%BOOK_ENTITIES; ]>

Cisco Virtual Network Management Center (VNMC) provides centralized multi-device and policy management for Cisco Network Virtual Services. You can integrate Cisco VNMC with &PRODUCT; to leverage the firewall and NAT service offered by ASA 1000v Cloud Firewall. Use it in a Cisco Nexus 1000v dvSwitch-enabled cluster in &PRODUCT;. In such a deployment, you will be able to: Configure Cisco ASA 1000v firewalls. You can configure one per guest network. Use Cisco ASA 1000v firewalls to create and apply security profiles that contain ACL policy sets for both ingress and egress traffic. Use Cisco ASA 1000v firewalls to create and apply Source NAT, Port Forwarding, and Static NAT policy sets. &PRODUCT; supports Cisco VNMC on Cisco Nexus 1000v dvSwich-enabled VMware hypervisors.

Cisco ASA 1000v firewall is supported only in Isolated Guest Networks. Cisco ASA 1000v firewall is not supported on VPC. Cisco ASA 1000v firewall is not supported for load balancing. When a guest network is created with Cisco VNMC firewall provider, an additional public IP is acquired along with the Source NAT IP. The Source NAT IP is used for the rules, whereas the additional IP is used to for the ASA outside interface. Ensure that this additional public IP is not released. You can identify this IP as soon as the network is in implemented state and before acquiring any further public IPs. The additional IP is the one that is not marked as Source NAT. You can find the IP used for the ASA outside interface by looking at the Cisco VNMC used in your guest network. Use the public IP address range from a single subnet. You cannot add IP addresses from different subnets. Only one ASA instance per VLAN is allowed because multiple VLANS cannot be trunked to ASA ports. Therefore, you can use only one ASA instance in a guest network. Only one Cisco VNMC per zone is allowed. Supported only in Inline mode deployment with load balancer. The ASA firewall rule is applicable to all the public IPs in the guest network. Unlike the firewall rules created on virtual router, a rule created on the ASA device is not tied to a specific public IP. Use a version of Cisco Nexus 1000v dvSwitch that support the vservice command. For example: nexus-1000v.4.2.1.SV1.5.2b.bin Cisco VNMC requires the vservice command to be available on the Nexus switch to create a guest network in &PRODUCT;.

Configure Cisco Nexus 1000v dvSwitch in a vCenter environment. Create Port profiles for both internal and external network interfaces on Cisco Nexus 1000v dvSwitch. Note down the inside port profile, which needs to be provided while adding the ASA appliance to &PRODUCT;. For information on configuration, see . Deploy and configure Cisco VNMC. For more information, see Installing Cisco Virtual Network Management Center and Configuring Cisco Virtual Network Management Center. Register Cisco Nexus 1000v dvSwitch with Cisco VNMC. For more information, see Registering a Cisco Nexus 1000V with Cisco VNMC. Create Inside and Outside port profiles in Cisco Nexus 1000v dvSwitch. For more information, see . Deploy and Cisco ASA 1000v appliance. For more information, see Setting Up the ASA 1000V Using VNMC. Typically, you create a pool of ASA 1000v appliances and register them with &PRODUCT;. Specify the following while setting up a Cisco ASA 1000v instance: VNMC host IP. Ensure that you add ASA appliance in VNMC mode. Port profiles for the Management and HA network interfaces. This need to be pre-created on Cisco Nexus 1000v dvSwitch. Internal and external port profiles. The Management IP for Cisco ASA 1000v appliance. Specify the gateway such that the VNMC IP is reachable. Administrator credentials VNMC credentials Register Cisco ASA 1000v with VNMC. After Cisco ASA 1000v instance is powered on, register VNMC from the ASA console.

Ensure that all the prerequisites are met. See . Add a VNMC instance. See . Add a ASA 1000v instance. See . Create a Network Offering and use Cisco VNMC as the service provider for desired services. See . Create an Isolated Guest Network by using the network offering you just created.

Log in to the &PRODUCT; UI as administrator. In the left navigation bar, click Infrastructure. In Zones, click View More. Choose the zone you want to work with. Click the Physical Network tab. In the Network Service Providers node of the diagram, click Configure. You might have to scroll down to see this. Click Cisco VNMC. Click View VNMC Devices. Click the Add VNMC Device and provide the following: Host: The IP address of the VNMC instance. Username: The user name of the account on the VNMC instance that &PRODUCT; should use. Password: The password of the account. Click OK.

Log in to the &PRODUCT; UI as administrator. In the left navigation bar, click Infrastructure. In Zones, click View More. Choose the zone you want to work with. Click the Physical Network tab. In the Network Service Providers node of the diagram, click Configure. You might have to scroll down to see this. Click Cisco VNMC. Click View ASA 1000v. Click the Add CiscoASA1000v Resource and provide the following: Host: The management IP address of the ASA 1000v instance. The IP address is used to connect to ASA 1000V. Inside Port Profile: The Inside Port Profile configured on Cisco Nexus1000v dvSwitch. Cluster: The VMware cluster to which you are adding the ASA 1000v instance. Ensure that the cluster is Cisco Nexus 1000v dvSwitch enabled. Click OK.

To have Cisco ASA 1000v support for a guest network, create a network offering as follows: Log in to the &PRODUCT; UI as a user or admin. From the Select Offering drop-down, choose Network Offering. Click Add Network Offering. In the dialog, make the following choices: Name: Any desired name for the network offering. Description: A short description of the offering that can be displayed to users. Network Rate: Allowed data transfer rate in MB per second. Traffic Type: The type of network traffic that will be carried on the network. Guest Type: Choose whether the guest network is isolated or shared. Persistent: Indicate whether the guest network is persistent or not. The network that you can provision without having to deploy a VM on it is termed persistent network. VPC: This option indicate whether the guest network is Virtual Private Cloud-enabled. A Virtual Private Cloud (VPC) is a private, isolated part of &PRODUCT;. A VPC can have its own virtual network topology that resembles a traditional physical network. For more information on VPCs, see . Specify VLAN: (Isolated guest networks only) Indicate whether a VLAN should be specified when this offering is used. Supported Services: Use Cisco VNMC as the service provider for Firewall, Source NAT, Port Forwarding, and Static NAT to create an Isolated guest network offering. System Offering: Choose the system service offering that you want virtual routers to use in this network. Conserve mode: Indicate whether to use conserve mode. In this mode, network resources are allocated only when the first virtual machine starts in the network. Click OK The network offering is created.

You can reuse an ASA 1000v appliance in a new guest network after the necessary cleanup. Typically, ASA 1000v is cleaned up when the logical edge firewall is cleaned up in VNMC. If this cleanup does not happen, you need to reset the appliance to its factory settings for use in new guest networks. As part of this, enable SSH on the appliance and store the SSH credentials by registering on VNMC. Open a command line on the ASA appliance: Run the following: ASA1000V(config)# reload You are prompted with the following message: System config has been modified. Save? [Y]es/[N]o:" Enter N. You will get the following confirmation message: "Proceed with reload? [confirm]" Restart the appliance. Register the ASA 1000v appliance with the VNMC: ASA1000V(config)# vnmc policy-agent ASA1000V(config-vnmc-policy-agent)# registration host vnmc_ip_address ASA1000V(config-vnmc-policy-agent)# shared-secret key where key is the shared secret for authentication of the ASA 1000V connection to the Cisco VNMC