Jump to content

Nokia Networking/SR Linux Initial Config

From Wikitech

First login

On a new device log in as the "linuxadmin" user first, and the default password NokiaSrl1!. Once done you can disable the ZTP / autoboot process with: 

   ztp service stop --autoboot disable

When that is done reboot the box with "shutdown -r now", after which you can log on with "admin" and the default password.

First thing to do is generate a new self-signed cert and key as follows: 

   tools system tls generate-self-signed email noc@wikimedia.org country us organization wmf


When logged on add the basic config via cli as follows: 

   enter candidate

   set system name host-name <device_name>
   set / system aaa authentication linuxadmin-user password <network_root_password>
   set / system aaa authentication admin-user password <network_root_password>
   
   set / system aaa authentication user homer superuser true
   set / system aaa authentication user homer ssh-key [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESO36OH9RJD/YwgTv0PRQzivYEC4RzfC7m+K5unFtS6" ]
   set / system aaa authentication user homer password <homer_user_password>    

   delete / interface mgmt0 subinterface 0 ipv4 dhcp-client
   delete / interface mgmt0 subinterface 0 ipv6 dhcp-client
   set / interface mgmt0 admin-state enable
   set / interface mgmt0 subinterface 0 admin-state enable
   set / interface mgmt0 subinterface 0 ipv6 admin-state disable
   set / interface mgmt0 subinterface 0 ipv4 admin-state enable
   set / interface mgmt0 subinterface 0 ipv4 address <mgmt_ip>
   
   set / network-instance mgmt type ip-vrf
   set / network-instance mgmt admin-state enable
   set / network-instance mgmt interface mgmt0.0
   set / network-instance mgmt protocols linux import-routes true
   set / network-instance mgmt protocols linux export-routes true
   set / network-instance mgmt protocols linux export-neighbors true
   set / network-instance mgmt static-routes route 0.0.0.0/0 next-hop-group mgmt_gw
   set / network-instance mgmt next-hop-groups group mgmt_gw nexthop 0 ip-address <mgmt_network_gw_ip>
   
   set / system ssh-server mgmt admin-state enable
   set / system ssh-server mgmt network-instance mgmt
   set / system ssh-server mgmt use-credentialz true
   
   set / system dns-instance mgmt network-instance mgmt
   set / system dns-instance mgmt server-list [ 10.3.0.1 ]
   
   set / system ntp admin-state enable
   set / system ntp network-instance mgmt
   set / system ntp server 10.3.0.5
   set / system ntp server 10.3.0.6
   set / system ntp server 10.3.0.7
   
   set / acl acl-filter cpm type ipv4 entry 600 description "Accept packets from HTTP-ALT port for software downloads"
   set / acl acl-filter cpm type ipv4 entry 600 match ipv4 protocol tcp
   set / acl acl-filter cpm type ipv4 entry 600 match transport source-port operator eq
   set / acl acl-filter cpm type ipv4 entry 600 match transport source-port value 8080
   set / acl acl-filter cpm type ipv4 entry 600 action accept
   
   set / system tls profile self-signed key '<tls_private_key_generated_above>'
   set / system tls profile self-signed certificate '<tls_certificate_generated_above>'
   
   set / system json-rpc-server admin-state enable
   set / system json-rpc-server network-instance mgmt https admin-state enable
   set / system json-rpc-server network-instance mgmt https tls-profile self-signed

   commit save

   tools system configuration rescue-save

NOTE: if you need to run Homer from your own laptop you need to add yourself as a user. Copy the lines above for the homer user, but with your own ssh key and the password from /etc/homer/config.yaml.

TLS Certificate

The above config adds a temporary 'server-profile' called self-signed with a TLS private key and certificate.

Once the above config is added, and the device is reachable on the network, run the sre.network.tls cookbook which will push the valid WMF-signed cert to the device and configure it to use that for the JSON-RPC endpoint instead. 

   sudo cookbook sre.network.tls <switch_name>

After which you should be able to push the rest of the config with homer.

Notes

The admin/linuxadmin passwords should be the network-root from pwstore.

ONIE

If a switch defaults to booting into the ONIE environment you can login with "root" and "NokiaSrl1!".

Once you're logged on stop the onie process: 

   onie-stop

Now you need to configure the mgmt IP on the mgmt interface within the ONIE/BusyBox environment. From experience this is 'eth2' 

   ip link show     # you can see which link is 'up'
   ip addr add 10.128.128.36/17 dev eth2
   ip route add default via 10.128.128.1

We should now be able to copy a SR-Linux version to the system with wget: 

    cd /root
    wget http://208.80.154.10:8080/srlinux/srlinux-25.10.3-449.bin

Finally we can install SR-Linux from this image: 

   onie-nos-install srlinux-25.10.3-449.bin

This will reset the system disk/partition layout and install SR-Linux, leaving you with a fresh system with no existing config. Once done you can follow the instructions from the top of this page to set up.

Software Version

Before the device goes into production it should be running the correct software version, which may be different from the factory-shipped image.

If necessary upgrade/downgrade the version as shown on the commands page. This should generally be done as one of the first steps. Please note that the YANG schema can change every year with the first release (for instance in 2026 in the 26.3 release), which may mean existing config doesn't load, or Homer fails to configure it.

Nokia consider the October / "10" release to be the long-term-stable. All other things being equal we should be using the latest version of the last "10" version released.

Homer

Once the device has a valid TLS cert we can run homer to add the rest of the configuration.

RANCID

See instructions on RANCID#Nokia SR-Linux

Retrieved from "https://wikitech.wikimedia.org/w/index.php?title=Nokia_Networking/SR_Linux_Initial_Config&oldid=2454665"