server, you need to install netq-apps on each Ubuntu server. This is available from the NetQ repository.

To get the NetQ CLI package:

1. Reference and update the local apt repository.

   root@ubuntu:~# sudo wget -O- https://apps3.cumulusnetworks.com/setup/cumulus-apps-deb.pubkey | apt-key add -
   

2. Add the Ubuntu repository:

   Ubuntu 18.04

   Create the file /etc/apt/sources.list.d/cumulus-host-ubuntu-bionic.list and add the following line:

   root@ubuntu:~# vi /etc/apt/sources.list.d/cumulus-apps-deb-bionic.list
   ...
   deb [arch=amd64] https://apps3.cumulusnetworks.com/repos/deb bionic netq-latest
   ...
   

   The use of netq-latest in these examples means that a get to the repository always retrieves the latest version of NetQ, even for a major version update. If you want to keep the repository on a specific version — such as netq-4.4 — use that instead.

Install NetQ CLI

Follow these steps to install the NetQ CLI on a switch or host.

cumulus@switch:~$ sudo nano /etc/apt/sources.list
...
deb https://apps3.cumulusnetworks.com/repos/deb CumulusLinux-3 netq-4.5
...

cumulus@switch:~$ sudo nano /etc/apt/sources.list
...
deb https://apps3.cumulusnetworks.com/repos/deb CumulusLinux-4 netq-4.5
...

Configure the NetQ CLI

By default, you do not configure the NetQ CLI during the NetQ installation. The configuration resides in the /etc/netq/netq.yml file. Until the CLI is configured on a device, you can only run netq config and netq help commands, and you must use sudo to run them.

At minimum, you need to configure the NetQ CLI and NetQ Agent to communicate with the telemetry server. To do so, configure the NetQ Agent and the NetQ CLI so that they are running in the VRF where the routing tables have connectivity to the telemetry server (typically the management VRF).

On-premises Deployments

To access and configure the CLI for your on-premises NetQ deployment, you must generate AuthKeys. You’ll need your username and password to generate them. These keys provide authorized access (access key) and user authentication (secret key).

To generate AuthKeys:

1. Enter your on-premises NetQ appliance hostname or IP address into your browser to open the NetQ UI login page.

2. Enter your username and password.

3. Expand the Menu, and under Admin, select Management.

4. Select Manage on the User Accounts card.

5. Select your user and click above the table.

6. Copy these keys to a safe place. Select Copy to obtain the CLI configuration command to use on your devices.

The secret key is only shown once. If you do not copy these, you will need to regenerate them and reconfigure CLI access.

You can also save these keys to a YAML file for easy reference, and to avoid having to type or copy the key values. You can:

• store the file wherever you like, for example in /home/cumulus/ or /etc/netq
• name the file whatever you like, for example credentials.yml, creds.yml, or keys.yml

The file must have the following format:

access-key: <user-access-key-value-here>
secret-key: <user-secret-key-value-here>

7. Insert the AuthKeys onto your device to configure the CLI. Alternately, use the following command.

   netq config add cli server <text-gateway-dest> [access-key <text-access-key> secret-key <text-secret-key> premises <text-premises-name> | cli-keys-file <text-key-file> premises <text-premises-name>] [vrf <text-vrf-name>] [port <text-gateway-port>]
   

8. Restart the CLI to activate the configuration.

   The following example uses the individual access key, a premises of datacenterwest, and the default Cloud address, port and VRF. Replace the key values with your generated keys if you are using this example on your server.

   sudo netq config add cli server netqhostname.labtest.net access-key 123452d9bc2850a1726f55534279dd3c8b3ec55e8b25144d4739dfddabe8149e secret-key /vAGywae2E4xVZg8F+HtS6h6yHliZbBP6HXU3J98765= premises datacenterwest
   Updated cli server netqhostname.labtest.net vrf default port 443. Please restart netqd (netq config restart cli)
   
   sudo netq config restart cli
   Restarting NetQ CLI... Success!
   

   This example uses an optional keys file. Replace the keys filename and path with the full path and name of your keys file, and the datacenterwest premises name with your premises name if you are using this example on your server.

   sudo netq config add cli server netqhostname.labtest.net cli-keys-file /home/netq/nq-cld-creds.yml premises datacenterwest
   Updated cli server netqhostname.labtest.net vrf default port 443. Please restart netqd (netq config restart cli)
   
   sudo netq config restart cli
   Restarting NetQ CLI... Success!
   

If you have multiple premises and want to query data from a different premises than you originally configured, rerun the netq config add cli server command with the desired premises name. You can only view the data for one premises at a time with the CLI.

Cloud Deployments

To access and configure the CLI for your on-premises NetQ deployment, you must generate AuthKeys. You’ll need your username and password to generate them. These keys provide authorized access (access key) and user authentication (secret key). Your credentials and NetQ Cloud addresses were obtained during first login to the NetQ Cloud and premises activation.

To generate AuthKeys:

1. Enter netq.nvidia.com into your browser to open the NetQ UI login page.

2. Enter your username and password.

3. Expand the Menu, and under Admin, select Management.

4. Select Manage on the User Accounts card.

5. Select your user and click above the table.

6. Copy these keys to a safe place. Select Copy to obtain the CLI configuration command to use on your devices.

The secret key is only shown once. If you do not copy these, you will need to regenerate them and reconfigure CLI access.

You can also save these keys to a YAML file for easy reference, and to avoid having to type or copy the key values. You can:

• store the file wherever you like, for example in /home/cumulus/ or /etc/netq
• name the file whatever you like, for example credentials.yml, creds.yml, or keys.yml

The file must have the following format:

access-key: <user-access-key-value-here>
secret-key: <user-secret-key-value-here>

7. Insert the AuthKeys onto your device to configure the CLI. Alternately, use the following command.

   netq config add cli server <text-gateway-dest> [access-key <text-access-key> secret-key <text-secret-key> premises <text-premises-name> | cli-keys-file <text-key-file> premises <text-premises-name>] [vrf <text-vrf-name>] [port <text-gateway-port>]
   

8. Restart the CLI to activate the configuration.

   The following example uses the individual access key, a premises of datacenterwest, and the default Cloud address, port and VRF. Replace the key values with your generated keys if you are using this example on your server.

   sudo netq config add cli server api.netq.cumulusnetworks.com access-key 123452d9bc2850a1726f55534279dd3c8b3ec55e8b25144d4739dfddabe8149e secret-key /vAGywae2E4xVZg8F+HtS6h6yHliZbBP6HXU3J98765= premises datacenterwest
   Successfully logged into NetQ cloud at api.netq.cumulusnetworks.com:443
   Updated cli server api.netq.cumulusnetworks.com vrf default port 443. Please restart netqd (netq config restart cli)
   
   sudo netq config restart cli
   Restarting NetQ CLI... Success!
   

   The following example uses an optional keys file. Replace the keys filename and path with the full path and name of your keys file, and the datacenterwest premises name with your premises name if you are using this example on your server.

   sudo netq config add cli server api.netq.cumulusnetworks.com cli-keys-file /home/netq/nq-cld-creds.yml premises datacenterwest
   Successfully logged into NetQ cloud at api.netq.cumulusnetworks.com:443
   Updated cli server api.netq.cumulusnetworks.com vrf default port 443. Please restart netqd (netq config restart cli)
   
   sudo netq config restart cli
   Restarting NetQ CLI... Success!
   

If you have multiple premises and want to query data from a different premises than you originally configured, rerun the netq config add cli server command with the desired premises name. You can only view the data for one premises at a time with the CLI.

You can add additional nodes to your server cluster on-premises and cloud deployments using the CLI:

The NetQ UI ships with a self-signed certificate that is sufficient for non-production environments or cloud deployments. For on-premises deployments, however, you receive a warning from your browser that this default certificate is not trusted when you first log in to the NetQ UI. You can avoid this by installing your own signed certificate.

You need the following items to perform the certificate installation:

• A valid X509 certificate.

• A private key file for the certificate.

• A DNS record name configured to access the NetQ UI.

  The FQDN should match the common name of the certificate. If you use a wild card in the common name — for example, if the common name of the certificate is *.example.com — then the NetQ telemetry server should reside on a subdomain of that domain, accessible via a URL like netq.example.com.

• A functioning and healthy NetQ instance.

  You can verify this by running the netq show opta-health command.

Install a Certificate using the NetQ CLI

Your custom certificate should now be working. Verify this by opening the NetQ UI at https://<your-hostname-or-ipaddr> in your browser.

NVIDIA provides a cloud activation key when you set up your premises. You use the cloud activation key (called the config-key) to access the cloud services. Note that these authorization keys are different from the ones you use to configure the CLI.

On occasion, you might want to update your cloud service activation key—for example, if you mistyped the key during installation and now your existing key does not work, or you received a new key for your premises from NVIDIA.

Update the activation key using the NetQ CLI:

cumulus@<hostname>:~$ netq install standalone activate-job config-key <text-opta-key>

This section describes how to upgrade from your current installation to NetQ 4.5. Refer to the release notes before you upgrade.

You must upgrade your NetQ On-premises or Cloud Appliances or virtual machines (VMs). While there is some backwards compatibility with the previous NetQ release for any version, upgrading NetQ Agents is always recommended. If you want access to new and updated commands, you can upgrade the CLI on your physical servers or VMs, and monitored switches and hosts as well.

To complete the upgrade for either an on-premises or a cloud deployment:

• Start with Upgrade NetQ Appliances and Virtual Machines
• Then go to Upgrade NetQ Agents
• Then go to Upgrade NetQ CLI

Upgrading to NetQ 4.5.0 from a previous NetQ release requires a new installation of the NetQ virtual machine. Perform the following steps to upgrade:

1. For on-premises deployments, back up your existing NetQ data. NetQ Cloud Appliances and VMs create backups automatically.

2. Follow the installation process for your deployment model.

3. For on-premises deployments, restore your NetQ data.

To upgrade the NetQ Agent:

1. Log in to your switch or host.

2. Update and install the new NetQ Debian package.

   Cumulus Linux Switches or Ubuntu Hosts

   sudo apt-get update
   sudo apt-get install -y netq-agent
   

   RHEL or CentOS Hosts

   sudo yum update
   sudo yum install netq-agent
   

3. Restart the NetQ Agent with the following command. The NetQ CLI must be installed for the command to run successfully.

   netq config restart agent
   

Refer to Install NetQ Agents to complete the upgrade.

Verify NetQ Agent Version

You can verify the version of the agent software you have deployed as described in the following sections.

Run the following command to view the NetQ Agent version.

cumulus@switch:~$ dpkg-query -W -f '${Package}\t${Version}\n' netq-agent

root@ubuntu:~# dpkg-query -W -f '${Package}\t${Version}\n' netq-agent

root@rhel7:~# rpm -q -netq-agent

If you see an older version, upgrade the NetQ Agent, as described above.

Related Information

• Manage NetQ Agents

Upgrading the NetQ CLI is optional, but recommended.

To upgrade the NetQ CLI:

1. Log in to your switch or host.

2. Update and install the new NetQ Debian package:

   Cumulus Linux and SONiC Switches and Ubuntu Hosts

   sudo apt-get update
   sudo apt-get install -y netq-apps
   

   RHEL or CentOS Hosts

   sudo yum update
   sudo yum install netq-apps
   

3. Restart the CLI:

   netq config restart cli
   

To complete the upgrade, refer to Configure the NetQ CLI.

NetQ accounts are assigned one of two roles: admin or user.

Accounts with admin privileges can perform the same actions as user accounts. Additionally, admins can access a management dashboard in the UI. From this dashboard, admins can:

• Create, edit, and delete NetQ accounts.
• Manage login policies, including SSO and LDAP authentication.
• Review account activity.
• Create, edit, and delete system events, channels, and notifications.
• Manage premises.
• Schedule network traces and validations.
• Manage switches' lifecycles.

The following image displays the management dashboard. Accounts with user privileges cannot perform the functions described above and do not have access to the management dashboard.

Related Information

• Add and Manage Accounts

Sign in to NetQ as an admin to view and manage accounts. If you want to change individual preferences, visit Set User Preferences.

Navigate to the NetQ management dashboard to complete the tasks outlined in this section. To get there, expand the Menu on the NetQ dashboard and select Management.

Add an Account

This section outlines the steps to add a local user account. To add an LDAP account, refer to LDAP Authentication.

To create a new account:

1. On the User Accounts card, select Manage to open a table listing all accounts.

2. Above the table, select Add to add an account.

   

3. Enter the fields and select Save.

   Be especially careful entering the email address; you cannot change it once you save the account. If you save a mistyped email address, you must delete the account and create a new one.

Edit an Account

As an admin, you can:

• Edit the first or last name associated with an account
• Reset an account’s password
• Change an account’s role (user or admin)

You cannot edit the email address associated with an account, because this is the identifier the system uses for authentication. If you need to change an email address, delete the account and create a new one.

To edit an account:

1. On the User Accounts card, select Manage to open a table listing all accounts.

2. Select the account you’d like to edit. Above the table, click Edit to edit the account’s information.

Reset an Admin Password

If your account is assigned an admin role, reset your password by restoring the default password, then changing the password:

kubectl exec $(kubectl get pod -oname -l app=cassandra) -- cqlsh -e "INSERT INTO master.user(id,  cust_id,  first_name,  last_name,  password,     access_key,  role,  email,  is_ldap_user,  is_active,  terms_of_use_accepted,  enable_alarm_notifications,  default_workbench,  preferences,  creation_time,  last_login,  reset_password)     VALUES(  'admin',  0,  'Admin',  '',  '009413d86fd42592e0910bb2146815deaceaadf3a4667b728463c4bc170a6511',     null, 'admin',  null,  false,  true,  true,  true,  { workspace_id : 'DEFAULT', workbench_id : 'DEFAULT' },  '{}',  toUnixTimestamp(now()),  toUnixTimestamp(now()),  true )"

Delete an Account

To delete one or more accounts:

1. On the User Accounts card, select Manage to open a table listing all accounts.

2. Select one or more accounts. Above the table, click Delete to delete the selected account(s).

View Account Activity

Administrators can view account activity in the activity log.

To view the log, expand the Menu on the NetQ dashboard and select Management. Select Activity Log to open a table listing account activity. Use the controls above the table to filter or export the data.

Manage Login Policies

Administrators can configure a session expiration time and the number of times users can refresh before requiring them to log in again to NetQ.

To configure these login policies:

1. On the Login Management card, select Manage.

2. Select how long an account can be logged in before requiring a user to log in again:

   

3. Click Update to save the changes.

   The Login Management card reflects the updated configuration.

The NetQ management dashboard lets you configure a single NetQ UI and CLI for monitoring data from multiple premises. This means you do not need to log in to each premises individually to view the data.

Configure Multiple Premises

There are two ways to implement a multi-site, on-premises deployment: (1) as a full deployment at the primary premises and each of the external premises or (2) as a full deployment at the primary premises with smaller deployments at the secondary premises.

Full NetQ Deployment at Each Premises

In this implementation, there is a NetQ appliance or VM running the NetQ Platform software with a database. Each premises operates independently as an external premises, with its own NetQ UI and CLI. The NetQ appliance or VM at one of the deployments acts as the primary premises. A list of external premises is stored with the primary deployment.

To configure a single UI to monitor multiple premises:

1. From the UI of the primary premises (OPID0), select the Premises dropdown in the top-right corner of the screen.

2. Select Manage premises, then select the External premises tab.

   

3. Select Add external premises.

   

4. Enter the IP address for the external server.

5. Enter the username and password for the external server, then click Next. These are the same credentials used to log in to the UI for the external server.

6. Select the premises you want to connect, then click Finish.

   

You can also reduce the number of premises that can be displayed in the UI by hovering over a deployment and selecting Delete.

To view the premises you just added, return to the home workbench and select the Premises dropdown in the top-right corner of the screen.

Full NetQ Deployment at Primary Premises and Smaller Deployments at Secondary Premises

In this implementation, there is a NetQ appliance or VM at one of the deployments acting as the primary premises for the other deployments. The primary premises runs the NetQ software (including the NetQ UI and CLI) and houses the database. All other deployments are secondary premises; they run the NetQ Collector software and send their data to the primary premises for storage and processing. A list of these secondary premises is stored with the primary deployment.

After the multiple premises are configured, you can view this list of premises in the NetQ UI at the primary premises, change the name of premises on the list, and delete premises from the list.

In this deployment model, the data is stored and can be viewed only from the NetQ UI at the primary premises.

To create and add secondary premises:

1. In the workbench header, select the Premises dropdown.

2. Click Manage premises. Your primary premises (OPID0) is shown by default.

3. Click Add premises.

4. Enter the name of a secondary premises you’d like to add, then click Done.

5. From the confirmation dialog, select View config key.

6. Click the copy icon, then save the key to a safe place, or click e-mail to send it to yourself or others. Then click Confirm activation.

To view the premises you just added, return to the home workbench and select the Premises dropdown at the top-right corner of the screen.

Rename a Premises

To rename an existing premises:

1. In the workbench header, select the Premises dropdown, then Manage premises.

2. Select a premises to rename, then click Edit.

3. Enter the new name for the premises, then click Done.

The following sections describe how to back up and restore your NetQ data and VMs.

Back Up Your NetQ Data

NetQ stores its data in a Cassandra database. You perform backups by running scripts provided with the software and located in the /usr/sbin directory. When you run a backup, the script creates a single tar file in the /opt/backuprestore/ directory.

To create a backup, refer to the following steps for your NetQ version.

Back Up NetQ 4.4.1 or Earlier

1. Retrieve the vm-backuprestore.sh script:

a. On the NVIDIA Application Hub, log in to your account.

b. Select NVIDIA Licensing Portal.

c. Select Software Downloads from the menu.

d. Click Product Family and select NetQ.

e. Locate the NetQ Upgrade Backup Restore file and select Download.

f. If prompted, agree to the license agreement and proceed with the download.

2. Copy the vm-backuprestore.sh script to your NetQ server:

username@hostname:~$ scp ./vm-backuprestore.sh cumulus@10.10.10.10:/home/cumulus/
cumulus@10.10.10.10's password:
vm-backuprestore.sh                                                                                       100%   15KB  54.0KB/s   00:00 

3. Log in to your NetQ server and set the script to executable:

cumulus@netq-appliance:/home/cumulus# chmod +x /usr/sbin/vm-backuprestore.sh

4. In the directory you copied the vm-backuprestore.sh script, run:

cumulus@netq-appliance:~$ sudo ./vm-backuprestore.sh --backup
[sudo] password for cumulus:
Mon Feb  6 12:37:18 2023 - Please find detailed logs at: /var/log/vm-backuprestore.log
Mon Feb  6 12:37:18 2023 - Starting backup of data, the backup might take time based on the size of the data
Mon Feb  6 12:37:19 2023 - Scaling static pods to replica 0
Mon Feb  6 12:37:19 2023 - Scaling all pods to replica 0
Mon Feb  6 12:37:28 2023 - Scaling all daemonsets to replica 0
Mon Feb  6 12:37:29 2023 - Waiting for all pods to go down
Mon Feb  6 12:37:29 2023 - All pods are down
Mon Feb  6 12:37:29 2023 - Creating backup tar /opt/backuprestore/backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar
Backup is successful, please scp it to the master node the below command:
      sudo scp /opt/backuprestore/backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar cumulus@<ip_addr>:/home/cumulus
 
  Restore the backup file using the below command:
      ./vm-backuprestore.sh --restore --backupfile /opt/backuprestore/backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar
cumulus@netq-appliance:~$

5. Verify the backup file creation was successful:

   cumulus@netq-appliance:~$ cd /opt/backuprestore/
   cumulus@netq-appliance:~/opt/backuprestore$ ls
   backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar
   

Back Up NetQ 4.5.0

1. Run the backup script /usr/sbin/vm-backuprestore.sh:

cumulus@netq-appliance:~$ sudo /usr/sbin/vm-backuprestore.sh --backup

2. Verify the backup file creation was successful:

   cumulus@netq-appliance:~$ cd /opt/backuprestore/
   cumulus@netq-appliance:~/opt/backuprestore$ ls
   

Restore Your NetQ Data

Restore NetQ data with the backup file you created in the steps above. The restore option of the backup script copies the data from the backup file to the database, decompresses it, verifies the restoration, and starts all necessary services. You should not see any data loss as a result of a restore operation.

Run the restore script, referencing the directory where the backup file resides.

cumulus@netq-appliance:~$ sudo vm-backuprestore.sh --restore --backupfile /home/cumulus/backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar
Mon Feb  6 12:39:57 2023 - Please find detailed logs at: /var/log/vm-backuprestore.log
Mon Feb  6 12:39:57 2023 - Starting restore of data
Mon Feb  6 12:39:57 2023 - Extracting release file from backup tar
Mon Feb  6 12:39:57 2023 - Cleaning the system
Mon Feb  6 12:39:57 2023 - Restoring data from tarball /home/cumulus/backup-netq-standalone-onprem-4.4.0-2023-02-06_12_37_29_UTC.tar
Data restored successfully
  Please follow the below instructions to bootstrap the cluster
  The config key restored is EhVuZXRxLWVuZHBvaW50LWdhdGVfYXkYsagDIix2OUJhMUpyekMwSHBBaitUdTVDaTRvbVJDR3F6Qlo4VHhZRytjUUhLZGJRPQ==, alternately the config key is available in file /tmp/config-key
 
  Pass the config key while bootstrapping:
  Example(standalone): netq install standalone full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz config-key EhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIix2OUJhMUpyekMwSHBbaitUdTVDaTRvbVJDR3F6Qlo4VHhZRytjUUhLZGJRPQ==
  Example(cluster):    netq install cluster full interface eth0 bundle /mnt/installables/NetQ-4.5.0.tgz config-key EhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIix2OUJhMUpyekMwSHBbaitUdTVDaTRvbVJDR3F6Qlo4VHhZRytjUUhLZGJRPQ==
  Alternately you can setup config-key post bootstrap in case you missed to pass it during bootstrap
  Example(standalone): netq install standalone activate-job config-key EhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIix2OUJhMUpyekMwSHBbaitUdTVDaTRvbVJDR3F6Qlo4VHhZRytjUUhLZGJRPQ==
  Example(cluster):    netq install cluster activate-job config-key EhVuZXRxLWVuZHBvaW50LWdhdGV3YXkYsagDIix2OUJhMUpyekMwSHBbaitUdTVDaTRvbVJDR3F6Qlo4VHhZRytjUUhLZGJRPQ==
  In case the IP of the restore machine is different from the backup machine, please reconfigure the agents using: https://docs.nvidia.com/networking-ethernet-software/cumulus-netq-44/Installation-Management/Install-NetQ/Install-NetQ-Agents/#configure-netq-agents-using-a-configuration-file
cumulus@netq-appliance:~$

This section describes the various integrations you can configure after installing NetQ.

As an administrator, you can integrate the NetQ role-based access control (RBAC) with your lightweight directory access protocol (LDAP) server in on-premises deployments. NetQ maintains control over role-based permissions for the NetQ application. There are two roles, admin and user. With the RBAC integration, LDAP handles account authentication and your directory service (such as Microsoft Active Directory, Kerberos, OpenLDAP, and Red Hat Directory Service). A copy of each account from LDAP is stored in the local NetQ database.

Integrating with an LDAP server does not prevent you from configuring local accounts (stored and managed in the NetQ database) as well.

Get Started

LDAP integration requires information about how to connect to your LDAP server, the type of authentication you plan to use, bind credentials, and, optionally, search attributes.

Provide Your LDAP Server Information

To connect to your LDAP server, you need the URI and bind credentials. The URI identifies the location of the LDAP server. It comprises a FQDN (fully qualified domain name) or IP address, and the port of the LDAP server where the LDAP client can connect. For example: myldap.mycompany.com or 192.168.10.2. Typically you use port 389 for connection over TCP or UDP. In production environments, you deploy a secure connection with SSL. In this case, the port used is typically 636. Setting the Enable SSL toggle automatically sets the server port to 636.

Specify Your Authentication Method

There are two types of user authentication: anonymous and basic.

• Anonymous: LDAP client does not require any authentication. The user can access all resources anonymously. This is not commonly used for production environments.

• Basic: (Also called Simple) LDAP client must provide a bind DN and password to authenticate the connection. When selected, the Admin credentials appear: Bind DN and Bind Password. You define the distinguished name (DN) using a string of variables. Some common variables include:

  Syntax	Description or Usage
  cn	Common name
  ou	Organizational unit or group
  dc	Domain name
  dc	Domain extension

  • Bind DN: DN of user with administrator access to query the LDAP server; used for binding with the server. For example, uid =admin,ou=ntwkops,dc=mycompany,dc=com.
  • Bind Password: Password associated with Bind DN.

  The Bind DN and password get sent as clear text. Only users with these credentials can perform LDAP operations.

If you are unfamiliar with the configuration of your LDAP server, contact your administrator to ensure you select the appropriate authentication method and credentials.

Define User Attributes

You need the following two attributes to define a user entry in a directory:

• Base DN: Location in directory structure where search begins. For example, dc=mycompany,dc=com.
• User ID: Type of identifier used to specify an LDAP user. This can vary depending on the authentication service you are using. For example, you can use the user ID (UID) or email address with OpenLDAP, whereas you might use the sAMAccountName with Active Directory.

Optionally, you can specify the first name, last name, and email address of the user.

Set Search Attributes

While optional, specifying search scope indicates where to start and how deep a given user can search within the directory. You specify the data to search for in the search query.

Search scope options include:

• Subtree: Search for users from base, subordinates at any depth (default)
• Base: Search for users at the base level only; no subordinates
• One level: Search for immediate children of user; not at base or for any descendants
• Subordinate: Search for subordinates at any depth of user; but not at base

A typical search query for users could be {userIdAttribute}={userId}.

Create an LDAP Configuration

You can configure one LDAP server per bind DN (distinguished name). After you configure LDAP, you can verify the connectivity and save the configuration.

To create an LDAP configuration:

1. Expand the Menu and select Management.

2. Locate the LDAP Server Info card, and click Configure LDAP.

3. Fill out the LDAP server configuration form according to your particular configuration.

4. Click Save to complete the configuration, or click Cancel to discard the configuration.

Example LDAP Configurations

This section lists a variety of example configurations. Scenarios 1-3 are based on using an OpenLDAP or similar authentication service. Scenario 4 is based on using the Active Directory service for authentication.

Scenario 1: Base Configuration

In this scenario, we are configuring the LDAP server with anonymous authentication, a user ID based on an email address, and a search scope of base.

Scenario 2: Basic Authentication and Subset of Users

In this scenario, we are configuring the LDAP server with basic authentication, accessible only to users in the network operators group, and with a limited search scope.

Scenario 3: Scenario 2 with Widest Search Capability

In this scenario, we are configuring the LDAP server with basic authentication, accessible only to users in the network administrators group, and with an unlimited search scope.

Scenario 4: Scenario 3 with Active Directory Service

In this scenario, we are configuring the LDAP server with basic authentication, accessible only to users in the given Active Directory group, and with an unlimited search scope.

Add LDAP Users to NetQ

1. Click Menu and select Management.

2. Locate the User Accounts card, and click Manage.

3. From the User accounts tab, select Add user above the table.

4. Select LDAP User, then enter the user’s ID.

5. Enter your administrator password, then select Search.

6. If the user is found, the email address, first, and last name fields are automatically populated. If searching is not enabled on the LDAP server, you must enter the information manually.

   

   If the fields are not automatically filled in, and searching is enabled on the LDAP server, you might need to edit the mapping file.

   LDAP user passwords are not stored in the NetQ database and are always authenticated against LDAP.

7. Repeat these steps to add additional LDAP users.

Remove LDAP Users from NetQ

You can remove LDAP users in the same manner as local users.

1. Expand the Menu and select Management.

2. Locate the User Accounts card, and click Manage.

3. Select the user(s) you want to remove, then select Delete.

Switches collect statistics about the performance of their interfaces. The NetQ Agent on each switch collects these statistics every 15 seconds and then sends them to your NetQ Appliance or Virtual Machine.

NetQ collects statistics for physical interfaces; it does not collect statistics for virtual interfaces, such as bonds, bridges, and VXLANs.

NetQ displays:

• Transmit with tx_ prefix: bytes, carrier, colls, drop, errs, packets
• Receive with rx_ prefix: bytes, drop, errs, frame, multicast, packets

You can use Grafana, an open source analytics and monitoring tool, to view these statistics. The fastest way to achieve this is by installing Grafana on an application server or locally per user, and then installing the NetQ plugin.

Install NetQ Plugin for Grafana

Use the Grafana CLI to install the NetQ plugin. For more detail about this command, refer to the Grafana CLI documentation.

Then install the plugin:

cumulus@netq-appliance:~$ grafana-cli --pluginUrl https://netq-grafana-dsrc.s3-us-west-2.amazonaws.com/NetQ-DSplugin-3.3.1-plus.zip plugins install netq-dashboard
installing netq-dashboard @
from: https://netq-grafana-dsrc.s3-us-west-2.amazonaws.com/NetQ-DSplugin-3.3.1-plus.zip
into: /usr/local/var/lib/grafana/plugins

✔ Installed netq-dashboard successfully

After installing the plugin, you must restart Grafana, following the steps specific to your implementation.

Set Up the NetQ Data Source

Now that you have the plugin installed, you need to configure access to the NetQ data source.

1. Open the Grafana user interface and log in. Navigate to the Home Dashboard:

   

2. Click Add data source or > Data Sources.

3. Enter Net-Q in the search box. Alternately, scroll down to the Other category, and select it from there.

   

4. Enter Net-Q into the Name field.

5. Enter the URL used to access the database:

   • Cloud: https://plugin.prod.netq.nvidia.com
   • On-premises: http://<hostname-or-ipaddr-of-netq-appl-or-vm>/plugin
   • Cumulus in the Cloud (CITC): plugin.air.netq.nvidia.com

6. Select procdevstats from the Module dropdown.

7. Enter your credentials (the ones used to log in).

8. For NetQ cloud deployments only, if you have more than one premises configured, you can select the premises you want to view, as follows:

   • If you leave the Premises field blank, the first premises name is selected by default

   • If you enter a premises name, that premises is selected for viewing

     Note: If multiple premises are configured with the same name, then the first premises of that name is selected for viewing

9. Click Save & Test.

Create Your NetQ Dashboard

With the data source configured, you can create a dashboard with the transmit and receive statistics of interest to you.

Create a Dashboard

1. Click to open a blank dashboard.

2. Click (Dashboard Settings) at the top of the dashboard.

Add Variables

1. Click Variables.

   

2. Enter hostname into the Name field.

3. Enter hostname into the Label field.

4. Select Net-Q from the Data source list.

5. Select On Dashboard Load from the Refresh list.

6. Enter hostname into the Query field.

7. Click Add.

   You should see a preview at the bottom of the hostname values.

8. Click Variables to add another variable for the interface name.

   

9. Enter ifname into the Name field.

10. Enter ifname into the Label field.

11. Select Net-Q from the Data source list.

12. Select On Dashboard Load from the Refresh list.

13. Enter ifname into the Query field.

14. Click Add.

    You should see a preview at the bottom of the ifname values.

15. Click Variables to add another variable for metrics.

    

16. Enter metrics into the Name field.

17. Enter metrics into the Label field.

18. Select Net-Q from the Data source list.

19. Select On Dashboard Load from the Refresh list.

20. Enter metrics into the Query field.

21. Click Add.

    You should see a preview at the bottom of the metrics values.

Add Charts

1. Now that the variables are defined, click to return to the new dashboard.

2. Click Add Query.

   

3. Select Net-Q from the Query source list.

4. Select the interface statistic you want to view from the Metric list.

5. Click the General icon.

   

6. Select hostname from the Repeat list.

7. Set any other parameters around how to display the data.

8. Return to the dashboard.

9. Select one or more hostnames from the hostname list.

   

10. Select one or more interface names from the ifname list.

    

11. Select one or more metrics to display for these hostnames and interfaces from the metrics list.

    

The following example shows a dashboard with two hostnames, two interfaces, and one metric selected. The more values you select from the variable options, the more charts appear on your dashboard.

Analyze the Data

When you have configured the dashboard, you can start analyzing the data. You can explore the data by modifying the viewing parameters in one of several ways using the dashboard tool set:

• Select a different time period for the data by clicking the forward or back arrows. The default time range is dependent on the width of your browser window.
• Zoom in on the dashboard by clicking the magnifying glass.
• Manually refresh the dashboard data, or set an automatic refresh rate for the dashboard from the down arrow.
• Add additional panels.
• Click any chart title to edit or remove it from the dashboard.
• Rename the dashboard by clicking the cog wheel and entering the new name.

You can integrate your NetQ Cloud deployment with a Microsoft Azure Active Directory (AD) or Google Cloud authentication server to support single sign-on (SSO) to NetQ. NetQ supports integration with SAML (Security Assertion Markup Language), OAuth (Open Authorization), and multi-factor authentication (MFA). Only one SSO configuration can be configured at a time.

You can create local accounts with default access roles by enabling SSO. After enabling SSO, users logging in for the first time can sign up for SSO through the NetQ login screen or with a link provided by an admin.

Add SSO Configuration and Accounts

To integrate your authentication server:

1. Expand the Menu and select Management.

2. Locate the SSO Configuration card and select Manage.

3. Select either SAML or OpenID (which uses OAuth with OpenID Connect).

4. Specify the parameters:

   OAuth+OpenID Connect

   You need several pieces of data from your Microsoft Azure or Google account and authentication server to complete the integration.

   

   SSO Organization is typically a company’s name or a department. The name entered in this field will appear in the SSO signup URL.

   Role (either user or admin) is automatically assigned when the account is initalized via SSO login.

   Name is a unique name for the SSO configuration.

   Client ID is the identifier for your resource server.

   Client Secret is the secret key for your resource server.

   Authorization Endpoint is the URL of the authorization application.

   Token Endpoint is the URL of the authorization token.

   After you enter the fields, select Add.

   As indicated, copy the redirect URI (https://api.netq.nvidia.com/netq/auth/v1/sso-callback) into your OpenID Connect configuration.

   

   Select Test to verify the configuration and ensure that you can log in. If it is not working, you are logged out. Check your specification and retest the configuration until it is working properly.

   Select Close. The card reflects the configuration:

   

   To require users to log in using this SSO configuration, select Change under the “Disabled” status and confirm. The card updates to reflect that SSO is enabled.

   After an admin has configured and enabled SSO, users logging in for the first time can sign up for SSO.

   Admins can also provide users with an SSO signup URL: https://netq.nvidia.com/signup?organization=SSO_Organization

   The SSO organization you entered during the configuration will replace SSO_Organization in the URL.

   SAML

   You need several pieces of data from your Microsoft Azure or Google account and authentication server to complete the integration.

   

   SSO Organization is typically a company’s name or a department. The name entered in this field will appear in the SSO signup URL.

   Role (either user or admin) is automatically assigned when the account is initialized via SSO login.

   Name is a unique name for the SSO configuration.

   Login URL is the URL for the authorization server login page.

   Identity Provider Identifier is the name of the authorization server.

   Service Provider Identifier is the name of the application server.

   Email Claim Key is an optional field. When left blank, the email address is captured.

   After you enter the fields, select Add.

   As indicated, copy the redirect URI (https://api.netq.nvidia.com/netq/auth/v1/sso-callback) into your OpenID Connect configuration.

   

   Select Test to verify the configuration and ensure that you can log in. If it is not working, you are logged out. Check your specification and retest the configuration until it is working properly.

   Select Close. The card reflects the configuration:

   

   To require users to log in using this SSO configuration, select Change under the “Disabled” status and confirm. The card updates to reflect that SSO is enabled.

   Select Submit to enable the configuration. The SSO card reflects the “enabled” status.

   After an admin has configured and enabled SSO, users logging in for the first time can sign up for SSO.

   Admins can also provide users with an SSO signup URL: https://netq.nvidia.com/signup?organization=SSO_Organization

   The SSO organization you entered during the configuration will replace SSO_Organization in the URL.

Modify Configuration

You can change the specifications for SSO integration with your authentication server at any time, including changing to an alternate SSO type, disabling the existing configuration, or reconfiguring SSO.

Change SSO Type

From the SSO Configuration card:

1. Select Disable, then Yes.

2. Select Manage then select the desired SSO type and complete the form.

3. Copy the redirect URL on the success dialog into your identity provider configuration.

4. Select Test to verify that the login is working. Modify your specification and retest the configuration until it is working properly.

5. Select Update.

Disable SSO Configuration

From the SSO Configuration card:

1. Select Disable.

2. Select Yes to disable the configuration, or Cancel to keep it enabled.

This page outlines how to remove the NetQ software from your system server and switches.

Remove the NetQ Agent and CLI

cumulus@switch:~$ sudo apt-get update
cumulus@switch:~$ sudo apt-get purge netq-agent netq-apps
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
  netq-agent* netq-apps*
0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
After this operation, 310 MB disk space will be freed.
Do you want to continue? [Y/n] Y
Creating pre-apt snapshot... 2 done.
(Reading database ... 42026 files and directories currently installed.)
Removing netq-agent (3.0.0-cl3u27~1587646213.c5bc079) ...
/usr/sbin/policy-rc.d returned 101, not running 'stop netq-agent.service'
Purging configuration files for netq-agent (3.0.0-cl3u27~1587646213.c5bc079) ...
dpkg: warning: while removing netq-agent, directory '/etc/netq/config.d' not empty so not removed
Removing netq-apps (3.0.0-cl3u27~1587646213.c5bc079) ...
/usr/sbin/policy-rc.d returned 101, not running 'stop netqd.service'
Purging configuration files for netq-apps (3.0.0-cl3u27~1587646213.c5bc079) ...
dpkg: warning: while removing netq-apps, directory '/etc/netq' not empty so not removed
Processing triggers for man-db (2.7.0.2-5) ...
grep: extra.services.enabled: No such file or directory
Creating post-apt snapshot... 3 done.

cumulus@switch:~$ dpkg-query -l netq-agent
dpkg-query: no packages found matching netq-agent
cumulus@switch:~$ dpkg-query -l netq-apps
dpkg-query: no packages found matching netq-apps

root@rhel7:~# sudo yum remove netq-agent netq-apps
Loaded plugins: fastestmirror
Resolving Dependencies
--> Running transaction check
---> Package netq-agent.x86_64 0:3.1.0-rh7u28~1594097110.8f00ba1 will be erased
--> Processing Dependency: netq-agent >= 3.2.0 for package: cumulus-netq-3.1.0-rh7u28~1594097110.8f00ba1.x86_64
--> Running transaction check
---> Package cumulus-netq.x86_64 0:3.1.0-rh7u28~1594097110.8f00ba1 will be erased
--> Finished Dependency Resolution

Dependencies Resolved

...

Removed:
  netq-agent.x86_64 0:3.1.0-rh7u28~1594097110.8f00ba1

Dependency Removed:
  cumulus-netq.x86_64 0:3.1.0-rh7u28~1594097110.8f00ba1

Complete!

root@rhel7:~# rpm -q netq-agent
package netq-agent is not installed
root@rhel7:~# rpm -q netq-apps
package netq-apps is not installed

Uninstall NetQ from the System Server

First remove the data collected to free up used disk space. Then remove the software.

1. Log on to the NetQ system server.

2. Remove the data:

netq bootstrap reset purge-db

3. Remove the software with apt-get purge:

cumulus@switch:~$ sudo apt-get update
cumulus@switch:~$ sudo apt-get purge netq-agent netq-apps

4. Verify the removal of the packages from the switch:

cumulus@switch:~$ dpkg-query -l netq-agent
dpkg-query: no packages found matching netq-agent
cumulus@switch:~$ dpkg-query -l netq-apps
dpkg-query: no packages found matching netq-apps

5. Delete the virtual machine according to the usual VMware or KVM practice.

The topics in this section provide instructions for admins responsible for managing user accounts, physical and software inventory, events and notifications, and lifecycle management.

As an admin, you can manage users and authentication settings from the NetQ management dashboard.

• Accounts and Roles
• Add and Manage Accounts
• LDAP Authentication
• SSO Authentication

Using the NetQ UI or CLI, lifecycle management (LCM) allows you to:

• Manage Cumulus Linux and NetQ images in a local repository
• Configure switch access credentials and profiles (required for installations and upgrades)
• Manage switch inventory and roles
• Install or upgrade NetQ (Agents and CLI) and Cumulus Linux on switches running Cumulus Linux
• Create snapshots of the network state at various times
• Decommission switches
• View a history of upgrade attempts

Access Lifecycle Management in the UI

You can access the LCM dashboard in a few ways:

• Expand the Menu, then select Manage switches
• Click Upgrade in a workbench header
• Click Devices in a workbench header, then select Manage switches

Access Lifecycle Management with the CLI

Lifecycle management workflows use the netq lcm command set. Refer to the command line reference for a comprehensive list of options and definitions.

NetQ and network operating system images (Cumulus Linux and SONiC) are managed with LCM. This section explains how to check for missing images, upgrade images, and specify default images.

View and Upload Missing Images

You should upload images for each network OS and NetQ version currently installed in your inventory so you can support rolling back to a known good version should an installation or upgrade fail. If you have specified a default network OS and/or NetQ version, the NetQ UI also verifies that the necessary versions of the default image are available based on the known switch inventory, and if not, lists those that are missing.

To upload missing network OS images:

NetQ UI

1. Expand the Menu and select Manage switches. Select the Image management tab.

2. On the Cumulus Linux Images card, select View # missing CL images to see which images you need.

If you have already specified a default image, you must click Manage and then Missing to see the missing images.

3. Select one or more of the missing images and take note of the version, ASIC vendor, and CPU architecture for each.

4. Download the network OS disk images (.bin files) from the NVIDIA Enterprise Support Portal. Log in to the portal and from the Downloads tab, select Switches and Gateways. Under Switch Software, click All downloads next to Cumulus Linux for Mellanox Switches. Select the current version and the target version, then click Show Downloads Path. Download the file.

5. In the UI, select Add image above the table.

6. Provide the .bin file from an external drive that matches the criteria for the selected image(s).

7. Click Import.

If the upload was unsuccessful, an Image Import Failed message appears. Close the dialog and try uploading the file again.

8. Click Done.

9. (Optional) Click the Uploaded tab to verify the image is in the repository.

10. Click Close to return to the LCM dashboard.

    The Cumulus Linux Images card reflects the number of images you uploaded.

NetQ CLI

1. (Optional) Display a summary of Cumulus Linux images uploaded to the LCM repo on the NetQ appliance or VM:

netq lcm show cl-images

2. Download the network OS disk images (.bin files) from the NVIDIA Enterprise Support Portal. Log into the portal and from the Downloads tab, select Switches and Gateways. Under Switch Software, click All downloads next to Cumulus Linux for Mellanox Switches. Select the current version and the target version, then click Show Downloads Path. Download the file.

3. Upload the images to the LCM repository. The following example uses a Cumulus Linux 4.2.0 disk image.

   cumulus@switch:~$ netq lcm add cl-image /path/to/download/cumulus-linux-4.2.0-mlnx-amd64.bin
   

4. Repeat step 2 for each image you need to upload to the LCM repository.

To upload missing NetQ images:

NetQ UI

1. Expand the Menu and select Manage switches. Select the Image management tab.

2. On the NetQ Images card, select View # missing NetQ images to see which images you need.

If you have already specified a default image, you must click Manage and then Missing to see the missing images.

3. Select one or all of the missing images and make note of the OS version, CPU architecture, and image type. Remember that you need both netq-apps and netq-agent for NetQ to perform the installation or upgrade.

4. Download the NetQ Debian packages needed for upgrade from the NetQ repository, selecting the appropriate OS version and architecture. Place the files in an accessible part of your local network.

5. In the UI, click Add image above the table.

6. Provide the .deb file(s) from an external drive that matches the criteria for the selected image.

7. Click Import.

If the upload was unsuccessful, an Image Import Failed message appears. Close the dialog and try uploading the file again.

8. Click Done.

9. (Optional) Click the Uploaded tab to verify that the image is in the repository.

10. Click Close to return to the LCM dashboard.

The NetQ Images card reflects the number of images you uploaded.

NetQ CLI

1. (Optional) Display a summary of NetQ images uploaded to the LCM repo on the NetQ appliance or VM:

netq lcm show netq-images

2. Download the NetQ Debian packages needed for upgrade from the NetQ repository, selecting the appropriate version and hypervisor/platform. Place them in an accessible part of your local network.

3. Upload the images to the LCM repository. This example uploads the two packages (netq-agent and netq-apps) needed for NetQ version 4.4.0 for a NetQ appliance or VM running Ubuntu 18.04 with an x86 architecture.

   cumulus@switch:~$ netq lcm add netq-image /path/to/download/netq-agent_4.4.0-ub18.04u40~1667493385.97ef4c9_amd64.deb
   cumulus@switch:~$ netq lcm add netq-image /path/to/download/netq-apps_4.4.0-ub18.04u40~1667493385.97ef4c9_amd64.deb
   

Upload Upgrade Images

To upload the network OS or NetQ images that you want to use for upgrade, first download the Cumulus Linux or SONiC disk images (.bin files) and NetQ Debian packages from the NVIDIA Enterprise Support Portal and NetQ repository, respectively. Place them in an accessible part of your local network.

If you are upgrading the network OS on switches with different ASIC vendors or CPU architectures, you need more than one image. For NetQ, you need both the netq-apps and netq-agent packages for each variant.

After obtaining the images, upload them to NetQ with the UI or CLI:

cumulus@switch:~$ netq lcm add image /path/to/download/cumulus-linux-4.2.0-mlx-amd64.bin

cumulus@switch:~$ netq lcm add image /path/to/download/netq-agent_4.4.0-ub18.04u40~1667493385.97ef4c9_amd64.deb
cumulus@switch:~$ netq lcm add image /path/to/download/netq-apps_4.4.0-ub18.04u40~1667493385.97ef4c9_amd64.deb

Specify a Default Upgrade Version

Specifying a default upgrade version is optional, but recommended. You can assign a specific OS or NetQ version as the default version to use when installing or upgrading switches. The default is typically the newest version that you intend to install or upgrade on all, or the majority, of your switches. If necessary, you can override the default selection during the installation or upgrade process if an alternate version is needed for a given set of switches.

cumulus@switch:~$ netq lcm add default-version cl-images <text-cumulus-linux-version>

cumulus@switch:~$ netq lcm show default-version cl-images

cumulus@switch:~$ netq lcm add default-version netq-images <text-netq-version>

cumulus@switch:~$ netq lcm show default-version netq-images

Remove Images from Local Repository

After you upgrade all your switches beyond a particular release, you can remove images from the LCM repository to save space on the server. To remove images:

netq lcm show cl-images [json]
netq lcm del cl-image <text-cl-image-id>

netq lcm show netq-images [json]
netq lcm del netq-image <text-netq-image-id>

Authentication credentials are stored in access profiles which can be assigned to individual switches. You can create credentials with either basic (SSH username/password) or SSH (public/private key) authentication. This section describes how to create, edit, and delete access profiles. After you create a profile, attach it to individual switches so that you can perform upgrades on those switches.

Create Access Profiles

NetQ UI

1. Expand the Menu and select Manage switches.

2. On the Access Profiles card, select Add profile.

3. Enter a name for the profile, then select the authentication method you want to use: SSH or Basic

SSH

You must have sudoer permission to configure switches when using the SSH key method.

4. Create a pair of SSH private and public keys:

   ssh-keygen -t rsa -C "<USER>"
   

5. Copy the SSH public key to each switch that you want to upgrade using one of the following methods:

   • Manually copy the SSH public key to the /home/<USER>/.ssh/authorized_keys file on each switch, or
   • Run ssh-copy-id USER@<switch_ip> on the server where you generated the SSH key pair for each switch

6. Copy the SSH private key into the entry field:

For security, your private key is stored in an encrypted format, and only provided to internal processes while encrypted.

7. (Optional) To verify that the new profile is listed among available profiles, select View profiles from the Access Profiles card.

Basic Authentication

Be sure to use credentials for an account that has permission to configure switches.

The default credentials for Cumulus Linux have changed from cumulus/CumulusLinux! to cumulus/cumulus for releases 4.2 and later. For details, read Cumulus Linux User Accounts.

4. Enter a username and password.

5. Click Create, then confirm.

6. (Optional) To verify that the new profile is listed among available profiles, select View profiles from the Access Profiles card.

NetQ CLI

To configure basic authentication, run:

cumulus@switch:~$ netq lcm add credentials profile_name NEWPROFILE username cumulus password cumulus

Specify a unique name for the configuration after profile_name.

The default credentials for Cumulus Linux have changed from cumulus/CumulusLinux! to cumulus/cumulus for releases 4.2 and later. For details, read Cumulus Linux User Accounts.

To configure SSH authentication using a public/private key:

You must have sudoer permission to properly configure switches when using the SSH key method.

1. If the keys do not yet exist, create a pair of SSH private and public keys.

   ssh-keygen -t rsa -C "<USER>"
   

2. Copy the SSH public key to each switch that you want to upgrade using one of the following methods:

   • Manually copy the SSH public key to the /home/<USER>/.ssh/authorized_keys file on each switch, or
   • Run ssh-copy-id USER@<switch_ip> on the server where you generated the SSH key pair for each switch

3. Add these credentials to the switch. Specify a unique name for the configuration after profile_name.

   cumulus@switch:~$ netq lcm add credentials profile_name NEWPROFILE ssh-key PUBLIC_SSH_KEY
   

Edit Access Profiles

cumulus@switch:~$ netq lcm edit credentials 
    profile_id <text-switch-profile-id> 
    [profile_name <text-switch-profile-name>] 
    [auth-type <text-switch-auth-type>] 
    [username <text-switch-username>] 
    [password <text-switch-password> | ssh-key <text-ssh-key>]

Delete Access Profiles

Any profile that is assigned to a switch can’t be deleted. You must attach a different profile to the switch first. Note that Netq-Default and Nvl4-Default can’t be deleted.

NetQ UI

1. On the Access Profiles card, select View profiles.

2. From the list of profiles, select Delete in the profile’s row.

The delete icon only appears next to custom profiles that are not already attached to a switch.

3. Select Remove.

NetQ CLI

1. Run netq lcm show credentials. Identify the profile you’d like to delete and copy its identifier from the Profile ID column. The following example deletes the n-1000 profile:

cumulus@switch:~$ netq lcm show credentials
Profile ID           Profile Name             Type             SSH Key        Username         Password         Number of switches                   Last Changed
-------------------- ------------------------ ---------------- -------------- ---------------- ---------------- ------------------------------------ -------------------------
credential_profile_d Netq-Default             BASIC                           cumulus          **************   11                                   Fri Feb  3 18:20:33 2023
9e875bd2e6784617b304
c20090ce28ff2bb46a4b
9bf23cda98f1bdf91128
5c9
credential_profile_3 Nvl4-Default             BASIC                           admin            **************   1                                    Fri Feb  3 19:18:26 2023
5a2eead7344fb91218bc
dec29b12c66ebef0d806
659b20e8805e4ff629bc
23e
credential_profile_3 n-1000                   BASIC                           admin            **************   0                                    Fri Feb  3 21:49:10 2023
eddab251bddea9653df7
cd1be0fc123c5d7a42f8
18b68134e42858e54a9c
289

2. Run netq lcm del credentials profile_id <text-credential-profile-id>:

cumulus@switch:~$ netq lcm del credentials profile_id credential_profile_3eddab251bddea9653df7cd1be0fc123c5d7a42f818b68134e42858e54a9c289

3. Verify that the profile is deleted with netq lcm show credentials.

View Access Profiles

You can view the type of credentials used to access your switches in the NetQ UI. You can view the details of the credentials using the NetQ CLI.

Related Information

• Attach a Profile to a Switch

Upon installation, lifecycle management displays an inventory of switches that are available for software installation or upgrade through NetQ. This includes all switches running Cumulus Linux 3.7.12 or later, SONiC 202012 and 202106, and NetQ Agent 4.1.0 or later in your network. From this list, you can assign access profiles and roles to switches, and select switches for software installation and upgrades.

View the LCM Switch Inventory

NetQ UI

From the LCM dashboard, select the Switch management tab. The Switches card displays the number of switches that NetQ discovered and the network OS versions that are running on those switches:

To view a table of all discovered switches and their attributes, select Manage on the Switches card.

If you have more than one network OS version running on your switches, you can click a version segment on the Switches card graph to open a list of switches pre-filtered by that version.

NetQ CLI

To view a list of all switches discovered by lifecycle management, run:

netq lcm show switches
    [cl-version <text-cumulus-linux-version>]
    [netq-version <text-netq-version>]
    [json]

Use the version options to display switches with a given OS version, X.Y.Z.

For additional details, refer to the command line reference.

This list is the starting point for network OS upgrades or NetQ installations and upgrades. If the switches you want to upgrade are not present in the list, you can:

• Verify the missing switches are reachable using ping
• Verify the NetQ Agent is fresh and version 4.1.0 or later for switches that already have the agent installed (click Menu, then click Agents or run netq show agents)
• Install NetQ on the switch
• Upgrade NetQ Agents (if needed)

Attach a Profile to a Switch

After creating access profiles from your credentials, you can attach a profile to one or more switches.

NetQ UI

1. On the Switches card, select Manage.

2. The table displays a list of switches. The Access type column specifies whether the type of authentication is basic or SSH. The Profile name column displays the access profile that is assigned to the switch.

Select the switches you’d like to assign access profiles, then select Manage access profile above the table:

3. Select the profile from the list, then click Done.

If the profile you want to use isn’t listed, select Add new profile and follow the steps to create an access profile.

4. Select Ok on the confirmation dialog. The updated access profiles are now reflected in the Profile name column:

NetQ CLI

The command syntax to attach a profile to a switch is:

netq lcm attach credentials 
    profile_id <text-switch-profile-id> 
    hostnames <text-switch-hostnames>

1. Run netq lcm show credentials to display a list of access profiles. Note the profile ID that you’d like to assign to a switch.

2. Run netq lcm show switches to display a list of switches. Note the hostname of the switch(es) you’d like to attach a profile to.

3. Next, attach the credentials to the switch:

netq lcm attach credentials profile_id credential_profile_3eddab251bddea9653df7cd1be0fc123c5d7a42f818b68134e42858e54a9c289 hostnames tor-1,tor-2
Attached profile to switch(es).

4. Run netq lcm show switches and verify the change in the credential profile column.

Reassign or Detach an Access Profile

Detaching a profile from a switch restores it to the default access profile, Netq-Default.

NetQ UI

1. On the Switches card, click Manage.

2. The table displays a list of switches. In the profile name column, locate the access profile. Hover over the access type column and select Manage access:

3. To assign a different access profile to the switch, select it from the list. To detach the access profile, select Detach.

After you detach the profile from the switch, NetQ reassigns it to the Netq-Default profile.

NetQ CLI

The syntax for the detach command is netq lcm detach credentials hostname <text-switch-hostname>.

1. To obtain a list of hostnames, run netq lcm show switches.

2. Detach the access profile and specify the hostname. The following example detaches spine-1 from its assigned access profile:

cumulus@switch:~$ netq lcm detach credentials hostname spine-1
Detached profile from switch.

3. Run netq lcm show switches and verify the change in the credential profile column.

Role Management

You can assign switches one of four roles: superspine, spine, leaf, and exit.

Switch roles identify switch dependencies and determine the order in which switches are upgraded. The upgrade process begins with switches assigned the superspine role, then continues with the spine switches, leaf switches, exit switches, and finally, switches with no role assigned. Upgrades for all switches with a given role must be successful before the upgrade proceeds to the switches with the closest dependent role.

Role assignment is optional, but recommended. Assigning roles can prevent switches from becoming unreachable due to dependencies between switches or single attachments. Additionally, when you deploy MLAG pairs, assigned roles avoid upgrade conflicts.

Assign Roles to Switches

NetQ UI

1. On the Switches card, click Manage.

2. Select one switch or multiple switches to assign to the same role.

3. Above the table, select Assign role.

4. Select the role (superspine, leaf, spine, or exit) that applies to the selected switch(es).

5. Click Assign.

   Note that the Role column is updated with the role assigned to the selected switch(es). To return to the full list of switches, click All.

6. Continue selecting switches and assigning roles until most or all switches have roles assigned.

NetQ CLI

To add a role to one or more switches, run:

netq lcm add role (superspine | spine | leaf | exit) switches <text-switch-hostnames>

For a single switch, run:

netq lcm add role leaf switches leaf01

To assign multiple switches to the same role, separate the hostnames with commas (no spaces). This example configures leaf01 through leaf04 switches with the leaf role:

netq lcm add role leaf switches leaf01,leaf02,leaf03,leaf04

To view all switch roles, run:

netq lcm show switches [version <text-cumulus-linux-version>] [json]

Use the version option to only show switches with a given network OS version, X.Y.Z.

The Role column displays assigned roles:

cumulus@switch:~$ netq lcm show switches
Hostname          Role       IP Address                MAC Address        CPU      CL Version           NetQ Version             Last Changed
----------------- ---------- ------------------------- ------------------ -------- -------------------- ------------------------ -------------------------
leaf01            leaf       192.168.200.11            44:38:39:00:01:7A  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:55:37 2020
                                                                                                        104fb9ed
spine04           spine      192.168.200.24            44:38:39:00:01:6C  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:25:16 2020
                                                                                                        104fb9ed
leaf03            leaf       192.168.200.13            44:38:39:00:01:84  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:55:56 2020
                                                                                                        104fb9ed
leaf04            leaf       192.168.200.14            44:38:39:00:01:8A  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:55:07 2020
                                                                                                        104fb9ed
border02                     192.168.200.64            44:38:39:00:01:7C  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:56:49 2020
                                                                                                        104fb9ed
border01                     192.168.200.63            44:38:39:00:01:74  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:56:37 2020
                                                                                                        104fb9ed
fw2                          192.168.200.62            44:38:39:00:01:8E  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:24:58 2020
                                                                                                        104fb9ed
spine01           spine      192.168.200.21            44:38:39:00:01:82  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:25:07 2020
                                                                                                        104fb9ed
spine02           spine      192.168.200.22            44:38:39:00:01:92  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:25:08 2020
                                                                                                        104fb9ed
spine03           spine      192.168.200.23            44:38:39:00:01:70  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:25:16 2020
                                                                                                        104fb9ed
fw1                          192.168.200.61            44:38:39:00:01:8C  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Tue Sep 29 21:24:58 2020
                                                                                                        104fb9ed
leaf02            leaf       192.168.200.12            44:38:39:00:01:78  x86_64   4.1.0                3.2.0-cl4u30~1601410518. Wed Sep 30 21:55:53 2020
                                                                                                        104fb9ed

Reassign Roles to Switches

netq lcm add role exit switches border01

cumulus@switch:~$ netq lcm add role exit switches border01,border02

Lifecycle management lets you upgrade to the latest agent version on switches with an existing NetQ Agent. You can upgrade only the NetQ Agent or both the NetQ Agent and NetQ CLI simultaneously. You can run up to five jobs at the same time; however, a given switch can only appear in one running job at a time.

Prepare for a NetQ Agent Upgrade

Before you upgrade, make sure you have the appropriate files and credentials:

Perform a NetQ Agent Upgrade

After you complete the preparation steps, upgrade the NetQ Agents:

netq lcm upgrade netq-image 
    job-name <text-job-name> 
    [netq-version <text-netq-version>] 
    [upgrade-cli True | upgrade-cli False] 
    hostnames <text-switch-hostnames> 
    [config_profile <text-config-profile>]

cumulus@switch:~$ netq lcm upgrade netq-image job-name upgrade-cl530-nq450 netq-version 4.5.0 hostnames spine01,spine02

Analyze the NetQ Agent Upgrade Results

After starting the upgrade you can monitor the progress in the NetQ UI. Successful upgrades are indicated by a green . Failed upgrades display error messages indicating the cause of failure.

To view the progress of upgrade jobs using the CLI, run:

netq lcm show upgrade-jobs netq-image [json]
netq lcm show status <text-lcm-job-id> [json]

cumulus@switch:~$ netq lcm show upgrade-jobs netq-image json
[
    {
        "jobId": "job_netq_install_7152a03a8c63c906631c3fb340d8f51e70c3ab508d69f3fdf5032eebad118cc7",
        "name": "Leaf01-02 to NetQ330",
        "netqVersion": "4.1.0",
        "overallStatus": "FAILED",
        "pre-checkStatus": "COMPLETED",
        "warnings": [],
        "errors": [],
        "startTime": 1611863290557.0
    }
]

cumulus@switch:~$ netq lcm show status netq-image job_netq_install_7152a03a8c63c906631c3fb340d8f51e70c3ab508d69f3fdf5032eebad118cc7
NetQ Upgrade FAILED

Upgrade Summary
---------------
Start Time: 2021-01-28 19:48:10.557000
End Time: 2021-01-28 19:48:17.972000
Upgrade CLI: True
NetQ Version: 4.1.0
Pre Check Status COMPLETED
Precheck Task switch_precheck COMPLETED
	Warnings: []
	Errors: []
Precheck Task version_precheck COMPLETED
	Warnings: []
	Errors: []
Precheck Task config_precheck COMPLETED
	Warnings: []
	Errors: []


Hostname          CL Version  NetQ Version  Prev NetQ Ver Config Profile               Status           Warnings         Errors       Start Time
                                            sion
----------------- ----------- ------------- ------------- ---------------------------- ---------------- ---------------- ------------ --------------------------
leaf01            4.2.1       4.1.0         3.2.1         ['NetQ default config']      FAILED           []               ["Unreachabl Thu Jan 28 19:48:10 2021
                                                                                                                         e at Invalid
                                                                                                                         /incorrect u
                                                                                                                         sername/pass
                                                                                                                         word. Skippi
                                                                                                                         ng remaining
                                                                                                                         10 retries t
                                                                                                                         o prevent ac
                                                                                                                         count lockou
                                                                                                                         t: Warning:
                                                                                                                         Permanently
                                                                                                                         added '192.1
                                                                                                                         68.200.11' (
                                                                                                                         ECDSA) to th
                                                                                                                         e list of kn
                                                                                                                         own hosts.\r
                                                                                                                         \nPermission
                                                                                                                         denied,
                                                                                                                         please try a
                                                                                                                         gain."]
leaf02            4.2.1       4.1.0         3.2.1         ['NetQ default config']      FAILED           []               ["Unreachabl Thu Jan 28 19:48:10 2021
                                                                                                                         e at Invalid
                                                                                                                         /incorrect u
                                                                                                                         sername/pass
                                                                                                                         word. Skippi
                                                                                                                         ng remaining
                                                                                                                         10 retries t
                                                                                                                         o prevent ac
                                                                                                                         count lockou
                                                                                                                         t: Warning:
                                                                                                                         Permanently
                                                                                                                         added '192.1
                                                                                                                         68.200.12' (
                                                                                                                         ECDSA) to th
                                                                                                                         e list of kn
                                                                                                                         own hosts.\r
                                                                                                                         \nPermission
                                                                                                                         denied,
                                                                                                                         please try a
                                                                                                                         gain."]

LCM lets you upgrade Cumulus Linux on one or more switches in your network via the NetQ UI or the CLI. You can run up to five upgrade jobs simultaneously; however, a given switch can only appear in one running job at a time. Upgrading Cumulus Linux on a switch typically takes around 45 minutes.

You can upgrade Cumulus Linux from:

• 3.7.16 to later versions of Cumulus Linux 3
• 3.7.16 or later to 4.2.0 or later versions of Cumulus Linux 4
• 4.2 to later versions of Cumulus Linux 4
• 4.4.0 or later to Cumulus Linux 5 releases
• 5.0.0 or later to 5.1.0 or later versions of Cumulus Linux 5

Prepare for a Cumulus Linux Upgrade

If the NetQ Agent is already installed on the switches you’d like to upgrade, follow the steps below. If the NetQ Agent is not installed on the switches you’d like to upgrade, run a switch discovery, then proceed with the upgrade.

Before you upgrade, make sure you have the appropriate files and credentials:

Upgrade Cumulus Linux

After you complete the preparation steps, upgrade Cumulus Linux:

NetQ UI

1. Click Devices in any workbench header, then select Manage switches.

2. Locate the Switches card and click Manage.

3. Select the switches you want to upgrade.

4. Click Upgrade OS above the table.

   Follow the steps in the UI. Create a name for the upgrade and review the switches that you selected to upgrade:

If you accidentally included a switch that you do not want to upgrade, hover over the switch information card and click Delete to remove it from the upgrade.

If the role is incorrect or missing, click Edit, then select a role for that switch from the dropdown. Click Cancel to discard the change.

7. Click Next.

8. Select either a default image or custom version.

9. Verify or add switch access credentials.

10. Click Next.

11. Verify the upgrade job options.

    By default, NetQ performs a roll back to the original Cumulus Linux version on any server which fails to upgrade. It also takes network snapshots before and after the upgrade.

    You can exclude selected services and protocols from the snapshots by clicking them. Node and services must be included.

12. Click Next.

13. NetQ performs several checks to eliminate preventable problems during the upgrade process. When all of the pre-checks pass, click Preview.

14. NetQ directs you to a screen where you can review the upgrade. After reviewing, select Start upgrade and confirm.

NetQ CLI

Perform the upgrade using the netq lcm upgrade cl-image command, providing a name for the upgrade job, the Cumulus Linux and NetQ version, and a comma-separated list of the hostname(s) to be upgraded:

cumulus@switch:~$ netq lcm upgrade cl-image job-name upgrade-cl430 cl-version 4.3.0 netq-version 4.5.0 hostnames spine01,spine02

Create a Network Snapshot

You can also generate a network snapshot before and after the upgrade by adding the run-snapshot-before-after option to the command:

cumulus@switch:~$ netq lcm upgrade cl-image job-name upgrade-430 cl-version 4.3.0 netq-version 4.5.0 hostnames spine01,spine02,leaf01,leaf02 order spine,leaf run-snapshot-before-after

Restore upon an Upgrade Failure

(Recommended) You can restore the previous version of Cumulus Linux if the upgrade job fails by adding the run-restore-on-failure option to the command.

cumulus@switch:~$ netq lcm upgrade cl-image name upgrade-530 cl-version 5.3.0 netq-version 4.5.0 hostnames spine01,spine02,leaf01,leaf02 order spine,leaf run-restore-on-failure

Pre-check Failures

If one or more of the pre-checks fail, resolve the related issue and start the upgrade again. In the NetQ UI these failures appear on the Upgrade Preview page. In the NetQ CLI, it appears in the form of error messages in the netq lcm show upgrade-jobs cl-image command output.

Analyze Results

After starting the upgrade you can monitor the progress in the NetQ UI. Successful upgrades are indicated by a green . Failed upgrades display error messages indicating the cause of failure.

To view the progress of current upgrade jobs and the history of previous upgrade jobs using the CLI, run netq lcm show upgrade-jobs cl-image.

To see details of a particular upgrade job, run netq lcm show status job-ID.

To see only Cumulus Linux upgrade jobs, run netq lcm show status cl-image job-ID.

Upon successful upgrade, you can:

• Compare network snapshots taken before and after the upgrade.

• Download details about the upgrade in a JSON-formatted file, by clicking Download report.

Post-check Failures

A successful upgrade can still have post-check warnings. For example, you updated the OS, but not all services are fully up and running after the upgrade. If one or more of the post-checks fail, warning messages appear in the Post-Upgrade Tasks section of the preview. Click the warning category to view the detailed messages.

Upgrade Cumulus Linux on Switches Without NetQ Agent Installed

To upgrade Cumulus Linux on switches without NetQ installed, create a switch discovery. The discovery searches your network for all Cumulus Linux switches (with and without NetQ currently installed) and determines the versions of Cumulus Linux and NetQ installed. These results are then used to install or upgrade Cumulus Linux and NetQ on all discovered switches in a single procedure rather than in two steps. You can run up to five jobs simultaneously; however, a given switch can only appear in one running job at a time.

To discover switches running Cumulus Linux and upgrade Cumulus Linux and NetQ on those switches:

NetQ UI

1. Click Devices in the workbench header, then click Manage switches.

2. On the Switches card, click Discover.

3. Enter a name for the scan.

4. Choose whether you want to look for switches by entering IP address ranges or import switches using a comma-separated values (CSV) file.

IP Address Range

If you do not have a switch listing, then you can manually add the address ranges where your switches are located in the network. This has the advantage of catching switches that might have been missed in a file.

A maximum of 50 addresses can be included in an address range. If necessary, break the range into smaller ranges.

To discover switches using address ranges:

1. Enter an IP address range in the IP Range field.

   Ranges can be contiguous, for example 192.168.0.24-64, or non-contiguous, for example 192.168.0.24-64,128-190,235, but they must be contained within a single subnet.

2. Optionally, enter another IP address range (in a different subnet) by clicking .

   For example, 198.51.100.0-128 or 198.51.100.0-128,190,200-253.

3. Add additional ranges as needed. Click to remove a range.

If you decide to use a CSV file instead, the ranges you entered will remain if you return to using IP ranges again.

CSV Import

To import switches through a CSV file:

1. Click Browse.

2. Select the CSV file containing the list of switches.

   The CSV file must include a header containing hostname, ip, and port. They can be in any order you like, but the data must match that order. For example, a CSV file that represents the Cumulus reference topology could look like this:

or this:

You must have an IP address in your file, but the hostname is optional. If the port is blank, NetQ uses switch port 22 by default.

Click Remove if you decide to use a different file or want to use IP address ranges instead. If you entered ranges before selecting the CSV file option, they remain.

5. Select an access profile from the dropdown menu. If you use Netq-Default you will see a message requesting that you create or update your credentials.

6. Click Next.

   When the network discovery is complete, NetQ presents the number of Cumulus Linux switches it found. Each switch can be in one of the following categories:

   • Discovered without NetQ: Switches found without NetQ installed
   • Discovered with NetQ: Switches found with some version of NetQ installed
   • Discovered but Rotten: Switches found that are unreachable
   • Incorrect Credentials: Switches found that cannot are unreachable because the provided access credentials do not match those for the switches
   • OS not Supported: Switches found that are running Cumulus Linux version not supported by the LCM upgrade feature
   • Not Discovered: IP addresses which did not have an associated Cumulus Linux switch

   If the discovery process does not find any switches for a particular category, then it does not display that category.

7. Select which switches you want to upgrade from each category by clicking the checkbox on each switch card.

8. Click Next.

9. Accept the default NetQ version or click Custom and select an alternate version.

10. By default, the NetQ Agent and CLI are upgraded on the selected switches. If you do not want to upgrade the NetQ CLI, click Advanced and change the selection to No.

11. Click Next.

12. NetQ performs several checks to eliminate preventable problems during the upgrade process. When all of the pre-checks pass, select Install.

    After starting the upgrade you can monitor the progress from the preview page or the Upgrade History page.

NetQ CLI

Use the netq lcm discover command, specifying a single IP address, a range of IP addresses where your switches are located in the network, or a CSV file containing the IP address.

You must also specify the access profile ID, which you can obtain with the netq lcm show credentials command.

   cumulus@switch:~$ netq lcm discover ip-range 10.0.1.12 profile_id credential_profile_3eddab251bddea9653df7cd1be0fc123c5d7a42f818b68134e42858e54a9c289
   NetQ Discovery Started with job id: job_scan_4f3873b0-5526-11eb-97a2-5b3ed2e556db

When the network discovery is complete, NetQ presents the number of Cumulus Linux switches it has found. The output displays their discovery status, which can be one of the following:

• Discovered without NetQ: Switches found without NetQ installed
• Discovered with NetQ: Switches found with some version of NetQ installed
• Discovered but Rotten: Switches found that are unreachable
• Incorrect Credentials: Switches found that are unreachable because the provided access credentials do not match those for the switches
• OS not Supported: Switches found that are running Cumulus Linux version not supported by the LCM upgrade feature
• NOT_FOUND: IP addresses which did not have an associated Cumulus Linux switch

After you determine which switches you need to upgrade, run the upgrade process as described above.

Note that if you previously ran a switch discovery, you can display its results with netq lcm show discovery-job:

cumulus@switch:~$ netq lcm show discovery-job job_scan_921f0a40-5440-11eb-97a2-5b3ed2e556db
Scan COMPLETED

Summary
-------
Start Time: 2021-01-11 19:09:47.441000
End Time: 2021-01-11 19:09:59.890000
Total IPs: 1
Completed IPs: 1
Discovered without NetQ: 0
Discovered with NetQ: 0
Incorrect Credentials: 0
OS Not Supported: 0
Not Discovered: 1


Hostname          IP Address                MAC Address        CPU      CL Version  NetQ Version  Config Profile               Discovery Status Upgrade Status
----------------- ------------------------- ------------------ -------- ----------- ------------- ---------------------------- ---------------- --------------
N/A               10.0.1.12                 N/A                N/A      N/A         N/A           []                           NOT_FOUND        NOT_UPGRADING
cumulus@switch:~$ 

Snapshots capture a network’s state—including the services running on the network—at a particular point in time. Comparing snapshots lets you check what (if anything) changed in the network, which can be helpful when upgrading a switch or modifying its configuration. This section outlines how to create, compare, and interpret snapshots.

Create a Network Snapshot

To create a snapshot:

1. From the workbench header, select Snapshot, then Create Snapshot:

   

2. Next, enter the snapshot’s name, time frame, and the elements you’d like included in the snapshot:

   

   To capture the network’s current state, click Now. To capture the network’s state at a previous date and time, click Past, then in the Start Time field, select the calendar icon.

   The Choose options field includes all the elements and services that may run on the network. All are selected by default. Click any element to remove it from the snapshot. Nodes and services are included in all snapshots.

   The Notes field is optional. You can add a note to remind you of the snapshot’s purpose.

3. Select Finish. The card now appears on your workbench.

4. When you are finished viewing the snapshot, click Dismiss to remove it from your workbench. You can add it back by selecting Snapshot in the header and navigating to the option to view snapshots.

Compare Network Snapshots

You can compare the state of your network before and after an upgrade or other configuration change to help avoid unwanted changes to your network’s state.

To compare network snapshots:

1. From the workbench header, select Snapshot.

2. Select Compare snapshots, then select the two snapshots you want to compare.

3. Click Finish.

If the snapshot cards are already on your workbench, place the cards side-by-side for a high-level comparison. For a more detailed comparison, click Compare on one of the cards and select a snapshot for comparison from the list.

Interpreting the Comparison Data

For each network element with changes, a visualization displays the differences between the two snapshots. Green represents additions, red represents subtractions, and orange represents updates.

In the following example, Snapshot 3 and Snapshot 4 are being compared. Snapshot 3 has a BGP count of 212 and Snapshot 4 has a BGP count of 186. The comparison also shows 98 BGP updates.

From this view, you can dismiss the snapshots or select View Details for additional information and to filter and export the data as a JSON file.

The following table describes the information provided for each element type when changes are present:

Related Information

• Back Up and Restore NetQ

You might need to decommission a switch when you:

• Change the hostname of the monitored switch or host
• Move the monitored switch or host from one data center to another
• RMA the monitored switch or host

Decommission a Switch

NetQ UI

1. From the LCM dashboard, navigate to the Switch management tab.

2. On the Switches card, select Manage.

3. Select the devices to decommission, then select the decommission icon above the table:

If you attempt to decommission a switch that is assigned a default, unmodified access profile, the process will fail. Create a unique access profile (or update the default with unique credentials), then attach the profile to the switch you want to decommission.

4. Confirm the devices you want to decommission.

5. Wait for the decommission process to complete, then select Done.

NetQ CLI

To decommission a switch or host:

1. On the given switch or host, stop and disable the NetQ Agent service:

   cumulus@switch:~$ sudo systemctl stop netq-agent
   cumulus@switch:~$ sudo systemctl disable netq-agent
   

2. On the NetQ On-premises or Cloud Appliance or VM, decommission the switch or host:

   cumulus@netq-appliance:~$ netq decommission <hostname-to-decommission>
   

Related Information

• Manage NetQ Agents
• Uninstall NetQ

Run the following commands to view the status of an agent, disable an agent, manage logging, and configure the events the agent collects.

View NetQ Agent Status

The syntax for the NetQ Agent status command is:

netq [<hostname>] show agents
    [fresh | dead | rotten | opta]
    [around <text-time>]
    [json]