Efficient network simulation: vESR Eltex in GNS3

Efficient Network Simulation: Eltex vESR in GNS3 for Engineers

Network equipment virtualization has become an indispensable part of a network engineer's and developer's toolkit, offering flexible and scalable environments for learning, testing, and prototyping. In this article, we will delve into the process of integrating the Eltex vESR virtual service router into the popular GNS3 simulation environment. We'll focus on key installation aspects, potential pitfalls, and the licensing and technical limitations one might encounter. We will also explore how to effectively use vESR for modeling complex network scenarios and validating architectural solutions, which is crucial for mid-level and senior specialists.

Capabilities and Benefits of Network Virtualization

Modern network infrastructures are growing increasingly complex, demanding a deep understanding of various protocols and technologies from specialists. Virtual routers, such as the Eltex vESR, offer a unique opportunity to instantly deploy and scale network topologies without the need for expensive physical hardware. This empowers engineers to:

• Explore new technologies: Rapidly master specific equipment functionalities, such as Eltex cluster solutions, without risking a production environment.
• Model complex scenarios: Validate conceptual solutions for systems requiring specific routing and traffic management functionalities.
• Justify technical solutions: Demonstrate the viability of proposed configurations to colleagues and management, avoiding 'he-said-she-said' debates.
• Develop and test configurations: Prepare and debug configuration files for real hardware in advance, minimizing errors during deployment.
• Use in production environments: In some cases, under specific conditions and licensing requirements, virtual routers can even be deployed in live operations.

To achieve these tasks, a suitable simulation environment is essential. GNS3 (Graphical Network Simulator-3) stands out as one of the most popular solutions due to its flexibility and support for a wide range of virtual devices. Alongside GNS3, platforms like EVE-NG and PNETLab also support vESR, offering engineers choices based on their preferences and functional requirements.

Integrating vESR into GNS3: Pitfalls and Solutions

The process of installing vESR in GNS3, despite its apparent simplicity, can hide non-obvious nuances. Eltex provides detailed documentation for various virtualization environments (VirtualBox, VMware ESXi, QEMU/KVM, Proxmox, GNS3, EVE-NG, PNETLab, Xen) and file formats (.iso, .qcow2, .vdi, .vmdk). However, when working with GNS3, a correct .gns3a template file becomes critically important.

Often, documentation may contain outdated information, such as incorrect checksums or file sizes for the latest vESR version. This can lead to the image being copied but ultimately unusable. Copying from PDF documents can also introduce formatting errors, such as line transpositions or missing commas, which break the JSON structure and render the template inoperable.

For vESR version 1.37.4-build2 in GNS3, the following .gns3a template is recommended. Save its content to a text file with the .gns3a extension and import it into GNS3:

{
"appliance_id": "da593cf4-fdeb-4be4-9c1e-963263f9368f",
"name": "vESR",
"category": "router",
"description": "virtual Eltex service router",
"vendor_name": "Eltex",
"vendor_url": "http://www.eltex-co.ru",
"documentation_url": "https://docs.eltex-co.ru/pages/viewpage.action?pageId=52497571",
"product_name": "vESR",
"product_url": "https://eltex-co.ru/catalog/service_gateways/virtualnyy_servisnyy_marshrutizator_vesr/",
"registry_version": 4,
"status": "stable",
"availability": "free-to-try",
"maintainer": "Eltex",
"maintainer_email": "",
"usage": "Default credentials: admin/password\n\nUntil the standard password is changed, the device will not allow further configuration. To change the password, enter the command 'password <new password>', where the new password is the password that the user chooses and remembers.\n\nAfter changing the password, you need to accept the changes and save them with the command 'commit', and then additionally confirm your decision with the 'confirm' command.",
"port_name_format": "Gi1/0/{port1}",

"qemu": {
"adapter_type": "e1000",
"adapters": 8,
"ram": 3072,
"cpus": 1,
"hda_disk_interface": "ide",
"arch": "x86_64",
"console_type": "telnet",
"kvm": "require",
"options": "-smp 1 -cpu host"
    },
        
"images": [
        {
"filename": "vesr-1.37.4-build2.qcow2",
"version": "1.37.4-build2",
"md5sum": "c1f16d15db275d188fbec3c1e13ebafc",
"filesize": 293928960
        }
    ],
"versions": [
        {
"name": "1.37.4-build2",
"images": {
"hda_disk_image": "vesr-1.37.4-build2.qcow2"
          }
        }
    ]
}

Particular attention should be paid to the parameter "options": "-smp 1 -cpu host" within the qemu section. This parameter proved critically important for stable operation and launching complex topologies, including up to 23 vESR virtual routers with active OSPF, BGP, and BFD protocols on a virtual machine with 16 vCPUs and 64GB RAM. Without it, launching such topologies would have been impossible. Interestingly, for EVE-NG and PNETLab, the manufacturer recommends 4 vCPUs, whereas in GNS3, 1 vCPU is sufficient, suggesting differences in optimization or virtualization. Subjectively, vESR in GNS3 with 1 vCPU feels slightly slower than a hardware ESR-30 but noticeably faster than an ESR-15.

Licensing and Technical Limitations of vESR in Demo Mode

When working with vESR in a virtual environment, it's important to consider several limitations, stemming from both licensing policies (primarily marketing considerations to protect hardware business solutions) and the virtual nature of the device itself. In demo mode, without activating a full license, vESR operates with the following key restrictions:

• IPsec Tunnels: Limited to no more than two active tunnels.
• Throughput: Restricted to 1 Mbps, significantly limiting performance testing capabilities.
• RIB Size (Routing Information Base):

* BGP RIB: No more than 1024 routes.

* OSPF RIB: No more than 1000 routes.

* RIP RIB: No more than 1000 routes.

* ISIS RIB: No more than 1000 routes.

* It's important to note that exceeding the BGP RIB limit may not trigger explicit warnings but will simply result in prefixes beyond the limit not being installed.

• SLA Functionality: Completely disabled, which can be a significant limitation for testing network performance monitoring and fast failover mechanisms.

Beyond these basic limitations, a set of demo licenses tied to the serial number VESR0000000 exists, unlocking additional functionality:

• WIFI-DEMO: Limited to 5 concurrently operating access points, activates SoftGRE tunnels.
• BRAS-DEMO: Limited to 5 subscribers, activates AAA (Authentication, Authorization, Accounting) functions when a RADIUS server is present.
• IPS-DEMO: Provides access to IDS/IPS configuration commands, but with performance limitations (operates on a single CPU core).

The virtual nature of vESR also leaves its mark. By default, all vESR instances share the same system serial number (VESR0000000) and MAC address (A2:00:00:00:00:00). This becomes an issue when working with L2 protocols like LACP or LLDP, which require unique MAC addresses. Unfortunately, changing the serial number to ensure MAC address uniqueness results in the loss of all demo licenses. Thus, an engineer must choose between unique identifiers for L2 protocols and the additional functionality offered by demo licenses. However, core routing functionality remains within licensing limits, even after changing the serial number.

Practical Applications of vESR for Learning and Testing Complex Scenarios

Despite the described limitations, vESR is a powerful tool for in-depth study of network technologies and modeling diverse architectures. Its functionality, stated by the manufacturer as identical to hardware versions (excluding licensing restrictions), makes it ideal for the following tasks:

• Studying Cluster Technologies: The author notes that with vESR version 1.37, they successfully configured and tested Eltex cluster solutions, where node failover took 5-7 seconds, including BGP session re-establishment. This required changing the serial numbers of all nodes to avoid MAC address conflicts.
• Modeling Enterprise Networks: vESR offers sufficiently broad functionality for modeling solutions in enterprise networks, although it does not support advanced technologies like Segment Routing or SRv6. The only significant drawback noted by the author was the absence of an SLA mechanism.
• Overcoming Skepticism: In situations where proposed network solutions face objections like 'I don't believe it' or 'it works on other equipment, but not this one?', a clear demonstration of functionality on a virtual testbed becomes a powerful argument. The ability to quickly deploy a topology and show functionality in action significantly simplifies decision-making and reduces risks.

During the modeling process, nuances may arise, such as the absence of a virtual switch in GNS3 for working with vESR, which necessitates using third-party solutions like Cisco IOL L2. Nevertheless, the completeness and quality of vESR's stated functionality implementation in a virtual environment are pleasantly surprising. Functions configured according to documentation generally work as expected, allowing for its effective use in solving most modeling and testing tasks.

Key Takeaways

• GNS3 – A Powerful Tool: GNS3 effectively simulates complex network topologies using virtual routers like Eltex vESR.
• The .gns3a Template is Critical: Successful integration of vESR into GNS3 requires a correct and up-to-date .gns3a template, accounting for QEMU parameters for stable operation.
• Licensing Limitations: In demo mode, vESR has significant restrictions on throughput, the number of IPsec tunnels, and RIB size, and does not support SLA.
• MAC Addresses and Serial Numbers: By default, vESR instances share identical MAC addresses and serial numbers, requiring their modification for L2 protocols, but this disables demo licenses.
• Practical Value: Despite its limitations, vESR in GNS3 is an excellent tool for learning new technologies, modeling network architectures, and validating configurations before deployment on real hardware.

— Editorial Team