Page History

...

Since asa1kv works with n1kv and this is available only for Vmware HV, guest networks with asa1kv will only be supported on Vmware only.

VNMC setup (external to CS)

VNMC appliance needs to be setup externally and then registered with CS using admin API.

ASA setup (external to CS)

ASA1000v appliance is needs ot be setup externally and then registered with CS using admin API. Typically admin will create a pool of ASA1000v appliances and register them with CS.

Following inputs to be provided for setting up ASA:

• ESX host
• Standalone/HA mode
• Port profiles for mgmt. and ha n/w interfaces (pre-created on n1kv switch, can be same or different)
• Port profiles for inside/outside n/w interfaces (pre-created on n1kv switch, updated appropriately while implementing guest n/w)
• Mgmt. IP for ASA, specify g/w such that VNMC IP is reachable
• Admin password
• VNMC IP and other parameters

Inside port profile configuration on Nexus1000v

• in_port_profile
  port-profile type vethernet %asa-in-port-profile%
  vmware port-group
  switchport mode access
  no shutdown
  state enabled

Outside port profile configuration on Nexus1000v

• out_port_profile
  port-profile type vethernet %asa-out-port-profile%
  vmware port-group
  switchport mode access
  switchport access vlan %vlanid-of-outside%
  no shutdown
  state enabled

After the ASA instance is powered on the VNMC needs to be registered from ASA console

• ASA1000V(config)# vnmc policy-agent
• ASA1000V(config-vnmc-policy-agent)# registration host vnmc_ip_address
• ASA1000V(config-vnmc-policy-agent)# shared-secret key where key is the shared secret for authentication of the ASA 1000V connection to the Cisco VNMC

ASA limitation

1. ASA inside and outside interfaces cannot act as trunk interfaces to support multiple VLANs. What this mean for CS is that multiple guest networks cannot be trunked to the inside interface. So in order to support VPC, some alternate needs to be thought out for deploying ASA. The same applies to outside interface as well implying that a single public subnet can be used with ASA deployments. See http://goo.gl/rZPFx
2. ASA outside interface ip cannot be used in any NAT rule. This means that source NAT ip allocated to a guest network in CS cannot be used as ASA outside ip.

Guest network implement() logic

...