Configuring a controller team using curl
This section describes configuring a controller team using curl commands.
Team authentication is managed with
iptables
. The team communication channel is not
encrypted. If you deploy the team in a highly secure environment, you can always use standard
Linux IPSec functionality to encrypt traffic between the team members.
You will need to setup bi-directional rules on each controller for communication with each of the
other two controllers using the IP addresses specified during the team creation. For simplicity,
you can configure
host
to
host IPsec
and secure all traffic between the controllers. However,
all external communication channels other than teaming are already secured with SSL. If you
only want to secure the team communication channel, the rules should be created to only encrypt
port 5700.
NOTE:
Do not use the team leader IP address in any of the IPsec rules.
For more information on how to configure IPsec for Ubuntu Linux:
https://help.ubuntu.com/community/IPSecHowTo
http://manpages.ubuntu.com/manpages/precise/man5/ipsec.conf.5.html
http://manpages.ubuntu.com/manpages/precise/man5/ipsec.secrets.5.html
Prerequisites
CAUTION:
Credential information (user name, password, domain, and authentication tokens)
used in curl commands might be saved in the command history. For security reasons, Hewlett
Packard Enterprise recommends that you disable command history prior to executing commands
containing credential information.
NOTE:
The default domain and user settings are
sdn
. The default password setting is
skyline
.
1.
Install and start three standalone controllers in the network. (See the latest
HPE VAN SDN
Controller Installation Guide
.)
2.
Optional: To improve security, you can change the username and password from the default
settings on each of the standalone controllers in step 1.
3.
Select any one of the controllers to use for configuring the team.
4.
On the selected controller, acquire an Authentication Token. Use the following curl command,
with the controller IP address, to acquire the token:
curl --noproxy controller_ip> -X POST --fail
-ksSfL --url "https://<controller_ip>:8443/sdn/v2.0/auth"
-H "Content-Type: application/json" --data-binary '{"login":
{"domain": "<domain>","user": "<user>","password": "<password>"}}'
Command Example
In this example, the default domain, user name, and password are used.
curl --noproxy 192.15.135.187 -X POST --fail -ksSfL
--url "https://192.15.135.187:8443/sdn/v2.0/auth"
-H "Content-Type: application/json"
--data-binary '{"login": {"domain": "sdn","user": "sdn","password": "skyline"}}'
Command Response
The command generates the authentication token
1759f214479e4ffd9504acb42123ef40
.
{"record":{"token":"1759f214479e4ffd9504acb42123ef40",
"expiration":1381982391381982399000,"expirationDate":"2014-10-16 20-59-59 -0700",
"userId":"b00cb0e94c9441d58011f980cf9635ae","userName":"sdn","domainId":
"a6701f6593d84fa5b8f23f9ab4ed69db","domainName":"sdn"}}
182
curl commands