Page History

...

• VirtualRouterElement creates the VR for DHCP, userdata and metadata, password server
• CiscoVNMCElement::implement() does the following:
  • Create tenant/edge_security_profile/logical_edge_firewall in VNMC. There will be helper methods in VnmcResource class for all these operations (currently assuming one VNMC appliance per zone. do we need to support multiple VNMCs per zone, in that case how to choose?) ).
    • Tenant creation - tenantName format vlan-%vlanid%
    • Edge security profile - name format esp-%tenantName%
    • Logical edge firewall -
  • Create vservice_node, in_port_profile, out_port_profile for ASA in VSM for the Vmware cluster. This is done through VsmCommand class
    • vservice_node (below commands for doing it on CLI)
      vservice node ASA-%vlanid% type asa
      ip address 10.1.1.1
      adjacency l2 vlan %vlanid%
      fail-mode close
    • in_port_profile
      port-profile type vethernet ASA%asa-in-Insideport-%vlanidprofile%
      vmware port-group
      switchport mode access
      switchport access vlan %vlanid%
      no shutdown
      state enabled
    • out_port_profile
      same as in_port_profile but with some vlan for public n/w
  • Reconfigure in/out n/w interfaces /edit inside port profile for ASA appliance with in_port_profile and out_port_profile respectively (need to check what all need to be stored name, cluster, ip address for getting hold of vCenter reference for this VM so that reconfigure can be done)in VSM. The needs to be done from VnmcResource as there is no resource class for Nexus VSM.
  • Associate ASA appliance with logical_edge_firewall (in VNMC). IP address of ASA is required for this. This is again done using VnmcResource

For guest VM the following change is required while creating the port profile in VSM

Create port profile for guest VM and associate logical_edge_firewall, edge_security_profile

• guest_port_profile
  port-profile type vethernet Guest-%vlanid%
  vmware port-group
  switchport mode access
  switchport access vlan %vlanid%
  org root/%tenant%
  vservice node ASA-%vlanid% profile edge%edge_security_profileprofile%
  no shutdown
  state enabled

API changes

VNMC lifecycle APIs

• addCiscoVNMCResource (physical n/w id, mgmt. ip, username, password)
• deleteCiscoVNMCResource (resource UUID)
• listCiscoVNMCResource

Currently in the code there is another set of lifecycle commands - (add/delete/list)NetworkDeviceCommand, can these be reused instead of creating a new set?

...

• listCiscoVNMCResources

ASA lifecycle 1000v APIs

Typically lifecycle of ASA is tied to the associated guest network. But since ASA requires some CLI configuration it is not possible to spin it up as part of guest network creation. One option is to pre-create a pool of ASA appliances. During network creation ASA is assigned from the pool and released when the network is destroyed. The pool will be created using lifecycle APIs

• createASA1000vResource (mgmt. IP of ASA, inside port profile, ) createASA1000vPool (need to check if the deployment of ovf can be automated? if not then these need to be manually deployed and then registered with CS)
• deleteCiscoASA1000vResource (resource UUID), deletion would fail if the device is associated with a guest network. Association will be removed when the network gets destroyed.
• listCiscoASA1000vResources

DB changes

A new table needs to be created for storing VNMC details.
A table needs to be created for storing ASA 1000v details.
A table to store the mapping between guest network and ASA device.

TODO:
Currently ASA is manually setup and configured. Need to see if this can be automatically provisioned?

...