Cisco Virtual Network Management Center (VNMC) provides centralized multidevice and policy management for Cisco network virtual services. 

When combined with the Cisco Nexus 1000V Switch, ASA 1000V Cloud Firewall, or the Cisco Virtual Security Gateway (VSG), it enables:

• CloudStack integration through XML APIs
• Support for ASA 1000v edge firewalls to enable:
  • Adding and configuring edge firewalls
  • Creating and applying edge security profiles that contain access control list (ACL) policy sets (ingress and egress), connection timeout, Network Address Translation (NAT) policy sets, TCP intercept, VPN interface policy sets, and more
  • Site-to-site IPsec VPNs

Currently the 1000v series and the VSG are supported on VMWare hypervisors. 
This would be the deployment model with CloudStack:

Use Cases / Flow

For 4.2

1. Cloud operator adds VNMC as a network element using admin API addCiscoVnmcResource, specifying username and password
2. Cloud operator adds ASA1000v appliances (one per guest network) using admin API addCiscoAsa1000vResource.
3. Cloud operator creates isolated guest network offering with source nat using ASA1000v as the service provider for firewall, source nat, port forwarding and static NAT. CloudStack system vm is used for DHCP, userdata and metadata, password server

Beyond 4.2

1. Cloud operator creates VPC network offering with source nat using ASA1000v as the service provider for firewall, source nat, port forwarding, ACL and routing. CloudStack system vm is used for DHCP, userdata and metadata, password server.
2. Network offerings as above, with LB added, and using Cloudstack System VM as LB provider
3. Network offerings as above, with LB added, and using Netscaler VPX as LB provider

VNMC interaction

The VNMC controller is a VMWare appliance that presents an XML API to control the Cisco virtual appliance porfolio.
The GUI is a Flash-based web application that utilizes the XML API to interact with the controller. By enabling the flash debugger (see http://s.apache.org/v5) we can capture the precise XML commands required by CloudStack.

Design details

CiscoVnmcResource

The resource translates abstract network configuration commands such as SetStaticNatRule into concrete XML api calls to the VNMC controller

CiscoVnmcElement

The network element participates in L2 orchestration by extending NetworkElement. When a network is created, the element needs to

• create a tenant and tenant vdc in VNMC if not already created
• create the following policies / objects if not already created inside the tenant VDC
  • Edge static route policy
  • Edge static route
  • Source NAT pool
  • Edge security profile to deny all incoming traffic
  • Create an edge firewall
  • Associate an unused ASA1000v appliance to the edge firewall

The Cisco ASA1000v can function as a DHCP server, however it cannot guarantee a specific ip<->mac address mapping. Therefore the CloudStack systemvm will be used for this purpose.

The CiscoVnmcElement also implement the IpDeployer and various service provider interfaces to satisfy the requirements of the network offering.

Additionally the following are also provided:

• Allows cloud operator to provision the VNMC controller into CloudStack
• Allows cloud operator to register ASA1000v appliances into CloudStack

VSG interaction

The VSG can be used to provide security group isolation.

There is an alternate feature proposal where SG isolation for Vmware will be done using PVLANs. So there is no need for VSG integration based on the current requirements.

Nexus 1000v + VNMC + ASA 1000v deployment model

Prereqs

• Nexus 1000v appliance is setup and configured in CS (when adding Vmware cluster)
• VNMC appliance is configured and added to CS (separate lifecycle commands will be provided)
• ASA1000v appliances are setup/configured outside of CS and then added to CS (separate lifecycle commands will be provided)

Deployment model

In current CS there is a 1:1 mapping between Vmware cluster and n1kv switch. This model will be used by asa1kv appliances as well as they also need n1kv. There can be multiple asa1kv appliances associated with the same Vmware cluster (and corresponding n1kv).

There will be a 1:1 mapping between guest network and asa1kv appliance. This guest network can span multiple Vmware clusters (multiple n1kv switches). (Note: The scenario where a guest network spans multiple Vmware clusters with n1kv is not a tested scenario currently.)

HV limitation

Since asa1kv works with n1kv and this is available only for Vmware HV, guest networks with asa1kv will only be supported on Vmware only.

ASA setup (external to CS)

ASA1000v appliance is setup externally and then registered with CS using admin API

Following inputs to be provided for setting up ASA:

• ESX host
• Standalone/HA mode
• Port profiles for mgmt. and ha n/w interfaces (pre-created on n1kv switch, can be same or different)
• Port profiles for inside/outside n/w interfaces (pre-created on n1kv switch, updated appropriately while implementing guest n/w)
• Mgmt. IP for ASA, specify g/w such that VNMC IP is reachable
• Admin password
• VNMC IP and other parameters

After the ASA instance is powered on the VNMC needs to be registered from ASA console

• ASA1000V(config)# vnmc policy-agent
• ASA1000V(config-vnmc-policy-agent)# registration host vnmc_ip_address
• ASA1000V(config-vnmc-policy-agent)# shared-secret key where key is the shared secret for authentication of the ASA 1000V connection to the Cisco VNMC

Guest network implement() logic

Guest network gets implemented when first guest VM is deployed

Guest network implementation

• VirtualRouterElement creates the VR for DHCP, userdata and metadata, password server
• CiscoVNMCElement::implement() does the following:
  • Create tenant and policies in VNMC. There will be helper methods in VnmcResource class for all these operations (currently assuming one VNMC appliance per zone).
    • Tenant creation - tenantName format vlan-%vlanid%
    • Edge device profile - name format edsp-%tenantName%
    • Edge security profile - name format esp-%tenantName%
    • Logical edge firewall - name format efw-%tenantName%
  • Create vservice_node and update in_port_profile for ASA in VSM for the Vmware cluster. This is again done using VnmcResource class (internally will call VsmCommand)
    • vservice_node (below commands for doing it on CLI)
      vservice node ASA-%vlanid% type asa
      ip address 10.1.1.1
      adjacency l2 vlan %vlanid%
      fail-mode close
    • in_port_profile
      port-profile type vethernet %asa-in-port-profile%
      vmware port-group
      switchport mode access
      switchport access vlan %vlanid%
      no shutdown
      state enabled
  • Associate ASA appliance with logical_edge_firewall (in VNMC). IP address of ASA is required for this. This is again done using VnmcResource.

All the above steps will be idempotent.

For guest VM the following change is required while creating the port profile in VSM

Create port profile for guest VM and associate edge_security_profile

• guest_port_profile
  port-profile type vethernet Guest-%vlanid%
  vmware port-group
  switchport mode access
  switchport access vlan %vlanid%
  org root/%tenant%
  vservice node ASA-%vlanid% profile %edge_security_profile%
  no shutdown
  state enabled

API changes

VNMC lifecycle APIs

• addCiscoVNMCResource
  • physical n/w id - id of the physical n/w to which VNMC is associated with; validation - check that physical network id is valid
  • mgmt. ip - IP address for connecting to VNMC; check ip address format is valid
  • username - Username for connecting to VNMC; no validation
  • password - Password for the above username; no validation
• deleteCiscoVNMCResource
  • resource id - unique id of VNMC; validation - check that resource id is valid. Deletion would fail if there are one or more ASA appliances attached to the physical network to which this VNMC belongs.
• listCiscoVNMCResources

ASA lifecycle 1000v APIs

Typically lifecycle of ASA is tied to the associated guest network. But since ASA requires some CLI configuration it is not possible to spin it up as part of guest network creation. One option is to pre-create a pool of ASA appliances. During network creation ASA is assigned from the pool and released when the network is destroyed. The pool will be created using lifecycle APIs

• createCiscoASA1000vResource
  • mgmt. ip of ASA - IP address for connecting to ASA; check ip address format is valid
  • cluster id - CS cluster id (Vmware cluster only) this appliance is tied to; validation - check that cluster id is valid and Vmware cluster
  • inside port profile name - name of Nexus port profile associated with ASA inside interface; no validation
• deleteCiscoASA1000vResource
  • resource id - unique id of ASA; validation - check that id is valid. Deletion would fail if the appliance is associated with a guest network. Association will be removed when the network gets destroyed.
• listCiscoASA1000vResources

DB changes

• table for storing VNMC details.
  _CREATE TABLE `cloud`.`external_cisco_vnmc_devices` (
  `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
  `uuid` varchar(255) UNIQUE,
  `physical_network_id` bigint unsigned NOT NULL COMMENT 'id of the physical network in to which cisco vnmc device is added',
  `provider_name` varchar(255) NOT NULL COMMENT 'Service Provider name corresponding to this cisco vnmc device',
  `device_name` varchar(255) NOT NULL COMMENT 'name of the cisco vnmc device',
  `host_id` bigint unsigned NOT NULL COMMENT 'host id coresponding to the external cisco vnmc device',
  PRIMARY KEY (`id`),
  CONSTRAINT `fk_external_cisco_vnmc_devices__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_external_cisco_vnmc_devices__physical_network_id` FOREIGN KEY (`physical_network_id`) REFERENCES `physical_network`(`id`) ON DELETE CASCADE
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8;_

• table for storing asa1kv details.
  _CREATE TABLE `cloud`.`external_cisco_asa1000v_devices` (
  `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
  `uuid` varchar(255) UNIQUE,
  `management_ip` varchar(255) NOT NULL COMMENT 'mgmt. ip of cisco asa1kv device',
  `cluster_id` bigint unsigned NOT NULL COMMENT 'id of the Vmware cluster to which cisco asa1kv device is attached (cisco n1kv switch)',
  `in_port_profile` varchar(255) NOT NULL COMMENT 'inside port profile name of cisco asa1kv device',
  PRIMARY KEY (`id`)
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8;_

• table to store mapping between guest network and asa1kv.
  _CREATE TABLE `cloud`.`network_asa1000v_map` (
  `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
  `network_id` bigint unsigned NOT NULL UNIQUE COMMENT 'id of guest network',
  `asa1000v_id` bigint unsigned NOT NULL UNIQUE COMMENT 'id of asa1000v device',
  PRIMARY KEY (`id`),
  CONSTRAINT `fk_network_asa1000v_map__network_id` FOREIGN KEY (`network_id`) REFERENCES `networks`(`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_network_asa1000v_map__asa1000v_id` FOREIGN KEY (`asa1000v_id`) REFERENCES `external_cisco_asa1000v_devices`(`id`) ON DELETE CASCADE
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8;_

An entry need to be created in physical_network_service_providers table. I saw that currently these entries are created from the UI using API addNetworkServiceProvider (for e.g. for JuniperSRX).
A network offering needs to be created for using for using CiscoVNMC to provide firewall, source nat, port forwarding.

UI changes

A new provider needs to be added for Cisco VNMC (similar to SRX). This will provide services for firewall, source nat, port forwarding. Rest of the services will be provided by VR.
There will be APIs to manage lifecycle of VNMC appliances (add, delete, list). These also needs to be plugged to the UI. Also there will be APIs to manage lifecycle of ASA appliances.

TODO:

Currently ASA is manually setup and configured. Need to see if this can be automatically provisioned?

Links

http://www.cisco.com/en/US/docs/security/asa/quick_start/asa1000V/setup_vnmc.html