You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 14 Next »

Cisco Virtual Network Management Center (VNMC) provides centralized multidevice and policy management for Cisco network virtual services. 

When combined with the Cisco Nexus 1000V Switch, ASA 1000V Cloud Firewall, or the Cisco Virtual Security Gateway (VSG), it enables:

  • CloudStack integration through XML APIs
  • Support for ASA 1000v edge firewalls to enable:
    • Adding and configuring edge firewalls
    • Creating and applying edge security profiles that contain access control list (ACL) policy sets (ingress and egress), connection timeout, Network Address Translation (NAT) policy sets, TCP intercept, VPN interface policy sets, and more
    • Site-to-site IPsec VPNs

Currently the 1000v series and the VSG are supported on VMWare hypervisors. 
This would be the deployment model with CloudStack:

Use Cases / Flow

  1. Cloud operator adds VNMC as a network element using admin API addCiscoVnmcController, specifying username and password
  2. Cloud operator creates isolated guest network offering with source nat using ASA1000v as the service provider for firewall, source nat, port forwarding. CloudStack system vm is used for DHCP, userdata and metadata, password server
  3. Cloud operator creates VPC network offering with source nat using ASA1000v as the service provider for firewall, source nat, port forwarding, ACL and routing. CloudStack system vm is used for DHCP, userdata and metadata, password server.
  4. Network offerings as above, but using VXLAN as the isolation technology
  5. Network offerings as above, with LB added, and using Cloudstack System VM as LB provider
  6. Network offerings as above, with LB added, and using Netscaler VPX as LB provider

VNMC interaction

The VNMC controller is a VMWare appliance that presents an XML API to control the Cisco virtual appliance porfolio.
The GUI is a Flash-based web application that utilizes the XML API to interact with the controller. By enabling the flash debugger (see http://s.apache.org/v5) we can capture the precise XML commands required by CloudStack.

Design details

CiscoVnmcResource

The resource translates abstract network configuration commands such as SetStaticNatRule into concrete XML api calls to the VNMC controller

CiscoVnmcElementService

The service is a pluggable service that allows the cloud operator to provision the VNMC controller URL and credentials into CloudStack

CiscoVnmcManager

The manager implements the CiscoVnmcElementService. It also pre-creates and manages a pool of ASA1000v appliances. The pool is created with an initial capacity and is expanded as demand grows. As networks are de-provisioned, the appliances are returned to the pool.

CiscoVnmcElement

The network element participates in L2 orchestration by extending NetworkElement. When a network is created, the element needs to

  • create a tenant and tenant vdc in VNMC if not already created
  • create the following policies / objects if not already created inside the tenant VDC
    • Edge Static route policy
    • Edge static route
    • Source NAT pool
    • Edge security profile to deny all incoming traffic
    • Create an edge firewall
    • Associate an unused ASA1000v to the firewall

The Cisco ASA1000v can function as a DHCP server, however it cannot guarantee a specific ip<->mac address mapping. Therefore the CloudStack systemvm will be used for this purpose.

The CiscoVnmcElement also implement the IpDeployer and various service provider interfaces to satisfy the requirements of the network offering.

VXLAN isolation

VXLAN isolation needs to be added as an isolation method, with a specific Guru managing allocation of the VXLAN network identifier (VNI)

VSG interaction

The VSG can be used to provide security group isolation.

Nexus 1000v + VNMC + ASA 1000v deployment model

Prereqs

Nexus 1000v appliance is setup and configured in CS (when adding Vmware cluster)
VNMC appliance is configured and added to CS (separate lifecycle commands will be provided for this)
ASA 1000v appliances are setup/configured outside of CS

Deployment limitation

In current CS there is a 1:1 mapping between Vmware cluster and Nexus 1000v. Now one or more ASAs can use this Nexus 1000v.

Isolated guest network will be associated with a single ASA appliance. Now if this network spans multiple clusters then some book-keeping needs to be done as to which Nexus 1000v VSM should be used for ASA's and guest VMs for doing required configuration. To simplify things I am currently making the assumption that there will be a single Vmware cluster in the zone where ASA support is required. This can be changed later on. Moreover the scenario where a guest network spans multiple clusters (with n1kv) is not a supported scenario currently.

Also the network can have guest VMs on the Vmware cluster only as n1kv is not available on other HVs.

ASA setup and configuration

Spin up an ASA instance in standalone mode (do we need to support HA mode?)

Following configuration needs to be provided:

  • ESX host
  • Port profiles for mgmt. and ha n/w interfaces (some port profiles created on n1kv switch, can be same or different)
  • Specify some dummy port profiles for inside/outside n/w interfaces (dummy as these will be replaced with appropriate profiles while implementing guest n/w)
  • Mgmt. IP for ASA (from private IP range of the zone), specify g/w such that VNMC IP is reachable
  • Admin password
  • VNMC IP and other parameters

After the ASA instance is powered on the VNMC needs to be registered from ASA console

  • ASA1000V(config)# vnmc policy-agent
  • ASA1000V(config-vnmc-policy-agent)# registration host vnmc_ip_address
  • ASA1000V(config-vnmc-policy-agent)# shared-secret key where key is the shared secret for authentication of the ASA 1000V connection to the Cisco VNMC

Guest network implement() logic

Guest network gets implemented when first guest VM is deployed

Guest network implementation
  • VirtualRouterElement creates the VR for DHCP, userdata and metadata, password server
  • CiscoVNMCElement::implement() does the following:
    • Create tenant/edge_security_profile/logical_edge_firewall in VNMC. There will be helper methods in VnmcResource class for all these operations (currently assuming one VNMC appliance per zone).
      • Tenant creation - tenantName format vlan-%vlanid%
      • Edge security profile - name format esp-%tenantName%
      • Logical edge firewall -
    • Create vservice_node, in_port_profile, out_port_profile for ASA in VSM for the Vmware cluster. This is done through VsmCommand class
      • vservice_node (below commands for doing it on CLI)
        vservice node ASA-%vlanid% type asa
        ip address 10.1.1.1
        adjacency l2 vlan %vlanid%
        fail-mode close
      • in_port_profile
        port-profile type vethernet %asa-in-port-profile%
        vmware port-group
        switchport mode access
        switchport access vlan %vlanid%
        no shutdown
        state enabled
      • out_port_profile
        same as in_port_profile but with some vlan for public n/w
    • Reconfigure/edit inside port profile for ASA appliance in VSM. The needs to be done from VnmcResource as there is no resource class for Nexus VSM.
    • Associate ASA appliance with logical_edge_firewall (in VNMC). IP address of ASA is required for this. This is again done using VnmcResource
For guest VM the following change is required while creating the port profile in VSM

Create port profile for guest VM and associate edge_security_profile

  • guest_port_profile
    port-profile type vethernet Guest-%vlanid%
    vmware port-group
    switchport mode access
    switchport access vlan %vlanid%
    org root/%tenant%
    vservice node ASA-%vlanid% profile %edge_security_profile%
    no shutdown
    state enabled

API changes

VNMC lifecycle APIs
  • addCiscoVNMCResource (physical n/w id, mgmt. ip, username, password)
  • deleteCiscoVNMCResource (resource UUID)
  • listCiscoVNMCResources
ASA lifecycle 1000v APIs

Typically lifecycle of ASA is tied to the associated guest network. But since ASA requires some CLI configuration it is not possible to spin it up as part of guest network creation. One option is to pre-create a pool of ASA appliances. During network creation ASA is assigned from the pool and released when the network is destroyed. The pool will be created using lifecycle APIs

  • createASA1000vResource (mgmt. IP of ASA, inside port profile, ) (need to check if the deployment of ovf can be automated? if not then these need to be manually deployed and then registered with CS)
  • deleteCiscoASA1000vResource (resource UUID), deletion would fail if the device is associated with a guest network. Association will be removed when the network gets destroyed.
  • listCiscoASA1000vResources

DB changes

A table needs to be created for storing VNMC details.
CREATE TABLE `cloud`.`external_cisco_vnmc_devices` (
`id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
`uuid` varchar(255) UNIQUE,
`physical_network_id` bigint unsigned NOT NULL COMMENT 'id of the physical network in to which cisco vnmc device is added',
`provider_name` varchar(255) NOT NULL COMMENT 'Service Provider name corresponding to this cisco vnmc device',
`device_name` varchar(255) NOT NULL COMMENT 'name of the cisco vnmc device',
`host_id` bigint unsigned NOT NULL COMMENT 'host id coresponding to the external cisco vnmc device',
PRIMARY KEY (`id`),
CONSTRAINT `fk_external_cisco_vnmc_devices__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
CONSTRAINT `fk_external_cisco_vnmc_devices__physical_network_id` FOREIGN KEY (`physical_network_id`) REFERENCES `physical_network`(`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

A table needs to be created for storing ASA 1000v details.
CREATE TABLE `cloud`.`external_cisco_asa1000v_devices` (
`id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
`uuid` varchar(255) UNIQUE,
`management_ip` varchar(255) NOT NULL COMMENT 'mgmt. ip of cisco asa1kv device',
`in_port_profile` varchar(255) NOT NULL COMMENT 'inside port profile name of cisco asa1kv device',
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

A table to store the mapping between guest network and ASA device.
CREATE TABLE `cloud`.`network_asa1000v_map` (
`id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
`network_id` bigint unsigned NOT NULL UNIQUE COMMENT 'id of guest network',
`asa1000v_id` bigint unsigned NOT NULL UNIQUE COMMENT 'id of asa1000v device',
PRIMARY KEY (`id`),
CONSTRAINT `fk_network_asa1000v_map__network_id` FOREIGN KEY (`network_id`) REFERENCES `networks`(`id`) ON DELETE CASCADE,
CONSTRAINT `fk_network_asa1000v_map__asa1000v_id` FOREIGN KEY (`asa1000v_id`) REFERENCES `external_cisco_asa1000v_devices`(`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

TODO:
Currently ASA is manually setup and configured. Need to see if this can be automatically provisioned?

http://www.cisco.com/en/US/docs/security/asa/quick_start/asa1000V/setup_vnmc.html

  • No labels