Page History

...

• Nexus 1000v appliance is setup and configured in CS (when adding Vmware cluster)
• VNMC appliance is configured and added to CS (separate lifecycle commands will be provided). A single VNMC is sufficient for managing the ASA1000v appliances
• ASA1000v appliances are setup/configured outside of CS and then added to CS (separate lifecycle commands will be provided)

...

• VirtualRouterElement creates the VR for DHCP, userdata and metadata, password server
• CiscoVNMCElement::implement() does the following:
  • Create tenant and policies in VNMC. There will be helper methods in VnmcResource class for all these operations (currently assuming one VNMC appliance per zone).
    • Tenant creation - tenantName format vlan-%vlanid%
    • Edge device profile - name format edsp-%tenantName%. This will have the routing policies. Static routes will be configured for all gateways specified along with public IP ranges associated with the zone.
    • Edge security profile - name format esp-%tenantName%. This will have the NAT, PF and ACL policies.
    • Logical edge firewall - name format efw-%tenantName%
  • Create vservice_node and update in_inside port _ profile for ASA in n1kv VSM for the Vmware cluster. This is again done using VnmcResource class (internally will call VsmCommand)
    • vservice_node (below commands for doing it on CLI)
      vservice node ASA-%vlanid% type asa
      ip address 10.1.1.1
      adjacency l2 vlan %vlanid%
      fail-mode close
    • in_port_profile
      port-profile type vethernet %asa-in-port-profile%
      vmware port-group
      switchport mode access
      switchport access vlan %vlanid%
      no shutdown
      state enabled
  • Associate ASA ASA1000v appliance with logical_ edge _ firewall (in VNMC). IP address of ASA is required for this. This is again done using VnmcResource.

...

Create port profile for guest VM and associate edge _ security _profileprofile created as part of implement() of network element

• guest_port_profile
  port-profile type vethernet Guest-%vlanid%
  vmware port-group
  switchport mode access
  switchport access vlan %vlanid%
  org root/%tenant%
  vservice node ASA-%vlanid% profile %edge_security_profile%
  no shutdown
  state enabled

...

Typically lifecycle of ASA is tied to the associated guest network. But since ASA requires some CLI configuration it is not possible to spin it up as part of guest network creation. One option is to pre-create a pool of ASA appliances. During network creation ASA is assigned from the pool and released when the network is destroyed. The pool will be created using lifecycle APIs

• addCiscoASA1000vResource createCiscoASA1000vResource
  • mgmt. ip of ASA - IP address for connecting to ASA; check ip address format is valid
  • cluster id - CS cluster id (Vmware cluster only) this appliance is tied to; validation - check that cluster id is valid and Vmware cluster
  • inside port profile name - name of Nexus port profile associated with ASA inside interface; no validation
• deleteCiscoASA1000vResource
  • resource id - unique id of ASA; validation - check that id is valid. Deletion would fail if the appliance is associated with a guest network. Association will be removed when the network gets destroyed.
• listCiscoASA1000vResources

...

A new provider needs to be added for Cisco VNMC (similar to SRX). This will provide services for firewall, source nat, port forwarding and static nat. Rest of the services will be provided by VR.
There will be APIs to manage lifecycle of VNMC appliances (add, delete, list). These also needs to be plugged to the UI. Also there will be APIs to manage lifecycle of ASA appliances.

TODO:

Currently ASA is manually setup and configured. Need to see if this can be automatically provisioned?

Links

http://www.cisco.com/en/US/docs/security/asa/quick_start/asa1000V/setup_vnmc.html