Cisco VSG for Microsoft Hyper-V Guide
إعلان
إعلان
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco
Prime NSC, Release 3.4 Installation and Upgrade Guide
First Published: 2014-12-19
Last Modified: 2018-12-20
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com
go trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
© 2014–2018 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
P R E F A C E
C H A P T E R 1
C H A P T E R 2
Related Documentation for Cisco Virtual Security Gateway for Microsoft Hyper-V viii
Communications, Services, and Additional Information ix
Information About Installing Cisco PNSC and Cisco VSG 1
Cisco Prime NSC and VSG Architecture 2
Dynamic Virtualization-Aware Operation 3
Setting Up Cisco VSG and VLAN 4
Information About Cisco Prime NSC 5
Cisco Prime NSC Key Benefits 5
Cisco Prime NSC Architecture 6
Installing the Cisco Prime NSC and Cisco VSG-Quick Start 9
Information About Installing Cisco Prime NSC and Cisco VSG 9
Cisco VSG and Cisco Prime NSC Installation Planning Checklists 9
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide iii
Contents
Basic Hardware and Software Requirements 10
VLAN Configuration Requirements for VSG 12
Required Cisco Prime NSC and Cisco VSG Information 12
Obtaining Cisco Prime NSC and Cisco VSG Software 13
Task 1: Installing the Cisco Prime NSC from an ISO Image 13
Task 2: On the VSM, Configuring Cisco Prime NSC Policy Agent 18
Task 3: On the VSM, Preparing Cisco VSG Port Profiles 19
Task 4: On the VSM, Configuring Virtual Network Adapters on the Hosts 21
Create Port-profile for the Virtual Network Adapter 21
Creating Virtual Network Adapter 22
Task 5: Installing Cisco VSG from an ISO Image 22
Task 6: On the VSG, Configuring the Cisco Prime NSC Policy Agent 27
Task 7: On Cisco VSG, Cisco VSM, and Cisco PNSC, Verifying the NSC Policy-Agent Status 28
Task 8: On Cisco PNSC, Configuring a Tenant, Security Profile, Compute Firewall, and Assigning
Cisco VSG to the Compute Firewall 29
Configuring a Tenant on Cisco Prime NSC 30
Configuring a Security Profile on the Cisco Prime NSC 30
Configuring a Compute Firewall and Assigning Cisco VSG to Cisco Prime NSC 31
Task 9: On the Prime NSC, Configuring a Permit-All Rule 31
Task 10: On Cisco VSG, Verifying the Permit-All Rule 32
Enabling Logging level 6 for Policy-Engine Logging 32
Enabling Global Policy-Engine Logging 33
Between the VSM, VEM, and VSG 34
Enabling Traffic VM Port-Profile for Firewall Protection 34
Verifying the VSM or VEM for Cisco VSG Reachability 35
Checking the VM Virtual Ethernet Port for Firewall Protection 37
Task 13: Installing Microsoft Service Provider Foundation 37
Installing Service Provider Foundation 38
Configuring Service Provider Foundation 38
Verifying Service Provider Foundation Installation 39
iv
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Contents
C H A P T E R 3
C H A P T E R 4
C H A P T E R 5
Creating VM Manager on Cisco Prime NSC 39
Task 14: Sending Traffic Flow and on Cisco VSG Verifying Statistics and Logs 39
Verifying Policy-Engine Statistics and Logs on Cisco VSG 41
Installing the Cisco Prime Network Services Controller 43
Information About the Cisco Prime NSC 43
Cisco Prime NSC System Requirements 43
Web-Based GUI Client Requirements 44
Firewall Ports Requiring Access 45
Cisco Nexus 1000V Series Switch Requirements 45
Information Required for Installation and Configuration 45
Shared Secret Password Criteria 46
Microsoft Hyper-V Server Requirement 47
Information About the Cisco VSG 51
Cisco VSG and Supported Cisco Nexus 1000V Series Device Terminology 52
Prerequisites for Installing the Cisco VSG Software 52
Obtaining the Cisco VSG Software 53
Installing the Cisco VSG Software 53
Installing the Cisco VSG Software from an ISO File 53
Configuring Initial Settings 57
On the VSG, Configuring the Cisco Prime NSC Policy Agent 58
Configuring Initial Settings on a Secondary Cisco VSG 60
Verifying the Cisco VSG Configuration 60
Registering Devices with the Cisco Prime NSC 63
Registering Cisco Nexus 1000V VSM 64
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide v
Contents
C H A P T E R 6
C H A P T E R 7
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance 67
Information About Installing the Cisco VSG on the Cisco Cloud Service Platform 67
Prerequisites for Installing Cisco VSG on the Cisco Cloud Service Platform 68
Installing Cisco VSG on a Cisco Cloud Service Platform 69
Upgrading the Cisco VSG and the Cisco Prime NSC 75
Information About Cisco Prime NSC Upgrades 76
Information About Cisco VSG Upgrades 76
Upgrade Guidelines and Limitations 76
Upgrade Procedure for Cisco VSG Release 5.2(1)VSG2(1.1b) to Release 5.2(1)VSG2(1.2b), Cisco
Prime NSC Release 3.2 to Cisco Prime NSC Release 3.4 and Cisco Nexus 1000V Release
5.2(1)SM1(5.2b) to Release 5.2(1)SM3(1.1) 77
Cisco VSG Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b) and Cisco Prime NSC 3.2 to Cisco Prime
Upgrading Cisco Prime NSC 3.2 to Cisco Prime NSC 3.4
Upgrading Cisco VSG from Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b) 81
Cisco VSG Software Upgrade Guidelines 81
Upgrade a VSG Pair in HA Mode 81
Upgrading a Device for Standalone VSG 84
Re-registering the Policy Agent with the Upgraded VSG 86
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V 87
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V 87
vi
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Preface
The preface contains the following sections:
•
•
Document Conventions, on page vii
•
Related Documentation for Cisco Virtual Security Gateway for Microsoft Hyper-V, on page viii
•
Documentation Feedback , on page ix
•
Communications, Services, and Additional Information, on page ix
Audience
This publication is for network administrators and server administrators who understand virtualization.
Document Conventions
Note As part of our constant endeavor to remodel our documents to meet our customers' requirements, we have modified the manner in which we document configuration tasks. As a result of this, you may find a deviation in the style used to describe these tasks, with the newly included sections of the document following the new format.
Command descriptions use the following conventions:
Convention bold
Description
Bold text indicates the commands and keywords that you enter literally as shown.
Italic
[x]
[x | y]
Italic text indicates arguments for which the user supplies the values.
Square brackets enclose an optional element (keyword or argument).
Square brackets enclosing keywords or arguments separated by a vertical bar indicate an optional choice.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide vii
Preface
Related Documentation for Cisco Virtual Security Gateway for Microsoft Hyper-V
Convention
{x | y}
[x {y | z}] variable string
Description
Braces enclosing keywords or arguments separated by a vertical bar indicate a required choice.
Nested set of square brackets or braces indicate optional or required choices within optional or required elements. Braces and a vertical bar within square brackets indicate a required choice within an optional element.
Indicates a variable for which you supply values, in context where italics cannot be used.
A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.
Examples use the following conventions:
Convention screen font
Description
Terminal sessions and information the switch displays are in screen font.
boldface screen font italic screen font
< >
[ ]
!, #
Information you must enter is in boldface screen font.
Arguments for which you supply values are in italic screen font.
Nonprinting characters, such as passwords, are in angle brackets.
Default responses to system prompts are in square brackets.
An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.
This document uses the following conventions:
Note Means reader take note . Notes contain helpful suggestions or references to material not covered in the manual.
Caution Means reader be careful . In this situation, you might do something that could result in equipment damage or loss of data.
Related Documentation for Cisco Virtual Security Gateway for
Microsoft Hyper-V
This section lists the documents available for Cisco Virtual Security Gateway for Microsoft Hyper-V and related products.
viii
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Preface
Documentation Feedback
Cisco Virtual Security Gateway Documentation
The Cisco Virtual Security Gateway for Microsoft Hyper-V documentation is available at http://www.cisco.com/ en/US/products/ps13095/tsd_products_support_series_home.html
.
Cisco Virtual Security Gateway for Microsoft Hyper-V Release Notes
Cisco Virtual Security Gateway for Microsoft Hyper-V Installation Guide
Cisco Virtual Security Gateway for Microsoft Hyper-V Configuration Guide
Cisco Virtual Security Gateway for Microsoft Hyper-V Troubleshooting Guide
Cisco Virtual Security Gateway for Microsoft Hyper-V Command Reference
Cisco vPath and vServices Reference Guide for Microsoft Hyper-V
Related Documentation for Nexus 1000V Series NX-OS for Microsoft Hyper-V Software
The Cisco Nexus 1000V Series Switch for Microsoft Hyper-V documents are available on Cisco.com at the following URL: http://www.cisco.com/en/US/products/ps13056/tsd_products_support_series_home.html
Documentation Feedback
To provide technical feedback on this document, or to report an error or omission, please send your comments to [email protected]. We appreciate your feedback.
Communications, Services, and Additional Information
• To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager .
• To get the business impact you’re looking for with the technologies that matter, visit Cisco Services .
• To submit a service request, visit Cisco Support .
• To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit
Cisco Marketplace .
• To obtain general networking, training, and certification titles, visit Cisco Press .
• To find warranty information for a specific product or product family, access Cisco Warranty Finder .
Cisco Bug Search Tool
Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide ix
Communications, Services, and Additional Information
Preface x
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
1
Overview
This chapter contains the following sections:
•
Information About Installing Cisco PNSC and Cisco VSG, on page 1
•
Information About Cisco Prime NSC, on page 5
Information About Installing Cisco PNSC and Cisco VSG
You must install Cisco Prime Network Services Controller (PNSC) and Cisco VSG in a particular sequence on the Cisco Nexus 1000V switch to have a functioning virtual system.
Information About Cisco VSG
Cisco VSG is a virtual firewall appliance that provides trusted access to virtual data center and cloud environments with dynamic policy-driven operation, mobility-transparent enforcement, and scale-out deployment for dense multi-tenancy. By associating one or more Virtual Machines (VMs) into distinct trust zones, Cisco VSG ensures that access to trust zones is controlled and monitored through established security policies. The following figure shows the trusted zone-based access control that is used in per-tenant enforcement with Cisco VSG.
Figure 1: Trusted Zone-Based Access Control Using Per-Tenant Enforcement with Cisco VSG
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
1
Overview
Cisco Prime NSC and VSG Architecture
Cisco Prime NSC and VSG Architecture
Cisco VSG operates with Cisco Nexus 1000V Series switch on KVM on Red Hat Enterprise Linux OpenStack
Platform and leverages the virtual network service data path (Cisco vPath). Cisco vPath steers traffic, whether external-to-VM or VM-to-VM, to Cisco VSG of a tenant. Initial packet processing occurs in Cisco VSG for policy evaluation and enforcement. After the policy decision is made, Cisco VSG offloads policy enforcement of the remaining packets to Cisco vPath.
Figure 2: Cisco Virtual Security Gateway Deployment Topology
Cisco vPath supports the following features:
• Tenant-aware flow classification and subsequent redirection to a designated Cisco VSG tenant
• Per-tenant policy enforcement of flows offloaded by the Cisco VSG to Cisco vPath
Cisco VSG and the VEM provide the following benefits:
• Each Cisco VSG can provide protection across multiple physical servers, which eliminates the need for you to deploy a virtual appliance per physical server.
• By offloading the fast-path to one or more Cisco vPath Virtual Ethernet Modules (VEMs), Cisco VSG enhances security performance through distributed Cisco vPath-based enforcement.
• You can use Cisco VSG without creating multiple switches or temporarily migrating VMs to different switches or servers. Zone scaling, which is based on security profiles, simplifies physical server upgrades without compromising security or incurring application outages.
• For each tenant, you can deploy Cisco VSG in an active-standby mode to ensure that Cisco vPath redirects packets to the standby Cisco VSG when the primary Cisco VSG is unavailable.
• You can place Cisco VSG on a dedicated server so that you can allocate the maximum compute capacity to application workloads. This feature enables capacity planning to occur independently and allows for operational segregation across security, network, and server groups.
2
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Overview
Trusted Multitenant Access
Trusted Multitenant Access
You can transparently insert a Cisco VSG into the Microsoft Hyper-V environment where Cisco Nexus 1000V is deployed. One or more instances of Cisco VSG is deployed on a per-tenant basis, which allows a highly scale-out deployment across many tenants. Tenants are isolated from each other, so no traffic can cross tenant boundaries. You can deploy Cisco VSG at the tenant level in Hyper-V and manage each tenant instance using
Microsoft System Center Virtual Machine Manager (SCVMM).
As you instantiate VMs for a given tenant, their association to security profiles (or zone membership) occurs immediately through binding with the Cisco Nexus 1000V port profile. Each VM is placed upon instantiation into a logical trust zone. Security profiles contain context-aware rule sets that specify access policies for traffic that enters and exits each zone. You can apply controls to zone-to-zone traffic and to external-to-zone (and zone-to-external) traffic. Zone-based enforcement occurs within a VLAN because a VLAN often identifies a tenant boundary. The Cisco VSG evaluates access control rules and then offloads enforcement to the Cisco
Nexus 1000V VEM vPath module. Upon enforcement, Cisco VSG can permit or deny access and can generate optional access logs. Cisco VSG also provides policy-based traffic monitoring capability with access logs.
Dynamic Virtualization-Aware Operation
A virtualization environment is dynamic, where frequent additions, deletions, and changes occur across tenants and across VMs. The following figure shows how the structured environment can change over time due to dynamic VMs.
Figure 3: Cisco VSG Security in a Dynamic VM Environment, Including VM Live Migration
Cisco VSG operating with Cisco Nexus 1000V (and Cisco vPath) supports a dynamic VM environment. When you create a tenant with Cisco VSG (standalone or active-standby pair) on Cisco Prime NSC, associated
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
3
Overview
Setting Up Cisco VSG and VLAN security profiles are defined that include trust zone definitions and access control rules. Each security profile is bound to a Cisco Nexus 1000V port profile (authored on the Cisco Nexus 1000V Virtual Supervisor Module
(VSM) and published to Microsoft SCVMM.
When a new VM is instantiated, the server administrator assigns appropriate port profiles to the virtual Ethernet port of the VM. Because the port profile uniquely refers to a security profile and VM zone membership, Cisco
VSG immediately applies the security controls. You can repurpose a VM by assigning it to a different port profile or security profile.
As VM migration events are triggered, VMs move across physical servers. Because Cisco Nexus 1000V ensures that port profile policies follow the VMs, associated security profiles also follow these moving VMs, and security enforcement and monitoring remain transparent to the migration events.
Setting Up Cisco VSG and VLAN
You can set up Cisco VSG in an overlay fashion so that VMs can reach Cisco VSG irrespective of its location.
The Cisco vPath component in Cisco Nexus 1000V VEM intercepts the packets from the VM and sends them to Cisco VSG for further processing.
Figure 4: Cisco Virtual Security Gateway VLAN Usages
In the following figure, Cisco VSG connects to three different VLANs (service VLAN, management VLAN, and HA VLAN). Cisco VSG is configured with three vNICS—data vNIC (1), management vNIC (2), and
HA vNIC (3)—with each of the vNICs connected to one of the VLANs through a port profile.
The VLAN functions are as follows:
• The service VLAN provides communications between Cisco Nexus 1000V VEM and Cisco VSG through a physical router. Cisco VSG data interface and VEM interface are configured on different subnets. All the Cisco VSG data interfaces are part of the service VLAN and the VEM interacts with Cisco VSG using the router.
• The management VLAN connects the management platforms such as ????Microsoft SCVMM????, Cisco
PNSC, Cisco Nexus 1000V VSM, and managed Cisco VSGs. The Cisco VSG management vNIC is part of the management VLAN.
• The HA VLAN provides the heartbeat mechanism and identifies the active and standby relationship between the Cisco VSGs. The Cisco VSG vNICs are part of the HA VLAN.
4
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Overview
Information About Cisco Prime NSC
You can allocate one or more VM data VLANs for VM-to-VM communications. In a typical multi-tenant environment, the management VLAN is shared among all the tenants and the service VLAN, HA VLAN, and the VM data. VLANs are allocated on a per-tenant basis. However, when VLAN resources become scarce, you might decide to use a single VLAN for service and HA functions.
Information About Cisco Prime NSC
Cisco PNSC virtual appliance is based on Red Hat Enterprise Linux (RHEL), which provides centralized device and security policy management of Cisco VSG for Cisco Nexus 1000V Series switch. Designed for multi-tenant operation, Cisco PNSC provides seamless, scalable, and automation-centric management for virtual data center and ???cloud environments???. With a web-based GUI, CLI, and XML APIs, Cisco PNSC enables you to manage Cisco VSGs that are deployed throughout the data center from a centralized location.
Note Multi-tenancy is when a single instance of the software runs on a Software-as-a-Service (SaaS) server, serving multiple client organizations or tenants. In contrast, multi-instance architecture has separate software instances set up for different client organizations. With a multi-tenant architecture, a software application can virtually partition data and configurations so that each tenant works with a customized virtual application instance.
Cisco PNSC is built on an information model-driven architecture, where each managed device is represented by its sub-components.
Cisco Prime NSC Key Benefits
Cisco PNSC provides the following key benefits:
• Rapid and scalable deployment with dynamic, template-driven policy management based on security profiles.
• Seamless operational management through XML APIs that enable integration with third-party management tools.
• Greater collaboration across security and server administrators, while maintaining administrative separation and reducing administrative errors.
Cisco Prime NSC Components
Cisco PNSC architecture includes the following components:
• A centralized repository for managing security policies (security templates) and object configurations that allow managed devices to be stateless.
• A centralized resource management function that manages pools of devices that are commissioned and pools of devices that are available for commissioning. This function simplifies large scale deployments as follows:
• Devices can be pre-instantiated and then configured on demand
• Devices can be allocated and deallocated dynamically across commissioned and noncommissioned pools
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
5
Overview
Cisco Prime NSC Architecture
• A distributed management-plane function that uses an embedded management agent on each device that allows for a scalable management framework.
Cisco Prime NSC Architecture
The Cisco PNSC architecture includes the components in the following figure:
Figure 5: Cisco Prime NSC Components
Cisco Prime NSC Security
Cisco PNSC uses security profiles for tenant-centric template-based configuration of security policies. A security profile is a collection of security policies that are predefined and applied on an on-demand basis at the time of Virtual Machine (VM) instantiation. These profiles simplify authoring, deployment, and management of security policies in a dense multi-tenant environment, reduce administrative errors, and simplify audits.
Cisco Prime NSC API
The Cisco PNSC API allows you to coordinate with third-party provisioning tools for programmatic provisioning and management of Cisco VSGs. This feature allows you to simplify data center operational processes and reduce the cost of infrastructure management.
Cisco Prime NSC and VSG
Cisco PNSC operates with the Cisco Nexus 1000V Series VSM to achieve the following scenarios:
• Security administrators who author and manage security profiles as well as manage Cisco VSG instances.
Security profiles are referenced in Cisco Nexus 1000V Series port profiles through Cisco PNSC interface.
• Network administrators who author and manage port profiles as well as manage Cisco Nexus 1000V
Series switches. Port profiles are referenced in ?????Microsoft SCVMM???? through the Cisco Nexus
1000V Series VSM interface.
6
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Overview
System Requirements
• Server administrators who select the appropriate port profiles in ?????Microsoft SCVMM???? when instantiating a virtual machine.
System Requirements
System requirements for Cisco Prime NSC are as follows:
• Microsoft Windows Server with SCVMM 2012 SP1, SCVMM 2012 R2, or SCVMM 2016.
• Intel VT that is enabled in the BIOS.
• 4 GB RAM for Prime NSC ISO installation.
• One of the following, depending on InterCloud functionality:
• With InterCloud functionality, 220 GB on shared network file storage (NFS) or storage area network
(SAN), and configured on two disks as follows:
• Disk 1: 20 GB
• Disk 2: 200 GB
• Without InterCloud functionality, 40 GB on shared NFS or SAN, and configured on two disks as follows:
• Disk 1: 20 GB
• Disk 2: 20 GB
• Adobe Flash Player plugin 11.2 or higher.
• Any of the following browsers:
• Internet Explorer 9.0 or higher
• Mozilla Firefox 23.0 or higher
• Google Chrome 29.0 or higher
Access to Cisco Prime NSC application using a Web browser and the following ports (if the deployment uses a firewall, make sure to permit the following ports):
• 443 (HTTPs)
• 80 (HTTP/TCP)
• 843 (Adobe Flash)
Note If you are running Firefox or IE and do not have Flash, or you have a version of Flash that is older than 11.2, a message displays asking you to install Flash and provides a link to the Adobe website.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
7
System Requirements
Overview
8
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
2
Installing the Cisco Prime NSC and Cisco
VSG-Quick Start
This chapter contains the following sections:
•
Information About Installing Cisco Prime NSC and Cisco VSG, on page 9
•
Task 1: Installing the Cisco Prime NSC from an ISO Image, on page 13
•
Task 2: On the VSM, Configuring Cisco Prime NSC Policy Agent, on page 18
•
Task 3: On the VSM, Preparing Cisco VSG Port Profiles, on page 19
•
Task 4: On the VSM, Configuring Virtual Network Adapters on the Hosts, on page 21
•
Task 5: Installing Cisco VSG from an ISO Image, on page 22
•
Task 6: On the VSG, Configuring the Cisco Prime NSC Policy Agent, on page 27
•
Task 7: On Cisco VSG, Cisco VSM, and Cisco PNSC, Verifying the NSC Policy-Agent Status, on page
•
Task 8: On Cisco PNSC, Configuring a Tenant, Security Profile, Compute Firewall, and Assigning Cisco
VSG to the Compute Firewall, on page 29
•
Task 9: On the Prime NSC, Configuring a Permit-All Rule, on page 31
•
Task 10: On Cisco VSG, Verifying the Permit-All Rule, on page 32
•
Task 11: Enabling Logging, on page 32
•
Between the VSM, VEM, and VSG, on page 34
•
Task 13: Installing Microsoft Service Provider Foundation, on page 37
•
Task 14: Sending Traffic Flow and on Cisco VSG Verifying Statistics and Logs, on page 39
Information About Installing Cisco Prime NSC and Cisco VSG
This chapter describes how to install and set up a basic working configuration of Cisco Prime Network Services
Controller (Cisco PNSC) and Cisco Virtual Security Gateway (Cisco VSG). The example in this chapter uses the ISO files of the software for installation. The steps assume that Cisco Nexus 1000V Series switch is operational, and endpoint VMs are already installed.
Cisco VSG and Cisco Prime NSC Installation Planning Checklists
Planning the arrangement and architecture of your network and equipment is essential for a successful operation of Cisco PNSC and Cisco VSG.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
9
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Basic Hardware and Software Requirements
Basic Hardware and Software Requirements
The following table lists the basic hardware and software requirements for Cisco VSG and Cisco PNSC installation.
Requirement
Virtual CPUs
Description
• Cisco VSG: 1 (1.5 GHz)
• Cisco PNSC: 4 (1.8 GHz each)
Memory
Disk Space
Processor
Network Interfaces
Microsoft SCVMM
Browser
• Cisco VSG: 2GB RAM
• Cisco PNSC: 4GB RAM
Cisco VSG: 3 GB
Cisco Prime NSC: Without InterCloud functionality, 40 GB on shared NFS or SAN, and configured on two disks as follows:
• Disk 1: 20 GB
• Disk 2: 20 GB x86 Intel or AMD server with a 64-bit processor.
• Cisco VSG: 3
• Cisco PNSC: 1
SCVMM 2012 SP1, SCVMM 2012 R2, or SCVMM 2016
Any of the following browsers:
• Internet Explorer 9.0 or higher
• Mozilla Firefox 23.0 or higher
• Google Chrome 29.0 or higher
Note
Note
If you are running Firefox or IE and do not have Flash, or you have a version of Flash that is older than 11.2, a message displays asking you to install Flash and provides a link to the Adobe website.
Before using Google Chrome with Cisco PNSC, you must disable the Adobe Flash Players that are installed by default with Chrome.
10
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
License Requirements
Requirement
Ports
Flash Player
Description
Access to the Cisco PNSC application using a web browser and the following ports (if the deployment uses a firewall, make sure to permit the following ports):
• 443 (HTTPS)
• 80 (HTTP/TCP)
• 843 (Adobe Flash)
Adobe Flash Player plugin 11.2 or higher
Note The Cisco VSG software is available for download at http://www.cisco.com/en/US/products/ps13095/index.html
and the Cisco PNSC software is available for download at http://www.cisco.com/en/US/products/ps13213/ index.html
.
License Requirements
Cisco VSG license is integrated with the Nexus1000V Multi-Hypervisor License. You need to install the
Nexus1000V Multi-Hypervisor License for Cisco VSG for Microsoft Hyper-V. The Cisco N1kv VSM is available in two modes: essential and advanced. VSG functionality is available only in the advanced mode.
You need to install the Nexus1000V Multi-Hypervisor License and change the VSM mode to advanced mode.
When the Nexus1000V Multi-Hypervisor License is installed, the license for Cisco VSG is automatically included.
Note If you try to access VSG services with VSM in essential mode, an error message is generated on VSM console indicating that the Nexus1000V Multi-Hypervisor License is required for VSG.
Starting with Release 5.2(1)SM1(5.2), Cisco Nexus1000V Multi-Hypervisor License is available in three different types:
• Default: The Nexus 1000v switch may be configured in Essential or Advanced mode.
• Essential Mode: Not Supported.
• Advanced Mode: After upgrade to Software Release 5.2(1)SM(5.2) or later- Nexus1000V
Multi-Hypervisor License is available with 1024 Socket Count and expires in 60 days.
Note You must install either the evaluation or the permanent (MSFT PKG) license prior to upgrading to the Software Release 5.2(1)SM1(5.2) or later.
• Evaluation: The Nexus 1000V switch should be in Advanced mode. After upgrading to Software Release
5.2(1)SM1(5.2) or later - Nexus1000V Multi-Hypervisor License is available with1024 Socket Count and expires in 60 days.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
11
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
VLAN Configuration Requirements for VSG
• Permanent: The Nexus 1000V switch should be in Advanced mode. After upgrading to Software Release
5.2(1)SM1(5.2) or later - Nexus1000V Multi-Hypervisor License is available with 1024 Socket Count and expires in 60 days.
Note You have to request for an evaluation or permanent Nexus1000V Multi-Hypervisor License.
For more information about the Cisco Nexus 1000V for Microsoft Hyper-V licenses, see the Cisco Nexus
1000V for Microsoft Hyper-V License Configuration Guide .
VLAN Configuration Requirements for VSG
You must have two port-profiles configured on two different VLANs in the VSM:
• Service interface VLAN
• HA interface VLAN
Required Cisco Prime NSC and Cisco VSG Information
The following information can be used during the Cisco PNSC and Cisco VSG installation.
Type
Cisco VSG name—Unique within the inventory folder and up to 80 characters
Your Information
Hostname—Where the Cisco VSG will be installed in the inventory folder
ISOs—Managed within SCVMM library, if stored at
C:\ProgramData\Virtual Machine Manager Library
Files\ISO to manage. Refresh the SCVMM library after saving the ISO file to the specified location.
Cisco VSG management IP address
VSM management IP address
Cisco PNSC instance IP address
Mode for installing the Cisco VSG • Standalone
• HA primary
• HA secondary
Cisco VSG VLAN number
• Service (1)
• Management (2)
• High availability (HA) (3)
12
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Host Requirements
Type
Cisco VSG port profile name
• Data (1)
• Management (2)
• High availability (HA) (3)
Note The numbers indicate the Cisco VSG port profile that must be associated with the
Cisco VSG VLAN number.
Your Information
HA pair ID (HA domain ID)
Cisco VSG admin password
Cisco PNSC admin password
Cisco VSM admin password
Shared secret password (Cisco PNSC, Cisco VSG policy agent, Cisco VSM policy agent)
NSC DNS IP address
NSC NTP IP address
Host Requirements
• Microsoft SCVMM 2012 R2 or Microsoft SCVMM 2016
• Windows Server 2012 R2 or Windows Server 2016
• 6 GB RAM
Obtaining Cisco Prime NSC and Cisco VSG Software
Cisco VSG software is available for download at the following URL: http://software.cisco.com/download/navigator.html
Cisco PNSC software is available for download at the following URL: http://software.cisco.com/download/navigator.html
Task 1: Installing the Cisco Prime NSC from an ISO Image
Before you begin
Ensure that you have:
• Verified that the Hyper-V host on which to deploy Cisco PNSC VM is available in SCVMM.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
13
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 1: Installing the Cisco Prime NSC from an ISO Image
• Copied the Cisco PNSC 3.4 ISO image to the SCVMM library location on the file system. To make this image available in SCVMM, choose Library > Library Servers , right-click the library location, and then refresh.
• NTP server information.
SUMMARY STEPS
1.
Launch the SCVMM.
2.
In the VMs and Services pane, choose the Hyper-V host on which to deploy the Cisco PNSC VM.
3.
Right-click the Hyper-V host and choose Create Virtual Machine .
4.
In the Create Virtual Machine wizard, from the Select Source screen, choose the Create the new virtual machine with a blank virtual hard disk radio button, and then click Next.
5.
In the Specify Virtual Machine Identity screen, Specify the name and description for the virtual machine, and then click Next.
6.
In the Configure Hardware screen, do the following:
7.
In the Select Destination screen, do the following:
8.
In the Select Host screen, choose the destination, and then click Next.
9.
In the Configure Settings screen, click Browse and navigate to the storage location of virtual machine file, and then click Next.
10.
In the Add properties screen, choose the Red Hat Enterprise Linux 5 (64 bit) operating system, and then click Next.
11.
In the Summary screen, do the following:
12.
After the VM is successfully created, right-click the new Virtual Machine and choose Connect or View
> Connect Via Console .
13.
Launch the console and install Cisco PNSC.
14.
After Cisco PNSC is successfully deployed, click Close and power on the Cisco PNSC VM.
DETAILED STEPS
Step 1 Launch the SCVMM.
14
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Figure 6: Create Virtual Machine Wizard - Select Source
Task 1: Installing the Cisco Prime NSC from an ISO Image
Step 2
Step 3
Step 4
Step 5
Step 6
In the VMs and Services pane, choose the Hyper-V host on which to deploy the Cisco PNSC VM.
Right-click the Hyper-V host and choose Create Virtual Machine .
In the Create Virtual Machine wizard, from the Select Source screen, choose the Create the new virtual machine with a blank virtual hard disk radio button, and then click Next.
In the Specify Virtual Machine Identity screen, Specify the name and description for the virtual machine, and then click Next.
In the Configure Hardware screen, do the following: a) From General, do the following:
• Choose Processor and set the number of processors.
• Choose Memory and choose the required memory value. You will need a minimum 4 GB of memory.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
15
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 1: Installing the Cisco Prime NSC from an ISO Image
Step 7
Step 8
Step 9
Step 10
Step 11 b) From Bus Configuration > IDE Devices , do the following:
• Choose the hard disk with the virtual machine name you specified and enter the required size of the hard disk.
You will need at least 20 GB.
• Click New > Disk to add a new hard disk, enter hard disk name in the File Name field, set the hard disk size to 20 GB and click Ok .
• Choose Virtual DVD Drive , choose the Existing ISO image file radio button, and browse to select the Cisco
PNSC 3.4 ISO image file from the library in the Select ISO dialog box.
c) Choose Network Adapters > Network Adapter 1 , select the Connect to a VM Network radio button, and browse to select a VM Network.
d) Click Next.
In the Select Destination screen, do the following: a) Choose the Place the virtual machine on a host radio button.
b) From the Destination drop-down list, choose All hosts .
c) Click Next.
In the Select Host screen, choose the destination, and then click Next.
In the Configure Settings screen, click Browse and navigate to the storage location of virtual machine file, and then click Next.
In the Add properties screen, choose the Red Hat Enterprise Linux 5 (64 bit) operating system, and then click Next.
In the Summary screen, do the following: a) Verify the settings.
b) Check the Start the virtual machine after deploying it check box.
c) Click Create.
16
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Figure 7: Create Virtual Machine Wizard - Summary
Task 1: Installing the Cisco Prime NSC from an ISO Image
Step 12
Step 13
Step 14
The job Create VM starts. You can see the status of this job in the Recent Jobs window. Ensure that the job completes without any errors.
After the VM is successfully created, right-click the new Virtual Machine and choose Connect or View > Connect
Via Console .
Launch the console and install Cisco PNSC.
Note Before the final Cisco PNSC installation step, before you reboot, launch SCVMM again, and right-click the
Virtual machine and choose Properties > Hardware Configuration > Bus Configuration > Virtual DVD
Drive > no media , so that Cisco PNSC does not use the ISO image at boot time.
After Cisco PNSC is successfully deployed, click Close and power on the Cisco PNSC VM.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
17
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 2: On the VSM, Configuring Cisco Prime NSC Policy Agent
Task 2: On the VSM, Configuring Cisco Prime NSC Policy Agent
Once Cisco PNSC is installed, you must register the VSM with Cisco PNSC.
Before you begin
Ensure that you have:
• Cisco PNSC policy-agent image on the VSM (for example, vsmhv-pa.3.2.1e.bin)
Note The string vsmhv-pa must appear in the image name as highlighted.
• The IP address of Cisco PNSC
• The shared secret password you defined during Cisco PNSC installation
• IP connectivity between the VSM and Cisco PNSC is working
Note If you upgrade your VSM, you must also copy the latest Cisco VSM policy agent image. This image is available in Cisco PNSC image bundle to boot from a flash drive and to complete registration with Cisco PNSC.
Note VSM clock should be synchronized with Cisco PNSC clock.
SUMMARY STEPS
1.
On the VSM, enter the following commands:
2.
Check the status of the NSC policy agent configuration to verify that you have installed Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that Cisco
PNSC is reachable and the installation is correct:
DETAILED STEPS
Step 1 On the VSM, enter the following commands: vsm# configure terminal vsm(config)# nsc-policy-agent vsm(config-nsc-policy-agent)# registration-ip 10.193.75.95
vsm(config-nsc-policy-agent)# shared-secret Example_Secret123 vsm(config-nsc-policy-agent)# policy-agent-image vsmhv-pa.3.2.1e.bin
vsm(config-nsc-policy-agent)# exit vsm(config)# copy running-config startup-config vsm(config)# exit
18
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 3: On the VSM, Preparing Cisco VSG Port Profiles
Step 2 Check the status of the NSC policy agent configuration to verify that you have installed Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that Cisco PNSC is reachable and the installation is correct: vsm# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 3.2(1e)-vsm vsm
The VSM is now registered with Cisco PNSC.
Example
This example shows that Cisco PNSC is unreachable or an incorrect IP is configured: vsm# show nsc-pa status nsc Policy-Agent status is - Installation Failure
Cisco PNSC not reachable.
vsm#
This example shows that the NSC policy-agent is not configured or installed: vsm# show nsc-pa status
NSC Policy-Agent status is - Not Installed
Task 3: On the VSM, Preparing Cisco VSG Port Profiles
To prepare Cisco VSG port profiles, you must create the VLANs and use the VLANs in Cisco VSG data port profile and the Cisco VSG-ha port profile.
Before you begin
Ensure that you have:
• Logical Switch name (Network Uplink port-profile name).
• VLAN ID for the Cisco VSG data interface (for example,100).
• VLAN ID for the Cisco VSG-ha interface (for example, 200).
• Management VLAN (management).
Note None of these VLANs need to be system VLANs.
SUMMARY STEPS
1.
Create a Cisco VSG data port profile and a Cisco VSG-ha port profile by first enabling the Cisco VSG data port-profile configuration mode. Cisco VSG data interface should be in the system VLAN. To configure VSG data interface in the system VLAN, you need a system network segment, a system port-profile, and an uplink configured as a system uplink. Use the configure command to enter global configuration mode.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
19
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 3: On the VSM, Preparing Cisco VSG Port Profiles
2.
Create Network Uplink port-profile and use it in the Logical Switch.
3.
Create the network segment and port-profile for the Data VLAN.
4.
Create the network segment and port-profile for the HA VLAN.
DETAILED STEPS
Step 1
Step 2
Step 3
Create a Cisco VSG data port profile and a Cisco VSG-ha port profile by first enabling the Cisco VSG data port-profile configuration mode. Cisco VSG data interface should be in the system VLAN. To configure VSG data interface in the system VLAN, you need a system network segment, a system port-profile, and an uplink configured as a system uplink.
Use the configure command to enter global configuration mode.
Important Ensure that all the critical VMs are configured in the system VLANs.
vsm# configure
Create Network Uplink port-profile and use it in the Logical Switch.
vsm(config)# nsm logical network vsm_LogicalNet vsm(config-logical-net)# exit vsm(config)# nsm network segment pool vsm_NetworkSite vsm(config-net-seg-pool)# member-of logical network vsm_LogicalNet vsm(config-net-seg-pool)# exit vsm(config)# nsm ip pool template pool-vmk-n vsm(config-ip-pool-template)# address family ipv4 vsm(config-ip-pool-template)# network 90.90.90.0/24 vsm(config-ip-pool-template)# ip address 90.90.90.2 90.90.90.100
vsm(config-ip-pool-template)# default-router 90.90.90.1
vsm(config-ip-pool-template)# exit vsm(config)# port-profile type ethernet sys-uplink vsm(config-port-prof)# channel-group auto vsm(config-port-prof)# no shutdown vsm(config-port-prof)# system port-profile vsm(config-port-prof)# state enabled vsm(config-port-prof)# exit vsm(config)# nsm network uplink vsm_Uplink vsm(config-uplink-net)# allow network segment pool vsm_NetworkSite vsm(config-uplink-net)# import port-profile sys_Uplink vsm(config-uplink-net)# system network uplink vsm(config-uplink-net)# publish uplink-network vsm(config-uplink-net)# exit
Create the network segment and port-profile for the Data VLAN.
vsm(config)# nsm network segment VMAccess_502 vsm(config-net-seg)# member-of network segment pool vsm_NetworkSite vsm(config-net-seg)# system network segment vsm(config-net-seg)# switchport access vlan 502 vsm(config-net-seg)# ip pool import template VM_IP_Pool vsm(config-net-seg)# publish network-segment vsm(config-net-seg)# exit vsm(config)# port-profile type vethernet VSG_Data vsm(config-port-prof)# no shutdown vsm(config-port-prof)# state enabled vsm(config-port-prof)# system port-profile
20
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 4: On the VSM, Configuring Virtual Network Adapters on the Hosts
Step 4 vsm(config-port-prof)# publish port-profile vsm(config-port-prof)# exit
Create the network segment and port-profile for the HA VLAN.
vsm(config)# nsm network segment VMAccess_503 vsm(config-net-seg)# member-of network segment pool vsm_NetworkSite vsm(config-net-seg)# switchport access vlan 503 vsm(config-net-seg)# ip pool import template VM_IP_Pool vsm(config-net-seg)# publish network-segment vsm(config-net-seg)# exit vsm(config)# port-profile type vethernet VSG_HA vsm(config-port-prof)# no shutdown vsm(config-port-prof)# state enabled vsm(config-port-prof)# publish port-profile vsm(config-port-prof)# exit
Task 4: On the VSM, Configuring Virtual Network Adapters on the Hosts
Now that you have prepared Cisco VSG port profiles on VSM, you should configure virtual network adapters on the hosts.
This task includes the following subtasks:
•
Create Port-profile for the Virtual Network Adapter, on page 21
•
Creating Virtual Network Adapter, on page 22
Before you begin
Ensure that you have:
• Cisco VSG port-profile configured on VSM.
Create Port-profile for the Virtual Network Adapter
You need to log in to VSM to create port-profile for the virtual network adapter.
SUMMARY STEPS
1.
Create port-profile for the virtual network adapter in VSM.
DETAILED STEPS
Create port-profile for the virtual network adapter in VSM.
Example: vsm# configure terminal vsm(config)# port-profile type vethernet Virtual-Net-PP
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
21
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Creating Virtual Network Adapter vsm(config-port-prof)# capability l3-vservice vsm(config-port-prof)# no shutdown vsm(config-port-prof)# state enabled vsm(config-port-prof)# publish port-profile vsm(config-port-prof)# exit vsm# copy running-config startup-config
Creating Virtual Network Adapter
Before you begin
Make sure that you know the following:
• Port-profile for virtual network adapter is created.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Launch SCVMM.
In the VMs and Services tab, click All Hosts .
Choose the host on which you want to add the virtual network adapter.
Right-click the host and choose Properties from the pop-up menu.
In the Properties window, click Virtual Switches .
On the Virtual Switches tab, click New Virtual Network Adapter .
In the Name field, enter name of virtual network adapter.
Under the Connectivity , in the VM Network field, choose an appropriate VM network.
Under Port profile , select L3 service enabled port-profile that you created from the Classification drop-down list.
Under IP address configuration , check Static radio-button and do the following: a) Choose IP-pool for virtual network adapter from the IPv4 pool drop-down list.
b) In the IPv4 address field, enter IP address for virtual network adapter.
Click Ok .
The VM manager warning message appears, click Ok .
What to do next
Add a physical router between VSG and virtual network adapter.
Task 5: Installing Cisco VSG from an ISO Image
Note Cisco VSG is supported as VSB on Nexus Cloud Services platform only.
22
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 5: Installing Cisco VSG from an ISO Image
Before you begin
Ensure that you have:
• Installed Microsoft SCVMM 2012 R2 or Microsoft SCVMM 2016.
• Downloaded the Cisco VSG ISO image and uploaded it to the server (C:\ProgramData\Virtual Machine
Manager Library Files\ISO). Refresh the library server under the Library tab.
• Cisco VSG-Data port profile: VSG-Data.
• Cisco VSG-ha port profile: VSG-ha.
• HA ID.
• IP/subnet mask/gateway information for Cisco VSG
• Administrator password
• Minimum of 2 GB RAM and 3 GB hard disk space, recommended space is 4 GB RAM and 4 GB hard disk.
• Cisco PNSC IP address.
• The shared secret password.
• IP connectivity between Cisco VSG and Cisco PNSC is okay.
• Cisco VSG NSC-PA image name (vnmc-vsgpa.2.1.2a.bin) is available.
Step 1
Step 2
Step 3
Step 4
Launch SCVMM.
On the VMs and Services tab, click Create Virtual Machine .
In the Create Virtual Machine Wizard, in the Select Source screen, check the Create the new virtual machine with a blank virtual hard disk radio button, and click Next .
In the Specify Virtual Machine Identity screen, enter the name for the Cisco VSG in the Virtual machine name field and click Next.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
23
Task 5: Installing Cisco VSG from an ISO Image
Figure 8: Create Virtual Machine Wizard - Specify Virtual Machine Identity
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Step 5 In the Configure Hardware section, do the following: a) Under General , choose Memory , choose the Static option, and enter 2048 MB in the Virtual machine memory field.
b) Under Bus Configuration , choose the primary disk and enter 2 in the Size (GB) field.
c) Choose the virtual DVD Drive, select the Existing ISO image file radio button and browse for the VSG ISO within the SCVMM Library.
d) Click New > Network Adapter to create a total of three new Network Adapters.
• Under the Network Adapters section, choose Network Adapter 1 , and then choose Connected to a VM network and browse for the appropriate network that corresponds to the network segment for the VSG's data interface.
Note Network Adapter 1 is Service/Data network, use it to connect to the Data network.
24
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 5: Installing Cisco VSG from an ISO Image
Note
Note
Network Adapter 2 is the management network, connect it to the management network for the VSG.
Network Adapter 3 is the HA network, connect it to the HA network.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
25
Task 5: Installing Cisco VSG from an ISO Image
Figure 9: Create Virtual Machine Wizard - Configure Hardware
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
• From the Classification drop-down list, choose the port-profile corresponding to the VSG's data interface.
26
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 6: On the VSG, Configuring the Cisco Prime NSC Policy Agent
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Note Repeat Step d to create network adapters for management and HA.
In the Select Destination section, choose Place the virtual machine in a host , choose the host group on which you want to store the VSG from the drop-down list, and click Next .
In the Select Host section, choose the host that you want to place the VSG on and click Next.
In the Configure Settings section, review the virtual machine settings to ensure they are correct, and click Next .
(Optional) In the Add Properties section, choose the Other Linux (64-bit) from the Operating System from the drop-down list, and then click Next.
In the Summary section, click Create.
Once the VSG is successfully installed, choose the VSG on the VMs and Services tab, and click Power On .
Connect to the VSG using Connect or View > Connect via Console .
Task 6: On the VSG, Configuring the Cisco Prime NSC Policy
Agent
Once Cisco PNSC is installed, you must register Cisco VSG with Cisco PNSC.
Before you begin
Ensure that you have:
• The Cisco PNSC policy-agent image on Cisco VSG (for example, vnmc-vsgpa.2.1.2a.bin).
Note The string vsgpa must appear in the image name as highlighted.
• IP address of the Cisco PNSC.
• Shared secret password you defined during the Cisco PNSC installation.
• IP connectivity between the VSG and the Cisco PNSC.
Note If you upgrade your VSG, you must also copy the latest Cisco VSG policy agent image. This image is available in Cisco PNSC image bundle to boot from a flash drive and to complete registration with Cisco PNSC.
Note VSG clock should be synchronized with Cisco PNSC clock.
SUMMARY STEPS
1.
On Cisco VSG, configure the NSC policy agent:
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
27
Task 7: On Cisco VSG, Cisco VSM, and Cisco PNSC, Verifying the NSC Policy-Agent Status
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
2.
Check the status of the NSC policy agent configuration to verify that you have installed Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that Cisco
PNSC is reachable and the installation is correct:
DETAILED STEPS
Step 1
Step 2
On Cisco VSG, configure the NSC policy agent:
VSG-Firewall# configure
Enter configuration commands, one per line.
End with CNTL/Z.
VSG-Firewall(config)# nsc-policy-agent
VSG-Firewall(config-nsc-policy-agent)# registration-ip 10.193.72.242
VSG-Firewall(config-nsc-policy-agent)# shared-secret Sgate123
VSG-Firewall(config-nsc-policy-agent)# policy-agent-image vnmc-vsgpa.2.1.2a.bin
VSG-Firewall(config-nsc-policy-agent)# copy running-config startup-config
[########################################] 100%
Copy complete, now saving to disk (please wait)...
VSG-Firewall(config-nsc-policy-agent)# exit
Check the status of the NSC policy agent configuration to verify that you have installed Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that Cisco PNSC is reachable and the installation is correct:
VSG-Firewall(config)# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(2a)-vsg
Cisco VSG is now registered with Cisco PNSC.
Example
This example shows that Cisco PNSC is unreachable or an incorrect IP is configured: vsg# show nsc-pa status
NSC Policy-Agent status is - Installation Failure
Cisco PNSC not reachable.
vsg#
This example shows that the NSC policy-agent is not configured or installed: vsg# show nsc-pa status
NSC Policy-Agent status is - Not Installed
Task 7: On Cisco VSG, Cisco VSM, and Cisco PNSC, Verifying the NSC Policy-Agent Status
You can use the show nsc-pa status command to verify the nsc policy-agent status on Cisco VSG, Cisco
VSM, and Cisco Prime NSC (which can indicate that you have installed the policy-agent successfully).
SUMMARY STEPS
1.
Log in to the Cisco VSG.
2.
Check the status of NSC-PA configuration by entering the following command:
28
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 8: On Cisco PNSC, Configuring a Tenant, Security Profile, Compute Firewall, and Assigning Cisco VSG to the Compute Firewall
3.
Log in to the Cisco VSM.
4.
Check the status of NSC-PA configuration by entering the following command:
5.
Log in to Cisco PNSC.
6.
Click Resource Management and then click Resources .
7.
In the navigation pane, click VSMs and verify the VSM information in the VSMs pane.
8.
In the navigation pane, click VSGs and verify the VSG information in the VSGs pane.
DETAILED STEPS
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Log in to the Cisco VSG.
Check the status of NSC-PA configuration by entering the following command: vsg# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(2a)-vsg vsg#
Log in to the Cisco VSM.
Check the status of NSC-PA configuration by entering the following command:
VSM# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 3.2(1e)-vsm
VSM#
Log in to Cisco PNSC.
Click Resource Management and then click Resources .
In the navigation pane, click VSMs and verify the VSM information in the VSMs pane.
In the navigation pane, click VSGs and verify the VSG information in the VSGs pane.
Task 8: On Cisco PNSC, Configuring a Tenant, Security Profile,
Compute Firewall, and Assigning Cisco VSG to the Compute
Firewall
Now that you have Cisco PNSC and Cisco VSG successfully installed with the basic configurations, you should configure the basic security profiles and policies.
This task includes the following subtasks:
•
Configuring a Tenant on Cisco Prime NSC, on page 30
•
Configuring a Security Profile on the Cisco Prime NSC, on page 30
•
Configuring a Compute Firewall and Assigning Cisco VSG to Cisco Prime NSC, on page 31
What to do next
Go to
Configuring a Tenant on Cisco Prime NSC, on page 30
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
29
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Configuring a Tenant on Cisco Prime NSC
Configuring a Tenant on Cisco Prime NSC
Tenants are entities (businesses, agencies, institutions, and so on) whose data and processes are hosted on
VMs on the virtual data center. To provide firewall security for each tenant, the tenant must first be configured in Cisco PNSC.
SUMMARY STEPS
1.
From the Cisco PNSC toolbar, click the Tenant Management tab.
2.
In the Navigation pane directory tree, right-click root , and from the drop-down list, choose Create Tenant .
3.
In the Create Tenant dialog box, do the following:
4.
Click OK .
DETAILED STEPS
Step 1
Step 2
Step 3
Step 4
From the Cisco PNSC toolbar, click the Tenant Management tab.
In the Navigation pane directory tree, right-click root , and from the drop-down list, choose Create Tenant .
In the Create Tenant dialog box, do the following: a) In the Name field, enter the tenant name; for example, Tenant-A.
b) In the Description field, enter a description for that tenant.
Click OK .
Notice that the tenant that you have just created is listed in the left-side pane under root.
What to do next
See
Configuring a Security Profile on the Cisco Prime NSC, on page 30
Configuring a Security Profile on the Cisco Prime NSC
You can configure a security profile on Cisco PNSC.
Step 1
Step 2
Step 3
Step 4
Step 5
In the Cisco PNSC toolbar, click the Policy Management > Service Profiles .
In the Root navigation window, from the directory path, choose Tenant > Compute Firewall > Compute Security
Profile .
Right-click Compute Security Profile and choose Add Compute Security Profile .
The Add Compute Security Profile dialog box opens.
In the Add Compute Security Profile dialog box, do the following: a) In the Name field, enter a name for the security profile; for example, sp-web.
b) In the Description field, enter a brief description of this security profile.
Click OK
30
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Configuring a Compute Firewall and Assigning Cisco VSG to Cisco Prime NSC
What to do next
See
Configuring a Compute Firewall and Assigning Cisco VSG to Cisco Prime NSC, on page 31
Configuring a Compute Firewall and Assigning Cisco VSG to Cisco Prime NSC
The compute firewall is a logical virtual entity that contains the device profile that you can bind (assign) to
Cisco VSG VM. The device policy in the device profile is then pushed from Cisco PNSC to Cisco VSG. Once this is complete, the compute firewall is in the applied configuration state on Cisco PNSC.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
From Cisco PNSC, choose Resource Management > Managed Resources .
On the left-pane directory tree, navigate to choose a tenant.
Click the Action drop-down list, choose Add Compute Firewall . The Add Compute Firewall dialog box opens.
In the Add Compute Firewall dialog box, do the following: a) In the Name field, enter a name for the compute firewall.
b) In the Description field, enter a brief description of the compute firewall.
c) In the Host Name field, enter the name for your Cisco VSG.
Click Next .
The new Compute Firewall pane displays with the information that you provided.
In the Select Service Devices pane, choose Assign VSG radio button, from the VSG Devices drop-down, choose a VSG.
then and click Next .
In the Interface tab, Configure Data Interface pane, enter data interface (data0) IP address and subnet mask, and click
Next .
Verify the configuration in Summary tab and click Finish .
Click Root > Tenant > Network Services and verify the status of the firewall.
Task 9: On the Prime NSC, Configuring a Permit-All Rule
You can configure a permit-all rule in the Cisco PNSC.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Log in to the Cisco PNSC.
Choose Policy Management > Service Profiles .
Choose Root > Tenant > Compute Firewall > Compute Security Profile , and then select a security profile.
In the right pane, click Add ACL Policy Set .
In the Add ACL Policy dialog box, do the following: a) In the Name field, enter the ACL Policy Set name.
b) In the Description field, enter a brief description of the ACL Policy Set.
c) Click Add ACL Policy .
In the Add ACL Policy dialog-box, enter the policy name, enter policy description, and then click Add Rule .
In the Add Rule dialog box, do the following:
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
31
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 10: On Cisco VSG, Verifying the Permit-All Rule
Step 8
Step 9
Step 10 a) In the Name field, enter the rule name.
b) For the Action radio button, choose the matching condition (for example, Permit-All to permit all the traffic).
c) On the Condition Match Criteria field, choose the required condition.
d) On the Source - Destination - Service tab, click Add to add source/destination conditions or service.
e) On the Protocol tab, uncheck Any to choose specific protocols. Do not uncheck Any if you wish to match all the protocols.
f) On the Ether-Type tab, click Add to specify an Ether type for the rule.
g) On the Time Range tab, keep the default option to leave the rule enabled.
h) On the Advanced tab, click Add to add checks for source ports.
i) Click Ok .
In the Add Policy dialog box, click OK .
The newly created policy is displayed in the Assigned field.
In the Add Policy Set dialog box, click OK .
In the Service Profile window, click Save .
Task 10: On Cisco VSG, Verifying the Permit-All Rule
You can verify the rule presence in Cisco VSG, by using the Cisco VSG CLI and the show commands.
vsg# show running-config rule rule POL-DEMO/R-DEMO@root/Tenant/VDC cond-match-criteria: match-allaction permit rule POL1/R1@root/Tenant/VDC cond-match-criteria: match-allaction permit rule default/default-rule@root cond-match-criteria: match-allaction drop vsg#
Task 11: Enabling Logging
To enable logging follow these procedures:
•
Enabling Logging level 6 for Policy-Engine Logging, on page 32
•
Enabling Global Policy-Engine Logging, on page 33
Enabling Logging level 6 for Policy-Engine Logging
Logging enables you to see what traffic is going through your monitored virtual machine. This logging is helpful for verifying that you have a proper configuration and to help in troubleshooting. You can enable
Logging Level 6 for policy-engine logging in a monitor session.
Step 1
Step 2
Log in to Cisco PNSC.
Choose Policy Management > Device Configurations .
32
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Enabling Global Policy-Engine Logging
Step 3
Step 4
In the Navigation pane, choose root > Policies > Syslog > Default , and then click Edit .
In the Edit Syslog dialog box, do the following: a) Click the Servers tab.
b) In the Server Type column, choose the primary server type from the displayed list.
c) From the pane toolbar, click Edit.
Figure 10: Edit Syslog Dialog Box
Step 5
Step 6
In the Edit Syslog Client dialog box, do the following: a) In the Hostname/IP address field, enter the syslog server IP address.
b) From the Severity drop-down list, choose Information(6).
c) From the Admin State drop-down list, check Enabled radio button.
d) Click OK .
Click OK .
What to do next
See
Enabling Global Policy-Engine Logging, on page 33
.
Enabling Global Policy-Engine Logging
Logging enables you to see what traffic is going through your monitored VM. This logging is helpful for verifying that you have a proper configuration and to help in troubleshooting.
Step 1
Step 2
Step 3
Step 4
Log in to Cisco PNSC.
In the Cisco Prime NSC window, choose Policy Management > Device Configurations > root > Device Profiles > default . The default Device Profile window opens.
In the default pane, do the following: a) In the Work pane, click the General tab.
b) In the Policy Engine Logging field, check the Enabled radio button.
Click Save .
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
33
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Task 12: Enabling the Traffic VM Port-Profile for Firewall Protection and Verifying the Communication Between the VSM, VEM, and VSG
Task 12: Enabling the Traffic VM Port-Profile for Firewall
Protection and Verifying the Communication Between the VSM,
VEM, and VSG
This section includes the following topics:
•
Enabling Traffic VM Port-Profile for Firewall Protection , on page 34
•
Verifying the VSM or VEM for Cisco VSG Reachability, on page 35
•
Checking the VM Virtual Ethernet Port for Firewall Protection, on page 37
Before you begin
Ensure that you have:
• Server VM that runs with an access port profile (for example, web server)
• Cisco VSG data IP address (for example, 10.10.10.200) and VLAN ID (for example, 100)
• Set up the Virtual Network Adapter
• Security profile name (for example, sp-web)
• Organization (Org) name (for example, root/Tenant-A)
• Port profile that you would like to edit to enable firewall protection
Enabling Traffic VM Port-Profile for Firewall Protection
You can enable a traffic VM port profile for traffic protection.
SUMMARY STEPS
1.
Create VSG node.
2.
Create the network segment and Traffic VM Port-Profile for Firewall Protection.
DETAILED STEPS
Step 1
Step 2
Create VSG node.
vsm# configure terminal vsm (config)# vservice node VSG type vsg vsm (config-vservice-node)# ip address 10.10.10.200
vsm (config-vservice-node)# adjacency l3 vsm (config-vservice-node)# exit vsm (config)# copy running-config startup-config
Create the network segment and Traffic VM Port-Profile for Firewall Protection.
34
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Verifying the VSM or VEM for Cisco VSG Reachability vsm(config)# nsm network segment VMAccess_400 vsm(config-net-seg)# member-of network segment pool vsm_NetworkSite vsm(config-net-seg)# switchport access vlan 400 vsm(config-net-seg)# ip pool import template VM_IP_Pool vsm(config-net-seg)# publish network-segment vsm(config-net-seg)# exit vsm(config)# port-profile type vethernet pp-webserver vsm(config-port-prof)# org root/Tenant-A vsm(config-port-prof)# vservice node VSG profile sp-web vsm(config-port-prof)# no shutdown vsm(config-port-prof)# state enabled vsm(config-port-prof)# publish port-profile vsm(config-port-prof)# exit vsm(config)# show port-profile name pp-webserver
What to do next
See
Verifying the VSM or VEM for Cisco VSG Reachability, on page 35
.
Verifying the VSM or VEM for Cisco VSG Reachability
Ensure that you have assigned the traffic VM port profile with firewall protection to the traffic VM.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
35
Verifying the VSM or VEM for Cisco VSG Reachability
Figure 11: Virtual Machine Properties Window
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
This example shows how to verify the communication between the VEM and the VSG:
VSM# show vservice brief
--------------------------------------------------------------------------------
Node Information
--------------------------------------------------------------------------------
ID Name Type IP-Address Mode State Module
1 VSG-1 vsg 192.161.0.85
l3 Alive 3,4,
--------------------------------------------------------------------------------
Path Information
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Port Information
--------------------------------------------------------------------------------
PortProfile:PP-VSERVICE
Org:root/Tenant1
Node:VSG-1(192.161.0.85)
Veth Mod VM-Name
Profile(Id):SP1(6) vNIC IP-Address
36
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Checking the VM Virtual Ethernet Port for Firewall Protection
4 4 traffic-vm-win-22
8 3 traffic-vm-win-12
10 3 traffic-vm-ubuntu-61
11 3 traffic-vm-ubuntu-52
192.163.0.53,
192.163.0.76
192.163.0.80,
192.163.0.52,
A display showing the IP-ADDR Listing and Alive state verifies that the VEM can communicate with the
Cisco VSG.
Checking the VM Virtual Ethernet Port for Firewall Protection
This example shows how to verify the VM Virtual Ethernet port for firewall protection:
VSM(config)# show vservice port brief port-profile VSGDemo-WEB-FW
--------------------------------------------------------------------------------
Port Information
--------------------------------------------------------------------------------
PortProfile:VSGDemo-WEB-FW
Org:root/Demo
Node:VSG(153.1.1.13)
Veth Mod VM-Name
1 3 web-server1
Profile(Id):Demo-Default-Security-Profile(6) vNIC IP-Address
152.1.1.11,
Note Make sure that your VNSP ID value is greater than 1.
Task 13: Installing Microsoft Service Provider Foundation
After installing Cisco Prime NSC, you need to enable communication between the Prime NSC and Microsoft
SCVMM. This is required for virtual machine attribute based policies to work on VSG. Microsoft Service
Provider Foundation (SPF) is a plugin that enables communication between Microsoft SCVMM and Cisco
Prime NSC. The following table lists the SPF versions compatible with Cisco Prime NSC 3.4:
Table 1: SPF versions compatible with Cisco Prime NSC 3.4
SCVMM Version SPF
Version
System Center 2012 Service Pack
1
7.1.3117.0
System Center 2016 7.2.379.0
This task includes the following subtasks:
•
Installing Service Provider Foundation, on page 38
•
Configuring Service Provider Foundation, on page 38
•
Verifying Service Provider Foundation Installation, on page 39
•
Creating VM Manager on Cisco Prime NSC, on page 39
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
37
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Installing Service Provider Foundation
What to do next
See
Installing Service Provider Foundation, on page 38
Installing Service Provider Foundation
For detailed information about installing Service Provider Foundation, see How to Install Service Provider
Foundation for System Center 2012 R2 or How to Install Service Provider Foundation for System Center
2016 available at: http://technet.microsoft.com/en-us/library/dn266007.aspx
.
Before you begin
Ensure that you have:
• Downloaded install system center 2012 R2 or 2016 orchestrator based on your requirement.
• Verified the system requirements for Service Provider Foundation (SPF). For information on system requirements, refer to System Requirements for Service Provider Foundation for System Center 2012
SP1 or System Requirements for Service Provider Foundation for System Center 2016 , available at: http://technet.microsoft.com/en-us/library/jj642899.aspx
.
• NTP server information.
Configuring Service Provider Foundation
After the Service Provider Foundation (SPF) is successfully installed, you need to a create stamp ID (stampId) and associate it with the Microsoft SCVMM server. For more information about configuring SPF, see http://technet.microsoft.com/en-us/library/jj613915.aspx
.
Before you begin
See
Verifying Service Provider Foundation Installation, on page 39
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Open a Windows powers shell.
Run import-module spfadmin .
Enter $server = New-SCSPFServer -Name "scvmm server" -ServerType VMM
This is the server name that is displayed in the login window.
$tenant = New-SCSPFTenant -Name "tenant-name"
$tenant = New-SCSPFTenant -Name "<tenant-name>"
Enter the VM name as the tenant name.
$stamp = New-SCSPFStamp -Name "Stamp" -Servers $server
Set-SCSPFStamp -Stamp $stam -Tenants $tenant
38
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Verifying Service Provider Foundation Installation
Verifying Service Provider Foundation Installation
To check if the SPF installation is successful and functional, launch the following VMM REST interface web link: https://<spf_host>:8090/SC2016R2/VMM/Microsoft.Management.Odata.Svc
where <spf_host> is the IP address for the Microsoft SCVMM VM.
Use the following link to launch the Virtual Machines REST URL: https://<spf_host>:8090/SC2016R2/VMM/Microsoft.Management.Odata.Svc/VirtualMachines where <spf_host> is the IP address for the SCVMM VM.
Creating VM Manager on Cisco Prime NSC
You need to create a VM manager to enable Prime NSC to retrieve VM information from Microsoft SCVMM.
Step 1
Step 2
Step 3
Launch Cisco Prime NSC.
Choose Resource Management > VM Manager > Add VM Manager .
In the Add VM Manager dialog box, enter the following: a) Name for VM manager.
b) Description for the VM manager c) Hostname/IP address of SCVMM.
d) Domain-Name/User-name.
e) Password SCVMM host.
f) Keep the default Port Number.
g) Click OK .
Task 14: Sending Traffic Flow and on Cisco VSG Verifying
Statistics and Logs
This section includes the following topics:
•
Sending Traffic Flow, on page 39
•
Verifying Policy-Engine Statistics and Logs on Cisco VSG, on page 41
Sending Traffic Flow
You can send traffic flow through the Cisco VSG to ensure that it is functioning properly.
Step 1 Ensure that you have the VM (Server-VM) that is using the port profile (pp-webserver) configured for firewall protection.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
39
Sending Traffic Flow
Figure 12: Virtual Machine Properties Window
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Step 2
Step 3
Log in to any of your client virtual machine (Client-VM).
Send traffic (for example, HTTP) to your Server-VM.
[root@]# wget http://172.31.2.92/
--2014-11-28 13:38:40-http://172.31.2.92/
Connecting to 172.31.2.92:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 258 [text/html]
Saving to: `index.html'
100%[=======================================================================>] 258 in 0s
2014-11-28 13:38:40 (16.4 MB/s) - `index.html' saved [258/258]
[root]#
--.-K/s
40
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
Verifying Policy-Engine Statistics and Logs on Cisco VSG
Step 4 Check the policy-engine statistics and log in to Cisco VSG.
In the Cisco VSG Layer 3 mode, IP fragmentation is not supported on the VEM virtual machine network interface card
(vmnic) for traffic leaving the host. Hence, after vPath encapsulation, if an IP packet is received by a VEM from a virtual machine with a packet size greater than the outgoing interface MTU value, it will be dropped, and an ICMP error message
(error code = 4) will be sent back to the source virtual machine. To avoid packet drops in this scenario, increase the outgoing server port MTU value by 94 bytes. For example, if the MTU values of client and server virtual machines and uplinks are all 1500 bytes, set the uplink MTU value to 1594 bytes
What to do next
See
Verifying Policy-Engine Statistics and Logs on Cisco VSG, on page 41
.
Verifying Policy-Engine Statistics and Logs on Cisco VSG
Log in to Cisco VSG and check the policy-engine statistics and logs.
This example shows how to check the policy-engine statistics and logs: vsg# show policy-engine stats
Policy Match Stats: default@root : default/default-rule@root :
NOT_APPLICABLE :
0
0 (Drop)
0 (Drop)
PS_web@root/Tenant-A : 1 pol_web/permit-all@root/Tenant-A :
NOT_APPLICABLE :
1 (Log, Permit)
0 (Drop) vsg# terminal monitor vsg# 2014 Nov 28 05:41:27 firewall %POLICY_ENGINE-6-POLICY_LOOKUP_EVENT: policy=PS_web@root/Tenant-A rule=pol_web/permit-all@root/Tenant-A action=Permit direction=egress src.net.ip-address=172.31.2.91 src.net.port=48278 dst.net.ip-address=172.31.2.92 dst.net.port=80 net.protocol=6 net.ethertype=800
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
41
Verifying Policy-Engine Statistics and Logs on Cisco VSG
Installing the Cisco Prime NSC and Cisco VSG-Quick Start
42
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
3
Installing the Cisco Prime Network Services
Controller
This chapter contains the following sections:
•
Information About the Cisco Prime NSC , on page 43
•
Installation Requirements, on page 43
•
Microsoft Hyper-V Server Requirement, on page 47
•
Installing Cisco Prime NSC, on page 47
Information About the Cisco Prime NSC
The Cisco Prime Network Services Controller (Cisco PNSC) is a virtual appliance that provides centralized device and security policy management for Cisco virtual services. Designed to support enterprise and multiple-tenant cloud deployments, the Cisco PNSC provides transparent, seamless, and scalable management for securing virtualized data center and cloud environments.
Installation Requirements
Cisco Prime NSC System Requirements
Requirement
Virtual Appliance
Four virtual CPUs
Memory
Disk space
Description
1.8 GHz each
Minimum 4 GB RAM, recommended 4 GB RAM
Without InterCloud functionality, 40 GB on shared
NFS or SAN, and configured on two disks as follows:
• Disk 1: 20 GB
• Disk 2: 20 GB
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
43
Installing the Cisco Prime Network Services Controller
Web-Based GUI Client Requirements
Requirement
Management interface
Processor
Microsoft Hyper-V
Microsoft SCVMM 2016 R2
Interfaces and Protocols
HTTP/HTTPS
Lightweight Directory Access Protocol (LDAP)
Intel VT
Intel Virtualization Technology (VT)
Description
One management network interface x86 Intel or AMD server with 64-bit processor
—
—
Enabled in the BIOS
Web-Based GUI Client Requirements
Requirement
Operating system
Browser
Flash Player
Description
Any of the following:
• Windows
• Apple Mac OS
Any of the following:
• Internet Explorer 9.0
• Mozilla Firefox 23.0
• Chrome 29.0
Note
Note
If you are running Firefox or IE and do not have Flash, or you have a version of Flash that is older than 11.2, a message displays asking you to install Flash and provides a link to the Adobe website.
Before using Google Chrome with Cisco
PNSC, you must disable the Adobe Flash
Players that are installed by default with
Chrome. For more information, see
Configuring Chrome for Use with Cisco
PNSC.
Adobe Flash Player plugin (Version 11.2 or higher)
44
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime Network Services Controller
Firewall Ports Requiring Access
Note Before you can use Chrome with Prime NSC 3.2, you must first disable the Adobe Flash Players that are installed by default with Chrome.
Firewall Ports Requiring Access
Requirement
80
443
843
Description
HTTP/TCP
HTTP
TCP
Cisco Nexus 1000V Series Switch Requirements
Requirement
One port profile configured on the Cisco Nexus
1000V Series Switch for the service VLAN.
Notes
General
The procedures in this guide assume that the Cisco
Nexus 1000V Series switch is up and running, and that endpoint Virtual Machines (VMs) are installed.
—
Port Profiles
—
Information Required for Installation and Configuration
Information Type
For Deploying the Cisco PNSC ISO
Name
ISO file location
Storage location
Management port profile name for VM management
Note The management port profile is the same port profile that is used for VSM. The port profile is configured in VSM and is used for the Cisco PNSC management interface.
Your Information
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
45
Installing the Cisco Prime Network Services Controller
Shared Secret Password Criteria
Information Type
IP address
Subnet mask
Gateway IP address
Domain name
DNS server
Admin password
Shared secret password for communications between the Cisco PNSC, Cisco VSG, and VSM.
For Configuring Microsoft Hyper-V in Cisco PNSC
HyperV name
Description
Hostname or IP address
Your Information
Shared Secret Password Criteria
A shared secret password is a password that is known only to those using a secure communication. Passwords are designated strong if they cannot be easily guessed for unauthorized access. When you set a shared secret password for communications between the Cisco PNSC, Cisco VSG, and VSM, adhere to the following criteria for setting valid, strong passwords:
Do not include the following items in passwords:
• Characters: & ' " ` ( ) < > | \ ; $
• Spaces
Create strong passwords based on the characteristics in this table:
46
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime Network Services Controller
Microsoft Hyper-V Server Requirement
Table 2: Characteristics of Strong Passwords
Strong passwords have...
• At least eight characters.
• Lowercase letters, uppercase letters, digits, and special characters.
Strong passwords do not have...
• Consecutive characters, such as aaabbb .
abcd .
• Characters repeated three or more times, such as
• A variation of the word Cisco, such as cisco , ocsic , or one that changes the capitalization of letters in the word Cisco.
• The username or the username in reverse.
• A permutation of characters present in the username or Cisco.
Examples of strong passwords are:
• If2CoM18
• 2004AsdfLkj30
• Cb1955S21
Microsoft Hyper-V Server Requirement
You must set the clock to the correct time on all the Microsoft Hyper-V servers that will run Cisco PNSC,
Cisco VSG, or VSM. If you do not set the correct time on the server, the Cisco PNSC CA certificate that is created when the Cisco PNSC VM is deployed might have an invalid time stamp.
After you set the clock to the correct time on all the Hyper-V servers that run the Cisco PNSC, you can, as an option, set the clock on the Cisco PNSC as follows:
• If you set the clock manually, be sure to enter the correct time zone as a Coordinated Universal Time
(UTC) offset.
• If you set the clock by synchronizing with the Network Time Protocol (NTP), you can select the UTC time zone.
Installing Cisco Prime NSC
Before you begin
• Verify that the Hyper-V host on which to deploy the Cisco PNSC VM is available in SCVMM.
• Copy the Cisco PNSC ISO image to the SCVMM library location on the file system. To make this image available in SCVMM, choose Library > Library Servers , right-click the library location, and then refresh.
• Set your keyboard to United State English before installing the Cisco PNSC and using the VM console.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
47
Installing the Cisco Prime Network Services Controller
Installing Cisco Prime NSC
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
• There is no dependency on the VM hardware version, so the VM hardware version can be upgraded if required.
Launch the SCVMM.
Choose the Hyper-V host on which to deploy the Cisco PNSC VM.
Right-click the Hyper-V host and choose Create Virtual Machine .
In the Create Virtual Machine wizard, from the Select Source screen, choose the Create the new virtual machine with a blank virtual hard disk radio button, then click Next.
In the Specify Virtual Machine Identity screen, provide the required information, then click Next.
In the Configure Hardware screen, do the following: a) From General, do the following:
• Choose Processor and choose the number of processors.
• Choose Memory and choose the required memory value. You will need a minimum 4 GB of memory for
Prime NSC.
b) From Bus Configuration > IDE Devices , do the following:
• Choose Hard Disk , enter the required size of the hard disk. You will need a minimum of 20 GB of hard disk.
• Choose Virtual DVD Drive , check the Existing ISO image file radio button, and browse to choose theCisco
PNSC 3.4 ISO image file.
c) Choose Network Adapters > Network Adapter 1 , check the Connect to a VM Network radio button, and browse to choose a VM Network.
d) Click Next.
In the Select Destination screen, do the following: a) Check the Place the virtual machine on a host radio button.
b) Choose All hosts from the Destination drop-down list.
c) Click Next.
In the Select Host screen, choose the destination, then click Next.
In the Configure Settings screen, review the virtual machine settings, then click Next.
In the Add properties screen, choose the Red Hat Enterprise Linux 5 (64 bit) operating system, then click Next.
In the Summary screen, do the following: a) Verify the settings.
b) Check the Start the virtual machine after deploying it check box.
c) Click Create.
The job Create virtual machine starts. You can see the status of this job in The Recent Jobs window. Ensure that the job completes without any errors.
After the virtual machine is successfully created, right-click the new Virtual Machine (vnmc21-perf in this case) and choose Connect or View > Connect Via Console .
Launch the console and install Cisco PNSC.
48
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco Prime Network Services Controller
Installing Cisco Prime NSC
Step 14
Note Before the final Cisco PNSC installation step, before you reboot, launch Microsoft SCVMM again, right-click the Virtual machine (vnmc21-hyperv in this case), and choose Properties > Hardware Configuration >
Bus Configuration > Virtual DVD Drive > no media so that Cisco PNSC does not use the ISO image at boot time.
After Cisco PNSC is successfully deployed, click Close and power on the Cisco PNSC VM.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
49
Installing Cisco Prime NSC
Installing the Cisco Prime Network Services Controller
50
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
4
Installing the Cisco VSG
This chapter contains the following sections:
•
Information About the Cisco VSG, on page 51
•
Prerequisites for Installing the Cisco VSG Software, on page 52
•
Obtaining the Cisco VSG Software, on page 53
•
Installing the Cisco VSG Software, on page 53
•
Configuring Initial Settings, on page 57
•
Verifying the Cisco VSG Configuration, on page 60
•
Information About the Cisco VSG
This section describes how to install and complete the basic configuration of the Cisco VSG for Cisco Nexus
1000v Series switch software.
•
Host and VM Requirements, on page 51
•
Cisco VSG and Supported Cisco Nexus 1000V Series Device Terminology, on page 52
Host and VM Requirements
The Cisco VSG has the following requirements:
• Microsoft SCVMM R2
• Virtual Machine (VM)
• 64-bit VM is required.
• x86 Intel or AMD server with a 64-bit processor.
• 2 GB RAM, recommended space is 4 GB RAM.
• 3 NICs.
• Minimum 3 GB hard disk space with LSI Logic Parallel adapter (default), recommended space is
4 GB hard disk.
• Minimum CPU speed of 1.5 GHz.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
51
Installing the Cisco VSG
Cisco VSG and Supported Cisco Nexus 1000V Series Device Terminology
Cisco VSG and Supported Cisco Nexus 1000V Series Device Terminology
This table lists the terminology used in the Cisco VSG implementation.
Term Description
Logical Switch
NIC
Server hosting SCVMM
Virtual Ethernet Module (VEM)
Virtual Machine (VM) vPath
Virtual Security Gateway (VSG)
Virtual Supervisor Module (VSM)
SCVMM
Logical switch that spans one or more servers. It is controlled by one VSM instance.
Network interface card.
Service that acts as a central administrator for Microsoft Hyper-V hosts that are connected on a network. The server directs actions on the VMs and the VM hosts.
Part of the Cisco Nexus 1000V Series switch that switches data traffic. It runs on a Microsoft Hyper-V host. Up to 64 VEMs are controlled by one VSM. All the VEMs that form a switch domain should be in the same virtual data center as defined by the Hyper-V server.
Virtualized x86 PC environment in which a guest operating system and associated application software can run. Multiple VMs can operate on the same host system concurrently.
Component in the Cisco Nexus 1000V Series switch with a VEM that directs the appropriate traffic to the Cisco VSG for policy evaluation. It also acts as fast path and can short circuit part of the traffic without sending it to the Cisco VSG.
Cisco software that secures virtual networks and provides firewall functions in virtual environments using the Cisco Nexus 1000V
Series switch by providing network segmentation.
Control software for the Cisco Nexus 1000V Series distributed virtual device that runs on a Virtual Machine (VM) and is based on Cisco NX-OS.
System Center Virtual Machine Manager Connect remotely to
Hyper-V server. It is the primary interface for creating, managing, and monitoring VMs, their resources, and their hosts. It also provides console access to VMs.
Prerequisites for Installing the Cisco VSG Software
The following components must be installed and configured:
• On the Cisco Nexus 1000V Series switch, configure two port profiles for the Cisco VSG: one for the service VLAN and the other for the HA VLAN. (You will be configuring the Cisco VSG IP address on the Cisco VSG so that the Cisco Nexus 1000V Series switch can communicate with it.)
52
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG
Obtaining the Cisco VSG Software
Details about configuring VLANs and port profiles on the Cisco Nexus 1000V Series switch are available in the Cisco Nexus 1000V Series switch documentation.
Obtaining the Cisco VSG Software
You can obtain the Cisco VSG software files at this URL: http://software.cisco.com/download/navigator.html
Installing the Cisco VSG Software
You can install the Cisco VSG software on a VM by using an ISO image file from the CD.
Installing the Cisco VSG Software from an ISO File
Before you begin
Ensure that you have:
• Installed Microsoft SCVMM 2012 R2 or Microsoft SCVMM 2016.
• Downloaded the Cisco VSG ISO image and uploaded it to the server (C:\ProgramData\Virtual Machine
Manager Library Files\ISO). Refresh the library server under the Library tab.
• Cisco VSG-Data port profile: VSG-Data.
• Cisco VSG-ha port profile: VSG-ha.
• HA ID.
• IP/subnet mask/gateway information for the Cisco VSG.
• Admin password.
• 2 GB RAM and 3 GB hard disk space.
• Cisco PNSC IP address.
• The shared secret password.
• IP connectivity between Cisco VSG and Cisco PNSC.
• Cisco VSG NSC-PA image name (vnmc-vsgpa.2.1.2a.bin).
Step 1
Step 2
Step 3
Launch SCVMM.
On the VMs and Services tab, click Create Virtual Machine .
In the Create Virtual Machine Wizard, in the Select Source screen, check Create the new virtual machine with a blank virtual hard disk radio button, and click Next .
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
53
Installing the Cisco VSG
Installing the Cisco VSG Software from an ISO File
Step 4 In the Specify Virtual Machine Identity screen, enter the name for the Cisco VSG in the Virtual machine name field, and click Next.
Figure 13: Create Virtual Machine Wizard - Specify Virtual Machine Identity
Step 5 In the Configure Hardware section, do the following: a) Under General , choose Memory , choose the Static option, and enter 2048 MB in the Virtual machine memory field.
b) Under Bus Configuration , choose the primary disk and enter 3 in the Size (GB) field.
c) Choose the virtual DVD Drive, select the Existing ISO image file radio button and browse for the VSG ISO within the SCVMM Library.
d) Choose the Network Adapter drop-down near the top of the Create Virtual Machine Wizard and create two new
Network Adapters.
• Under the Network Adapters section, choose Network Adapter 1 , then choose Connected to a VM network and browse for the appropriate network corresponding to the network segment for the VSG's data interface.
54
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG
Installing the Cisco VSG Software from an ISO File
Step 6
Step 7
• From the Classification drop-down list, choose the port-profile corresponding to the VSG's data interface.
Note Repeat Step d to create network adapters for service interface.
In the Select Destination section, choose Place the virtual machine in a host and choose the host group on which you want to store the VSG from the drop-down and click Next .
In the Select Host section, select the host that you want to place the VSG on and click Next.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
55
Installing the Cisco VSG Software from an ISO File
Figure 14: Create Virtual Machine Wizard - Select Host
Installing the Cisco VSG
Step 8 In the Configure Settings section, review the virtual machine settings to ensure they are correct and click Next .
56
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG
Configuring Initial Settings
Step 9
Step 10
Step 11
Step 12
(Optional) In the Add Properties section, choose Other Linux (64-bit) from the Operating System drop-down list, and then click Next.
In the Summary section, click Create.
Choose the VSG in the VMs and Services tab and click Power On .
Connect to the VSG using Connect or View -> Connect via Console .
Configuring Initial Settings
This section describes how to configure the initial settings on Cisco VSG and configure a standby Cisco VSG with its initial settings. For configuring a standby Cisco VSG, see
Configuring Initial Settings on a Secondary
section.
You can connect to a VSG VM console through the SCVMM user interface by right-clicking a VM instance and connecting to it.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Navigate to the Console tab in the VM.
The Cisco Nexus 1000V Series switch opens the Console window and boots the Cisco VSG software.
At the Enter the password for "admin" prompt, enter the password for the admin account and press Enter .
At the prompt, confirm the admin password and press Enter .
At the Enter HA role[standalone/primary/secondary] prompt, enter the HA role that you want to use and press Enter .
This can be one of the following:
• standalone
• primary
• secondary
At the Enter the ha id(1-1024) prompt, enter the HA ID for the pair and press Enter .
Note If you entered secondary the primary system.
in the earlier step, the HA ID for this system must be the same as the HA ID for
If you want to perform basic system configuration, at the Would you like to enter the basic configuration dialog (yes/no) prompt, enter yes and press Enter , then complete the following steps.
a) At the Create another login account (yes/no)[n] prompt, do one of the following:
• To create a second login account, enter yes and press Enter .
• Press Enter .
b) (Optional) At the Configure read-only SNMP community string (yes/no)[n] prompt, do one of the following:
• To create an SNMP community string, enter yes and press Enter .
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
57
Installing the Cisco VSG
On the VSG, Configuring the Cisco Prime NSC Policy Agent
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
• Press Enter .
c) At the Enter the Virtual Security Gateway (VSG) name prompt, enter VSG-demo and press
Enter .
At the Continue with Out-of-band (mgmt0) management configuration? (yes/no)[y]: prompt, enter yes and press Enter .
At the Mgmt IPv4 address: prompt, enter 10.10.10.11
and press Enter .
At the Mgmt IPv4 netmask prompt, enter 255.255.255.0
and press Enter .
At the Configure the default gateway? (yes/no)[y] prompt, enter yes and press Enter .
At the Enable the telnet service? (yes/no)[y]: prompt, enter no and press Enter .
At the Configure the ntp server? (yes/no)[n] prompt, enter NTP server information and press Enter .
The following configuration will be applied:
Interface mgmt0 ip address 10.10.10.11 255.255.255.0
no shutdown vrf context management ip route 0.0.0.0/10.10.11.1
no telnet server enable ssh key rsa 768 force ssh server enable feature http-server ha-pair id 25
At the Would you like to edit the configuration? (yes/no)[n] prompt, enter n and press Enter .
At the Use this configuration and save it? (yes/no)[y]: prompt, enter y and press Enter .
At the VSG login prompt, enter the name of the admin account you want to use and press Enter .
The default account name is admin .
At the Password prompt, enter the name of the password for the admin account and press Enter .
You are now at the Cisco VSG node.
On the VSG, Configuring the Cisco Prime NSC Policy Agent
Once the Cisco PNSC is installed, you must register the VSG with the Cisco PNSC.
Note Cisco VSG is supported as VSB on Nexus Cloud Services platform only.
Before you begin
Make sure that you know the following:
• The Cisco PNSC policy-agent image is available on the VSG (for example, vnmc-vsgpa.2.1.2a.bin)
58
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG
On the VSG, Configuring the Cisco Prime NSC Policy Agent
Note The string vsghv-pa must appear in the image name as highlighted.
• The IP address of the Cisco PNSC.
• The shared secret password you defined during the Cisco PNSC installation.
• That IP connectivity between the VSG and the Cisco PNSC is working.
Note If you upgrade your VSG, you must also copy the latest Cisco VSG policy agent image. This image is available in the Cisco PNSC image bundle to boot from a flash drive and to complete registration with the Cisco PNSC.
Note VSG clock should be synchronized with the Cisco PNSC clock.
Step 1
Step 2
On the VSG, enter the following commands:
VSG-Firewall# configure terminal
Enter configuration commands, one per line.
End with CNTL/Z.
VSG-Firewall(config)# nsc-policy-agent
VSG-Firewall(config-nsc-policy-agent)# registration-ip 10.193.72.242
VSG-Firewall(config-nsc-policy-agent)# shared-secret Sgate123
VSG-Firewall(config-nsc-policy-agent)# policy-agent-image vnmc-vsgpa.2.1.2a.bin
VSG-Firewall(config-nsc-policy-agent)# copy running-config startup-config
[########################################] 100%
Copy complete, now saving to disk (please wait)...
VSG-Firewall(config-nsc-policy-agent)# exit
Check the status of the NSC policy agent configuration to verify that you have installed the Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that the Cisco PNSC is reachable and the installation is correct:
VSG-Firewall(config)# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(2a)-vsg
The VSG is now registered with the Cisco PNSC.
Example
This example shows that the Cisco PNSC is unreachable or an incorrect IP is configured: vsg# show nsc-pa status
NSC Policy-Agent status is - Installation Failure
Cisco PNSC not reachable.
vsg#
This example shows that the NSC policy-agent is not configured or installed:
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
59
Installing the Cisco VSG
Configuring Initial Settings on a Secondary Cisco VSG vsg# show nsc-pa status
NSC Policy-Agent status is - Not Installed
Configuring Initial Settings on a Secondary Cisco VSG
You can configure a standby Cisco VSG by logging in to the Cisco VSG you have identified as secondary and using the following procedure to configure a secondary Cisco VSG with its initial settings.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Navigate to the Console tab in the VM.
Cisco Nexus 1000V Series switch opens the Console window and boots the Cisco VSG software.
At the Enter the password for "admin" prompt, enter the password for the admin account and press Enter .
At the prompt, confirm the admin password and press Enter .
At the Enter HA role[standalone/primary/secondary] prompt, enter the secondary HA role and press
Enter .
At the Enter the ha id(1-1024) prompt, enter 25 for the HA pair Id and press Enter .
Note The HA ID uniquely identifies the two Cisco VSGs in an HA pair. If you are configuring Cisco VSGs in an
HA pair, make sure that the ID number you provide is identical to the other Cisco VSG in the pair.
At the VSG login prompt, enter the name of the admin account you want to use and press Enter .
The default account name is admin .
At the Password prompt, enter the name of the password for the admin account and press Enter .
You are now at the Cisco VSG node.
Verifying the Cisco VSG Configuration
To display the Cisco VSG configuration, perform this task:
Command Purpose show interface brief Displays a brief status and interface information.
This example shows how to verify the Cisco VSG configurations: firewall# show interface brief
--------------------------------------------------------------------------------
Port VRF Status IP Address Speed MTU
-------------------------------------------------------------------------------mgmt0 -up 10.2.71.43
-1500
--------------------------------------------------------------------------------
Port VRF Status IP Address Speed MTU
-------------------------------------------------------------------------------data0 -up -9000
60
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG
Where to Go Next
Where to Go Next
After installing and completing the initial configuration of the Cisco VSG, you can configure firewall policies on the Cisco VSG through the Cisco Prime NSC.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
61
Where to Go Next
Installing the Cisco VSG
62
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
5
Registering Devices with the Cisco Prime NSC
This chapter contains the following sections:
•
Registering a Cisco VSG, on page 63
•
Registering Cisco Nexus 1000V VSM , on page 64
Registering a Cisco VSG
You can register Cisco VSG with Cisco PNSC. Registration enables communication between the Cisco VSG and the Cisco PNSC.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Copy the vnmc-vsgpa.2.1.2a.bin file into the Cisco VSG bootflash: vsg# copy ftp://[email protected]/n1kv/vnmc-vsgpa.2.1.2a.bin bootflash
Enter global configuration mode.
vsg# configure
Enter nsc-policy-agent mode.
vsg (config)# nsc-policy-agent
Set the Cisco PNSC registration IP address.
vsg (config-nsc-policy-agent)# registration-ip 209.165.200.225
Specify the shared-secret of Cisco PNSC.
vsg (config-nsc-policy-agent)# shared-secret ********
Install the policy agent.
vsg (config-nsc-policy-agent)# policy-agent-image bootflash: vnmc-vsgpa.2.1.2a.bin
Exit all modes.
vsg (config-nsc-policy-agent)# end
On the Cisco VSG command line, display the NSC PA status:
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
63
Registering Devices with the Cisco Prime NSC
Registering Cisco Nexus 1000V VSM
Step 9 vsg# show nsc-pa status
If registration was successful, you should see the following message:
"NSC Policy-Agent status is - Installed Successfully. Version 2.1(2a)-vsg"
The Cisco VSG registration is complete.
Copy the running configuration to the startup configuration: vsg# copy running-config startup-config
Executing this command ensures that the registration becomes part of the basic configuration
Registering Cisco Nexus 1000V VSM
You can register Cisco Nexus 1000V with Cisco PNSC. Registration enables communication between the
Cisco Nexus 1000V VSM and Cisco PNSC.
SUMMARY STEPS
1.
Copy the vsmhv-pa.3.2.1e.bin file into the VSM bootflash:
2.
Enter global configuration mode.
3.
Enter config nsc-policy-agent mode.
4.
Set the Cisco PNSC registration IP address.
5.
Specify the shared-secret of Cisco PNSC.
6.
Install the policy agent.
7.
Exit all modes.
8.
Display the NSC PA status:
9.
Copy the running configuration to the startup configuration:
DETAILED STEPS
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Copy the vsmhv-pa.3.2.1e.bin file into the VSM bootflash: vsm# copy ftp://[email protected]/n1kv/vsmhv-pa.3.2.1e.bin bootflash:
Enter global configuration mode.
vsm# configure
Enter config nsc-policy-agent mode.
vsm(config)# nsc-policy-agent
Set the Cisco PNSC registration IP address.
vsm(config-nsc-policy-agent)# registration-ip 209.165.200.226
Specify the shared-secret of Cisco PNSC.
vsm(config-nsc-policy-agent)# shared-secret ********
Install the policy agent.
vsm(config-nsc-policy-agent)# policy-agent-image bootflash:vsmhv-pa.3.2.1e.bin
64
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Registering Devices with the Cisco Prime NSC
Registering Cisco Nexus 1000V VSM
Step 7
Step 8
Step 9
Exit all modes.
vsm(config-nsc-policy-agent)# top
Display the NSC PA status: vsm# show nsc-pa status
If registration was successful, you should see the following message:
NSC Policy-Agent status is - Installed Successfully. Version 3.2(1e)-vsg
The Cisco Nexus 1000V VSM registration is complete.
Copy the running configuration to the startup configuration: vsm# copy running-config startup-config
Executing this command ensures that the registration becomes part of the basic configuration.
What to do next
See the Cisco Virtual Management Center CLI Configuration Guide for detailed information about configuring the Cisco PNSC using the CLI.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
65
Registering Cisco Nexus 1000V VSM
Registering Devices with the Cisco Prime NSC
66
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
6
Installing the Cisco VSG on a Cisco Cloud Service
Platform Virtual Services Appliance
This chapter contains the following sections:
•
Information About Installing the Cisco VSG on the Cisco Cloud Service Platform, on page 67
•
Prerequisites for Installing Cisco VSG on the Cisco Cloud Service Platform, on page 68
•
Guidelines and Limitations, on page 68
•
Installing Cisco VSG on a Cisco Cloud Service Platform, on page 69
Information About Installing the Cisco VSG on the Cisco Cloud
Service Platform
The Cisco VSG software is provided with the other virtual service blade (VSB) software in the Cisco Cloud
Service Platform bootflash: repository directory. The Cisco Cloud Service Platform has up to six virtual service blades (VSBs) on which you can choose to place a Cisco VSG, VSM, or Network Analysis Module
(NAM).
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
67
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
Prerequisites for Installing Cisco VSG on the Cisco Cloud Service Platform
Figure 15: Cisco Cloud Service Platform Architecture Showing Virtual service Blades Usage
Prerequisites for Installing Cisco VSG on the Cisco Cloud
Service Platform
• You must first install the Cisco Cloud Service Platform Virtual Services Appliance and connect it to the network. For procedures on installing the hardware, see the Cisco Cloud Service Platform Virtual Services
Appliance Hardware Installation Guide .
• After you install the hardware appliance and connect it to the network, you can configure the Cisco Cloud
Service Platform management software and create and configure new VSBs that might host the Cisco
VSG. For procedures on configuring the software, see the Cisco Cloud Service Platform Software
Configuration Guide .
Guidelines and Limitations
• The Cisco Cloud Service Platform appliance and its hosted Cisco VSG VSBs must share the same management VLAN.
• Unlike the data and high availability (HA) VLANs that are set when a Cisco VSG VSB is created, a
Cisco VSG VSB inherits its management VLAN from the Cisco Cloud Service Platform.
Caution Do not change the management VLAN on a VSB. Because the management
VLAN is inherited from the Cisco Cloud Service Platform, any changes to the management VLAN are applied to both the Cisco Cloud Service Platform and all of its hosted VSBs.
68
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
Installing Cisco VSG on a Cisco Cloud Service Platform
Installing Cisco VSG on a Cisco Cloud Service Platform
You can install the Cisco VSG on a Cisco Cloud Service Platform as a virtual service blade (VSB).
Before you begin
• Log in to the CLI in EXEC mode.
• Know the name of the Cisco VSG VSB that you want to create.
• Whether you are using a new ISO file from the bootflash repository folder or from an existing VSB, do one of the following:
– If you are using a new ISO file in the bootflash repository, you know the filename, for example, nexus-1000v.5.2.1.VSG2.1.2a.iso
– If you are using an ISO file from an existing VSB, you must know the name of the VSB type. This procedure includes information about identifying this name.
• Know the following properties for the Cisco VSG VSB:
– HA ID Management IP address
– Cisco VSG name
– Management subnet mask length
– Default gateway IPv4 address
– Administrator password
– Data and HA VLAN IDs
• This procedure shows you how to identify and assign data and HA VLANs for the Cisco VSG VSB. Do not assign a management VLAN because the management VLAN is inherited from the Cisco Cloud
Service Platform.
SUMMARY STEPS
1.
switch# configure terminal
2.
(config)# virtual-service-blade name
3.
(config-vsb-config)# description description
4.
(config-vsb-config)# virtual-service-blade-type [ name name | new iso file name ]
5.
(config-vsb-config)# interface name vlan vlanid
6.
(config-vsb-config)# no shutdown
7.
(config-vsb-config)# interface name vlan vlanid
8.
(config-vsb-config)# enable [primary | secondary]
9.
(config-vsb-config)# show virtual-service-blade name name
10.
(Optional) (config-vsb-config)# copy running-config startup-config
DETAILED STEPS
Step 1 switch# configure terminal
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
69
Installing Cisco VSG on a Cisco Cloud Service Platform
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Enters global configuration mode.
(config)# virtual-service-blade name
Creates the named VSB and places you in to configuration mode for that service. The name can be an alphanumeric string of up to 80 characters.
(config-vsb-config)# description description
(Optional) Adds a description to the Cisco VSG VSB.
The description is an alphanumeric string of up to 80 characters.
(config-vsb-config)# virtual-service-blade-type [ name name | new iso file name ]
Specifies the type and name of the software image file to add to this Cisco VSG VSB:
• Use the new keyword to specify the name of the new Cisco VSG ISO software image file in the bootflash repository folder.
• Use the name keyword to specify the name of the existing Cisco VSG VSB type. Enter the name of an existing type found in the command output.
(config-vsb-config)# interface name vlan vlanid
Applies the interface and VLAN ID to this Cisco VSG. Use the interface names from the command output.
Note If you try to apply an interface that is not present, the following error is displayed:
ERROR: Interface name not found in the associated virtual-service-blade type.
Caution Do not assign a management VLAN. Unlike data and HA VLANs, the management VLAN is inherited from the Cisco Cloud Service Platform.
Caution To prevent loss of connectivity, you must configure the same data and HA VLANs on the hosted Cisco VSGs.
(config-vsb-config)# no shutdown
Enables the interface.
(config-vsb-config)# interface name vlan vlanid
Applies the interface and VLAN ID to this Cisco VSG. Use the interface names from the command output.
Note If you try to apply an interface that is not present, the following error is displayed:
ERROR: Interface name not found in the associated virtual-service-blade type.
Caution Do not assign a management VLAN. Unlike data and HA VLANs, the management VLAN is inherited from the Cisco Cloud Service Platform.
Caution To prevent loss of connectivity, you must configure the same data and HA VLANs on the hosted Cisco VSGs.
(config-vsb-config)# enable [primary | secondary]
Initiates the configuration of the VSB and then enables it.
If you enter the enable command without the optional primary or secondary keywords, it enables both.
70
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
Installing Cisco VSG on a Cisco Cloud Service Platform
Step 9
Step 10
If you are deploying a redundant pair, you do not need to specify primary or secondary.
If you are enabling a nonredundant VSB, you can specify its HA role as follows:
• Use the primary keyword to designate the VSB in a primary role.
• Use the secondary keyword to designate the VSB in a secondary role.
The Cisco Cloud Service platform prompts you for the following:
• HA ID
• Management IP address
• Management subnet mask length
• Default gateway IPv4 address
• Cisco VSG name
• Administrator password
(config-vsb-config)# show virtual-service-blade name name
(Optional) Displays the new VSB for verification.
While the Cisco Cloud Service Platform management software is configuring the Cisco VSG, the output for this command progresses from in progress to powered on.
(Optional) (config-vsb-config)# copy running-config startup-config
Saves the running configuration persistently through reboots and restarts by copying it to the startup configuration.
Example
This example shows how to configure a Cisco Cloud Service Platform appliance VSB as a Cisco
VSG: csp# configure
Enter configuration commands, one per line. End with CNTL/Z.
N1010-63(config)# virtual-service-blade vsg-1
N1010-63(config)# description vsg-1 for Tenant1
N1010-63(config-vsb-config)# virtual-service-blade-type new nexus-1000v.5.2.1.VSG2.1.2a.iso
N1010-63(config-vsb-config)# interface data vlan 923
N1010-63(config-vsb-config)# interface ha vlan 930
N1010-63(config-vsb-config)# no shutdown
N1010-63(config-vsb-config)# enable
Enter vsb image: [nexus-1000v.5.2.1.VSG2.1.2a.iso]
Enter HA id[1-4095]: 1002
Management IP version [V4/V6]: [ V4 ]
Enter Management IP address: 10.2.71.117
Enter Management subnet mask: 255.255.255.0
IPv4 address of the default gateway: 10.2.0.1
Enter HostName: VSG-1
Enter the password for 'admin': Hello123
N1010-63(config-vsb-config)# exit
N1010-63)#
This example show how to install the Cisco VSG on a Cisco Cloud Service Platform as a VSB.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
71
Installing Cisco VSG on a Cisco Cloud Service Platform
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
N1010-63# configure
N1010-63(config)# virtual-service-blade vsg-1
N1010-63(config-vsb-config)# show virtual-service-blade-type summary
-------------------------------------------------------------------------------
Virtual-Service-Blade-Type Virtual-Service-Blade
-------------------------------------------------------------------------------
VSG-2.1
VSG-NH-hpv hyperv-soak
VSG-354
VSG-357 vsg-1
N1010-63(config-vsb-config)# virtual-service-blade-type new nexus-1000v.5.2.1.VSG2.1.2a.iso
or
N1010-63(config-vsb-config)# show virtual-service-blade name vsg-1
N1010-63(config-vsb-config)# description vsg-1 for Tenant1
N1010-63(config-vsb-config)# show virtual-service-blade name vsg-1
------------------------------------------------------------------------------virtual-service-blade vsm2
Description:
Slot id: 2
Host Name:
Management IP:
VSB Type Name : VSG-2.1
Interface: ha vlan: 0
Interface: management vlan: 231
Interface: data vlan: 0
Interface: internal vlan: NA
Ramsize: 2048
Disksize: 3
Heartbeat: 0
HA Admin role: Primary
HA Oper role: NONE
Status: VSB NOT PRESENT
Location: PRIMARY
SW version:
HA Admin role: Secondary
HA Oper role: NONE
Status: VSB NOT PRESENT
Location: SECONDARY
SW version:
VSB Info:
-------------------------------------------------------------------------------
N1010-63(config-vsb-config)# interface data vlan 1044 or
N1010-63(config-vsb-config)# interface ha vlan 1045
N1010-63(config-vsb-config)# enable
-------------------------------------------------------------------------------
Enter domain id[1-1024]: 1014
Enter Management IP address: 10.78.108.40
Enter Management subnet mask length 28
IPv4 address of the default gateway: 10.78.108.117
Enter Switchname: VSG-1
Enter the password for 'admin': Hello_123
-------------------------------------------------------------------------------
N1010-63(config-vsb-config)# show virtual-service-blade name vsg-1
Description:
Slot id:
Host Name:
4
VSG-Fire-hpv
72
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
Installing Cisco VSG on a Cisco Cloud Service Platform
Management IP: 10.78.108.40
VSB Type Name : VSG-1.2
Configured vCPU:
Operational vCPU:
Configured Ramsize:
1
1
2048
Operational Ramsize:
Disksize: 3
Heartbeat: 521511
2048
Legends: P Passthrough
--------------------------------------------------------------------------
Interface Type MAC VLAN State Uplink-Int
Pri Sec Oper Adm
--------------------------------------------------------------------------
VsbEthernet4/1 data 0002.3d70.3f0c
1044 up up Po3 Po3
VsbEthernet4/2
VsbEthernet4/3 management 0002.3d70.3f0b
internal
HA Role: Primary
HA Status: ACTIVE ha 0002.3d70.3f0d
NA NA
231
1045
NA up up up Po1 up Po2 up up
Po1
Po2
Status:
Location:
VSB POWERED ON
PRIMARY
SW version: 5.2(1)VSG2(1.2a)
HA Role: Secondary
HA Status: STANDBY
Status:
Location:
VSB POWERED ON
SECONDARY
SW version: 5.2(1)VSG2(1.2a)
VSB Info:
Domain ID : 1054
-------------------------------------------------------------------------------
N1010-63(config-vsb-config)# copy running-config startup-config
This example shows how to display a virtual service blade summary on the Cisco Cloud Service
Platform:
N1010-63(config-vsb-config)# show virtual-service-blade summary
-------------------------------------------------------------------------------
Name HA-Role HA-Status Status Location
-------------------------------------------------------------------------------
VSG-NH-hpv
VSG-NH-hpv
PRIMARY ACTIVE
SECONDARY STANDBY
VSB POWERED ON
VSB POWERED ON
PRIMARY
SECONDARY hyperv-soak hyperv-soak
VSG-354
VSG-354
VSG-1
VSG-1
PRIMARY
SECONDARY
PRIMARY
NONE
NONE
ACTIVE
SECONDARY STANDBY
PRIMARY
SECONDARY
ACTIVE
STANDBY
VSB NOT PRESENT
VSB NOT PRESENT
VSB POWERED ON
VSB POWERED ON
VSB POWERED ON
VSB POWERED ON
PRIMARY
SECONDARY
PRIMARY
SECONDARY
PRIMARY
SECONDARY
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
73
Installing Cisco VSG on a Cisco Cloud Service Platform
Installing the Cisco VSG on a Cisco Cloud Service Platform Virtual Services Appliance
74
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
C H A P T E R
7
Upgrading the Cisco VSG and the Cisco Prime
NSC
This chapter contains the following sections:
•
Complete Upgrade Procedure, on page 75
•
Upgrade Guidelines and Limitations, on page 76
•
Upgrade Procedure for Cisco VSG Release 5.2(1)VSG2(1.1b) to Release 5.2(1)VSG2(1.2b), Cisco Prime
NSC Release 3.2 to Cisco Prime NSC Release 3.4 and Cisco Nexus 1000V Release 5.2(1)SM1(5.2b) to
Release 5.2(1)SM3(1.1), on page 77
Complete Upgrade Procedure
Table 3: Refer to the Section in Table Based on your Pre-upgrade Product Release
You are Upgrading From
Cisco VSG Release 5.2(1)VSG2(1.1b) to Release
5.2(1)VSG2(1.2b) and Cisco PNSC Release 3.2 to
Cisco PNSC Release 3.4.
Follow The Sequential Steps in the Following Section:
Upgrade Procedures for Cisco VSG Release
5.2(1)VSG2(1.1b) to Release 5.2(1)VSG2(1.2b) and
Cisco PNSC Release 3.2 to Cisco PNSC Release 3.4.
This includes upgrade procedures for Cisco Nexus
1000V Release 5.2(1)SM1(5.2b) to Release
5.2(1)SM3(1.1).
To upgrade the Cisco PNSC, Cisco VSG, and Cisco Nexus 1000V, follow the steps sequentially:
1.
Stage 1: Upgrading Cisco PNSC
2.
Stage 2: Upgrading a Cisco VSG Pair
3.
Stage 3: Upgrading the VSM pair and the VEMs
Note We highly recommend that you upgrade the Cisco VSG and the Cisco PNSC in the sequence listed. Any deviation from the ordered steps could cause disruption of your connectivity and data communication. The
Cisco PNSC must be upgraded with the corresponding policy agent (PA).
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
75
Upgrading the Cisco VSG and the Cisco Prime NSC
Information About Cisco Prime NSC Upgrades
Information About Cisco Prime NSC Upgrades
When you upgrade the Cisco PNSC software, all current (command-line interface) CLI and (graphical user interface) GUI sessions are interrupted, which means that you must restart any CLI or GUI sessions.
Information About Cisco VSG Upgrades
The upgrade procedure for Cisco VSG in standalone or HA mode is hitful, which means that you must manually reload the Cisco VSG for the new image to become effective.
Because license information is not stored with the Cisco VSG but is maintained between the Virtual Supervisor
Module (VSM) and Virtual Ethernet Module (VEM), if packets are received at the Cisco VSG, that means that the license is valid and the packets are processed.
An upgrade affects two bin files: the kickstart file and the system file.
An upgrade does not erase any of the existing information, when the Cisco VSG comes online. Because the
Cisco VSG is stateless, it gets all this information from the Cisco PNSC at bootup.
Upgrade Guidelines and Limitations
Before upgrading the Cisco PNSC, Cisco VSG, and Cisco Nexus 1000V, read the following:
• We highly recommend that you upgrade the Cisco VSG and the Cisco PNSC in the order provided. Any deviation from the ordered steps could cause disruption of your connectivity and data communication.
The Cisco PNSC must be upgraded with the corresponding policy agent (PA).
• Before upgrading to a new VSG version with VSG Universal License (UL), make sure that you change
VSM mode to advanced and save the configuration. Installing VSG with UL without changing the VSM mode to advanced may cause VSG service failure.
• We recommend that you take a snapshot or backup (clone) of the original Cisco PNSC and VSM prior to the upgrade process and then perform an ISSU upgrade process on the VSM. We do not recommend that you perform a manual upgrade.
• For a full In-service Software Upgrade (ISSU) upgrade on VSM, follow these rules:
• Install the Cisco PNSC before installing the VSM. The ISSU upgrade installs a new PA.
• A new PA with an old Cisco PNSC is not supported and there should never be an interim stage in this state.
• A copy run start is not required after the VSM upgrade.
• Upgrade instructions include the following information:
• Different stages of complete upgrade procedures and operations which are supported at different stages.
• Different component versions after each stage.
• Different operations supported after each stage.
76
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrade Procedure for Cisco VSG Release 5.2(1)VSG2(1.1b) to Release 5.2(1)VSG2(1.2b), Cisco Prime NSC Release 3.2 to Cisco Prime NSC Release 3.4 and
Cisco Nexus 1000V Release 5.2(1)SM1(5.2b) to Release 5.2(1)SM3(1.1)
Upgrade Procedure for Cisco VSG Release 5.2(1)VSG2(1.1b) to
Release 5.2(1)VSG2(1.2b), Cisco Prime NSC Release 3.2 to Cisco
Prime NSC Release 3.4 and Cisco Nexus 1000V Release
5.2(1)SM1(5.2b) to Release 5.2(1)SM3(1.1)
Cisco VSG Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b) and Cisco Prime NSC
3.2 to Cisco Prime NSC 3.4 Staged Upgrade
Virtual
Appliance
Original State Stage 1: Cisco PNSC
Upgrade only (no PAs upgraded)
Stage 2: Cisco VSG
Upgrade
Stage 3: VSM/VEM
Upgrade
Cisco PNSC
Cisco VSG
Old Cisco
Prime NSC 3.2
New Cisco Prime NSC
3.4
New Cisco Prime NSC
3.4
New Cisco Prime NSC
3.4
Old
5.2(1)VSG2(1.1b)
Old 5.2(1)VSG2(1.1b) New 5.2(1)VSG2(1.2b) New 5.2(1)VSG2(1.2b)
VSG PA
VSM
VEM
Old 2.1.1e
Old 2.1.1e
Old
5.2(1)SM1(5.2b)
Old 5.2(1)SM1(5.2b)
Old
5.2(1)SM1(5.2b)
Old 5.2(1)SM1(5.2b)
Old 3.2.1c
Old 3.2.1c
VSM PA
Supported operations after upgrading to each stage
All operations supported
• Existing data sessions
(offloaded).
• New data sessions.
• Allows Cisco
Nexus 1000V switch
(non-vservice) operations including non-vservice port profiles.
New 2.1.2a
Old 5.2(1)SM1(5.2b)
Old 5.2(1)SM1(5.2b)
Old 3.2.1c
• Short disruption in new data session establishment during the Cisco
VSG upgrade.
• Other operations are fully supported.
• Full Layer 3 VSG and VM VLAN support.
New 2.1.2a
New 5.2(1)SM3(1.1)
New 5.2(1)SM3(1.1)
New 3.2.1e
• All operations are supported if all the upgrades including
VEMs are successful.
• Restricted operations (below) apply only if all
VEMs are not upgraded
• Disruption of data traffic during
VEM upgrades.
• Layer 3 VSG and
VM VLAN support.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
77
Upgrading the Cisco VSG and the Cisco Prime NSC
Cisco VSG Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b) and Cisco Prime NSC 3.2 to Cisco Prime NSC 3.4 Staged Upgrade
Virtual
Appliance
Original State Stage 1: Cisco PNSC
Upgrade only (no PAs upgraded)
Restricted operations after upgrading to each stage
None • No Cisco PNSC policy cfg change
(assuming silent drops).
• No VSM/VEM vservice VM operations
(shutdown/bring up existing vservice VMs, bring down net adapters, etc).
• No new vservice
VMs is supported.
• No Vmotion of vservice firewalled
VMs on N1k
• No vservice PP operations or modifications
(toggles, removal, changing the PP on VSM).
• VSG failover not supported, VSM failover
(vns-agent) not supported (All
VSM to Cisco
PNSC to VSG control operations are restricted).
Stage 2: Cisco VSG
Upgrade
Stage 3: VSM/VEM
Upgrade
• No Cisco PNSC policy cfg change
(assuming silent drops).
The following restricted operations apply only if all VEMs are not upgraded:
• No VSM/VEM vservice VM operations
(shutdown/bring up existing vservice VMs, bring down net adapters, etc).
• No new vservice
VMs is supported.
• No Vmotion of vservice firewalled
VMs on N1k.
• No Cisco PNSC policy cfg change
(assuming silent drops).
• No VSM/VEM vservice VM operations
(shutdown/bring up existing vservice VMs, bring down net adapters, etc).
• No new vservice
VMs is supported.
• No vservice PP operations or modifications
(toggles, removal, changing the PP on VSM).
• No boot strap of devices (VNMC,
VSM,VSG).
• No Vmotion of vservice VMs on
N1k.
• VSG failover not supported, VSM failover
(vns-agent) not supported (All
VSM to Cisco
PNSC to VSG control operations are restricted).
• No vservice PP operations or modifications
(toggles, removal, changing the PP on
VSM).
• No N1k switch
(non vservice) operations, including non-vservice PPs
(VSM+VEM ugraded) (All
VSM to Cisco
PNSC to VSG control operations are restricted).
78
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading Cisco Prime NSC 3.2 to Cisco Prime NSC 3.4
Upgrading Cisco Prime NSC 3.2 to Cisco Prime NSC 3.4
Before you begin
• You are logged in to the CLI in EXEC mode.
• You have backed up the new software files to a remote server and have verified that the backup file was created on the remote server.
• You must have the Cisco PNSC Release 3.4 downloaded.
• You have added two hard disks to the Cisco PNSC VM. For more information on Cisco PNSC requirements, see
System Requirements, on page 7
.
SUMMARY STEPS
Step 3
1.
nsc# connect local-mgmt
2.
(Optional) nsc (local-mgmt)# show version
3.
(Optional) nsc (local-mgmt)# copy scp://user@example-server-ip/example-dir/filename bootflash:/
4.
nsc (local-mgmt)# dir bootflash:/
5.
nsc (local-mgmt)# update bootflash:/filename
6.
(Optional) nsc (local-mgmt)# service status
7.
(Optional) nsc (local-mgmt)# show version
DETAILED STEPS
Step 1
Step 2
Command or Action nsc# connect local-mgmt
(Optional) nsc (local-mgmt)# show version
Purpose
Places you in local management mode.
Displays the version information for the Cisco PNSC software.
Copies the Cisco PNSC software file to the VM.
Step 4
Step 5
Step 6
Step 7
(Optional) nsc (local-mgmt)# copy
scp://user@example-server-ip/example-dir/filename bootflash:/ nsc (local-mgmt)# dir bootflash:/ nsc (local-mgmt)# update bootflash:/filename
(Optional) nsc (local-mgmt)# service status
(Optional) nsc (local-mgmt)# show version
Verifies that the desired file is copied in the directory.
Begins the update of the Cisco PNSC software.
Allows you to verify that the server is operating as desired.
Allows you to verify that the Cisco PNSC software version is updated.
Note After you upgrade to Cisco PNSC Release 3.4, you might see the previous version of Cisco
PNSC in your browser. To view the upgraded version, clear the browser cache and browsing history in the browser. This note applies to all supported browsers: Internet Explorer, Mozilla
Firefox, and Chrome.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
79
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading Cisco Prime NSC 3.2 to Cisco Prime NSC 3.4
Configuration Example
The following example shows how to connect to the local-mgmt mode: nsc# connect local-mgmt
Cisco Prime Network Services Controller
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2013, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained in this software are owned by other third parties and used and distributed under license. Certain components of this software are licensed under the GNU General Public License (GPL) version 2.0 or the GNU
Lesser General Public License (LGPL) Version 2.1. A copy of each such license is available at http://www.opensource.org/licenses/gpl-2.0.php and http://www.opensource.org/licenses/lgpl-2.1.php
The following example shows how to display version information for the Cisco PNSC: nsc(local-mgmt)# show version
Name Package Version
---- ------- ------- ---core service-reg policy-mgr resource-mgr
Base System
Service Registry
Policy Manager
Resource Manager
3.2)
3.2
3.2
3.2
vm-mgr VM manager 3.2
cloudprovider-mgr Cloud Provider Mgr 3.2
GUI
3.2
3.2
3.2
3.2
none none
The following example shows how to copy the Cisco PNSC software to the VM: nsc(local-mgmt)# copy scp://<user@example-server-ip>/example1-dir/nsc.3.4.bin bootflash:/
Enter password:
100% 143MB 11.9MB/s 00:12
The following example shows how to see the directory information for Cisco PNSC: nsc(local-mgmt)# dir bootflash:/
1.1G Oct 14 00:57 nsc.3.4.bin
Usage for bootflash://
6359716 KB used
10889320 KB free
18187836 KB total
The following example shows how to start the update for the Cisco PNSC: nsc(local-mgmt)# update bootflash:/nsc.3.4.bin
It is recommended that you perform a full-state backup before updating any VNMC component.
Press enter to continue or Ctrl-c to exit.
The following example shows how to display the updated version for the Cisco PNSC: nsc(local-mgmt)# show version
Name Package
---- ------- ------- ---core Base System service-reg Service Registry policy-mgr resource-mgr
Policy Manager
Resource Manager
Version
3.4
3.4
3.4
3.4
3.4
3.4
3.4
3.4
GUI
80
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading Cisco VSG from Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b) vm-mgr VM manager 3.4
cloudprovider-mgr Cloud Provider Mgr 3.4
none none
Upgrading Cisco VSG from Release 5.2(1)VSG2(1.1b) to 5.2(1)VSG2(1.2b)
This section includes the following topics:
•
Cisco VSG Software Upgrade Guidelines, on page 81
•
Upgrade a VSG Pair in HA Mode, on page 81
•
Upgrading a Device for Standalone VSG, on page 84
•
Re-registering the Policy Agent with the Upgraded VSG, on page 86
Before you begin
• You are logged in to the CLI in EXEC mode.
• You have closed all the active VSG configuration sessions before upgrading the Cisco VSG software.
• You have copied the kickstart and system images from the remote server to the Cisco Nexus 1000V.
Cisco VSG Software Upgrade Guidelines
Follow these VSG upgrade guidelines while upgrading the VSG:
• Schedule the upgrade when the network is stable. Ensure that nobody is configuring the switch during the upgrade.
• Ensure that sufficient space is available for copying the upgrade images. A minimum of 200 MB of free bootflash space is required on both the active and standby VSGs.
• Avoid power interruptions to the hosts running the VSG VMs during any installation procedure.
• Ensure that the management (mgmt0) interface of the VSG is working and accessible.
• Ensure that the specified system and kickstart images are compatible with each other.
• Verify connectivity to the remote server by using the ping command.
Upgrade a VSG Pair in HA Mode
You can upgrade VSG pair in the High Availability (HA) mode.
SUMMARY STEPS
1.
Log in to the active VSG.
2.
Display the current boot variables.
3.
Verify that required space is available to copy the image files. Delete unnecessary files if required to create more space available for copying the new VSG image.
4.
Verify that required space is available on the standby VSG. Delete unnecessary files if required to create more space available for copying the new VSG image.
5.
Copy the Cisco Nexus 1000V kickstart and system software files to a server.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
81
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrade a VSG Pair in HA Mode
6.
Remove current boot variables.
7.
Display the current boot variables.
8.
Load the new boot variables and copy the running configuration to the startup configuration.
9.
Manually reboot the system.
10.
After the installation operation completes, log in and verify that the switch is running the upgraded software version.
DETAILED STEPS
Step 1
Step 2
Step 3
Step 4
Step 5
Log in to the active VSG.
Display the current boot variables.
vsg# show boot
Current Boot Variables: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
Boot Variables on next reload: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
Verify that required space is available to copy the image files. Delete unnecessary files if required to create more space available for copying the new VSG image.
.
.
vsg(config)# dir
.
Usage for bootflash://
692117504 bytes used
5711851520 bytes free
6403969024 bytes total
Verify that required space is available on the standby VSG. Delete unnecessary files if required to create more space available for copying the new VSG image.
vsg(config)# dir bootflash://sup-standby/
.
.
.
Usage for bootflash://sup-standby
577372160 bytes used
5826600960 bytes free
6403973120 bytes total
Copy the Cisco Nexus 1000V kickstart and system software files to a server.
82
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrade a VSG Pair in HA Mode
Step 6
Step 7
Step 8
Step 9
Step 10 vsg(config)# copy scp://[email protected]/downloads/nexus-1000v-kickstart.5.2.1.VSG2.1.2b.bin
./ vsg(config)# copy scp://[email protected]/downloads/nexus-1000v.5.2.1.VSG2.1.2b.bin ./
Remove current boot variables.
vsg(config)# no boot system vsg(config)# no boot kickstart
Display the current boot variables.
vsg(config)# show boot
Current Boot Variables: sup-1 kickstart variable not set system variable not set sup-2 kickstart variable not set system variable not set
No module boot variable set
Boot Variables on next reload: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
Load the new boot variables and copy the running configuration to the startup configuration.
vsg# configure terminal vsg(config)# boot system bootflash:///nexus-1000v.5.2.1.VSG2.1.2b.bin
vsg(config)# boot kickstart bootflash:///nexus-1000v-kickstart.5.2.1.VSG2.1.2b.bin
vsg(config)# copy running-config startup-config
Manually reboot the system.
vsg(config)# reload
This command will reboot the system. (y/n)?
[n]
If you want to continue with the reboot, press Y.
Note The system reboot takes approximately 10 seconds.
After the installation operation completes, log in and verify that the switch is running the upgraded software version.
Note The new software version will reflect after you reload the system.
switch# show version
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_home.html
Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at http://www.gnu.org/licenses/gpl.html.
Software loader: version unavailable [last: image booted through mgmt0]
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
83
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading a Device for Standalone VSG kickstart: version 5.2(1)VSG2(1.2b) system: version 5.2(1)VSG2(1.2b) system image file is: system compile time: bootflash:///nexus-1000v.5.2.1.VSG2.1.2b.bin
12/6/2013 16:00:00 [12/10/2014 21:10:51]
Hardware cisco Nexus 1000V Chassis ("Virtual Supervisor Module")
Intel(R) Xeon(R) CPU E5-2609 with 1933768 kB of memory.
Processor Board ID T155D4BC001
Device name: VSG_Fire bootflash: 1451180 kB
Kernel uptime is 1 day(s), 16 hour(s), 30 minute(s), 38 second(s) plugin
Core Plugin, Ethernet Plugin, Virtualization Plugin vsg #
Upgrading a Device for Standalone VSG
SUMMARY STEPS
1.
Log in to the active VSG.
2.
Use the show boot command to display the current boot variables.
3.
Verify that required space is available to copy the image files. Delete unnecessary files if required to create more space available for copying the new VSG image.
4.
Copy the Cisco VSG kickstart and system software files to a server.
5.
Remove current boot variables.
6.
Display the current boot variables.
7.
Load the new boot variables and copy the running configuration to the startup configuration.
8.
Manually reboot the system.
9.
After the installation operation completes, log in and verify that the switch is running the upgraded software version.
DETAILED STEPS
Step 1
Step 2
Log in to the active VSG.
Use the show boot command to display the current boot variables.
vsg# show boot
Current Boot Variables: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
84
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading a Device for Standalone VSG
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Boot Variables on next reload: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
Verify that required space is available to copy the image files. Delete unnecessary files if required to create more space available for copying the new VSG image.
vsg(config)# dir
.
.
.
Usage for bootflash://
692117504 bytes used
5711851520 bytes free
6403969024 bytes total
Copy the Cisco VSG kickstart and system software files to a server.
vsg(config)# copy scp://[email protected]/downloads/nexus-1000v-kickstart.5.2.1.VSG2.1.2b.bin
./ vsg(config)# copy scp://[email protected]/downloads/nexus-1000v.5.2.1.VSG2.1.2b.bin ./
Remove current boot variables.
vsg(config)# no boot system vsg(config)# no boot kickstart
Display the current boot variables.
vsg(config)# show boot
Current Boot Variables: sup-1 kickstart variable not set system variable not set sup-2 kickstart variable not set system variable not set
No module boot variable set
Boot Variables on next reload: sup-1 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
sup-2 kickstart variable = bootflash:/nexus-1000v-kickstart.5.2.1.VSG2.1.1b.bin
system variable = bootflash:/nexus-1000v.5.2.1.VSG2.1.1b.bin
No module boot variable set
Load the new boot variables and copy the running configuration to the startup configuration.
vsg# configure terminal vsg(config)# boot system bootflash:///nexus-1000v.5.2.1.VSG2.1.2b.bin
vsg(config)# boot kickstart bootflash:///nexus-1000v-kickstart.5.2.1.VSG2.1.2b.bin
vsg(config)# copy running-config startup-config
Manually reboot the system.
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
85
Upgrading the Cisco VSG and the Cisco Prime NSC
Re-registering the Policy Agent with the Upgraded VSG
Step 9 vsg(config)# reload
This command will reboot the system. (y/n)?
[n]
If you want to continue with the reboot, press Y.
Note The system reboot takes approximately 10 seconds.
After the installation operation completes, log in and verify that the switch is running the upgraded software version.
Note The new software version will reflect after you reload the system.
switch# show version
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_home.html
Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at http://www.gnu.org/licenses/gpl.html.
Software loader: version unavailable [last: image booted through mgmt0] kickstart: version 5.2(1)VSG2(1.2b) system: version 5.2(1)VSG2(1.2b) system image file is: bootflash:///nexus-1000v.5.2.1.VSG2.1.2b.bin
system compile time: 11/10/2014 16:00:00 [11/10/2014 21:10:51]
Hardware cisco Nexus 1000V Chassis ("Virtual Supervisor Module")
Intel(R) Xeon(R) CPU E5-2609 with 1933768 kB of memory.
Processor Board ID T155D4BC001
Device name: VSG_Fire bootflash: 1451180 kB
Kernel uptime is 1 day(s), 16 hour(s), 30 minute(s), 38 second(s) plugin
Core Plugin, Ethernet Plugin, Virtualization Plugin vsg #
Re-registering the Policy Agent with the Upgraded VSG
You need to re-register the policy agent after upgrading the Cisco VSG.
SUMMARY STEPS
1.
Log in to the active VSG.
2.
Check the current policy agent version.
3.
Enter the configuration mode.
4.
Unregister the old policy agent from VSG.
5.
Register the new policy agent with the VSG.
6.
Copy the current running configuration to the startup configuration.
86
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V
7.
Verify the updated policy agent version.
DETAILED STEPS
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Log in to the active VSG.
Check the current policy agent version.
vsg# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(1e)-vsg
VSG#
Enter the configuration mode.
vsg# configure terminal
Enter configuration commands, one per line.
End with CNTL/Z.
VSG(config)#
Unregister the old policy agent from VSG.
VSG(config)# nsc-policy-agent
VSG(config-nsc-policy-agent)# no policy-agent-image
Register the new policy agent with the VSG.
VSG(config-nsc-policy-agent)# policy-agent-image bootflash:vnmc-vsgpa.2.1.2a.bin
VSG(config-nsc-policy-agent)# exit
VSG(config)#
Copy the current running configuration to the startup configuration.
VSG(config)# copy running startup
[########################################] 100%
Verify the updated policy agent version.
VSG(config)# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(2a)-vsg
VSG(config)#
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V platform involves:
• Upgrading the VSM
• Upgrading the Cisco VSEM
• Upgrading the VEM Software
For detailed information about upgrading the Cisco Nexus 1000V for Microsoft Hyper-V, see the Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V chapter in Cisco Nexus 1000V for Microsoft Hyper-V
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
87
Upgrading the Cisco VSG and the Cisco Prime NSC
Upgrading the Cisco Nexus 1000V for Microsoft Hyper-V
Installation and Upgrade Guide, available at: http://www.cisco.com/en/US/partner/products/ps13056/prod_ installation_guides_list.html
88
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
I N D E X
A access
firewall ports
B bootflash
C
Cisco Cloud Service Platform
installation
Cisco port profile
Cisco Prime NSC
overview
CiscoPrime NSC
system requirements
compute firewall
configuring
initial settings
tenant on Prime NSC
configuring{security profile}
compute firewall
tenant
D dynamic operation
E enabling
global policy engin logging
enabling logging
enabling traffic
F firewall ports
access
firewall protection
G global policy-engine
guidelines and limitation
cloud service platform
H hardware requirements
host requirements
Hyper-V server
requirement
I information
configuration
installation
initial settings
installing
Cisco Prime NSC
Installing
VSG from ISO image
installing Cisco VSG
installing Service provider foundation
ISO file
L log
logging
enabling
level 6
policy engine
M multi-tenant
N
Nexus 1000V device terminology
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
IN-1
INDEX
P password
shared secret
planning checklist
PNSC
policy agent
port profile
prerequisites
installing the VSG
Prime NSC
Prime NSC architecture
Prime NSC benefits
Prime NSC components
Prime NSC upgrade
R registering
Cisco VSG
Nexus 1000V
requirements
Prime NSC installation
VLAN configuration
web-based GUI client
rule
permit-all
S security policy
security profile
policy management
shared secret
password
software requirements
standby Cisco VSG
statistics
switch
requirements
system requirements
Cisco Prime NSC
T traffic flow
U upgrade
procedure
upgrade guidelines
upgrading
Upgrading Prime NSC
Upgrading VSG
V verifying
permit-all rule
verifying communication
virtual network adapter
virtualization
VLAN setting
VLAN usages
VM communication
VM port-profile
VM requirements
VNMC security
VSG
VSG device terminology
VSG information
VSG setting
W web-based GUI client
requirements
IN-2
Cisco VSG for Microsoft Hyper-V, Release 5.2(1)VSG2(1.2b) and Cisco Prime NSC, Release 3.4 Installation and Upgrade Guide
تنزيل
تم تحديث الرابط العام
رابط عام للمستند
إعلان