Upgrading Field Programmable Device (FPD) in CIsco IOS-XR

As per Cisco official site definition of FPD:
An FPD refers to any programmable hardware device on a router, which includes a Field Programmable Gate Array (FPGA) and Read Only Memory Monitor (ROMMON). Cisco IOS® XR routers use a number of FPDs that are crucial for the function of route processors, line cards, shared port adapters (SPAs), SPA Interface Processors (SIPs), and fan trays.


Sample of upgrading fpd in ASR9000 running in IOS-XR. Linecard used is 24x10GE Tomahawk linecard.


A. Check first the linecards installed

RP/0/RSP0/CPU0:ASR9K-BOX#show platform
Fri Mar 27 09:00:23.066 SGP
Node            Type                      State            Config State
-----------------------------------------------------------------------------
0/4/CPU0        A9K-24X10GE-1G-SE         IOS XR RUN       PWR,NSHUT,MON

B. See if need to upgrade , it will indicate Yes if need to upgrade.
Show it using this command "admin show hw-module fpd location all"
It will tell below that one of the FPDs need an upgrade. Type "yes" to reload"

RP/0/RSP0/CPU0:ASR9K-BOX#admin show hw-module fpd location all

===================================== ==========================================
                                      Existing Field Programmable Devices
                                      ==========================================
                                        HW                       Current SW Upg/
Location     Card Type                Version Type Subtype Inst   Version   Dng?
============ ======================== ======= ==== ======= ==== =========== ====

0/4/CPU0     A9K-24X10GE-1G-SE          1.0   lc   cbc     0      47.03     No
                                              lc   rommon  0      18.24     Yes
                                              lc   fpga2   0       1.87     Yes
                                              lc   fsbl    0       1.104    Yes
                                              lc   lnxfw   0       1.104    Yes
                                              lc   fpga3   0       1.00     No
                                              lc   fpga4   0       1.09     Yes
--------------------------------------------------------------------------------
NOTES:
1.  One or more FPD needs an upgrade.  This can be accomplished
    using the "admin> upgrade hw-module fpd <fpd> location <loc>" CLI.
2.  ^ One or more FPD will be intentionally skipped from upgrade using CLI with option "all" or during "Auto fpd".
      It can be upgraded only using the "admin> upgrade hw-module fpd <fpd> location <loc>" CLI with exact location.


C. Upgrade the FPD using the command "admin> upgrade hw-module fpd <fpd> location <loc>"

RP/0/RSP0/CPU0:ASR9K-BOX#admin
RP/0/RSP0/CPU0:ASR9K-BOX(admin)#upgrade hw-module fpd all location 0/4/CPU0

***** UPGRADE WARNING MESSAGE: *****
  *  This upgrade operation has a maximum timout of 90 minutes.  *
  *  If you are executing the cmd for one specific location and  *
  *  card in that location reloads or goes down for some reason  *
  *  you can press CTRL-C to get back the RP's prompt.           *
  *  If you are executing the cmd for _all_ locations and a node *
  *  reloads or is down please allow other nodes to finish the   *
  *  upgrade process before pressing CTRL-C.                     *

% RELOAD REMINDER:
  - The upgrade operation of the target module will not interrupt its normal
    operation. However, for the changes to take effect, the target module
    will need to be manually reloaded after the upgrade operation. This can
    be accomplished with the use of "hw-module <target> reload" command.
  - If automatic reload operation is desired after the upgrade, please use
    the "reload" option at the end of the upgrade command.
  - The output of "show hw-module fpd location" command will not display
    correct version information after the upgrade if the target module is
    not reloaded.
NOTE: Chassis CLI will not be accessible while upgrade is in progress.
Continue ? [no]: yes



FPD upgrade in progress on some hardware, reload/configuration change
on those is not recommended as it might cause HW programming failure
and result in RMA of the hardware.


Starting the upgrade/download of following FPDs:
=========== ==== ======= ======= =========== =========
                                   Current    Upg/Dng
Location    Type Subtype Upg/Dng   Version    Version
=========== ==== ======= ======= =========== =========
0/4/CPU0    lc   rommon  upg        18.24       18.27 
            lc   fpga2   upg         1.87        1.88 
            lc   fsbl    upg         1.104       1.110 
            lc   lnxfw   upg         1.104       1.110 
            lc   fpga4   upg         1.09        1.11 
------------------------------------------------------
 
FPD upgrade in progress. Max timeout remaining 89 min.
FPD upgrade in progress. Max timeout remaining 88 min.
FPD upgrade in progress. Max timeout remaining 87 min.
FPD upgrade in progress. Max timeout remaining 86 min.
FPD upgrade in progress. Max timeout remaining 85 min.
Successfully upgraded    rommon for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from 18.24 to 18.27
Successfully upgraded     fpga2 for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.87 to  1.88
Successfully upgraded      fsbl for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.104 to  1.110
Successfully upgraded     lnxfw for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.104 to  1.110
Successfully upgraded     fpga4 for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.09 to  1.11


FPD upgrade has ended.

D. Reload the linecard that was upgraded using the command "hw-module location <loc> reload". Press y to reload.

RP/0/RSP0/CPU0:ASR9K-BOX(admin)#hw-module location 0/4/CPU0 reload

WARNING: This will take the requested node out of service.
Do you wish to continue?[confirm(y/n)]y
RP/0/RSP0/CPU0:ASR9K-BOX(admin)#

E. Verify again after reload. "No" means no longer need to upgrade , and it was successfully upgraded.

RP/0/RSP0/CPU0:ASR9K-BOX(admin)#show hw-module fpd location all

===================================== ==========================================
                                      Existing Field Programmable Devices
                                      ==========================================
                                        HW                       Current SW Upg/
Location     Card Type                Version Type Subtype Inst   Version   Dng?
============ ======================== ======= ==== ======= ==== =========== ====

0/4/CPU0     A9K-24X10GE-1G-SE          1.0   lc   cbc     0      47.03     No
                                              lc   rommon  0      18.27     No
                                              lc   fpga2   0       1.88     No
                                              lc   fsbl    0       1.110    No
                                              lc   lnxfw   0       1.110    No
                                              lc   fpga3   0       1.00     No
                                              lc   fpga4   0       1.11     No

Configure Management Interface in Juniper

One of the best security practices in networking is separation of management traffic and data/control traffic. One way to achieve this is to use the management ports of Juniper devices to physically connect it preferably to different network.
The management Ethernet interface is usually em0 or fxp0 in Juniper, and provides out-of-band(OOB)management network of the device.
Assuming UTP cables are already connected to both management ports of both routing engine (RE) of the Juniper devices, here are the steps to follow:

1. Configure the following management IP address.
e.g.
re0 = 192.168.1.20
re1 = 192.168.1.21
vip = 192.168.1.22

configure:
#set groups re0 system host-name JUNOS-BOX-re0
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.20/26

#set groups re1 system host-name JUNOS-BOX-re1
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.21/26

It will be something like this when use show command
networkbio@JUNOS-BOX-re0# show groups re0
system {
    host-name JUNOS-BOX-re0;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.20/26;
            }
        }
    }
}



networkbio@JUNOS-BOX-re0# show groups re1
system {
    host-name JUNOS-BOX-re1;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.21/26;
            }
        }
    }
}

2. Configure Routing instance for management.  The name of the dedicated management instance is reserved and hardcoded as mgmt_junos. 

The name of the dedicated management instance is reserved and hardcoded as mgmt_junos

As per Juniper official website:

Once the mgmt_junos routing instance is deployed, management traffic no longer shares a routing table (that is, the default.inet.0 table) with other control or protocol traffic in the system, nor is configuring dynamic protocols on the management interface supported.

#set system management-instance

3. Configure the next-hop (192.168.1.1 is the gateway)

#set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 192.168.1.1

Commands to verify:
show route
show route protocol static
show route forwarding-table

SSH Configuration Examples in Cisco (IOS,IOS-XE,NX-OS,IOS-XR) and Juniper(JunOS)

Here are the configuration examples:
whereas:
192.168.100.100 = Jumphost IP (Allowed IP to SSH into the device)

Juniper

system {
    services {
        ssh {
            root-login deny;
            protocol-version v2;
            connection-limit 5;
            rate-limit 5;


policy-options {
    prefix-list PERMIT-SSH {
       192.168.100.100/32;
         }

firewall {
    family inet {
        filter PROTECT-ENGINE {
    term PERMIT-SSH {
                from {
                    source-prefix-list {
                        ALLOWED-IP;
                    }
                    protocol tcp;
                    port [ ssh ];
                }
                then {
                    count PERMIT-SSH;
                    accept;
                }
            }

            term DENY-SSH {
                from {
                    protocol tcp;
                    destination-port ssh;
                }
                then {
                    count DENY-SSH;
                    discard;
                }
            }


   interfaces {

 lo0 {
        unit 0 {
            family inet {
                filter {
                    input PROTECT-ENGINE;

 Set format:
set system services ssh root-login deny
set system services ssh protocol-version v2
set system services ssh connection-limit 5
set system services ssh rate-limit 5

set policy-options prefix-list  ALLOWED-IP 192.168.100.100/32

set firewall family inet filter PROTECT-ENGINE term PERMIT-SSH from source-prefix-list ALLOWED-IP
set firewall family inet filter PROTECT-ENGINE term PERMIT-SSH from protocol tcp
set firewall family inet filter PROTECT-ENGINE term PERMIT-SSH from port ssh
set firewall family inet filter PROTECT-ENGINE term PERMIT-SSH then count PERMIT-SSH
set firewall family inet filter PROTECT-ENGINE term PERMIT-SSH then accept

set firewall family inet filter PROTECT-ENGINE term DENY-SSH from protocol tcp
set firewall family inet filter PROTECT-ENGINE term DENY-SSH from destination-port ssh
set firewall family inet filter PROTECT-ENGINE term DENY-SSH then count DENY-SSH
set firewall family inet filter PROTECT-ENGINE term DENY-SSH then discard

set interfaces lo0 unit 0 family inet filter input PROTECT-ENGINE

Cisco:

Prerequisites in configuring SSH for Cisco devices include SSH key generation, please refer to Cisco Official Documentation.
command: crypto key generate rsa

Preferably, RSA key bits at least 2048, else use 1024 for better security

IOS:
ip ssh version 2
line vty 0 4
 access-class 101 in
 exec-timeout 5 0
 password 7 01234ABC
 login authentication VTY
 transport input ssh

access-list 101 permit tcp host 192.168.100.100 any eq 22


IOS-XE:
ip ssh version 2
login quiet-mode access-class SSH-ACL
ip access-list extended SSH-ACL
 permit tcp host 192.168.100.100 any eq 22
 deny   tcp any any eq 22

line vty 0 4
 access-class SSH-ACL in
 exec-timeout 5 0
 password 7 01234ABCDEF
 login authentication VTY
 transport input ssh


NEXUS OS:
feature ssh
interface mgmt0
  ip access-group acl_101 in
 vrf member management

ip access-list acl_101
10 permit tcp 192.168.100.100/32 any eq 22
20 deny ip any any log


IOS-XR:
ssh client source-interface Loopback0
ssh server v2
!
line template VTYTEMPLATE
 secret 5 $encrpytedlocalpass
 users group root-system
 users group cisco-support
 accounting exec VTY
 accounting commands VTY
 authorization exec VTY
 authorization commands VTY
 login authentication VTY
 exec-timeout 5 0
 access-class ingress SSH-VTY
 transport input ssh

vty-pool default 0 4 line-template VTYTEMPLATE

or (simpler)
line default
 secret 5 $encrpytedlocalpass
 login authentication default
 timestamp
 exec-timeout 5 0
 access-class ingress SSH-VTY
 session-timeout 5
 transport input ssh
!

!
ipv4 access-list SSH-VTY
 10 permit tcp host 192.168.100.100 any eq ssh
 20 deny ipv4 any any log
!
control-plane
 management-plane
  inband
   interface all
    allow SSH peer
     address ipv4 192.168.100.100
      !

TACACS (AAA) Configuration in Juniper and Cisco(IOS-XR,IOS-XE,IOS,NX-OS)

Configuring Juniper and Cisco to authenticate (also including authorization and accounting) to Tacacs+ server

10.10.10.10 - Tacacs+ AAA server
20.20.20.2 -  Loopback IP

Juniper:

system {
    host-name JUNIPER-ROUTER1;
       }
    authentication-order [ tacplus password ];
    root-authentication {
        encrypted-password "$r00tp44sw0rdh3r3/1"; ## SECRET-DATA
    }
    tacplus-server {
        10.10.10.10 {
            secret "$4ut0g3n3r4t3t4c4c5p455w0rd1"; ## SECRET-DATA
            single-connection;
            source-address 20.20.20.2;
        }
       }
    accounting {
        events interactive-commands;
        destination {
            tacplus {
                server {
                    10.10.10.10 {
                        secret "$4ut0g3n3r4t3t4c4c5p455w0rd2"; ## SECRET-DATA
                        single-connection;
                        source-address 20.20.20.2;
                    }
           }

firewall {
    family inet {
 filter FIREWALL-RE {
            /* TRUSTED TACACS */
            term TACACS-ACL {
                from {
                    source-address {
                        10.10.10.10/32;
                     
                    }
                    protocol tcp;
                    port tacacs;
                }
                then {
                    count TACACS-ACL;
                    accept;
                }
            }     

In set format:

set system host-name JUNIPER-ROUTER1
set system authentication-order tacplus
set system authentication-order password
set system root-authentication encrypted-password "$r00tp44sw0rdh3r3/1"
set system tacplus-server 10.10.10.10 secret "$4ut0g3n3r4t3t4c4c5p455w0rd1"
set system tacplus-server 10.10.10.10 single-connection
set system tacplus-server 10.10.10.10 source-address 20.20.20.2
set system accounting destination tacplus server 10.10.10.10 secret "$4ut0g3n3r4t3t4c4c5p455w0rd2"
set system accounting destination tacplus server 10.10.10.10 single-connection
set system accounting destination tacplus server 10.10.10.10 source-address 20.20.20.2


set firewall family inet filter FIREWALL-RE term TACACS-ACL from source-address 10.10.10.10/32
set firewall family inet filter FIREWALL-RE term TACACS-ACL from source-address 20.20.20.2/32
set firewall family inet filter FIREWALL-RE term TACACS-ACL from protocol tcp
set firewall family inet filter FIREWALL-RE term TACACS-ACL from port tacacs
set firewall family inet filter FIREWALL-RE term TACACS-ACL then count TACACS-ACL
set firewall family inet filter FIREWALL-RE term TACACS-ACL then accept

Cisco:

IOS:

aaa authentication login VTY group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

tacacs-server host 10.10.10.10 single-connection
tacacs-server key 7 1234567890
ip tacacs source-interface Loopback0


IOS-XE:
aaa authentication login VTY group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

tacacs server TACACS-SERVER
 address ipv4 10.10.10.10
 key 7 1234567890

ip tacacs source-interface Loopback0


NEXUS OS
aaa authentication login default group tacacs
aaa authentication login console group tacacs
aaa authorization config-commands default group tacacs local
aaa authorization commands default group tacacs local
aaa accounting default group tacacs

tacacs+ distribute
ip tacacs source-interface mgmt0
tacacs-server host 10.10.10.10 key 7 "tacacs_pass"
aaa group server tacacs+ tacacs
    server 10.10.10.10


IOS-XR
aaa accounting exec VTY start-stop group tacacs+
aaa accounting commands VTY start-stop group tacacs+
aaa authorization exec VTY group tacacs+ none
aaa authorization commands VTY group tacacs+ none
aaa authentication login VTY group tacacs+ line local

tacacs source-interface Loopback0 vrf default
tacacs-server host 10.10.10.10 port 49
 key 7 1234567890123456789

Static Route Configuration Examples in Cisco (IOS-XR) and Juniper for BGP aggregated prefix advertisements

In order to advertise the aggregated routes (and default routes) via BGP, it should exists in the routing table, that's the #1 rule. If these summarized routes (/16) are not existing and only smaller subnets are learned via the IGP(e.g. OSPF,IS-IS), then configure static route and next hop e.g. Null0.

Juniper:

routing-options {
    graceful-restart;
    rib inet6.0 {
       static {
          route fd41:c8be:2153:f400::/64 discard;
          route ::0/0 {
                discard;
                no-install;
    static {
        route 172.16.0.0/16 discard;
        route 0.0.0.0/0 {
            discard;
            no-install;

In display set format:
set routing-options graceful-restart
set routing-options rib inet6.0 static route fd41:c8be:2153:f400::/64 discard
set routing-options rib inet6.0 static route ::0/0 discard
set routing-options rib inet6.0 static route ::0/0 no-install

set routing-options static route 172.16.0.0/16 discard
set routing-options static route 0.0.0.0/0 discard
set routing-options static route 0.0.0.0/0 no-install

Cisco:

router static
 address-family ipv4 unicast
  0.0.0.0/0 Null0
  172.16.0.0/16 Null0
 !
 address-family ipv6 unicast
  ::/0 Null0
  fd41:c8be:2153:f400::/64 Null0


In formal:
router static address-family ipv4 unicast 172.16.0.0/16 Null0
router static address-family ipv4 unicast 0.0.0.0/0 Null0
router static address-family ipv6 unicast ::/0 Null0
router static address-family ipv6 unicast fd41:c8be:2153:f400::/64 Null0

Originating BGP advertisements and BGP community tagging (Juniper and Cisco(IOS-XR) configuration)

Originating BGP advertisement can be configured to any iBGP peer router. Here's the sample configuration of originating BGP routes and community tagging in Cisco and Juniper.

Assuming these are the summarized prefixes that you want to advertise via BGP.
111.111.0.0/16
222.222.0.0/16

Juniper:

 routing-options {
 graceful-restart;
  router-id 1.1.1.1;
    autonomous-system 11111;

protocols {
 bgp {
        group RR-IBGP {
            type internal;
            description RR-IPv4;
            local-address 192.168.100.6;
            family inet {
                unicast;
            }
            authentication-key "$1$N3tBioBwfdFsFVwgoGDh.3C0oL"; ## SECRET-DATA
            export bgp-statement;
            neighbor 192.168.100.5 {
                description iBGP to Route Reflector;
            }

policy-statement bgp-statement {
     term SITE1 {
            from {
                route-filter 111.111.0.0/16 exact;
                route-filter 222.222.0.0/16 exact;
   }
            then {
                community add SITE1;
              accept;
            }


 community SITE1 members 12345:111;


In display set:
set routing-options graceful-restart


set routing-options router-id 1.1.1.1
set routing-options autonomous-system 11111

set protocols bgp group RR-IBGP type internal
set protocols bgp group RR-IBGP description RR-IPv4
set protocols bgp group RR-IBGP local-address 192.168.100.6
set protocols bgp group RR-IBGP family inet unicast
set protocols bgp group RR-IBGP authentication-key "$1$N3tBioBwfdFsFVwgoGDh.3C0oL"
set protocols bgp group RR-IBGP export bgp-statement
set protocols bgp group RR-IBGP neighbor 192.168.100.5 description iBGP to Route Reflector

set policy-options policy-statement bgp-statement term SB from route-filter 111.111.0.0/16 exact
set policy-options policy-statement bgp-statement term SB from route-filter 222.222.0.0/16  exact
set policy-options policy-statement bgp-statement term SITE1 then community add SB
set policy-options policy-statement bgp-statement term SITE1 then accept

set policy-options community SITE1 members 12345:111

Cisco:

 prefix-set SITE1
 111.111.0.0/16,
 222.222.0.0/16
end-set

route-policy bgp-statement
 if destination in SITE1 then
  set community (12345:111)
  endif
end-policy



router bgp 11111
 nsr
 bgp router-id 1.1.1.1
 bgp graceful-restart
  address-family ipv4 unicast
  network 111.111.0.0/16
  network 222.222.0.0/16

 neighbor-group RR-IBG
  remote-as 11111
  password encrypted 2185073C7B74154C
  description RR IBGP GROUP IPV4
  update-source Loopback0
  address-family ipv4 unicast
   soft-reconfiguration inbound
 !
 neighbor 192.168.100.5
  use neighbor-group RR-IBG
  description RR-IPv4
  address-family ipv4 unicast
   route-policy iBGP-policy-in in
   route-policy bgp-statement out


In Formal:

prefix-set SITE1
 111.111.0.0/16,
 222.222.0.0/16,
end-set

route-policy bgp-statement
 if destination in SITE1 then
  set community (12345:111)
  endif
end-policy


router bgp 11111 nsr
router bgp 11111 bgp router-id 1.1.1.1
router bgp 11111 bgp graceful-restart
router bgp 11111 address-family ipv4 unicast
router bgp 11111 address-family ipv4 unicast network 111.111.0.0/16
router bgp 11111 address-family ipv4 unicast network 222.222.0.0/16
router bgp 11111 neighbor-group RR-IBG
router bgp 11111 neighbor-group RR-IBG remote-as 11111
router bgp 11111 neighbor-group RR-IBG password encrypted 2185073C7B74154C
router bgp 11111 neighbor-group RR-IBG description RR IBGP GROUP IPV4
router bgp 11111 neighbor-group RR-IBG update-source Loopback0
router bgp 11111 neighbor-group RR-IBG address-family ipv4 unicast
router bgp 11111 neighbor-group RR-IBG address-family ipv4 unicast soft-reconfiguration inbound
router bgp 11111 neighbor 192.168.100.5
router bgp 11111 neighbor 192.168.100.5 use neighbor-group RR-IBG
router bgp 11111 neighbor 192.168.100.5 description RR-IPv4
router bgp 11111 neighbor 192.168.100.5 address-family ipv4 unicast
router bgp 11111 neighbor 192.168.100.5 address-family ipv4 unicast route-policy iBGP-policy-in in
router bgp 11111 neighbor 192.168.100.5 address-family ipv4 unicast route-policy bgp-statement out

FIxing IOU Keygen Error (Running IOS on Linux in Eve-NG)

If you keep getting this error when generating key as license for  running IOL or IOS On Linux, (also called IOU or IOS On Unix) in EVE-NG

darwin@eve-ng:/$ cd /opt/unetlab/addons/iol/bin

darwin@eve-ng:/opt/unetlab/addons/iol/bin$ python keygen.py
*********************************************************************
Cisco IOU License Generator - Kal 2011, python port of 2006 C version
hostid=bada0c0f, hostname=eve-ng, ioukey=bada0e51
Traceback (most recent call last):
  File "./keygen.py", line 18, in <module>
    md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1
struct.error: 'i' format requires -2147483648 <= number <= 2147483647

Step 1:
Solution: Modify the python script, change i to L

From: md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1

To:     md5input=iouPad1 + iouPad2 + struct.pack('!L', ioukey) + iouPad1

Run again:

darwin@eve-ng:/opt/unetlab/addons/iol/bin$ python keygen.py

*********************************************************************

Cisco IOU License Generator - Kal 2011, python port of 2006 C version

hostid=bada0c0f, hostname=eve-ng, ioukey=bada0e51

Step 2: Add the following text to ~/.iourc:

[license]

eve-ng = f2630dfba88daedd;

You can disable the phone home feature with something like:

 echo '127.0.0.127 xml.cisco.com' >> /etc/hosts

Step 2: Input the license key in "iourc" file

vi iourc

[license]

eve-ng = f2630dfba88daedd;

Step 3: Test IOL

darwin@eve-ng:/opt/unetlab/addons/iol/bin$ LD_LIBRARY_PATH=/opt/unetlab/addons/iol/lib /opt/unetlab/addons/iol/bin/i86bi-linux-l3-adventerprisek9-15.4.2T.bin 1

***************************************************************

IOS On Unix - Cisco Systems confidential, internal use only

Under no circumstances is this software to be provided to any

non Cisco staff or customers.  To do so is likely to result

in disciplinary action. Please refer to the IOU Usage policy at

wwwin-iou.cisco.com for more information.

***************************************************************

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

(c) of the Commercial Computer Software - Restricted

Rights clause at FAR sec. 52.227-19 and subparagraph

(c) (1) (ii) of the Rights in Technical Data and Computer

Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.

           170 West Tasman Drive

           San Jose, California 95134-1706

Cisco IOS Software, Linux Software (I86BI_LINUX-ADVENTERPRISEK9-M), Version 15.4(2)T, DEVELOPMENT TEST SOFTWARE

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2014 by Cisco Systems, Inc.

Compiled Thu 27-Mar-14 01:08 by prod_rel_team

This product contains cryptographic features and is subject to United
--omitted lines --