After it works
Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.
By the end you will be able to:
- Send logs to a central syslog server and use them as an audit trail
- Poll a router with SNMP, using 64-bit counters
- Export NetFlow and read flow records with nfdump
- Archive every commit off the router, including host-key handling
- Use commit-confirm to make remote changes safe
- Run idempotent Ansible playbooks against VyOS with a dry run first
Prerequisites: Setting up VyOS with NAT
Every lesson so far ended when the network worked. This one is about everything after that: knowing what the routers are doing, knowing when something changes or breaks, keeping copies of the configuration, changing it safely, and changing many routers the same way.
The lab is one VyOS router, R1 (198.51.100.1), and one ops server (198.51.100.10) on a management network. The ops server plays every supporting role:
| Job | Tool on the ops server | VyOS feature |
|---|---|---|
| Collect logs | rsyslog, UDP 514 | system syslog remote |
| Poll counters | snmpget / snmpwalk | service snmp |
| See traffic flows | nfcapd / nfdump, UDP 2055 | system flow-accounting netflow |
| Keep config history | SSH server (user cfgbackup) | system config-management commit-archive |
| Automate changes | Ansible with the vyos.vyos collection | SSH |
Plus one feature that needs no server at all: commit-confirm, VyOS's safety net for remote changes. Every output comes from the lab, including three places where this VyOS build behaves differently from older guides.
- Logs. R1 sends syslog to the ops server: UDP 514.
- Counters. The ops server polls SNMP counters: UDP 161.
- Flows. R1 exports NetFlow records: UDP 2055.
- Backups. Every commit is copied to the ops server over SCP.
- Automation. Ansible on the ops server connects over SSH to read facts and change configuration.
set system syslog remote 198.51.100.10 facility all level 'info'
set service snmp community ttr-lab-ro authorization 'ro'
set service snmp community ttr-lab-ro client '198.51.100.10'
set service snmp listen-address 198.51.100.1
set service snmp location 'Lab rack 1'
set service snmp contact 'noc@example.net'
set system flow-accounting netflow interface 'eth0'
set system flow-accounting netflow version '9'
set system flow-accounting netflow server 198.51.100.10 port '2055'
set system flow-accounting netflow active-timeout '30'
set system flow-accounting netflow inactive-timeout '15'- Line 1: Send everything at info and above to the ops server.
- Lines 2–3: Read-only SNMP, only for the ops server…
- Line 4: …and only on the management address.
- Lines 5–6: Shown in SNMP: where and who.
- Lines 7–9: NetFlow v9 for eth0 to the collector (this build's syntax).
- Lines 10–11: Report long flows every 30 s; finished ones after 15 s idle.