Introduction

Currently NiciraNVP plugin supports only Isolated networking. In this mode of operations networks are assigned to individual Cloudstack accounts and on NSX side are completely isolated on the L3 level. Many use cases especially in corporate environment call for shared networking mode support. In some circumstances there also may be a need to translate shared NSX network over to a physical VLAN via L2 NSX gateway.

This document describes a feature that will be introduced to support Cloudstack shared networks in two modes of NiciraNVP plugin:

• Shared networks mapped to a physical VLAN with L2 NSX gateway
• Shared networks within the same L3 NSX domain. Multiple L3 NSX domains will be supported.

Purpose

This is the functional specification for feature ‘Support shared networking in NiciraNVP plugin’.

References

JIRA Ticket

https://issues.apache.org/jira/browse/CLOUDSTACK-9074

Pull Request

Targeted for ACS master.
https://github.com/apache/cloudstack/pull/1094

Document History

Feature requirements, Architecture and Design description

1. Shared networking model support
   1. Support native Cloudstack shared network in NiciraNVP plugin.
      
   2. Current code that implements isolated networking mode support will stay intact.
   3. Designate network service offering by configuring VirtualNetworking provider with NiciraNVP.
   4. Static/Source NAT is not used and ignored if defined in the network offering.
   5. Nicira_vvp_router_map table will support non-unique logical routers to implement L3 NSX routing domains where multiple Cloudstack networks are attached to the same logical router.
   6. Shared network with NSX based Virtual networking will go through the following states:
      1. Allocated
         
      2. Implementing
      3. Implemented
      4. Destroy
2. Support NSX L2 gateways for L2 based VLANs mapped to a physical network
   
   1. Optional L2gatewayserviceuuid parameter for NiciraNVP controller
      
   2. VLAN ID of a Shared network represents VLAN to pass through L2 gateway similar to native Cloudstack shared networking
   3. NSX workflow for network allocation
      1. Check if l2gatewayservice defined
         
      2. Create record in networks table
         1. NiciraNvpGuestNetworkGuru as Guru_name
            
         2. Lswitch as broadcast_doamin
         3. Vlan://vlan_id as broadcast_uri
      3. Create record in VLAN table
   4. NSX workflow for network implementation
      
      1. Check if l2gatewayservice defined and valid
         
      2. Create logical switch
      3. Map logical switch to L2gateway service assigning shared network VLAN ID
   5. NSX workflow for NIC management and/or hypervisor support
      
      1. No changes from current implementation
         
3. Support NSX L3 multiple routing domains
   
   1. VLAN ID of a Shared network represents an UUID of a NSX virtual router of a particular routing domain. We will support UUID style notation for VLAN ID. l3gatewayservice option is not used in shared networking
      
   2. It is assumed that if connectivity to the physical networking is required then logical router is configured and connected to the physical network in advance. NiciraNVP plugin will not perform any task beyond basic connectivity to the logical router
   3. Support NSX L3 multiple routing domains
   4. NSX workflow for network allocation
      1. Create record in networks table
         
         1. NiciraNvpGuestNetworkGuru as Guru_name
            
         2. Lswitch as broadcast_domain
         3. NULL as broadcast_uri
      2. Create record in VLAN table
         
      3. Create record in nicira_nvp_router_map table
   5. NSX workflow for network implementation
      
      1. Check if logical router exists on NSX side which UUID matches the one defined during shared network creation. This mode is activated if VLAN ID supplied in UUID style notation
         
      2. Create logical switch
      3. Attach logical switch to the logical router
      4. Assign shared network default gateway to the inside port of the logical router
   6. NSX workflow for NIC management and/or hypervisor support
      
      1. No changes from current implementation
         

Test guidelines

• Create NiciraNVP device with L2gatewayservice parameter
• Create/delete a shared network offering supplying NiciraNVP as a provider of virtual networking
• Create/delete a guest network using shared network offering with Nicira/NVP provider, an API/UI should access VLAN in form of either numerical ID or logical router UUID.
• Implement guest network and observe correct creation of SDN artifacts depending on the requested mode
• Destroy implemented network and proper disposal of SDN objects
• Deploy new instance and verify connectivity

Error handling

• No functional changes in error handling
• Error handling is performed in the same fashion as for Isolated networks
• If logical router can’t be located by UUID supplied, the network implementation will result in exception
• If L2 gateway service is not defined for NSX controller, then no L2 attached networks can be created. Such network creation where VLAN ID represents physical VLAN mapping will result in exception. 

Audit Events

• Events will be generated in the management server logs for any network resource (for e.g. network, VLAN, logical switch, logical switch port) being created during the course of the deployment.

Target users

• CloudStack Users and Admins.

Use case

1. Allow deploying shared networks onto Nicira/NSX SDN platform
2. Allow flexible L3 targeting during network implementation
3. Support NSX L2 gateways for specific shared networks

Limitations

• Existing NiciraNVP plugin limitation will continue

 API Changes

1. Existing API addNiciraNvpDevices will be updated
   1. Adding 1 new optional parameter – l2gatewayserviceuuid
   2. Adding 1 new response tag – l2gatewayserviceuuid
2. Existing API listNiciraNvpDevices will be updated
   1. Adding 1 new response tag – l2gatewayserviceuuid
3. Existing API listNics will be updated
   
   1. Adding 2 new optional response tag – nsxlogicalswitch, nsxlogicalswitchport

DB Changes

1. To support multiple networks in the same NSX routing domain the following DB changes will be required:

drop index logicalrouter_uuid from table nicira_nvp_router_map

Hypervisors supported

• VMware ESXi 5.5 and above.
• KVM 4.1 and above
• XenServer 4.0 and above

UI Flow

• Add a new optional input text L2gatewayservice in ‘Add new NVP controller’ dialog
• ‘VLAN/VNI ID’ in network creation dialog will accept both numerical value as well as UUID style reference

 Upgrade

• Support for shared networking in NiciraNVP plugin will be available with a fresh deployment as well as an upgraded deployment.
• In an upgraded deployment, if there is a need for L2 connectivity services a new record in host_details table will need to be created for a host representing Nicira NVP controller:
  • Name “l2gatewayserviceuuid”
  • Value  “UUID_of_L2_gateway_service”

Open Items/Questions

• NA