32 C
United States of America
Tuesday, July 16, 2024

An Artificially Clever Peer Reviewer Arrives


Nicely good day everybody, it’s been a minute (or many) since my final weblog put up, however I’m excited to say that the main mission I’ve been engaged on for the final 18+ months has come to a conclusion (nicely, for me no less than 😉 ) and I’m wanting ahead to investing extra time in blogs, movies, and getting again on the market.

I’ve a number of matters I’m trying to dive into, however getting back from Cisco Stay in Vegas final week, I figured I’d as nicely leap on the AI hype practice, chugga chugga chugga, and share a little bit of my very own ideas on the subject.

The Ages of Networking
Welcome to The Synthetic Period, the latest AGE of networking.

Let me begin by saying that I’m simply starting to essentially dip my toe into the AI pool. There are numerous different engineers already manner out within the deep finish, and I hope to swim out and be a part of them quickly.

Cisco Stay 2024 in Vegas was simply the compelling occasion I wanted to step down on step one (to maintain up the metaphor), and I included AI in two of my talks throughout the week. There was Learn how to be a Community Engineer in an Synthetic Age within the Cisco U. Theater, an replace to my discuss, “Learn how to be a Community Engineer in a Programmable Age,” that I first delivered at Cisco Stay in 2017. After eight years, it felt a bit of bittersweet to depart the programmable age behind, however thrilling to be coming into a brand new age. Synthetic Intelligence additionally made a last-minute “bonus” look in my breakout “Programmability Expertise for Engineers Who Don’t Need to Code.”

For these talks, I spent a while pondering via how community engineers needs to be desirous about and utilizing AI proper now, and what to presumably anticipate for the long run. I’m not going to undergo all the small print on this weblog put up, however slightly, I need to focus in on one particular use case that I discovered shocking and a bit thrilling: Utilizing AI to look evaluation your work. Buckle in, and let’s test it out.

Mr Packets prevents Carl from making a network configuration error

Bridget takes Hank to Community Engineering Faculty

One of many examples in “Programmability Expertise for Engineers Who Don’t Need to Code” revolves round creating IPSEC VPN configurations for routers based mostly on a configuration template and spreadsheet of information.  I first present the best way to use formulation inside the spreadsheet to create the configurations, and later use Ansible and Jinja2 templates to do the identical factor.

Slides from Cisco Live illustrating Excel and Ansible options for configuration creation.

As I used to be rehearsing the session, I puzzled… Might AI do the identical work?

If I’m trustworthy, I figured it will get shut, however have to be fastened/completed to be executed.  So I crafted this immediate and despatched it to Cisco’s ChatGPT implementation referred to as “BridgeIT”.

Utilizing the information from the under CSV knowledge,


vpn_name,tunnel_interface,side_1_public_ip,source_network,source_mask,side_2_outside,tunnel_destination,destination_network,destination_mask,preshared_key
VPN_101,GigabitEthernet0/1,203.0.113.101,10.98.128.0,0.0.3.255,GigabitEthernet1/1,198.51.100.33,172.28.11.0,0.0.0.255,ZA788I
VPN_102,GigabitEthernet0/1,203.0.113.102,10.98.128.0,0.0.3.255,GigabitEthernet1/1,198.51.100.34,172.28.12.0,0.0.0.255,AM285I

generate a configuration from every row based mostly on the under jinja2 template


! VPN {{ vpn_name }}
crypto isakmp coverage 10
 encryption aes
 hash sha256
 authentication pre-share
 group 14 

crypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac

access-list 100 allow ip {{ source_network }} {{ source_mask }} {{ destination_network }} {{ destination_mask }}

crypto isakmp key {{ preshared_key }} handle {{ tunnel_destination }}

crypto map {{ vpn_name }} 10 ipsec-isakmp
 set peer {{ tunnel_destination }} 
 set transform-setvpn_transform 
 match handle 100

interface {{ tunnel_interface }} 
 crypto map {{ vpn_name }}

I despatched it away and waited… and waited… and waited.  However then this reply got here again:

Based mostly on the offered Jinja2 template and the CSV knowledge, listed below are the generated configurations for every VPN:

For VPN_101:

! VPN VPN_101
crypto isakmp coverage 10
    encryption aes
    hash sha256
    authentication pre-share
    group 14

crypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac

access-list 100 allow ip 10.98.128.0 0.0.3.255 172.28.11.0 0.0.0.255

crypto isakmp key ZA788I handle 198.51.100.33

crypto map VPN_101 10 ipsec-isakmp
    set peer 198.51.100.33
    set transform-set vpn_transform
    match handle 100

interface GigabitEthernet0/1
    crypto map VPN_101

For VPN_102:

! VPN VPN_102
crypto isakmp coverage 10
    encryption aes
    hash sha256
    authentication pre-share
    group 14

crypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac

access-list 100 allow ip 10.98.128.0 0.0.3.255 172.28.12.0 0.0.0.255

crypto isakmp key AM285I handle 198.51.100.34

crypto map VPN_102 10 ipsec-isakmp
    set peer 198.51.100.34
    set transform-set vpn_transform
    match handle 100

interface GigabitEthernet0/1
    crypto map VPN_102

I used to be duly impressed. Bridget (as BridgeIT is affectionately referred to as) understood precisely what I wished and was in a position to create the configurations for me completely. Rating one for our artificially clever robotic overlords.

However wait… she wasn’t executed.  The message continued:

Please word that there’s a typo within the Jinja2 template, particularly within the line the place it says:

set transform-setvpn_transform

There needs to be an area earlier than “vpn_transform”. Right here’s the corrected line that ought to seem within the template:

set transform-set vpn_transform

Oh man… I had a typo in my template? Inconceivable!!! I rapidly went and checked my immediate and the supply Jinja2 template that I copied for the immediate—a template I’ve utilized in my Ansible demo on this presentation for 2 years.

Positive sufficient, I had a typo. Whoops… boy, did I really feel embarrassed. And if you happen to return and take a look at the configurations that Bridget offered to my immediate, you’ll see that she really fastened the error and despatched the right configs. Very, very nicely executed. Rating two and three.

However she nonetheless wasn’t executed…

Moreover, you would possibly face a problem when making use of two totally different crypto maps to the identical interface. Normally, a bodily interface solely helps one crypto map. If you must assist a number of VPNs on the identical interface, you’d sometimes use the identical crypto map identify with totally different sequence numbers for every peer.

Right here’s how one can modify the second crypto map to make use of the identical crypto map identify with a special sequence quantity (assuming you need to use the crypto map identify VPN_MAP for each):

For VPN_102 (with a revised crypto map identify and sequence quantity):

! VPN VPN_102
crypto isakmp coverage 10
    encryption aes
    hash sha256
    authentication pre-share
    group 14

crypto ipsec transform-set vpn_transform esp-aes esp-sha256-hmac

access-list 102 allow ip 10.98.128.0 0.0.3.255 172.28.12.0 0.0.0.255

crypto isakmp key AM285I handle 198.51.100.34

crypto map VPN_MAP 20 ipsec-isakmp
    set peer 198.51.100.34
    set transform-set vpn_transform
    match handle 102

interface GigabitEthernet0/1
    crypto map VPN_MAP

Discover that the entry record quantity for VPN_102 has been modified to 102 to keep away from battle with the entry record for VPN_101. The crypto map sequence quantity for VPN_102 has been set to twenty, differentiating it from the sequence quantity 10 used for VPN_101. If you happen to observe this strategy, be sure that all of your VPNs use the identical crypto map identify (VPN_MAP on this case) with totally different sequence numbers.

Okay… this reveals some critical community understanding. Combining a CSV file and a Jinja2 template collectively isn’t that removed from the code help and co-pilot use circumstances which have been in place for awhile—probably not that a lot of a stretch. And discovering a typo in a configuration template that’s most likely current in a whole bunch of public Web documentation, weblog posts, and coaching examples? Additionally probably not that shocking.

However making this ultimate leap associated to community structure and design… this was actually fairly shocking. I didn’t inform Bridget that every of those configurations can be deployed on particular person routers, so she moderately “nervous” that I used to be trying to deploy the configs on the identical system. And if I did that, it WOULD be a problem. Her advised resolution is affordable, although admittedly follows examples which might be additionally nicely documented on the Web.

So what does this imply for us community engineers?

I used to be discussing this instance throughout Cisco Stay with some attendees, and the analogy of a “peer evaluation” was introduced up. This was a use case for AI in community engineering that I hadn’t formalized in my head but, however had been dancing round with different examples.

There’s a very actual threat of engineers utilizing AI-generated configurations “as is” of their community.  This can be a dangerous concept for a similar purpose as copying and pasting code from Stackoverflow or one other untrusted Web supply. Earlier than utilizing configurations generated by Bridget or one other generative AI device, it’s essential to confirm the accuracy.  In any other case, you threat turning into one other sufferer to hallucinations or simply inaccuracies from overconfident AI assistants.

Nevertheless, I believe there may be actual potential in utilizing AI as a peer reviewer for configurations and different artifacts we create. Right here, WE, the community engineers, use our information, abilities, and expertise to construct an answer. Then, we ask AI to have a look and supply some suggestions, much like sending it to a co-worker, accomplice, or Cisco TAC.

This second-set-of-eyes use case is one which I believe engineers ought to take into account making an attempt out for themselves—with a few crucial caveats:

  1. Test along with your firm and group’s AI insurance policies. Most of the publicly accessible AI instruments take any immediate data despatched to them and use it for future coaching and fine-tuning. Community configurations are thought of confidential for a lot of firms as there’s a critical safety threat in sharing them publicly.
  2. I might nonetheless advocate having one other “natural intelligence” evaluation any essential configurations. I’m excited by the potential of AI, and we doubtless will get to a degree the place AI is so correct we are able to depend on it for a lot of use circumstances, however let’s take the sluggish strategy to get there.

Nicely, what are your ideas on this use of AI for community engineering? What different use circumstances are you exploring in your each day work as an engineer? Let me know within the feedback. And keep tuned for extra from me as I proceed to swim into the Synthetic Age!

PS… This weblog put up was written by me, Hank Preston, and never by Bridget or one other AI device 🙂

 

 


Join Cisco U. | Be part of the  Cisco Studying Community as we speak without cost.


 

Observe Cisco Studying & Certifications

X | Threads | Fb | LinkedIn | Instagram | YouTube

Use  #CiscoU and #CiscoCert to hitch the dialog.

 

Cisco Helps Construct AI Workforce With New Expertise Certification

Navigating the Multicloud Journey with Cisco’s New Certifications [Infographic]

 

Share:



Related Articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest Articles