You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by ra...@apache.org on 2013/08/22 06:55:00 UTC
git commit: updated refs/heads/4.2 to 04db0e0
Updated Branches:
refs/heads/4.2 42e4b7440 -> 04db0e0dc
CLOUDSTACK-4416 and CLOUDSTACK-906 cisco vnmc doc reviews
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/04db0e0d
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/04db0e0d
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/04db0e0d
Branch: refs/heads/4.2
Commit: 04db0e0dc91c70f48318880535d39ba826fcb864
Parents: 42e4b74
Author: radhikap <ra...@citrix.com>
Authored: Wed Aug 21 17:36:42 2013 +0530
Committer: Radhika PC <ra...@citrix.com>
Committed: Thu Aug 22 10:17:42 2013 +0530
----------------------------------------------------------------------
docs/en-US/vnmc-cisco.xml | 172 ++++++++++++++++++++++++++---------------
1 file changed, 111 insertions(+), 61 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/04db0e0d/docs/en-US/vnmc-cisco.xml
----------------------------------------------------------------------
diff --git a/docs/en-US/vnmc-cisco.xml b/docs/en-US/vnmc-cisco.xml
index 7c72178..b0785fc 100644
--- a/docs/en-US/vnmc-cisco.xml
+++ b/docs/en-US/vnmc-cisco.xml
@@ -21,62 +21,127 @@
<section id="vnmc-cisco">
<title>External Guest Firewall Integration for Cisco VNMC (Optional)</title>
<para>Cisco Virtual Network Management Center (VNMC) provides centralized multi-device and policy
- management for Cisco Network Virtual Services. When Cisco VNMC is integrated with ASA 1000v
- Cloud Firewall and Cisco Nexus 1000v dvSwitch in &PRODUCT; you will be able to: </para>
+ management for Cisco Network Virtual Services. You can integrate Cisco VNMC with &PRODUCT; to
+ leverage the firewall and NAT service offered by ASA 1000v Cloud Firewall. Use it in a Cisco
+ Nexus 1000v dvSwitch-enabled cluster in &PRODUCT;. In such a deployment, you will be able to: </para>
<itemizedlist>
<listitem>
- <para>Configure Cisco ASA 1000v Firewalls</para>
+ <para>Configure Cisco ASA 1000v firewalls. You can configure one per guest network.</para>
</listitem>
<listitem>
- <para>Create and apply security profiles that contain ACL policy sets for both ingress and
- egress traffic, connection timeout, NAT policy sets, and TCP intercept</para>
+ <para>Use Cisco ASA 1000v firewalls to create and apply security profiles that contain ACL
+ policy sets for both ingress and egress traffic.</para>
+ </listitem>
+ <listitem>
+ <para>Use Cisco ASA 1000v firewalls to create and apply Source NAT, Port Forwarding, and
+ Static NAT policy sets.</para>
</listitem>
</itemizedlist>
<para>&PRODUCT; supports Cisco VNMC on Cisco Nexus 1000v dvSwich-enabled VMware
hypervisors.</para>
- <section id="usecase-vnmc">
- <title>Use Cases</title>
- <itemizedlist>
- <listitem>
- <para>A Cloud administrator adds VNMC as a network element by using the admin API
- addCiscoVnmcResource after specifying the credentials</para>
- </listitem>
- <listitem>
- <para>A Cloud administrator adds ASA 1000v appliances by using the admin API
- addCiscoAsa1000vResource. You can configure one per guest network.</para>
- </listitem>
- <listitem>
- <para>A Cloud administrator creates an Isolated guest network offering by using ASA 1000v as
- the service provider for Firewall, Source NAT, Port Forwarding, and Static NAT. </para>
- </listitem>
- </itemizedlist>
- </section>
<section id="deploy-vnmc">
<title>Using Cisco ASA 1000v Firewall, Cisco Nexus 1000v dvSwitch, and Cisco VNMC in a
Deployment</title>
+ <section id="notes-vnmc">
+ <title>Guidelines</title>
+ <itemizedlist>
+ <listitem>
+ <para>Cisco ASA 1000v firewall is supported only in Isolated Guest Networks.</para>
+ </listitem>
+ <listitem>
+ <para>Cisco ASA 1000v firewall is not supported on VPC.</para>
+ </listitem>
+ <listitem>
+ <para>Cisco ASA 1000v firewall is not supported for load balancing.</para>
+ </listitem>
+ <listitem>
+ <para>When a guest network is created with Cisco VNMC firewall provider, an additional
+ public IP is acquired along with the Source NAT IP. The Source NAT IP is used for the
+ rules, whereas the additional IP is used to for the ASA outside interface. Ensure that
+ this additional public IP is not released. You can identify this IP as soon as the
+ network is in implemented state and before acquiring any further public IPs. The
+ additional IP is the one that is not marked as Source NAT. You can find the IP used for
+ the ASA outside interface by looking at the Cisco VNMC used in your guest
+ network.</para>
+ </listitem>
+ <listitem>
+ <para>Use the public IP address range from a single subnet. You cannot add IP addresses
+ from different subnets.</para>
+ </listitem>
+ <listitem>
+ <para>Only one ASA instance per VLAN is allowed because multiple VLANS cannot be trunked
+ to ASA ports. Therefore, you can use only one ASA instance in a guest network.</para>
+ </listitem>
+ <listitem>
+ <para>Only one Cisco VNMC per zone is allowed.</para>
+ </listitem>
+ <listitem>
+ <para>Supported only in Inline mode deployment with load balancer.</para>
+ </listitem>
+ <listitem>
+ <para>The ASA firewall rule is applicable to all the public IPs in the guest network.
+ Unlike the firewall rules created on virtual router, a rule created on the ASA device is
+ not tied to a specific public IP.</para>
+ </listitem>
+ <listitem>
+ <para>Use a version of Cisco Nexus 1000v dvSwitch that support the vservice command. For
+ example: nexus-1000v.4.2.1.SV1.5.2b.bin</para>
+ <para>Cisco VNMC requires the vservice command to be available on the Nexus switch to
+ create a guest network in &PRODUCT;. </para>
+ </listitem>
+ </itemizedlist>
+ </section>
<section id="prereq-asa">
<title>Prerequisites</title>
- <itemizedlist>
+ <orderedlist>
+ <listitem>
+ <para>Configure Cisco Nexus 1000v dvSwitch in a vCenter environment.</para>
+ <para>Create Port profiles for both internal and external network interfaces on Cisco
+ Nexus 1000v dvSwitch. Note down the inside port profile, which needs to be provided
+ while adding the ASA appliance to &PRODUCT;.</para>
+ <para>For information on configuration, see <xref
+ linkend="vmware-vsphere-cluster-config-nexus-vswitch"/>.</para>
+ </listitem>
+ <listitem>
+ <para>Deploy and configure Cisco VNMC.</para>
+ <para>For more information, see <ulink
+ url="http://www.cisco.com/en/US/docs/switches/datacenter/vsg/sw/4_2_1_VSG_2_1_1/install_upgrade/guide/b_Cisco_VSG_for_VMware_vSphere_Rel_4_2_1_VSG_2_1_1_and_Cisco_VNMC_Rel_2_1_Installation_and_Upgrade_Guide_chapter_011.html"
+ >Installing Cisco Virtual Network Management Center</ulink> and <ulink
+ url="http://www.cisco.com/en/US/docs/unified_computing/vnmc/sw/1.2/VNMC_GUI_Configuration/b_VNMC_GUI_Configuration_Guide_1_2_chapter_010.html"
+ >Configuring Cisco Virtual Network Management Center</ulink>.</para>
+ </listitem>
+ <listitem>
+ <para>Register Cisco Nexus 1000v dvSwitch with Cisco VNMC.</para>
+ <para>For more information, see <ulink
+ url="http://www.cisco.com/en/US/docs/switches/datacenter/vsg/sw/4_2_1_VSG_1_2/vnmc_and_vsg_qi/guide/vnmc_vsg_install_5register.html#wp1064301"
+ >Registering a Cisco Nexus 1000V with Cisco VNMC</ulink>.</para>
+ </listitem>
<listitem>
- <para>Ensure that Cisco ASA 1000v appliance is set up externally and then registered with
- &PRODUCT; by using the admin API. Typically, you can create a pool of ASA 1000v
- appliances and register them with &PRODUCT;.</para>
- <para>Specify the following to set up a Cisco ASA 1000v instance:</para>
+ <para>Create Inside and Outside port profiles in Cisco Nexus 1000v dvSwitch.</para>
+ <para>For more information, see <xref
+ linkend="vmware-vsphere-cluster-config-nexus-vswitch"/>.</para>
+ </listitem>
+ <listitem>
+ <para>Deploy and Cisco ASA 1000v appliance.</para>
+ <para>For more information, see <ulink
+ url="http://www.cisco.com/en/US/docs/security/asa/quick_start/asa1000V/setup_vnmc.html"
+ >Setting Up the ASA 1000V Using VNMC</ulink>.</para>
+ <para>Typically, you create a pool of ASA 1000v appliances and register them with
+ &PRODUCT;.</para>
+ <para>Specify the following while setting up a Cisco ASA 1000v instance:</para>
<itemizedlist>
<listitem>
- <para>ESX host IP</para>
+ <para>VNMC host IP. </para>
</listitem>
<listitem>
- <para>Standalone or HA mode</para>
+ <para>Ensure that you add ASA appliance in VNMC mode.</para>
</listitem>
<listitem>
<para>Port profiles for the Management and HA network interfaces. This need to be
- pre-created on Nexus dvSwitch switch.</para>
+ pre-created on Cisco Nexus 1000v dvSwitch.</para>
</listitem>
<listitem>
- <para>Port profiles for both internal and external network interfaces. This need to be
- pre-created on Nexus dvSwitch switch, and to be updated appropriately while
- implementing guest networks.</para>
+ <para>Internal and external port profiles.</para>
</listitem>
<listitem>
<para>The Management IP for Cisco ASA 1000v appliance. Specify the gateway such that
@@ -89,29 +154,13 @@
<para>VNMC credentials</para>
</listitem>
</itemizedlist>
- <para>After Cisco ASA 1000v instance is powered on, register VNMC from the ASA
- console.</para>
</listitem>
<listitem>
- <para>Ensure that Cisco VNMC appliance is set up externally and then registered with
- &PRODUCT; by using the admin API. A single VNMC instance manages multiple ASA1000v
- appliances.</para>
- </listitem>
- <listitem>
- <para>Ensure that Cisco Nexus 1000v appliance is set up and configured in &PRODUCT; when
- adding VMware cluster.</para>
+ <para>Register Cisco ASA 1000v with VNMC.</para>
+ <para>After Cisco ASA 1000v instance is powered on, register VNMC from the ASA
+ console.</para>
</listitem>
- </itemizedlist>
- </section>
- <section id="notes-vnmc">
- <title>Guidelines</title>
- <para>When a guest network is created with Cisco VNMC firewall provider, an additional public
- IP is acquired along with the Source NAT IP. The Source NAT IP is used for the ASA outside
- interface, whereas the additional IP is used to workaround an ASA limitation. Ensure that
- this additional public IP is not released. You can identify this IP as soon as the network
- is in implemented state and before acquiring any further public IPs. The additional IP is
- the one that is not marked as Source NAT. You can find the IP used for the ASA outside
- interface by looking at the Cisco VNMC used in your guest network.</para>
+ </orderedlist>
</section>
<section id="how-to-asa">
<title>Using Cisco ASA 1000v Services</title>
@@ -156,7 +205,7 @@
<para>Choose the zone you want to work with.</para>
</listitem>
<listitem>
- <para>Click the Network tab.</para>
+ <para>Click the Physical Network tab.</para>
</listitem>
<listitem>
<para>In the Network Service Providers node of the diagram, click Configure. </para>
@@ -166,7 +215,7 @@
<para>Click Cisco VNMC.</para>
</listitem>
<listitem>
- <para>Click View VNMC Devices</para>
+ <para>Click View VNMC Devices.</para>
</listitem>
<listitem>
<para>Click the Add VNMC Device and provide the following:</para>
@@ -204,7 +253,7 @@
<para>Choose the zone you want to work with.</para>
</listitem>
<listitem>
- <para>Click the Network tab.</para>
+ <para>Click the Physical Network tab.</para>
</listitem>
<listitem>
<para>In the Network Service Providers node of the diagram, click Configure. </para>
@@ -220,15 +269,16 @@
<para>Click the Add CiscoASA1000v Resource and provide the following:</para>
<itemizedlist>
<listitem>
- <para>Host: The management IP address of the ASA 1000v instance. The IP address is used
- to connect to ASA 1000V.</para>
+ <para><emphasis role="bold">Host</emphasis>: The management IP address of the ASA 1000v
+ instance. The IP address is used to connect to ASA 1000V.</para>
</listitem>
<listitem>
- <para>Inside Port Profile: The Inside Port Profile configuration on Cisco Nexus1000v
- dvSwitch.</para>
+ <para><emphasis role="bold">Inside Port Profile</emphasis>: The Inside Port Profile
+ configured on Cisco Nexus1000v dvSwitch.</para>
</listitem>
<listitem>
- <para>Cluster: The VMware cluster to which you are adding the ASA 1000v instance.</para>
+ <para><emphasis role="bold">Cluster</emphasis>: The VMware cluster to which you are
+ adding the ASA 1000v instance.</para>
<para>Ensure that the cluster is Cisco Nexus 1000v dvSwitch enabled.</para>
</listitem>
</itemizedlist>