cloudstack/docs/en-US/vnmc-cisco.xml

<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
%BOOK_ENTITIES;
]>
<!-- Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements.  See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership.  The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License.  You may obtain a copy of the License at
    http://www.apache.org/licenses/LICENSE-2.0
    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.
-->
<section id="vnmc-cisco">
  <title>External Guest Firewall Integration for Cisco VNMC (Optional)</title>
  <para>Cisco Virtual Network Management Center (VNMC) provides centralized multi-device and policy
    management for Cisco Network Virtual Services. You can integrate Cisco VNMC with &PRODUCT; to
    leverage the firewall and NAT service offered by ASA 1000v Cloud Firewall. Use it in a Cisco
    Nexus 1000v dvSwitch-enabled cluster in &PRODUCT;. In such a deployment, you will be able to: </para>
  <itemizedlist>
    <listitem>
      <para>Configure Cisco ASA 1000v firewalls. You can configure one per guest network.</para>
    </listitem>
    <listitem>
      <para>Use Cisco ASA 1000v firewalls to create and apply security profiles that contain ACL
        policy sets for both ingress and egress traffic.</para>
    </listitem>
    <listitem>
      <para>Use Cisco ASA 1000v firewalls to create and apply Source NAT, Port Forwarding, and
        Static NAT policy sets.</para>
    </listitem>
  </itemizedlist>
  <para>&PRODUCT; supports Cisco VNMC on Cisco Nexus 1000v dvSwich-enabled VMware
    hypervisors.</para>
  <section id="deploy-vnmc">
    <title>Using Cisco ASA 1000v Firewall, Cisco Nexus 1000v dvSwitch, and Cisco VNMC in a
      Deployment</title>
    <section id="notes-vnmc">
      <title>Guidelines</title>
      <itemizedlist>
        <listitem>
          <para>Cisco ASA 1000v firewall is supported only in Isolated Guest Networks.</para>
        </listitem>
        <listitem>
          <para>Cisco ASA 1000v firewall is not supported on VPC.</para>
        </listitem>
        <listitem>
          <para>Cisco ASA 1000v firewall is not supported for load balancing.</para>
        </listitem>
        <listitem>
          <para>When a guest network is created with Cisco VNMC firewall provider, an additional
            public IP is acquired along with the Source NAT IP. The Source NAT IP is used for the
            rules, whereas the additional IP is used to for the ASA outside interface. Ensure that
            this additional public IP is not released. You can identify this IP as soon as the
            network is in implemented state and before acquiring any further public IPs. The
            additional IP is the one that is not marked as Source NAT. You can find the IP used for
            the ASA outside interface by looking at the Cisco VNMC used in your guest
            network.</para>
        </listitem>
        <listitem>
          <para>Use the public IP address range from a single subnet. You cannot add IP addresses
            from different subnets.</para>
        </listitem>
        <listitem>
          <para>Only one ASA instance per VLAN is allowed because multiple VLANS cannot be trunked
            to ASA ports. Therefore, you can use only one ASA instance in a guest network.</para>
        </listitem>
        <listitem>
          <para>Only one Cisco VNMC per zone is allowed.</para>
        </listitem>
        <listitem>
          <para>Supported only in Inline mode deployment with load balancer.</para>
        </listitem>
        <listitem>
          <para>The ASA firewall rule is applicable to all the public IPs in the guest network.
            Unlike the firewall rules created on virtual router, a rule created on the ASA device is
            not tied to a specific public IP.</para>
        </listitem>
        <listitem>
          <para>Use a version of Cisco Nexus 1000v dvSwitch that support the vservice command. For
            example: nexus-1000v.4.2.1.SV1.5.2b.bin</para>
          <para>Cisco VNMC requires the vservice command to be available on the Nexus switch to
            create a guest network in &PRODUCT;. </para>
        </listitem>
      </itemizedlist>
    </section>
    <section id="prereq-asa">
      <title>Prerequisites</title>
      <orderedlist>
        <listitem>
          <para>Configure Cisco Nexus 1000v dvSwitch in a vCenter environment.</para>
          <para>Create Port profiles for both internal and external network interfaces on Cisco
            Nexus 1000v dvSwitch. Note down the inside port profile, which needs to be provided
            while adding the ASA appliance to &PRODUCT;.</para>
          <para>For information on configuration, see <xref
              linkend="vmware-vsphere-cluster-config-nexus-vswitch"/>.</para>
        </listitem>
        <listitem>
          <para>Deploy and configure Cisco VNMC.</para>
          <para>For more information, see <ulink
              url="http://www.cisco.com/en/US/docs/switches/datacenter/vsg/sw/4_2_1_VSG_2_1_1/install_upgrade/guide/b_Cisco_VSG_for_VMware_vSphere_Rel_4_2_1_VSG_2_1_1_and_Cisco_VNMC_Rel_2_1_Installation_and_Upgrade_Guide_chapter_011.html"
              >Installing Cisco Virtual Network Management Center</ulink> and <ulink
              url="http://www.cisco.com/en/US/docs/unified_computing/vnmc/sw/1.2/VNMC_GUI_Configuration/b_VNMC_GUI_Configuration_Guide_1_2_chapter_010.html"
              >Configuring Cisco Virtual Network Management Center</ulink>.</para>
        </listitem>
        <listitem>
          <para>Register Cisco Nexus 1000v dvSwitch with Cisco VNMC.</para>
          <para>For more information, see <ulink
              url="http://www.cisco.com/en/US/docs/switches/datacenter/vsg/sw/4_2_1_VSG_1_2/vnmc_and_vsg_qi/guide/vnmc_vsg_install_5register.html#wp1064301"
              >Registering a Cisco Nexus 1000V with Cisco VNMC</ulink>.</para>
        </listitem>
        <listitem>
          <para>Create Inside and Outside port profiles in Cisco Nexus 1000v dvSwitch.</para>
          <para>For more information, see <xref
              linkend="vmware-vsphere-cluster-config-nexus-vswitch"/>.</para>
        </listitem>
        <listitem>
          <para>Deploy and Cisco ASA 1000v appliance.</para>
          <para>For more information, see <ulink
              url="http://www.cisco.com/en/US/docs/security/asa/quick_start/asa1000V/setup_vnmc.html"
              >Setting Up the ASA 1000V Using VNMC</ulink>.</para>
          <para>Typically, you create a pool of ASA 1000v appliances and register them with
            &PRODUCT;.</para>
          <para>Specify the following while setting up a Cisco ASA 1000v instance:</para>
          <itemizedlist>
            <listitem>
              <para>VNMC host IP. </para>
            </listitem>
            <listitem>
              <para>Ensure that you add ASA appliance in VNMC mode.</para>
            </listitem>
            <listitem>
              <para>Port profiles for the Management and HA network interfaces. This need to be
                pre-created on Cisco Nexus 1000v dvSwitch.</para>
            </listitem>
            <listitem>
              <para>Internal and external port profiles.</para>
            </listitem>
            <listitem>
              <para>The Management IP for Cisco ASA 1000v appliance. Specify the gateway such that
                the VNMC IP is reachable.</para>
            </listitem>
            <listitem>
              <para>Administrator credentials</para>
            </listitem>
            <listitem>
              <para>VNMC credentials</para>
            </listitem>
          </itemizedlist>
        </listitem>
        <listitem>
          <para>Register Cisco ASA 1000v with VNMC.</para>
          <para>After Cisco ASA 1000v instance is powered on, register VNMC from the ASA
            console.</para>
        </listitem>
      </orderedlist>
    </section>
    <section id="how-to-asa">
      <title>Using Cisco ASA 1000v Services</title>
      <orderedlist>
        <listitem>
          <para>Ensure that all the prerequisites are met.</para>
          <para>See <xref linkend="prereq-asa"/>.</para>
        </listitem>
        <listitem>
          <para>Add a VNMC instance.</para>
          <para>See <xref linkend="add-vnmc"/>.</para>
        </listitem>
        <listitem>
          <para>Add a ASA 1000v instance.</para>
          <para>See <xref linkend="add-asa"/>.</para>
        </listitem>
        <listitem>
          <para>Create a Network Offering and use Cisco VNMC as the service provider for desired
            services.</para>
          <para>See <xref linkend="asa-offering"/>.</para>
        </listitem>
        <listitem>
          <para>Create an Isolated Guest Network by using the network offering you just
            created.</para>
        </listitem>
      </orderedlist>
    </section>
  </section>
  <section id="add-vnmc">
    <title>Adding a VNMC Instance</title>
    <orderedlist>
      <listitem>
        <para>Log in to the &PRODUCT; UI as administrator.</para>
      </listitem>
      <listitem>
        <para>In the left navigation bar, click Infrastructure.</para>
      </listitem>
      <listitem>
        <para>In Zones, click View More.</para>
      </listitem>
      <listitem>
        <para>Choose the zone you want to work with.</para>
      </listitem>
      <listitem>
        <para>Click the Physical Network tab.</para>
      </listitem>
      <listitem>
        <para>In the Network Service Providers node of the diagram, click Configure. </para>
        <para>You might have to scroll down to see this.</para>
      </listitem>
      <listitem>
        <para>Click Cisco VNMC.</para>
      </listitem>
      <listitem>
        <para>Click View VNMC Devices.</para>
      </listitem>
      <listitem>
        <para>Click the Add VNMC Device and provide the following:</para>
        <itemizedlist>
          <listitem>
            <para>Host: The IP address of the VNMC instance.</para>
          </listitem>
          <listitem>
            <para>Username: The user name of the account on the VNMC instance that &PRODUCT; should
              use.</para>
          </listitem>
          <listitem>
            <para>Password: The password of the account.</para>
          </listitem>
        </itemizedlist>
      </listitem>
      <listitem>
        <para>Click OK.</para>
      </listitem>
    </orderedlist>
  </section>
  <section id="add-asa">
    <title>Adding an ASA 1000v Instance</title>
    <orderedlist>
      <listitem>
        <para>Log in to the &PRODUCT; UI as administrator.</para>
      </listitem>
      <listitem>
        <para>In the left navigation bar, click Infrastructure.</para>
      </listitem>
      <listitem>
        <para>In Zones, click View More.</para>
      </listitem>
      <listitem>
        <para>Choose the zone you want to work with.</para>
      </listitem>
      <listitem>
        <para>Click the Physical Network tab.</para>
      </listitem>
      <listitem>
        <para>In the Network Service Providers node of the diagram, click Configure. </para>
        <para>You might have to scroll down to see this.</para>
      </listitem>
      <listitem>
        <para>Click Cisco VNMC.</para>
      </listitem>
      <listitem>
        <para>Click View ASA 1000v.</para>
      </listitem>
      <listitem>
        <para>Click the Add CiscoASA1000v Resource and provide the following:</para>
        <itemizedlist>
          <listitem>
            <para><emphasis role="bold">Host</emphasis>: The management IP address of the ASA 1000v
              instance. The IP address is used to connect to ASA 1000V.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Inside Port Profile</emphasis>: The Inside Port Profile
              configured on Cisco Nexus1000v dvSwitch.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Cluster</emphasis>: The VMware cluster to which you are
              adding the ASA 1000v instance.</para>
            <para>Ensure that the cluster is Cisco Nexus 1000v dvSwitch enabled.</para>
          </listitem>
        </itemizedlist>
      </listitem>
      <listitem>
        <para>Click OK.</para>
      </listitem>
    </orderedlist>
  </section>
  <section id="asa-offering">
    <title>Creating a Network Offering Using Cisco ASA 1000v</title>
    <para>To have Cisco ASA 1000v support for a guest network, create a network offering as follows: </para>
    <orderedlist>
      <listitem>
        <para>Log in to the &PRODUCT; UI as a user or admin.</para>
      </listitem>
      <listitem>
        <para>From the Select Offering drop-down, choose Network Offering.</para>
      </listitem>
      <listitem>
        <para>Click Add Network Offering.</para>
      </listitem>
      <listitem>
        <para>In the dialog, make the following choices:</para>
        <itemizedlist>
          <listitem>
            <para><emphasis role="bold">Name</emphasis>: Any desired name for the network
              offering.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Description</emphasis>: A short description of the offering
              that can be displayed to users.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Network Rate</emphasis>: Allowed data transfer rate in MB
              per second.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Traffic Type</emphasis>: The type of network traffic that
              will be carried on the network.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Guest Type</emphasis>: Choose whether the guest network is
              isolated or shared.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Persistent</emphasis>: Indicate whether the guest network is
              persistent or not. The network that you can provision without having to deploy a VM on
              it is termed persistent network. </para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">VPC</emphasis>: This option indicate whether the guest
              network is Virtual Private Cloud-enabled. A Virtual Private Cloud (VPC) is a private,
              isolated part of &PRODUCT;. A VPC can have its own virtual network topology that
              resembles a traditional physical network. For more information on VPCs, see <xref
                linkend="vpc"/>.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Specify VLAN</emphasis>: (Isolated guest networks only)
              Indicate whether a VLAN should be specified when this offering is used.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Supported Services</emphasis>: Use Cisco VNMC as the service
              provider for Firewall, Source NAT, Port Forwarding, and Static NAT to create an
              Isolated guest network offering.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">System Offering</emphasis>: Choose the system service
              offering that you want virtual routers to use in this network.</para>
          </listitem>
          <listitem>
            <para><emphasis role="bold">Conserve mode</emphasis>: Indicate whether to use conserve
              mode. In this mode, network resources are allocated only when the first virtual
              machine starts in the network.</para>
          </listitem>
        </itemizedlist>
      </listitem>
      <listitem>
        <para>Click OK </para>
        <para>The network offering is created.</para>
      </listitem>
    </orderedlist>
  </section>
  <section id="reuse-asa">
    <title>Reusing ASA 1000v Appliance in new Guest Networks</title>
    <para>You can reuse an ASA 1000v appliance in a new guest network after the necessary cleanup.
      Typically, ASA 1000v is cleaned up when the logical edge firewall is cleaned up in VNMC. If
      this cleanup does not happen, you need to reset the appliance to its factory settings for use
      in new guest networks. As part of this, enable SSH on the appliance and store the SSH
      credentials by registering on VNMC.</para>
    <orderedlist>
      <listitem>
        <para>Open a command line on the ASA appliance:</para>
        <orderedlist>
          <listitem>
            <para>Run the following:</para>
            <programlisting>ASA1000V(config)# reload</programlisting>
            <para>You are prompted with the following message:</para>
            <programlisting>System config has been modified. Save? [Y]es/[N]o:"</programlisting>
          </listitem>
          <listitem>
            <para>Enter N.</para>
            <para>You will get the following confirmation message:</para>
            <programlisting>"Proceed with reload? [confirm]"</programlisting>
          </listitem>
          <listitem>
            <para>Restart the appliance.</para>
          </listitem>
        </orderedlist>
      </listitem>
      <listitem>
        <para>Register the ASA 1000v appliance with the VNMC:</para>
        <programlisting>ASA1000V(config)# vnmc policy-agent
ASA1000V(config-vnmc-policy-agent)# registration host vnmc_ip_address
ASA1000V(config-vnmc-policy-agent)# shared-secret key where key is the shared secret for authentication of the ASA 1000V connection to the Cisco VNMC</programlisting>
      </listitem>
    </orderedlist>
  </section>
</section>