{"id":20588993,"url":"https://github.com/ciscodevnet/sastre","last_synced_at":"2025-04-03T22:09:57.779Z","repository":{"id":50620154,"uuid":"200126692","full_name":"CiscoDevNet/sastre","owner":"CiscoDevNet","description":"Cisco-SDWAN Automation Toolset","archived":false,"fork":false,"pushed_at":"2024-09-30T07:06:36.000Z","size":2622,"stargazers_count":68,"open_issues_count":3,"forks_count":35,"subscribers_count":22,"default_branch":"master","last_synced_at":"2025-01-08T00:04:55.729Z","etag":null,"topics":["cisco","sd-wan","sdwan","viptela"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CiscoDevNet.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-08-01T22:28:41.000Z","updated_at":"2024-12-11T13:20:54.000Z","dependencies_parsed_at":"2024-03-22T20:45:12.349Z","dependency_job_id":"05fdc3d0-8db2-45d5-abd2-6775ec54f729","html_url":"https://github.com/CiscoDevNet/sastre","commit_stats":{"total_commits":236,"total_committers":12,"mean_commits":"19.666666666666668","dds":0.1313559322033898,"last_synced_commit":"fb45b4a43545d929566424bdb5fee814e8baa506"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CiscoDevNet%2Fsastre","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CiscoDevNet%2Fsastre/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CiscoDevNet%2Fsastre/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CiscoDevNet%2Fsastre/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CiscoDevNet","download_url":"https://codeload.github.com/CiscoDevNet/sastre/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247086027,"owners_count":20881160,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cisco","sd-wan","sdwan","viptela"],"created_at":"2024-11-16T07:27:26.656Z","updated_at":"2025-04-03T22:09:57.754Z","avatar_url":"https://github.com/CiscoDevNet.png","language":"Python","readme":"[![published](https://static.production.devnetcloud.com/codeexchange/assets/images/devnet-published.svg)](https://developer.cisco.com/codeexchange/github/repo/reismarcelo/sastre)\n\n# Sastre - Cisco-SDWAN Automation Toolset\n\nSastre provides functions to assist with managing configuration elements and visualize information from Cisco SD-WAN deployments. \n\nSome use-cases include:\n- Transfer configuration from one vManage to another. Lab or proof-of-concept environment to production, on-prem to cloud environments as examples.\n- Backup, restore and delete configuration items. Tags and regular expressions can be used to select all or a subset of items.\n- Visualize operational data across multiple devices. For instance, display status of control connections from multiple devices in a single table.\n\nSastre can also be used as an SDK to other applications, further information is available on [Sastre SDK](https://github.com/CiscoDevNet/sastre/wiki/4.-Sastre-SDK).\n\n[Sastre-Ansible](https://github.com/CiscoDevNet/sastre-ansible) is an Ansible Collection that exposes Sastre commands to Ansible Playbooks as a set of tasks and lookup plugins. Allowing users to build-up on Sastre functionality to create larger automation workflows.\n\nSupport enquires can be sent to sastre-support@cisco.com.\n\nNote on vManage release support:\n- Sastre 1.25 officially supports up to vManage 20.14. Newer vManage releases normally work without problems, just lacking support to the newer features added to that particular vManage release.\n\n## Sastre and Sastre-Pro\n\nAs of release 1.22, all functionality from Sastre-Pro is now available in Sastre. There is no functional difference between the two anymore.\n\nSastre continues as public open-source under MIT license available on [Cisco DevNet repository](https://github.com/CiscoDevNet/sastre). Supporting all tasks from Sastre-Pro.\n\n## Introduction\n\nSastre can be installed via pip, as a container or cloned from the git repository. Please refer to the [Installing](#installing) section for details.\n\nThe command line is structured as a set of base parameters, the task specification followed by task-specific parameters:\n```\nsdwan \u003cbase parameters\u003e \u003ctask\u003e \u003ctask-specific parameters\u003e\n```\n\nBase parameters define global options such as verbosity level, vManage credentials, etc.\n\nTask indicates the operation to be performed. The following tasks are currently available: \n- Backup: Save vManage configuration items to a local backup.\n- Restore: Restore configuration items from a local backup to vManage.\n- Delete: Delete configuration items on vManage.\n- Migrate: Migrate configuration items from a vManage release to another. Currently, only 18.4, 19.2 or 19.3 to 20.1 is supported. Minor revision numbers (e.g. 20.1.1) are not relevant for the template migration.\n- Encrypt: Encrypt values using target vManage keys. Used to generate CRYPT_CLUSTER encrypted values, which can only be decrypted by the target vManage.\n- Transform: Modify configuration items. Currently, copy, rename and crypt-update operations are supported. \n- Attach: Attach WAN Edges/vSmarts to templates. Allows further customization on top of the functionality available via \"restore --attach\".\n- Detach: Detach WAN Edges/vSmarts from templates. Allows further customization on top of the functionality available via \"delete --detach\".\n- Certificate: Restore device certificate validity status from a backup or set to a desired value (i.e. valid, invalid or staging).\n- List: List configuration items or device certificate information from vManage or a local backup.\n- Show-template: Show details about device templates on vManage or from a local backup.\n- Report: Generate a customizable report file containing the output of multiple commands. Also provide option to generate a diff between reports.\n- Show: Run vManage real-time, state or statistics commands; collecting data from one or more devices. Query vManage alarms and events.\n\nTask-specific parameters are provided after the task argument, customizing the task behavior. For instance, whether to execute a restore task in dry-run mode or the destination directory for a backup task. \n\nNotes:\n- Either 'sdwan' or 'sastre' can be used as the main command.\n- The command line described above, and in all examples that follow, assume Sastre was installed via PIP. \n- If Sastre was cloned from the git repository, then 'sdwan.py' or 'sastre.py' should be used instead. Please check the [Installing](#installing) section for more details.\n\n### Base parameters\n\n```\n% sdwan --help\nusage: sdwan [-h] [-a \u003cvmanage-ip\u003e] [-u \u003cuser\u003e] [-p \u003cpassword\u003e] [--tenant \u003ctenant\u003e] [--pid \u003cpid\u003e] [--port \u003cport\u003e] [--timeout \u003ctimeout\u003e] [--verbose] [--debug] [--version] \u003ctask\u003e ...\n\nSastre - Cisco-SDWAN Automation Toolset\n\npositional arguments:\n \u003ctask\u003e task to be performed (backup, restore, delete, migrate, attach, detach, certificate, transform, list, show-template, show, report, encrypt)\n \u003carguments\u003e task parameters, if any\n\noptions:\n -h, --help show this help message and exit\n -a \u003cvmanage-ip\u003e, --address \u003cvmanage-ip\u003e\n vManage IP address, can also be defined via VMANAGE_IP environment variable. If neither is provided user is prompted for the address.\n -u \u003cuser\u003e, --user \u003cuser\u003e\n username, can also be defined via VMANAGE_USER environment variable. If neither is provided user is prompted for username.\n -p \u003cpassword\u003e, --password \u003cpassword\u003e\n password, can also be defined via VMANAGE_PASSWORD environment variable. If neither is provided user is prompted for password.\n --tenant \u003ctenant\u003e tenant name, when using provider accounts in multi-tenant deployments.\n --pid \u003cpid\u003e CX project id, can also be defined via CX_PID environment variable. This is collected for AIDE reporting purposes. Use 0 if not applicable.\n --port \u003cport\u003e vManage port number, can also be defined via VMANAGE_PORT environment variable (default: 443)\n --timeout \u003ctimeout\u003e REST API timeout (default: 300)\n --verbose increase output verbosity\n --debug include additional API call details to the log files\n --version show program's version number and exit\n```\n\nvManage address (-a/--address), username (-u/--user), password (-p/--password) and port (--port) can also be provided via environment variables:\n- VMANAGE_IP\n- VMANAGE_USER\n- VMANAGE_PASSWORD\n- VMANAGE_PORT\n\nA good approach to reduce the number of parameters that need to be provided at execution time is to create rc text files exporting those environment variables for a particular vManage. This is demonstrated in the [Getting Started](#getting-started) section below.\n\nFor any of these arguments, vManage address, user, password and CX pid; user is prompted for a value if they are not provided via the environment variables or command line arguments.\n\n### Task-specific parameters\n\nTask-specific parameters and options are defined after the task is provided. Each task has its own set of parameters.\n```\n% sdwan backup -h\nusage: sdwan backup [-h] [--archive \u003cfilename\u003e | --workdir \u003cdirectory\u003e] [--no-rollover] [--save-running]\n [--regex \u003cregex\u003e | --not-regex \u003cregex\u003e]\n \u003ctag\u003e [\u003ctag\u003e ...]\n\nSastre - Cisco-SDWAN Automation Toolset\n\nBackup task:\n\npositional arguments:\n \u003ctag\u003e one or more tags for selecting items to be backed up. Multiple tags should be separated by space. Available\n tags: all, config_group, feature_profile, policy_customapp, policy_definition, policy_list,\n policy_security, policy_vedge, policy_voice, policy_vsmart, template_device, template_feature. Special tag\n \"all\" selects all items, including WAN edge certificates and device configurations.\n\noptions:\n -h, --help show this help message and exit\n --archive \u003cfilename\u003e backup to zip archive\n --workdir \u003cdirectory\u003e\n backup to directory (default: backup_198.18.1.10_20220915)\n --no-rollover by default, if workdir already exists (before a new backup is saved) the old workdir is renamed using a\n rolling naming scheme. This option disables this automatic rollover.\n --save-running include the running config from each node to the backup. This is useful for reference or documentation\n purposes. It is not needed by the restore task.\n --regex \u003cregex\u003e regular expression matching item names to backup, within selected tags.\n --not-regex \u003cregex\u003e regular expression matching item names NOT to backup, within selected tags.\n```\n\n#### Important concepts:\n- vManage URL: Constructed from the provided vManage IP address and TCP port (default 443). All operations target this vManage.\n- Workdir: Defines the location (in the local machine) where vManage data files are located. By default, it follows the format \"backup_\\\u003cvmanage-ip\\\u003e_\\\u003cyyyymmdd\\\u003e\". The --workdir parameter can be used to specify a different location. Workdir is under a 'data' directory. This 'data' directory is relative to the directory where Sastre is run.\n- Tag: vManage configuration items are grouped by tags, such as policy_apply, policy_definition, policy_list, template_device, etc. The special tag 'all' is used to refer to all configuration elements. Depending on the task, one or more tags can be specified in order to select groups of configuration elements.\n\n#### Common behavior of \"table\" tasks:\n\nA number of Sastre tasks provide output in the form of one or more tables. For instance, list, show-template and show tasks. There is a common set of options shared by all such tasks:\n\n**Table export options:**\n- --save-csv: Export as CSV file(s).\n- --save-json: Export as JSON file(s).\n\n**Table filtering options:**\n- --include: Include rows matching the provided regular expression, exclude all other rows.\n- --exclude: Exclude rows matching the provided regular expression.\n\nInclude/exclude regular expressions match on any cell value of the particular row. In other words, any cell value matching the regular expression will cause a row match.\n\nBoth --include and --exclude can be provided at simultaneously. In this case, exclude match is performed first then include.\n\n## Getting Started\n\nCreate a directory to serve as root for backup files, log files and rc files:\n```\n% mkdir sastre\n% cd sastre\n```\n \nWhen Sastre is executed, data/ and logs/ directories are created as needed to store backup files and application logs. These are created under the directory where Sastre is run.\n\nCreate a rc-example.sh file to include vManage details and source that file:\n```\n% cat \u003c\u003cEOF \u003e rc-example.sh\nexport VMANAGE_IP='198.18.1.10'\nexport VMANAGE_USER='admin'\nEOF\n% source rc-example.sh\n```\n\nNote that in this example the password was not defined, the user will be prompted for a password.\n\nTest vManage credentials by running a simple query listing configured device templates:\n```\n% sdwan list configuration template_device\nvManage password: \n+============================================================================================+\n| Name | ID | Tag | Type |\n+============================================================================================+\n| DC_ADVANCED | bf322748-8dfd-4cb0-a9e4-5d758be239a0 | template_device | device template |\n| DC_BASIC | 09c02518-9557-4ae2-9031-7e6b3e7323fc | template_device | device template |\n| VSMART_v1 | 15c1962f-740e-4b89-a269-69f2cbfba296 | template_device | device template |\n| BRANCH_ADVANCED | ad449106-7ed6-442f-9ba8-820612b85981 | template_device | device template |\n| BRANCH_BASIC | cc2f7a24-4c93-49ed-8e6b-1c107797ba95 | template_device | device template |\n+-----------------+--------------------------------------+-----------------+-----------------+\n```\n\nAny of those vManage parameters can be provided via command line as well:\n```\n% sdwan -p admin list configuration template_device\n```\n\nPerform a backup:\n```\n% sdwan --verbose backup all\nINFO: Starting backup: vManage URL: \"https://198.18.1.10\" -\u003e Local workdir: \"backup_198.18.1.10_20210927\"\nINFO: Saved vManage server information\nINFO: Saved WAN edge certificates\nINFO: Saved device template index\n\u003csnip\u003e\nINFO: Saved prefix list index\nINFO: Done prefix list DefaultRoute\nINFO: Done prefix list InfrastructureRoutes\nINFO: Saved local-domain list index\nINFO: Done local-domain list DCLOUD\nINFO: Task completed successfully\n```\n\nNote that '--verbose' was specified so that progress information is displayed. Without this option, only warning-level messages and above are displayed.\n\nThe backup is saved under data/backup_10.85.136.253_20191206:\n```\n% ls\ndata\t\tlogs\t\trc-example.sh\n% ls data\nbackup_198.18.1.10_20210927\n```\n\n## Additional Examples\n\n### Customizing backup destination:\n\n```\n% sdwan --verbose backup all --workdir my_custom_directory\nINFO: Starting backup: vManage URL: \"https://198.18.1.10\" -\u003e Local workdir: \"my_custom_directory\"\nINFO: Saved vManage server information\nINFO: Saved WAN edge certificates\nINFO: Saved device template index\n\u003csnip\u003e\nINFO: Saved prefix list index\nINFO: Done prefix list DefaultRoute\nINFO: Done prefix list InfrastructureRoutes\nINFO: Saved local-domain list index\nINFO: Done local-domain list DCLOUD\nINFO: Task completed successfully\n```\n\n### Backup saved as a zip file:\n\n```\n% sdwan --verbose backup all --archive my_backup_file.zip\nINFO: Backup task: vManage URL: \"https://198.18.1.10\" -\u003e Local archive file: \"my_backup_file.zip\"\nINFO: Saved vManage server information\nINFO: Saved WAN edge certificates\nINFO: Saved device template index\n\u003csnip\u003e\nINFO: Saved local-domain list index\nINFO: Done local-domain list DCLOUD\nINFO: Created archive file \"my_backup_file.zip\"\nINFO: Task completed successfully\n```\n\nNote that the zip archive is created by default in the same directory where Sastre is executed (and not under a 'data' directory, as is the case for workdir):\n\n```\n% ls *.zip\nmy_backup_file.zip\n```\n\n### Restoring from backup:\n\n```\n% sdwan --verbose restore all \nINFO: Starting restore: Local workdir: \"backup_10.85.136.253_20200617\" -\u003e vManage URL: \"https://10.85.136.253\"\nINFO: Loading existing items from target vManage\nINFO: Identifying items to be pushed\nINFO: Inspecting template_device items\nINFO: Inspecting template_feature items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_voice items\nINFO: Inspecting policy_customapp items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_profile items\nINFO: Inspecting policy_list items\nINFO: Pushing items to vManage\nINFO: Done: Create data-ipv6-prefix list mgmt_prefixes_ipv6\nINFO: Done: Create SLA-class list Realtime_Full_Mesh\nINFO: Done: Create SLA-class list Best_Effort\nINFO: Done: Create data-prefix list mgmt_prefixes\n\u003csnip\u003e\nINFO: Done: Create device template BRANCH_ADVANCED\nINFO: Done: Create device template BRANCH_BASIC\nINFO: Task completed successfully\n```\n \n#### Restoring from a backup in a different directory than the default:\n\n```\n% sdwan --verbose restore all --workdir my_custom_directory\nINFO: Starting restore: Local workdir: \"my_custom_directory\" -\u003e vManage URL: \"https://10.85.136.253\"\nINFO: Loading existing items from target vManage\nINFO: Identifying items to be pushed\nINFO: Inspecting template_device items\nINFO: Inspecting template_feature items\n\u003csnip\u003e\nINFO: Task completed successfully\n```\n\n#### Restoring from a zip archive backup:\n\n```\n% sdwan --verbose restore all --archive my_backup_file.zip \nINFO: Restore task: Local archive file: \"my_backup_file.zip\" -\u003e vManage URL: \"https://198.18.1.10\"\nINFO: Loaded archive file \"my_backup_file.zip\"\nINFO: Loading existing items from target vManage\nINFO: Identifying items to be pushed\nINFO: Inspecting config_group items\nINFO: Inspecting feature_profile items\nINFO: Inspecting template_device items\n\u003csnip\u003e\nINFO: Task completed successfully\n```\n\n#### Restoring with template attachments and policy activation:\n \n```\n% sdwan --verbose restore all --attach\nINFO: Starting restore: Local workdir: \"backup_10.85.136.253_20200617\" -\u003e vManage URL: \"https://10.85.136.253\"\nINFO: Loading existing items from target vManage\n\u003csnip\u003e\nINFO: Attaching WAN Edge templates\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed DC_BASIC,BRANCH_BASIC\nINFO: Completed attaching WAN Edge templates\nINFO: Attaching vSmart template\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed VSMART_v1\nINFO: Completed attaching vSmart template\nINFO: Activating vSmart policy\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed Central_policy_v1\nINFO: Completed activating vSmart policy\nINFO: Task completed successfully\n```\n\n#### Overwriting items with the --update option:\n- By default, when an item from the backup has the same name as an existing item on vManage it will be skipped by restore.\n- For instance, if a device template is modified on vManage, restoring from a backup taken before the modification will skip that item.\n- With the --update option, items with the same name are updated with the info found in the backup.\n- Sastre only update items when there are differences between the backup and vManage content.\n- If the item is associated with attached templates or activated policies, all necessary re-attach/re-activate actions are automatically performed.\n- Currently, the --update option does not inspect changes to template values. \n\nExample:\n```\n% sdwan --verbose restore all --workdir state_b --update\nINFO: Starting restore: Local workdir: \"state_b\" -\u003e vManage URL: \"https://10.85.136.253\"\nINFO: Loading existing items from target vManage\nINFO: Identifying items to be pushed\nINFO: Inspecting template_device items\nINFO: Inspecting template_feature items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_list items\nINFO: Pushing items to vManage\nINFO: Done: Create community list LOCAL_DC_PREFIXES\nINFO: Done: Create community list REMAINING_PREFIXES\nINFO: Updating SLA-class list Best_Effort requires reattach of affected templates\nINFO: Reattaching templates\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed VSMART_v1\nINFO: Completed reattaching templates\nINFO: Done: Update SLA-class list Best_Effort\n\u003csnip\u003e\nINFO: Done: Update device template DC_BASIC\nINFO: Task completed successfully\n```\n\n### Deleting vManage items:\n\nDry-run, just list without deleting items matching the specified tag and regular expression:\n```\n% sdwan --verbose delete all --regex '^DC' --dryrun\nINFO: Starting delete, DRY-RUN mode: vManage URL: \"https://10.85.136.253\"\nINFO: Inspecting template_device items\nINFO: DRY-RUN: Delete device template DC_BASIC\nINFO: DRY-RUN: Delete device template DC_ADVANCED\nINFO: Inspecting template_feature items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_list items\nINFO: Task completed successfully\n```\n\nDeleting items:\n```\n% sdwan --verbose delete all --regex '^DC'\nINFO: Starting delete: vManage URL: \"https://10.85.136.253\"\nINFO: Inspecting template_device items\nINFO: Done: Delete device template DC_BASIC\nINFO: Done: Delete device template DC_ADVANCED\nINFO: Inspecting template_feature items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_list items\nINFO: Task completed successfully\n```\n\n#### Deleting with detach:\nWhen vSmart policies are activated and device templates are attached the associated items cannot be deleted. \nThe --detach option performs the necessary template detach and vSmart policy deactivate before proceeding with delete.\n\n```\n% sdwan --verbose delete all --detach\nINFO: Starting delete: vManage URL: \"https://10.85.136.253\"\nINFO: Detaching WAN Edge templates\nINFO: Waiting...\nINFO: Completed BRANCH_BASIC\nINFO: Completed DC_BASIC\nINFO: Completed detaching WAN Edge templates\nINFO: Deactivating vSmart policy\nINFO: Waiting...\nINFO: Completed Central_policy_v1\nINFO: Completed deactivating vSmart policy\nINFO: Detaching vSmart template\nINFO: Waiting...\nINFO: Completed VSMART_v1\nINFO: Completed detaching vSmart template\nINFO: Inspecting template_device items\nINFO: Done: Delete device template vManage_template\n\u003csnip\u003e\nINFO: Task completed successfully\n```\n\n### Listing items from vManage or from a backup:\n\nThe list task can be used to show items from a target vManage, or a backup directory. Matching criteria can contain item tag(s) and regular expression.\n\nList device templates and feature templates from target vManage:\n```\n% sdwan --verbose list configuration template_device template_feature\nINFO: Starting list configuration: vManage URL: \"https://198.18.1.10\"\nINFO: List criteria matched 45 items\n+========================================================================================================+\n| Name | ID | Tag | Type |\n+========================================================================================================+\n| BRANCH_ADVANCED | 6ece1f27-fbfa-4730-9a8f-b61bfd380047 | template_device | device template |\n| VSMART_v1 | ba623cf6-5d2c-4676-a763-11b9cf866074 | template_device | device template |\n| BRANCH_BASIC | 5e362c85-8251-428a-b650-d364f8e15a22 | template_device | device template |\n\u003csnip\u003e\n| vSmart_VPN0_Interface_v1 | be09349e-308e-4ca5-a306-fb7bcd5bcb28 | template_feature | feature template |\n+---------------------------+--------------------------------------+------------------+------------------+\nINFO: Task completed successfully\n```\n \nList all items from target vManage with name starting with 'DC':\n```\n% sdwan --verbose list configuration all --include '^DC' \nINFO: List configuration task: vManage URL: \"https://198.18.1.10\"\nINFO: Selection matched 9 items\n+============================================================================================================+\n| Name | ID | Tag | Type |\n+============================================================================================================+\n| DC-vEdges | 87f79b8f-c295-4ba9-8279-a7866055281b | template_device | device template |\n| DC-VPN-0 | c684bdcd-8397-4e93-b185-0474afc6a711 | template_feature | feature template |\n| DC-VPN10 | 9c0011b9-b2eb-48ba-a262-bf6a64bcba4d | template_feature | feature template |\n| DC-VPN20 | d8bcbe02-21db-4297-856d-03ec8de53b44 | template_feature | feature template |\n| DC1-VPN10-Interface-Template | 72b0a69a-6ce7-445d-871e-39fb7122115b | template_feature | feature template |\n| DC1-VPN20-Interface-Template | ea3e73e3-2b31-498d-8663-b0a1240e9a3c | template_feature | feature template |\n| DC1 | 8aefe416-4f02-40bc-a141-57fb605efe72 | policy_list | site list |\n| DC-TLOCS | cc13e69d-3f3a-4af0-ad28-70915d297acc | policy_list | TLOC list |\n| DCLOUD | bb90f933-37d2-4639-812b-e2fb73bbb95e | policy_list | local-domain list |\n+------------------------------+--------------------------------------+------------------+-------------------+\nINFO: Task completed successfully\n```\n\nList all items from backup directory with name starting with 'DC':\n```\n% sdwan --verbose list configuration all --include '^DC' --workdir backup_10.85.136.253_20191206\nINFO: Starting list configuration: Local workdir: \"backup_10.85.136.253_20191206\"\nINFO: Selection matched 2 items\n+========================================================================================+\n| Name | ID | Tag | Type |\n+========================================================================================+\n| DC_ADVANCED | bf322748-8dfd-4cb0-a9e4-5d758be239a0 | template_device | device template |\n| DC_BASIC | 09c02518-9557-4ae2-9031-7e6b3e7323fc | template_device | device template |\n+-------------+--------------------------------------+-----------------+-----------------+\nINFO: Task completed successfully\n```\n \nList also allows displaying device certificate information:\n```\n% sdwan --verbose list certificate \nINFO: List certificate task: vManage URL: \"https://198.18.1.10\"\nINFO: Selection matched 5 items\n+================================================================================================================================+\n| Hostname | Chassis | Serial | State | Status |\n+================================================================================================================================+\n| - | 52c7911f-c5b0-45df-b826-3155809a2a1a | 24801375888299141d620fbdb02de2d4 | bootstrap config generated | valid |\n| BR1-CEDGE1 | CSR-940ad679-a16a-48ea-9920-16278597d98e | 487D703A | certificate installed | valid |\n| BR1-CEDGE2 | CSR-04ed104b-86bb-4cb3-bd2b-a0d0991f6872 | AAC6C8F0 | certificate installed | valid |\n| DC1-VEDGE1 | ebdc8bd9-17e5-4eb3-a5e0-f438403a83de | ee08f743 | certificate installed | valid |\n| DC1-VEDGE2 | f21dbb35-30b3-47f4-93bb-d2b2fe092d35 | b02445f6 | certificate installed | valid |\n+------------+------------------------------------------+----------------------------------+----------------------------+--------+\nINFO: Task completed successfully\n```\n\nSimilar to the list task, show-template tasks can be used to display items from a target vManage or backup. With show-template values, additional details about the selected items are displayed. A regular expression can be used to select which device templates to inspect. If the inspected templates have devices attached their values are displayed.\n```\n% sdwan --verbose show-template values --templates '^DC'\nINFO: Show-template values task: vManage URL: \"https://198.18.1.10\"\nINFO: Inspecting device template DC-vEdges values\n*** Template DC-vEdges, device DC1-VEDGE1 ***\n+====================================================================================================================================================+\n| Name | Value | Variable |\n+====================================================================================================================================================+\n| Latitude(system_latitude) | 37.33 | //system/gps-location/latitude |\n| Longitude(system_longitude) | -121.88 | //system/gps-location/longitude |\n| Hostname(system_host_name) | DC1-VEDGE1 | //system/host-name |\n| Site ID(system_site_id) | 100 | //system/site-id |\n| System IP(system_system_ip) | 10.1.0.1 | //system/system-ip |\n| IPv4 Address(MPLS-Interface-IP) | 100.64.0.2/30 | /0/ge0/1/interface/ip/address |\n| IPv4 Address(InternetTLOCIP) | 100.64.2.26/30 | /0/ge0/2/interface/ip/address |\n| Address(Internet-GW) | 100.64.2.25 | /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/Internet-GW/address |\n| Address(MPLS-GW) | 100.64.0.1 | /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/MPLS-GW/address |\n| Router ID(ospf_router_id) | 10.1.0.1 | /10//router/ospf/router-id |\n| IPv4 Address(VPN10-Interface-IP) | 10.1.10.150/24 | /10/ge0/0/interface/ip/address |\n| Address(VPN10_DEF_GW_DC) | 10.1.10.1 | /10/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN10_DEF_GW_DC/address |\n| IPv4 address(fw_svc_ip) | 10.1.10.200 | /10/vpn-instance/service/FW/address |\n| Interface Name(OSPF_VPN20_IF) | ge0/3 | /20//router/ospf/area/0/interface/OSPF_VPN20_IF/name |\n| Router ID(ospf_router_id) | 10.1.0.1 | /20//router/ospf/router-id |\n| Address(VPN20_DEF_GW_DC) | 10.1.20.1 | /20/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN20_DEF_GW_DC/address |\n| Interface Name(vpn20-interface-name) | ge0/3 | /20/vpn20-interface-name/interface/if-name |\n| IPv4 Address(VPN20-IP-Address) | 10.1.20.150/24 | /20/vpn20-interface-name/interface/ip/address |\n| Interface Name(VPN512_INTERFACE) | eth0 | /512/VPN512_INTERFACE/interface/if-name |\n| IPv4 Address(VPN512_IP_ADDR) | 198.18.3.100/24 | /512/VPN512_INTERFACE/interface/ip/address |\n| Address(VPN512_GW) | 198.18.3.1 | /512/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN512_GW/address |\n| System IP | 10.1.0.1 | csv-deviceIP |\n| Chassis Number | ebdc8bd9-17e5-4eb3-a5e0-f438403a83de | csv-deviceId |\n| Hostname | DC1-VEDGE1 | csv-host-name |\n| Status | complete | csv-status |\n+--------------------------------------+--------------------------------------+----------------------------------------------------------------------+\n\n*** Template DC-vEdges, device DC1-VEDGE2 ***\n+====================================================================================================================================================+\n| Name | Value | Variable |\n+====================================================================================================================================================+\n| Latitude(system_latitude) | 37.33 | //system/gps-location/latitude |\n| Longitude(system_longitude) | -121.88 | //system/gps-location/longitude |\n| Hostname(system_host_name) | DC1-VEDGE2 | //system/host-name |\n| Site ID(system_site_id) | 100 | //system/site-id |\n| System IP(system_system_ip) | 10.1.0.2 | //system/system-ip |\n| IPv4 Address(MPLS-Interface-IP) | 100.64.0.6/30 | /0/ge0/1/interface/ip/address |\n| IPv4 Address(InternetTLOCIP) | 100.64.2.30/30 | /0/ge0/2/interface/ip/address |\n| Address(Internet-GW) | 100.64.2.29 | /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/Internet-GW/address |\n| Address(MPLS-GW) | 100.64.0.5 | /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/MPLS-GW/address |\n| Router ID(ospf_router_id) | 10.1.0.2 | /10//router/ospf/router-id |\n| IPv4 Address(VPN10-Interface-IP) | 10.1.10.250/24 | /10/ge0/0/interface/ip/address |\n| Address(VPN10_DEF_GW_DC) | 10.1.10.1 | /10/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN10_DEF_GW_DC/address |\n| IPv4 address(fw_svc_ip) | 10.1.10.200 | /10/vpn-instance/service/FW/address |\n| Interface Name(OSPF_VPN20_IF) | ge0/3 | /20//router/ospf/area/0/interface/OSPF_VPN20_IF/name |\n| Router ID(ospf_router_id) | 10.1.0.2 | /20//router/ospf/router-id |\n| Address(VPN20_DEF_GW_DC) | 10.1.20.1 | /20/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN20_DEF_GW_DC/address |\n| Interface Name(vpn20-interface-name) | ge0/3 | /20/vpn20-interface-name/interface/if-name |\n| IPv4 Address(VPN20-IP-Address) | 10.1.20.250/24 | /20/vpn20-interface-name/interface/ip/address |\n| Interface Name(VPN512_INTERFACE) | eth0 | /512/VPN512_INTERFACE/interface/if-name |\n| IPv4 Address(VPN512_IP_ADDR) | 198.18.3.101/24 | /512/VPN512_INTERFACE/interface/ip/address |\n| Address(VPN512_GW) | 198.18.3.1 | /512/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN512_GW/address |\n| System IP | 10.1.0.2 | csv-deviceIP |\n| Chassis Number | f21dbb35-30b3-47f4-93bb-d2b2fe092d35 | csv-deviceId |\n| Hostname | DC1-VEDGE2 | csv-host-name |\n| Status | complete | csv-status |\n+--------------------------------------+--------------------------------------+----------------------------------------------------------------------+\nINFO: Task completed successfully\n```\n\n### Modifying device certificate validity status:\n\nRestore certificate validity status from a backup:\n```\n% sdwan --verbose certificate restore --workdir test\nINFO: Starting certificate: Restore status workdir: \"test\" \u003e vManage URL: \"https://198.18.1.10\"\nINFO: Loading WAN edge certificate list from target vManage\nINFO: Identifying items to be pushed\nINFO: Will update DC1-VEDGE1 status: valid -\u003e staging\nINFO: Will update 52c7911f-c5b0-45df-b826-3155809a2a1a status: valid -\u003e invalid\nINFO: Will update DC1-VEDGE2 status: valid -\u003e staging\nINFO: Will update BR1-CEDGE2 status: valid -\u003e staging\nINFO: Will update BR1-CEDGE1 status: valid -\u003e staging\nINFO: Pushing certificate status changes to vManage\nINFO: Certificate sync with controllers\nINFO: Waiting...\nINFO: Completed certificate sync with controllers\nINFO: Task completed successfully\n```\n\nSet certificate validity status to a desired value:\n```\n% sdwan --verbose certificate set valid \nINFO: Starting certificate: Set status to \"valid\" \u003e vManage URL: \"https://198.18.1.10\"\nINFO: Loading WAN edge certificate list from target vManage\nINFO: Identifying items to be pushed\nINFO: Will update DC1-VEDGE1 status: staging -\u003e valid\nINFO: Will update 52c7911f-c5b0-45df-b826-3155809a2a1a status: invalid -\u003e valid\nINFO: Will update DC1-VEDGE2 status: staging -\u003e valid\nINFO: Will update BR1-CEDGE2 status: staging -\u003e valid\nINFO: Will update BR1-CEDGE1 status: staging -\u003e valid\nINFO: Pushing certificate status changes to vManage\nINFO: Certificate sync with controllers\nINFO: Waiting...\nINFO: Completed certificate sync with controllers\nINFO: Task completed successfully\n```\n\n### Migrating templates from pre-20.1 to post-20.1\n- Template migration from pre-20.1 to post-20.1 format is supported. Maintenance numbers are not relevant to the migration. That is, 20.1 and 20.1.1 can be specified without any difference in terms of template migration.\n- The source of templates can be a live vManage or a backup. The destination is always a local directory. A restore task is then used to push migrated items to the target vManage.\n- Device attachments and template values are currently not handled by the migrate task. For instance, devices attached to a device template are left on that same template even when a new migrated template is created. \n\nMigrating off a live vManage:\n```\n% sdwan --verbose migrate all dcloud_migrated \nINFO: Starting migrate: vManage URL: \"https://198.18.1.10\" 18.4 -\u003e 20.1 Local output dir: \"dcloud_migrated\"\nINFO: Loaded template migration recipes\nINFO: Inspecting policy_list items\nINFO: Saved VPN list index\nINFO: Saved VPN list myvpns\nINFO: Saved VPN list corpVPN\nINFO: Saved VPN list pciVPN\nINFO: Saved VPN list guestVPN\nINFO: Saved VPN list ALLVPNs\nINFO: Saved URL-whitelist list index\nINFO: Saved URL-whitelist list Cisco\n\u003csnip\u003e\nINFO: Inspecting template_device items\nINFO: Saved device template index\nINFO: Saved device template vSmartConfigurationTemplate\nINFO: Saved device template VSMART-device-template\nINFO: Saved device template BranchType2Template-vEdge\nINFO: Saved device template DC-vEdges\nINFO: Saved device template migrated_BranchType1Template-CSR\nINFO: Task completed successfully\n```\n\nMigrating from a local workdir:\n```\n% sdwan --verbose migrate all --workdir sastre_cx_golden_repo sastre_cx_golden_repo_201\nINFO: Starting migrate: Local workdir: \"sastre_cx_golden_repo\" 18.4 -\u003e 20.1 Local output dir: \"sastre_cx_golden_repo_201\"\nINFO: Loaded template migration recipes\nINFO: Inspecting policy_list items\nINFO: Saved VPN list index\nINFO: Saved VPN list ALL_VPNS\nINFO: Saved VPN list G_All_SLAN_VPN_List\nINFO: Saved URL-blacklist list index\nINFO: Saved URL-blacklist list G_URL_BL_Example_List\nINFO: Saved class list index\nINFO: Saved class list G_Voice_Class_D46_C5_V01\n\u003csnip\u003e\nINFO: Saved device template migrated_G_Branch_184_Single_cE4451-X_2xWAN_DHCP_L2_v01\nINFO: Task completed successfully\n```\n \nBasic customization of migrated template names:\n- Using the --name option to specify the format for building migrated template names. Default is \"migrated_{name}\", where {name} is replaced with the original template name.\n\nExample:\n```\n% sdwan --verbose migrate all dcloud_migrated --workdir dcloud_192 --name \"201_{name}\"\nINFO: Starting migrate: Local workdir: \"dcloud_192\" 18.4 -\u003e 20.1 Local output dir: \"dcloud_migrated\"\nINFO: Previous migration under \"dcloud_migrated\" was saved as \"dcloud_migrated_1\"\nINFO: Loaded template migration recipes\nINFO: Inspecting policy_list items\nINFO: Saved VPN list index\nINFO: Saved VPN list myvpns\nINFO: Saved VPN list corpVPN\nINFO: Saved VPN list pciVPN\nINFO: Saved VPN list guestVPN\nINFO: Saved VPN list ALLVPNs\nINFO: Saved URL-whitelist list index\nINFO: Saved URL-whitelist list Cisco\n\u003csnip\u003e\nINFO: Inspecting template_device items\nINFO: Saved device template index\nINFO: Saved device template vSmartConfigurationTemplate\nINFO: Saved device template VSMART-device-template\nINFO: Saved device template BranchType2Template-vEdge\nINFO: Saved device template DC-vEdges\nINFO: Saved device template 201_BranchType1Template-CSR\nINFO: Task completed successfully\n```\n\nRegex-based customization of migrated template names:\n- This example shows a more complex --name option, containing multiple {name} entries with regular expressions.\n- Additional details about the name regex syntax are provided in the [Template name manipulation via name-regex](#template-name-manipulation-via-name-regex) section.\n\nExample:\n```\n% sdwan --verbose migrate all sastre_cx_golden_repo_201 --workdir sastre_cx_golden_repo --name '{name (G_.+)_184_.+}{name (G_VPN.+)}_201{name G.+_184(_.+)}'\nINFO: Starting migrate: Local workdir: \"sastre_cx_golden_repo\" 18.4 -\u003e 20.1 Local output dir: \"sastre_cx_golden_repo_201\"\nINFO: Loaded template migration recipes\nINFO: Inspecting policy_list items\n\u003csnip\u003e\nINFO: Inspecting template_feature items\nINFO: Saved feature template index\nINFO: Saved feature template G_vEdge_201_Banner_Template_v01\nINFO: Saved feature template G_vEdge_184_Banner_Template_v01\nINFO: Saved feature template G_vEdge_184_SLAN_INT3_v01\nINFO: Saved feature template G_vEdge_184_VPN0_Transport5_TLOC_EXT_v01\nINFO: Saved feature template G_cEdge_201_Loopback0_Template_v01\nINFO: Saved feature template G_cEdge_184_Loopback0_Template_v01\n\u003csnip\u003e\nINFO: Saved device template G_Branch_201_Dual_cE4321_2xWAN_TLOC_L2_v01\nINFO: Saved device template G_Branch_201_Single_cE4451-X_2xWAN_DHCP_L2_v01\nINFO: Task completed successfully\n```\n\n### Selectively attach/detach devices to/from templates\n\nThe attach and detach tasks expose a number of knobs to select templates and devices to be included:\n- Templates regular expression, selecting templates to attach. Match on template name.\n- Devices regular expression, selecting devices to attach. Match on device name.\n- Reachability state\n- Site-ID\n- System-IP\n\nWhen multiple filters are defined, the result is an AND of all filters. Dry-run can be used to validate the expected outcome.\n\nThe number of devices to include per attach/detach request (to vManage) can be defined with the --batch option.\n\nUsing dry-run mode to validate what templates and devices would be included with the attach task:\n```\n% sdwan --verbose attach edge --workdir dcloud_base --dryrun\nINFO: Starting attach templates, DRY-RUN mode: Local workdir: \"dcloud_base\" -\u003e vManage URL: \"https://198.18.1.10\"\nINFO: DRY-RUN: Template attach: DC-vEdges (DC1-VEDGE1, DC1-VEDGE2), migrated_CSR_BranchType1Template-CSR (BR1-CEDGE2, BR1-CEDGE1)\nINFO: Task completed successfully\n```\n\nSelecting devices to include in the attach task:\n```\n% sdwan --verbose attach edge --workdir dcloud_base --templates 'DC' --devices 'VEDGE2' \nINFO: Starting attach templates: Local workdir: \"dcloud_base\" -\u003e vManage URL: \"https://198.18.1.10\"\nINFO: Template attach: DC-vEdges (DC1-VEDGE2)\nINFO: Attaching WAN Edges\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed DC-vEdges\nINFO: Completed attaching WAN Edges\nINFO: Task completed successfully\n```\n\nSelecting vsmart/edge from input yml file to attach devices to templates\n```\n% sdwan --verbose attach edge --attach-file path/to/attach_file.yml \nINFO: Attach task source: Attach file: \"path/to/attach_file.yml\" -\u003e vManage URL: \"https://198.18.1.10\"\nINFO: No WAN Edge config-group deployments to process\nINFO: Template attach: DC-vEdges (DC1-VEDGE2)\nINFO: Template attaching WAN Edge\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed DC-vEdges\nINFO: Completed template attaching WAN Edge\nINFO: Task completed successfully\n```\n\n### Select templates/config-groups and devices and write to YML file for use in attach task\nThe attach create expose a number of knobs to select templates/config-groups and devices to be included:\n- Templates regular expression, selecting all devices attached to templates. Match on template name.\n- Config Groups regular expression, selecting all devices attached to config groups. Match on config_group name.\n- Devices regular expression, selecting devices to attach. Match on device name.\n- Reachability state\n- Site-ID\n- System-IP\n\nSelecting all config-groups and templates:\n```\n% sdwan attach create\nattach_templates:\n edge_templates:\n - templateName: DC-vEdges\n isCliTemplate: false\n device:\n - csv-status: complete\n csv-deviceId: ebdc8bd9-17e5-4eb3-a5e0-f438403a83de\n csv-deviceIP: 10.1.0.1\n csv-host-name: DC1-VEDGE1\n //system/host-name: DC1-VEDGE1\n //system/system-ip: 10.1.0.1\n //system/site-id: '100'\n //system/gps-location/latitude: '37.33'\n //system/gps-location/longitude: '-121.88'\n /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/MPLS-GW/address: 100.64.0.1\n /0/vpn-instance/ip/route/0.0.0.0/0/next-hop/Internet-GW/address: 100.64.2.25\n /10//router/ospf/router-id: 10.1.0.1\n /20/vpn20-interface-name/interface/if-name: ge0/3\n /20/vpn20-interface-name/interface/ip/address: 10.1.20.150/24\n /0/ge0/2/interface/ip/address: 100.64.2.26/30\n /0/ge0/1/interface/ip/address: 100.64.0.2/30\n /10/ge0/0/interface/ip/address: 10.1.10.150/24\n /512/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN512_GW/address: 198.18.3.1\n /512/VPN512_INTERFACE/interface/if-name: eth0\n /512/VPN512_INTERFACE/interface/ip/address: 198.18.3.100/24\n /20//router/ospf/router-id: 10.1.0.1\n /10/vpn-instance/service/FW/address: 10.1.10.200\n /20//router/ospf/area/0/interface/OSPF_VPN20_IF/name: ge0/3\n /10/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN10_DEF_GW_DC/address: 10.1.10.1\n /20/vpn-instance/ip/route/0.0.0.0/0/next-hop/VPN20_DEF_GW_DC/address: 10.1.20.1\n vsmart_templates:\n - templateName: VSMART-device-template\n isCliTemplate: false\n device:\n - csv-status: complete\n csv-deviceId: 10a98779-95f0-4383-871c-195d25bd9c74\n csv-deviceIP: 12.12.12.12\n csv-host-name: vSmart-1\n /0/eth0/interface/ip/address: 198.18.1.12/24\n //system/host-name: vSmart-1\n //system/system-ip: 12.12.12.12\n //system/site-id: '10'\n - csv-status: complete\n csv-deviceId: 704bbc2f-aa9a-4068-84a2-fc31602ed553\n csv-deviceIP: 22.22.22.22\n csv-host-name: vSmart-2\n /0/eth0/interface/ip/address: 198.18.1.22/24\n //system/host-name: vSmart-2\n //system/system-ip: 22.22.22.22\n //system/site-id: '20'\nconfig_groups:\n- configGroupName: test\n tag_rules:\n deviceAttribute: tags\n rule: equal\n values:\n - cedge2\n tagId: c8f055a9-4d20-469c-b753-7d2bbec84f34\n devices_association_values:\n family: sdwan\n devices:\n - deviceName: BR1-CEDGE2\n variables:\n - name: site_id\n value: '300'\n - name: system_ip\n value: 10.3.0.2\nvsmart_policy:\n name: StrictHub-n-Spoke\n activate: true\n```\n\nSelecting only devices attached to template:\n```\n% sdwan attach create --templates 'VSMART-device-template' \nattach_templates:\n edge_templates: []\n vsmart_templates:\n - templateName: VSMART-device-template\n isCliTemplate: false\n device:\n - csv-status: complete\n csv-deviceId: 10a98779-95f0-4383-871c-195d25bd9c74\n csv-deviceIP: 12.12.12.12\n csv-host-name: vSmart-1\n /0/eth0/interface/ip/address: 198.18.1.12/24\n //system/host-name: vSmart-1\n //system/system-ip: 12.12.12.12\n //system/site-id: '10'\nvsmart_policy:\n name: null\n activate: false\n```\n\nSaving devices attached to template and write to file:\n```\n% sdwan --verbose attach create --templates 'VSMART-device-template' --save-attach-file attach_file.yml\nINFO: Attach create task: \"attach_file.yml\"\nINFO: Attach file saved as \"attach_file.yml\"\nINFO: Task completed successfully\n```\n\nSelecting only vsmart devices and write to file:\n```\n% sdwan --verbose attach create --device-types vsmart --save-attach-file attach_file.yml\nINFO: Attach create task: \"attach_file.yml\"\nINFO: Attach file saved as \"attach_file.yml\"\nINFO: Task completed successfully\n```\n\n### Verifying device operational data\n\nThe show task provides commands to display operational data from devices, and vManage alarms and events.\n\nShow devices, realtime, state and statistics share the same set of options to filter devices to display:\n - --regex \u003cregex\u003e - Regular expression matching device name, type or model to display\n - --not-regex \u003cregex\u003e - Regular expression matching device name, type or model NOT to display.\n - --reachable - Display only reachable devices\n - --site \u003cid\u003e - Filter by site ID\n - --system-ip \u003cipv4\u003e - Filter by system IP\n\nVerifying inventory of devices that are reachable and name starting with \"pEdge3\" or \"pEdge4\":\n```\n% sdwan show devices --reachable --regex 'pEdge[3-4]'\n+==================================================================================+\n| Name | System IP | Site ID | Reachability | Type | Model |\n+==================================================================================+\n| pEdge3-ISR4331-1 | 100.1.140.1 | 140 | reachable | vedge | vedge-ISR-4331 |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 140 | reachable | vedge | vedge-ISR-4331 |\n+------------------+-------------+---------+--------------+-------+----------------+\n```\n\nListing the advertised routes from those two devices:\n```\n% sdwan show realtime omp adv-routes --reachable --regex 'pEdge[3-4]'\n*** OMP advertised routes ***\n+=====================================================================================================================================+\n| Device | VPN ID | Prefix | To Peer | Tloc color | Tloc IP | Protocol | Metric | OMP Preference |\n+=====================================================================================================================================+\n| pEdge3-ISR4331-1 | 1 | 10.5.113.0/24 | 100.1.9.104 | mpls | 100.1.140.1 | OSPF-external-2 | 20 | |\n| pEdge3-ISR4331-1 | 1 | 10.5.113.0/24 | 100.1.9.104 | biz-internet | 100.1.140.1 | OSPF-external-2 | 20 | |\n\u003csnip\u003e\n| pEdge3-ISR4331-1 | 1 | 172.18.31.0/24 | 100.1.9.105 | biz-internet | 100.1.140.1 | OSPF-intra-area | 2 | |\n+------------------+--------+------------------+-------------+--------------+-------------+-----------------+--------+----------------+\n| pEdge4-ISR4331-2 | 1 | 10.5.113.0/24 | 100.1.9.104 | mpls | 100.1.140.2 | OSPF-external-2 | 20 | |\n| pEdge4-ISR4331-2 | 1 | 10.5.113.0/24 | 100.1.9.104 | biz-internet | 100.1.140.2 | OSPF-external-2 | 20 | |\n\u003csnip\u003e\n| pEdge4-ISR4331-2 | 1 | 172.18.31.0/24 | 100.1.9.105 | biz-internet | 100.1.140.2 | OSPF-intra-area | 2 | |\n+------------------+--------+------------------+-------------+--------------+-------------+-----------------+--------+----------------+\n```\n\nChecking control connections and local-properties:\n```\n% sdwan show state control --reachable --regex 'pEdge[3-4]'\n*** Control connections ***\n+===============================================================================================+\n| Device | Peer System IP | Site ID | Peer Type | Local Color | Remote Color | State |\n+===============================================================================================+\n| pEdge3-ISR4331-1 | 100.1.9.105 | 9 | vsmart | biz-internet | default | up |\n| pEdge3-ISR4331-1 | 100.1.9.104 | 9 | vsmart | biz-internet | default | up |\n| pEdge3-ISR4331-1 | 100.1.9.104 | 9 | vsmart | mpls | default | up |\n| pEdge3-ISR4331-1 | 100.1.9.103 | 9 | vmanage | biz-internet | default | up |\n| pEdge3-ISR4331-1 | 100.1.9.105 | 9 | vsmart | mpls | default | up |\n+------------------+----------------+---------+-----------+--------------+--------------+-------+\n| pEdge4-ISR4331-2 | 100.1.9.105 | 9 | vsmart | biz-internet | default | up |\n| pEdge4-ISR4331-2 | 100.1.9.104 | 9 | vsmart | biz-internet | default | up |\n| pEdge4-ISR4331-2 | 100.1.9.101 | 9 | vmanage | mpls | default | up |\n| pEdge4-ISR4331-2 | 100.1.9.104 | 9 | vsmart | mpls | default | up |\n| pEdge4-ISR4331-2 | 100.1.9.105 | 9 | vsmart | mpls | default | up |\n+------------------+----------------+---------+-----------+--------------+--------------+-------+\n\n*** Control local-properties ***\n+======================================================================================================+\n| Device | System IP | Site ID | Device Type | Organization Name | Domain ID | Port Hopped |\n+======================================================================================================+\n| pEdge3-ISR4331-1 | 100.1.140.1 | 140 | vedge | AS_RTP_SDA_SDWAN | 1 | TRUE |\n+------------------+-------------+---------+-------------+-------------------+-----------+-------------+\n| pEdge4-ISR4331-2 | 100.1.140.2 | 140 | vedge | AS_RTP_SDA_SDWAN | 1 | TRUE |\n+------------------+-------------+---------+-------------+-------------------+-----------+-------------+\n```\n\nVerifying app-route data:\n```\n% sdwan show statistics app-route --reachable --regex 'pEdge[3-4]'\n*** Application-aware route statistics ***\n+===========================================================================================================================================================================+\n| Device | Local System Ip | Remote System Ip | Local Color | Remote Color | Total | Loss | Latency | Jitter | Name |\n+===========================================================================================================================================================================+\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.2 | mpls | mpls | 132 | 0 | 30 | 3 | 100.1.140.1:mpls-100.1.150.2:mpls |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.1 | mpls | mpls | 133 | 0 | 30 | 3 | 100.1.140.1:mpls-100.1.150.1:mpls |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.111.1 | biz-internet | biz-internet | 133 | 0 | 146 | 64 | 100.1.140.1:biz-internet-100.1.111.1:biz-internet |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.1 | biz-internet | biz-internet | 133 | 0 | 145 | 62 | 100.1.140.1:biz-internet-100.1.150.1:biz-internet |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.2 | biz-internet | biz-internet | 133 | 0 | 144 | 65 | 100.1.140.1:biz-internet-100.1.150.2:biz-internet |\n+------------------+-----------------+------------------+--------------+--------------+-------+------+---------+--------+---------------------------------------------------+\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.1 | biz-internet | biz-internet | 132 | 0 | 145 | 62 | 100.1.140.2:biz-internet-100.1.150.1:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.2 | biz-internet | biz-internet | 132 | 0 | 146 | 70 | 100.1.140.2:biz-internet-100.1.150.2:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.111.1 | biz-internet | biz-internet | 132 | 0 | 148 | 65 | 100.1.140.2:biz-internet-100.1.111.1:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.1 | mpls | mpls | 132 | 0 | 30 | 3 | 100.1.140.2:mpls-100.1.150.1:mpls |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.2 | mpls | mpls | 133 | 0 | 30 | 3 | 100.1.140.2:mpls-100.1.150.2:mpls |\n+------------------+-----------------+------------------+--------------+--------------+-------+------+---------+--------+---------------------------------------------------+\n```\n\nVerifying app-route data from 4 days ago:\n```\n% sdwan --verbose show statistics app-route --days 4 --reachable --regex 'pEdge[3-4]' \nINFO: Starting show statistics: vManage URL: \"https://10.122.41.140\"\nINFO: Query timestamp: 2021-04-26 15:36:12 UTC\nINFO: Retrieving application-aware route statistics from 2 devices\n*** Application-aware route statistics ***\n+===========================================================================================================================================================================+\n| Device | Local System Ip | Remote System Ip | Local Color | Remote Color | Total | Loss | Latency | Jitter | Name |\n+===========================================================================================================================================================================+\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.2 | biz-internet | biz-internet | 133 | 0 | 59 | 6 | 100.1.140.1:biz-internet-100.1.150.2:biz-internet |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.111.1 | biz-internet | biz-internet | 133 | 0 | 60 | 6 | 100.1.140.1:biz-internet-100.1.111.1:biz-internet |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.1 | biz-internet | biz-internet | 132 | 0 | 59 | 6 | 100.1.140.1:biz-internet-100.1.150.1:biz-internet |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.1 | mpls | mpls | 133 | 0 | 30 | 3 | 100.1.140.1:mpls-100.1.150.1:mpls |\n| pEdge3-ISR4331-1 | 100.1.140.1 | 100.1.150.2 | mpls | mpls | 132 | 0 | 30 | 3 | 100.1.140.1:mpls-100.1.150.2:mpls |\n+------------------+-----------------+------------------+--------------+--------------+-------+------+---------+--------+---------------------------------------------------+\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.111.1 | biz-internet | biz-internet | 133 | 0 | 60 | 7 | 100.1.140.2:biz-internet-100.1.111.1:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.2 | biz-internet | biz-internet | 132 | 0 | 60 | 7 | 100.1.140.2:biz-internet-100.1.150.2:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.1 | biz-internet | biz-internet | 133 | 0 | 60 | 6 | 100.1.140.2:biz-internet-100.1.150.1:biz-internet |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.1 | mpls | mpls | 133 | 0 | 30 | 3 | 100.1.140.2:mpls-100.1.150.1:mpls |\n| pEdge4-ISR4331-2 | 100.1.140.2 | 100.1.150.2 | mpls | mpls | 133 | 0 | 30 | 3 | 100.1.140.2:mpls-100.1.150.2:mpls |\n+------------------+-----------------+------------------+--------------+--------------+-------+------+---------+--------+---------------------------------------------------+\nINFO: Task completed successfully\n```\n\nChecking vManage alarms:\n```\n% sdwan --verbose show alarms --days 1\nINFO: Show alarms task: vManage URL: \"https://198.18.1.10\"\nINFO: Records query: 2022-02-16 18:05:20 UTC -\u003e 2022-02-17 19:05:20 UTC\n+================================================================================================================================================================+\n| Date \u0026 Time | Devices | Severity | Type | Message | Active |\n+================================================================================================================================================================+\n| 2022-02-17 19:02:49 UTC | BR1-CEDGE1 | Critical | utd-ips-alert | APP-DETECT DNS request for Dynamic Internet Technology domain dfgvx.com | True |\n| 2022-02-17 19:02:34 UTC | BR1-CEDGE1 | Critical | utd-ips-alert | APP-DETECT DNS request for Dynamic Internet Technology domain dfgvx.com | True |\n| 2022-02-17 19:02:19 UTC | BR1-CEDGE1 | Critical | utd-ips-alert | APP-DETECT DNS request for Dynamic Internet Technology domain dfgvx.com | True |\n| 2022-02-17 19:00:33 UTC | BR1-CEDGE1 | Critical | utd-file-reputation-alert | UTD file reputation alert | True |\n| 2022-02-17 19:00:07 UTC | vManage | Minor | cpu-usage | System CPU usage is back to normal level (below 60%) | False |\n| 2022-02-17 19:00:03 UTC | BR1-CEDGE1 | Critical | utd-file-reputation-alert | UTD file reputation alert | True |\n| 2022-02-17 19:00:03 UTC | BR1-CEDGE1 | Critical | utd-file-reputation-alert | UTD file reputation alert | True |\n| 2022-02-17 19:00:03 UTC | vManage | Medium | cpu-usage | System CPU usage is above 60% | False |\n| 2022-02-17 18:50:08 UTC | vManage | Minor | cpu-usage | System CPU usage is back to normal level (below 60%) | False |\n| 2022-02-17 18:50:03 UTC | vManage | Medium | cpu-usage | System CPU usage is above 60% | False |\n+-------------------------+------------+----------+---------------------------+-------------------------------------------------------------------------+--------+\nINFO: Task completed successfully\n```\n\n### Renaming configuration items\n\nThe transform task allows copying or renaming configuration items, including templates with attachments, activated policies and their dependencies. Transform task also supports updating vManage-encrypted values, allowing configuration items with values containing a CRYPT_CLUSTER prefix to be transferred to a different vManage.\n```\n% sdwan --verbose transform -h \nusage: sdwan transform [-h] {rename,copy,recipe,build-recipe} ...\n\nSastre - Cisco-SDWAN Automation Toolset\n\nTransform task:\n\noptions:\n -h, --help show this help message and exit\n\ntransform options:\n {rename,copy,recipe,build-recipe}\n rename rename configuration items\n copy copy configuration items\n recipe transform using custom recipe\n build-recipe generate recipe file for updating vManage-encrypted fields\n```\n\nTransform can read from a live vManage or from a backup directory (when --workdir is specified). It always save the processed items to the provided output directory. Then restore/attach tasks can be used to push those changes to vManage.\n\nNaming the new or renamed items can be done in a couple of ways:\n- Name template: A name_regex expression defines how to build the new name based on the old name. This method is available via CLI or custom recipe.\n- Name map: A 1-1 mapping from old name to new name is defined. This method is only available when using custom recipes.\n- Name map + name template: When both name map and name template are defined, name map lookup is done first. Only if no match is found on name map, name template processing is done.\n\nRenaming a feature-template using name template via transform rename:\n- Rename Logging_Template_cEdge to Logging_Template_v01\n```\n% sdwan list config template_feature --include '^Logging'\n+=====================================================================================================+\n| Name | ID | Tag | Type |\n+=====================================================================================================+\n| Logging_Template_cEdge | 1613ce4c-d098-4a24-8192-ef77d27dd0c4 | template_feature | feature template |\n+------------------------+--------------------------------------+------------------+------------------+\n\n% sdwan --verbose transform rename template_feature --regex '^Logging' '{name (Logging_Template)_cEdge}_v01' cleaned_configs\nINFO: Transform task: vManage URL: \"https://198.18.1.10\" -\u003e Local output dir: \"cleaned_configs\"\nINFO: Saved vManage server information\nINFO: Inspecting policy_list items\nINFO: Inspecting policy_profile items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_customapp items\nINFO: Inspecting policy_voice items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting template_feature items\nINFO: Matched feature template Logging_Template_cEdge\nINFO: Replacing feature template: Logging_Template_cEdge -\u003e Logging_Template_v01\nINFO: Inspecting template_device items\nINFO: Task completed successfully\n```\n\nPush changes to vManage using the restore task:\n- Note that --update option is used. This is so device template changes are detected and updated accordingly, with template reattach triggered as needed.\n```\n% sdwan --verbose restore all --update --workdir cleaned_configs \nINFO: Restore task: Local workdir: \"cleaned_configs\" -\u003e vManage URL: \"https://198.18.1.10\"\nINFO: Loading existing items from target vManage\nINFO: Identifying items to be pushed\nINFO: Inspecting template_device items\nINFO: Inspecting template_feature items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_voice items\nINFO: Inspecting policy_customapp items\nINFO: Inspecting policy_definition items\nINFO: Inspecting policy_profile items\nINFO: Inspecting policy_list items\nINFO: Pushing items to vManage\nINFO: Done: Create feature template Logging_Template_v01\nINFO: Updating device template BranchType1Template-cEdge requires reattach\nINFO: Template attach: BranchType1Template-cEdge (BR1-CEDGE2, BR1-CEDGE1)\nINFO: Reattaching templates\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed BranchType1Template-cEdge\nINFO: Completed reattaching templates\nINFO: Done: Update device template BranchType1Template-cEdge\nINFO: Task completed successfully\n```\n\nRenaming multiple feature-templates using name template and name map via transform recipe:\n- Using a custom recipe (defined in a YAML file or provided as a JSON string), allows more flexibility for defining which items are selected and how the new items should be named.\n```\n% cat recipe.yaml \n---\ntag: template_feature\n\nname_template:\n regex: \"^All-\"\n name_regex: \"{name ^All-(.+)}\"\n\nname_map:\n DC1-VPN10-Interface-Template: DC-VPN10-Interface_v01\n DC1-VPN20-Interface-Template: DC-VPN20-Interface_v01\n...\n\n% sdwan --verbose transform recipe --from-file recipe.yaml test-transform\nINFO: Transform task: vManage URL: \"https://198.18.1.10\" -\u003e Local output dir: \"test-transform\"\n\u003c\u003c snip \u003e\u003e\nINFO: Matched feature template All-VPN0-TEMPLATE_cEdge\nINFO: Replacing feature template: All-VPN0-TEMPLATE_cEdge -\u003e VPN0-TEMPLATE_cEdge\nINFO: Inspecting template_device items\nINFO: Task completed successfully\n```\n\nPush changes to vManage using the restore task:\n```\n% sdwan --verbose restore all --workdir test-transform --update \nINFO: Restore task: Local workdir: \"test-transform\" -\u003e vManage URL: \"https://198.18.1.10\"\n\u003c\u003c snip \u003e\u003e\nINFO: Task completed successfully\n```\n\n### Updating vManage-Encrypted values in configuration items\n\nTransform task also supports updating vManage-encrypted values, allowing configuration items with values containing a CRYPT_CLUSTER prefix to be transferred to a different vManage.\n\nThe first step is to find out the vManage-encrypted values present on vManage or a backup. This is accomplished with the transform build-recipe task.\n\nGenerate a recipe skeleton for the transform task:\n```\n% sdwan --verbose transform build-recipe --workdir dcloud-clean-mar4 recipe.yml\nINFO: Transform build-recipe task: Local workdir: \"dcloud-clean-mar4\" -\u003e Recipe file: \"recipe.yml\"\nINFO: Inspecting policy_customapp items\nINFO: Inspecting policy_list items\nINFO: Inspecting policy_definition items\nINFO: Inspecting parent_policy_definition items\nINFO: Inspecting policy_voice items\nINFO: Inspecting policy_security items\nINFO: Inspecting policy_vedge items\nINFO: Inspecting policy_vsmart items\nINFO: Inspecting template_feature items\nINFO: Found 1 crypt value in feature template VIP23-SIG-Credentials\nINFO: Found 1 crypt value in feature template SNMP-Basic_cEdge_v5\nINFO: Found 1 crypt value in feature template AddOnFeature_v1\nINFO: Inspecting template_device items\nINFO: Found 2 crypt values in device template test-cli-template\nINFO: Inspecting feature_profile items\nINFO: Inspecting config_group items\nINFO: Recipe file saved as \"recipe.yml\"\nINFO: Task completed successfully\n```\n\nThe generated recipe file contains all the current vManage-encrypted values found:\n``` \n% cat recipe.yml \ntag: all\ncrypt_updates:\n- resource_name: VIP23-SIG-Credentials\n replacements:\n - from_value: $CRYPT_CLUSTER$ToFuObeWUxN4nDPeds7FYA==$7Pzo514ANxdOCusPP+ZDth43Pp9S57xtjR1ofNjcszoKHhZ+zgAVbxUoN5rC7Pcz\n to_value: \u003c CHANGE ME \u003e\n- resource_name: SNMP-Basic_cEdge_v5\n replacements:\n - from_value: $CRYPT_CLUSTER$yGGUchXoTPJxctd+VFSYlw==$rv5ExxoXKv4Jm5lTiVGE/w==\n to_value: \u003c CHANGE ME \u003e\n- resource_name: AddOnFeature_v1\n replacements:\n - from_value: $CRYPT_CLUSTER$BJdUV6XNOPOiwv+51QU73A==$fs+9bcddKYs4uJn0TbpgRA==\n to_value: \u003c CHANGE ME \u003e\n- resource_name: test-cli-template\n replacements:\n - from_value: $CRYPT_CLUSTER$E/HhaXuj1/AzVLJgpbB0CA==$CbBdt/32vEqxpfhB+DShww==\n to_value: \u003c CHANGE ME \u003e\n - from_value: $CRYPT_CLUSTER$sVhKHHjEsFNv4TwqWBgK4g==$cA2R+9ozdQWlgnCwjXWB3A==\n to_value: \u003c CHANGE ME \u003e\n```\n\nEntries with a '\u003c CHANGE ME \u003e' placeholder need to be replaced with new values encrypted by the target vManage where you need to restore this backup to. This is done using the encrypt task.\n\nUsing the encrypt recipe task, Sastre will update the recipe file by requesting a new clear text value for each '\u003c CHANGE ME \u003e' entry, requesting the target vManage to encrypt it and update the corresponding to_value field with the new encrypted value.\n\nUpdate '\u003c CHANGE ME \u003e' entries in the recipe file:\n```\n% sdwan --verbose encrypt recipe recipe.yml \nINFO: Encrypt task: vManage URL: \"https://198.18.133.200:8443\"\nInteractive update of recipe file \"recipe.yml\", press \u003cENTER\u003e on empty value or ^C to abort without saving.\n\nResource VIP23-SIG-Credentials, from_value: $CRYPT_CLUSTER$ToFuObeWUxN4nDPeds7FYA==$7Pzo514ANxdOCusPP+ZDth43Pp9S57xtjR1ofNjcszoKHhZ+zgAVbxUoN5rC7Pcz\nValue to encrypt: \nEncrypted to_value: $CRYPT_CLUSTER$1JePUtTFGJuRf7PjK7IPIg==$VewhaXqfRvD/OUM7L9GqXg==\n\nResource SNMP-Basic_cEdge_v5, from_value: $CRYPT_CLUSTER$yGGUchXoTPJxctd+VFSYlw==$rv5ExxoXKv4Jm5lTiVGE/w==\nValue to encrypt: \nEncrypted to_value: $CRYPT_CLUSTER$IqogLSUdq/7X3ydwTgvYwg==$3m0OXrYsYBJ2yFHBAK9acw==\n\nResource AddOnFeature_v1, from_value: $CRYPT_CLUSTER$BJdUV6XNOPOiwv+51QU73A==$fs+9bcddKYs4uJn0TbpgRA==\nValue to encrypt: \nEncrypted to_value: $CRYPT_CLUSTER$epLo7ASRew0KNnHAq04h8A==$bU2mGCvHP3ajiBzTAHzhmw==\n\nResource test-cli-template, from_value: $CRYPT_CLUSTER$E/HhaXuj1/AzVLJgpbB0CA==$CbBdt/32vEqxpfhB+DShww==\nValue to encrypt: \nEncrypted to_value: $CRYPT_CLUSTER$DwZgpdH/23nINU7Wyg20QA==$ns4BwWhn9J6P9kOhJ+C6VA==\n\nResource test-cli-template, from_value: $CRYPT_CLUSTER$sVhKHHjEsFNv4TwqWBgK4g==$cA2R+9ozdQWlgnCwjXWB3A==\nValue to encrypt: \nEncrypted to_value: $CRYPT_CLUSTER$Li8Rp7YiBfuGMjx2wXw+LQ==$WduQWN+mBUF58U2QH2vdLA==\n\nINFO: Recipe file \"recipe.yml\" updated\nINFO: Task completed successfully\n```\n\nThe recipe file is updated with the newly encrypted values:\n```\n% cat recipe.yml \ntag: all\ncrypt_updates:\n- resource_name: VIP23-SIG-Credentials\n replacements:\n - from_value: $CRYPT_CLUSTER$ToFuObeWUxN4nDPeds7FYA==$7Pzo514ANxdOCusPP+ZDth43Pp9S57xtjR1ofNjcszoKHhZ+zgAVbxUoN5rC7Pcz\n to_value: $CRYPT_CLUSTER$1JePUtTFGJuRf7PjK7IPIg==$VewhaXqfRvD/OUM7L9GqXg==\n- resource_name: SNMP-Basic_cEdge_v5\n replacements:\n - from_value: $CRYPT_CLUSTER$yGGUchXoTPJxctd+VFSYlw==$rv5ExxoXKv4Jm5lTiVGE/w==\n to_value: $CRYPT_CLUSTER$IqogLSUdq/7X3ydwTgvYwg==$3m0OXrYsYBJ2yFHBAK9acw==\n- resource_name: AddOnFeature_v1\n replacements:\n - from_value: $CRYPT_CLUSTER$BJdUV6XNOPOiwv+51QU73A==$fs+9bcddKYs4uJn0TbpgRA==\n to_value: $CRYPT_CLUSTER$epLo7ASRew0KNnHAq04h8A==$bU2mGCvHP3ajiBzTAHzhmw==\n- resource_name: test-cli-template\n replacements:\n - from_value: $CRYPT_CLUSTER$E/HhaXuj1/AzVLJgpbB0CA==$CbBdt/32vEqxpfhB+DShww==\n to_value: $CRYPT_CLUSTER$DwZgpdH/23nINU7Wyg20QA==$ns4BwWhn9J6P9kOhJ+C6VA==\n - from_value: $CRYPT_CLUSTER$sVhKHHjEsFNv4TwqWBgK4g==$cA2R+9ozdQWlgnCwjXWB3A==\n to_value: $CRYPT_CLUSTER$Li8Rp7YiBfuGMjx2wXw+LQ==$WduQWN+mBUF58U2QH2vdLA==\n```\n\nNote that the 'recipe.yml' recipe file can also include name_template and/or name_map statements. This allows configuration items to be renamed or copied from, in addition to the crypt_updates.\n\nProcessing of crypt_updates happen after name_map and name_template. This means that resource_name entries under crypt_update match on the new names, post name_map and name_template processing. \n\nAs an example, this is a new version of 'recipe.yml' that also rename templates in the process:\n```\ntag: all\n\nname_template:\n regex: '^All-'\n name_regex: '{name ^All-(.+)}'\n\nname_map:\n SNMP-Basic_cEdge_v5: SNMP-Basic_cEdge_v6\n\ncrypt_updates:\n- resource_name: VIP23-SIG-Credentials\n replacements:\n - from_value: $CRYPT_CLUSTER$ToFuObeWUxN4nDPeds7FYA==$7Pzo514ANxdOCusPP+ZDth43Pp9S57xtjR1ofNjcszoKHhZ+zgAVbxUoN5rC7Pcz\n to_value: $CRYPT_CLUSTER$1JePUtTFGJuRf7PjK7IPIg==$VewhaXqfRvD/OUM7L9GqXg==\n- resource_name: SNMP-Basic_cEdge_v6\n replacements:\n - from_value: $CRYPT_CLUSTER$yGGUchXoTPJxctd+VFSYlw==$rv5ExxoXKv4Jm5lTiVGE/w==\n to_value: $CRYPT_CLUSTER$IqogLSUdq/7X3ydwTgvYwg==$3m0OXrYsYBJ2yFHBAK9acw==\n- resource_name: AddOnFeature_v1\n replacements:\n - from_value: $CRYPT_CLUSTER$BJdUV6XNOPOiwv+51QU73A==$fs+9bcddKYs4uJn0TbpgRA==\n to_value: $CRYPT_CLUSTER$epLo7ASRew0KNnHAq04h8A==$bU2mGCvHP3ajiBzTAHzhmw==\n- resource_name: test-cli-template\n replacements:\n - from_value: $CRYPT_CLUSTER$E/HhaXuj1/AzVLJgpbB0CA==$CbBdt/32vEqxpfhB+DShww==\n to_value: $CRYPT_CLUSTER$DwZgpdH/23nINU7Wyg20QA==$ns4BwWhn9J6P9kOhJ+C6VA==\n - from_value: $CRYPT_CLUSTER$sVhKHHjEsFNv4TwqWBgK4g==$cA2R+9ozdQWlgnCwjXWB3A==\n to_value: $CRYPT_CLUSTER$Li8Rp7YiBfuGMjx2wXw+LQ==$WduQWN+mBUF58U2QH2vdLA==\n```\n\nNote that crypt_update resource_name SNMP-Basic_cEdge_v6 is matching the new name post name_map update.\n\nWith the new recipe file prepared, the next step is to execute the transform recipe command.\n\nTransform backup using the recipe file:\n```\n% sdwan --verbose transform recipe --from-file recipe.yml --workdir dcloud-clean-mar4 dcloud-clean-mar4-transformed\nINFO: Transform task: Local workdir: \"dcloud-clean-mar4\" -\u003e Local output dir: \"dcloud-clean-mar4-transformed\"\n\u003csnip\u003e\nINFO: Inspecting template_feature items\nINFO: Matched feature template VIP23-SIG-Credentials\nINFO: Replacing feature template: VIP23-SIG-Credentials -\u003e VIP23-SIG-Credentials\nINFO: Matched feature template All-VPN0-TEMPLATE_cEdge\nINFO: Replacing feature template: All-VPN0-TEMPLATE_cEdge -\u003e VPN0-TEMPLATE_cEdge\nINFO: Matched feature template All-Banner-dCloud_cEdge\nINFO: Replacing feature template: All-Banner-dCloud_cEdge -\u003e Banner-dCloud_cEdge\nINFO: Matched feature template All-SNMP-Basic_cEdge\nINFO: Replacing feature template: All-SNMP-Basic_cEdge -\u003e SNMP-Basic_cEdge\nINFO: Matched feature template All-OMP-Basic_cEdge\nINFO: Replacing feature template: All-OMP-Basic_cEdge -\u003e OMP-Basic_cEdge\nINFO: Matched feature template All-System-Template_cEdge\nINFO: Replacing feature template: All-System-Template_cEdge -\u003e System-Template_cEdge\nINFO: Matched feature template All-BFDTemplate_cEdge\nINFO: Replacing feature template: All-BFDTemplate_cEdge -\u003e BFDTemplate_cEdge\nINFO: Matched feature template All-SNMP-Basic\nINFO: Replacing feature template: All-SNMP-Basic -\u003e SNMP-Basic\nINFO: Matched feature template SNMP-Basic_cEdge_v5\nINFO: Replacing feature template: SNMP-Basic_cEdge_v5 -\u003e SNMP-Basic_cEdge_v6\nINFO: Matched feature template AddOnFeature_v1\nINFO: Replacing feature template: AddOnFeature_v1 -\u003e AddOnFeature_v1\nINFO: Inspecting template_device items\nINFO: Matched device template test-cli-template\nINFO: Replacing device template: test-cli-template -\u003e test-cli-template\nINFO: Inspecting feature_profile items\nINFO: Inspecting config_group items\nINFO: Task completed successfully\n```\n\nThe final step is to restore 'dcloud-clean-mar4-transformed' to vManage:\n```\n% sdwan --verbose restore all --workdir dcloud-clean-mar4-transformed --update\nINFO: Restore task: Local workdir: \"dcloud-clean-mar4-transformed\" -\u003e vManage URL: \"https://198.18.133.200:8443\"\n\u003csnip\u003e\nINFO: Pushing items to vManage\nINFO: Done: Update feature template VIP23-SIG-Credentials\nINFO: Done: Create feature template VPN0-TEMPLATE_cEdge\nINFO: Done: Create feature template Banner-dCloud_cEdge\nINFO: Done: Create feature template SNMP-Basic_cEdge\nINFO: Done: Create feature template OMP-Basic_cEdge\nINFO: Done: Create feature template System-Template_cEdge\nINFO: Done: Create feature template BFDTemplate_cEdge\nINFO: Done: Create feature template SNMP-Basic\nINFO: Done: Create feature template SNMP-Basic_cEdge_v6\nINFO: Done: Update feature template AddOnFeature_v1\nINFO: Updating device template test-cli-template requires reattach\nINFO: Template attach: test-cli-template (Site100-cE1)\nINFO: Reattaching templates\nINFO: Waiting...\nINFO: Waiting...\nINFO: Waiting...\nINFO: Completed test-cli-template\nINFO: Completed reattaching templates\nINFO: Done: Update device template test-cli-template\nINFO: Done: Update device template BranchType1Template-cEdge\nINFO: Task completed successfully\n```\n\n## Notes\n\n### Regular Expressions\n\nIt is recommended to always use single quotes when specifying a regular expression to --regex option:\n```\nsdwan --verbose restore all --regex 'VPN1'\n```\n \nThis is to prevent the shell from interpreting special characters that could be part of the pattern provided.\n\nMatching done by --regex is un-anchored. That is, unless anchor marks are provided (e.g. ^ or $), the specified pattern matches if present anywhere in the string. In other words, this is a search function.\n\nThe regular expression syntax supported is described in https://docs.python.org/3/library/re.html\n\n#### Behavior of --regex and --not-regex:\n- --regex is used to select items to include (i.e. perform task operation)\n- --not-regex is used to define items not to include. That is, select all items, except the ones matching --not-regex.\n- When --regex match on multiple fields (e.g. item name, item ID), an item is selected if the item name OR item ID match the regular expression provided.\n- With --not-regex, when it matches on multiple fields (e.g. item name, item ID), all items are selected, except the ones where item name OR item ID match the regular expression.\n\n### Template name manipulation via name-regex\nMultiple Sastre tasks utilize name-regex for name manipulation:\n- Migrate task --name option accepts a name-regex.\n- Transform copy/rename tasks have a `\u003cname-regex\u003e` mandatory parameter. \n- Transform recipe task allow `name_regex` under `name_template` section of the recipe YAML file. \n- The 'list transform' task also take a `\u003cname-regex\u003e` parameter. This task was designed to facilitate testing of those expressions.\n\nA name-regex is a template for creating a new name based on segments of an original name.\n\nThe following rules apply:\n- Occurrences of {name} are replaced with the original item name.\n- Sections of the original item name can be captured by providing a regular expression in the format: {name \u0026lt;regex\u0026gt;}. This regular expression must contain one or more capturing groups, which define segments of the original name to \"copy\". Segments matching each capturing group are concatenated and \"pasted\" to the {name} position.\n- If the regular expression does not match, {name \u0026lt;regex\u0026gt;} is replaced with an empty string.\n\nExample:\n```\nConsider the template name \"G_Branch_184_Single_cE4451-X_2xWAN_DHCP_L2_v01\". \nIn order to get the migrated name as \"G_Branch_201_Single_cE4451-X_2xWAN_DHCP_L2_v01\", one can use --name '{name (G_.+)_184_.+}_201_{name G.+_184_(.+)}'.\n\n% sdwan list transform template_device --regex 'G_Branch_184_Single_cE4451' --workdir sastre_cx_golden_repo '{name (G_.+)_184_.+}_201_{name G.+_184_(.+)}'\n+===================================================================================================================================================================+\n| Name | Transformed | Tag | Type |\n+===================================================================================================================================================================+\n| G_Branch_184_Single_cE4451-X_2xWAN_Static_2xSLAN_Trunk_L2_v01 | G_Branch_201_Single_cE4451-X_2xWAN_Static_2xSLAN_Trunk_L2_v01 | template_device | device template |\n| G_Branch_184_Single_cE4451-X_2xWAN_DHCP_L2_v01 | G_Branch_201_Single_cE4451-X_2xWAN_DHCP_L2_v01 | template_device | device template |\n+---------------------------------------------------------------+---------------------------------------------------------------+-----------------+-----------------+\n```\n\n### Logs\n\nSastre logs messages to the terminal and to log files (under the logs/ directory).\n\nDebug-level and higher severity messages are always saved to the log files.\n\nThe --verbose flag controls the severity of messages printed to the terminal. If --verbose is not specified, only warning-level and higher messages are logged. When --verbose is specified, informational-level and higher messages are printed. \n\n### Restore behavior\n\nBy default, restore will skip items with the same name. If an existing item on vManage has the same name as an item in the backup this item is skipped from restore.\n\nAny references/dependencies on that item are properly updated. For instance, if a feature template is not pushed to vManage because an item with the same name is already present, device templates being pushed will now point to the feature template which is already on vManage.\n\n**Restore with --update:**\n\nAdding the --update option to restore modifies this behavior. In this case, Sastre will update existing items containing the same name as in the backup, but only if their content is different.\n\nWhen an existing vManage item is modified, device templates may need to be reattached or vSmart policies may need to be re-activated. This is handled as follows:\n- Updating items associated with an active vSmart policy may require this policy to be re-activated. In this case, Sastre will request the policy reactivate automatically.\n- On updates to master templates (e.g. device template) containing attached devices, Sastre will re-attach the device templates.\n- On Updates to child templates (e.g. feature template) associated with master templates containing attached devices, Sastre will re-attach the affected master template(s).\n- In all re-attach cases, Sastre will use the existing attachment values on vManage to feed the attach request.\n\nThe implication is that if modified templates define new variables re-attach will fail, because not all variables would have values assigned. In this case, the recommended procedure is to detach the master template (e.g. using detach task), re-run \"restore --update\", then re-attach the device-template from vManage, where one would be able to supply any missing variable values.\n\n**Factory default items:**\n\nIf a factory-default item in the backup is a dependency (referenced by other items) that is missing on the target vManage, it is converted to a non-default item and pushed to vManage. \n\nA WARNING message is displayed when this condition happens. The user may want to review the corresponding templates/policies and update them to reference newer versions or equivalent factory-defaults that may be available on vManage. \n\n## Installing\n\nSastre requires Python 3.9 or newer. This can be verified by pasting the following to a terminal window:\n```\n% python3 -c \"import sys;assert sys.version_info\u003e(3,9)\" \u0026\u0026 echo \"ALL GOOD\"\n```\n\nIf 'ALL GOOD' is printed it means Python requirements are met. If not, download and install the latest 3.x version at Python.org (https://www.python.org/downloads/).\n\nThe recommended way to install Sastre is via pip. For development purposes, Sastre can be installed from the GitHub repository. Both methods are described in this section.\n\n### PIP install in a virtual environment (recommended)\n\nCreate a directory to store the virtual environment and runtime files:\n```\n% mkdir sastre\n% cd sastre\n```\n\nCreate virtual environment:\n```\n% python3 -m venv venv\n```\n \nActivate virtual environment:\n```\n% source venv/bin/activate\n(venv) %\n```\n- Note that the prompt is updated with the virtual environment name (venv), indicating that the virtual environment is active.\n \nUpgrade initial virtual environment packages:\n```\n(venv) % pip install --upgrade pip setuptools\n```\n\nInstall Sastre:\n```\n(venv) % pip install --upgrade cisco-sdwan\n```\n \nVerify that Sastre can run:\n```\n(venv) % sdwan --version\n```\n\nNotes:\n- The virtual environment is deactivated by typing 'deactivate' at the command prompt.\n- Before running Sastre, make sure to activate the virtual environment back again (source venv/bin/activate).\n\n### PIP install\n\nWith this option you will likely need to run the pip commands as sudo.\n\nInstall Sastre:\n```\n% python3 -m pip install --upgrade cisco-sdwan\n```\n \nVerify that Sastre can run:\n```\n% sdwan --version\n```\n\n### GitHub install\n\nClone from the GitHub repository:\n```\n% git clone https://github.com/CiscoDevNet/sastre\n```\n\nMove to the clone directory:\n```\n% cd sastre\n```\n\nCreate virtual environment:\n```\n% python3 -m venv venv\n```\n \nActivate virtual environment:\n```\n% source venv/bin/activate\n(venv) %\n```\n- Note that the prompt is updated with the virtual environment name (venv), indicating that the virtual environment is active.\n\nUpgrade initial virtual environment packages:\n```\n(venv) % pip install --upgrade pip setuptools\n```\n\nInstall required Python packages:\n```\n(venv) % pip install -r requirements.txt\n```\n\nVerify that Sastre can run:\n```\n(venv) % python3 sdwan.py --version\n```\n\n### Docker install\n\nFirst, proceed with the [GitHub install](#GitHub-install) outlined above.\n\nEnsure you are within the directory cloned from GitHub:\n```\n% cd sastre\n```\n\nThen proceed as follows to build the docker container:\n```\n% docker build -t sastre .\nSending build context to Docker daemon 220MB\nStep 1/12 : ARG http_proxy\nStep 2/12 : ARG https_proxy\nStep 3/12 : ARG no_proxy\nStep 4/12 : FROM python:3.9-alpine\n ---\u003e 77a605933afb\n\u003csnip\u003e\n```\n\nCreate host directory to be mounted into the container:\n```\nmkdir sastre-volume\n```\n\nStart the docker container:\n```\ndocker run -it --rm --hostname sastre \\\n --mount type=bind,source=\"$(pwd)\"/sastre-volume,target=/shared-data \\\n sastre:latest\n\nusage: sdwan [-h] [-a \u003cvmanage-ip\u003e] [-u \u003cuser\u003e] [-p \u003cpassword\u003e] [--tenant \u003ctenant\u003e] [--port \u003cport\u003e] [--timeout \u003ctimeout\u003e] [--verbose] [--version] \u003ctask\u003e ...\n\nSastre - Automation Tools for Cisco SD-WAN Powered by Viptela\n\npositional arguments:\n \u003ctask\u003e task to be performed (backup, restore, delete, migrate)\n \u003carguments\u003e task parameters, if any\n\noptional arguments:\n -h, --help show this help message and exit\n -a \u003cvmanage-ip\u003e, --address \u003cvmanage-ip\u003e\n vManage IP address, can also be defined via VMANAGE_IP environment variable. If neither is provided user is prompted for the address.\n -u \u003cuser\u003e, --user \u003cuser\u003e\n username, can also be defined via VMANAGE_USER environment variable. If neither is provided user is prompted for username.\n -p \u003cpassword\u003e, --password \u003cpassword\u003e\n password, can also be defined via VMANAGE_PASSWORD environment variable. If neither is provided user is prompted for password.\n --tenant \u003ctenant\u003e tenant name, when using provider accounts in multi-tenant deployments.\n --port \u003cport\u003e vManage port number, can also be defined via VMANAGE_PORT environment variable (default: 443)\n --timeout \u003ctimeout\u003e REST API timeout (default: 300)\n --verbose increase output verbosity\n --version show program's version number and exit\nsastre:/shared-data#\n\nsastre:/shared-data# sdwan --version\nSastre Version 1.11. Catalog: 63 configuration items, 12 realtime items.\n\nsastre:/shared-data#\n```\n\nNotes:\n- When set, host proxy environment variables (http_proxy, https_proxy and no_proxy) are used during the build and execution of the container.\n- The container has a /shared-data volume.\n- Sastre data/ and logs/ directories are created under /shared-data.\n- A sample dcloud-lab.sh is copied to /shared-data/rc if no /shared-data/rc directory is present.\n- Directory structure:\n - /shared-data/data - Used as the vManage backup data repository\n - /shared-data/logs - Where the logs are saved\n - /shared-data/rc - Used to store 'rc' files defining environment variables used by Sastre: VMANAGE_IP, VMANAGE_USER, etc.\n- The suggested docker run command above bind-mounts the /shared-data volume, i.e. it is mapped to a host system directory. This facilitates transferring of data to/from the container (e.g. vManage backups). The host directory is relative to the location where the docker run command is executed.\n- Docker run will spin-up the container and open an interactive session to it using the ash shell. Sdwan commands (e.g. sdwan backup all, etc.) can be executed at this point. Typing 'exit' will leave the ash shell, stop and remove the container. Everything under data, rc and logs is persisted to the corresponding host system directories.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fciscodevnet%2Fsastre","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fciscodevnet%2Fsastre","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fciscodevnet%2Fsastre/lists"}