diff options
Diffstat (limited to 'doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml')
-rw-r--r-- | doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml | 139 |
1 files changed, 79 insertions, 60 deletions
diff --git a/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml b/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml index a56fc0a..b5e7803 100644 --- a/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml +++ b/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml | |||
@@ -27,7 +27,7 @@ | |||
27 | 27 | ||
28 | <para>System requirements for the uCPE device:</para> | 28 | <para>System requirements for the uCPE device:</para> |
29 | 29 | ||
30 | <itemizedlist> | 30 | <itemizedlist spacing="compact"> |
31 | <listitem> | 31 | <listitem> |
32 | <para>4 x Network Interfaces</para> | 32 | <para>4 x Network Interfaces</para> |
33 | </listitem> | 33 | </listitem> |
@@ -43,16 +43,17 @@ | |||
43 | 43 | ||
44 | <para>The following file(s) are needed for this example use-case:</para> | 44 | <para>The following file(s) are needed for this example use-case:</para> |
45 | 45 | ||
46 | <itemizedlist> | 46 | <itemizedlist spacing="compact"> |
47 | <listitem> | 47 | <listitem> |
48 | <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and | 48 | <para>FortiGate VNF image. Please contact Fortinet to get a VNF |
49 | its license file.</para> | 49 | image and its license file.</para> |
50 | </listitem> | 50 | </listitem> |
51 | 51 | ||
52 | <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access | 52 | <listitem> |
53 | release: <filename>fortigate-basic-fw.conf</filename>.</para> | 53 | <para>VNF Configuration file(s), provided with your Enea NFV Access |
54 | release: <filename>fortigate-basic-fw.conf</filename>.</para> | ||
54 | </listitem> | 55 | </listitem> |
55 | </itemizedlist> | 56 | </itemizedlist> |
56 | </section> | 57 | </section> |
57 | 58 | ||
58 | <section id="exam_setup_fortifirewall"> | 59 | <section id="exam_setup_fortifirewall"> |
@@ -72,9 +73,11 @@ | |||
72 | <para><emphasis role="bold">Network Configuration</emphasis>:</para> | 73 | <para><emphasis role="bold">Network Configuration</emphasis>:</para> |
73 | 74 | ||
74 | <para>Since the firewall uses three External Network Interfaces, three | 75 | <para>Since the firewall uses three External Network Interfaces, three |
75 | bridges need to be configured. Each bridge provides the ability to connect a physical network interface to the virtual network interface of a VM.</para> | 76 | bridges need to be configured. Each bridge provides the ability to |
77 | connect a physical network interface to the virtual network interface of | ||
78 | a VM.</para> | ||
76 | 79 | ||
77 | <para><emphasis role="bold">Setup of the uCPE device:</emphasis></para> | 80 | <para><emphasis role="bold">Setup of the uCPE device:</emphasis></para> |
78 | 81 | ||
79 | <orderedlist> | 82 | <orderedlist> |
80 | <listitem> | 83 | <listitem> |
@@ -90,7 +93,8 @@ | |||
90 | </listitem> | 93 | </listitem> |
91 | 94 | ||
92 | <listitem> | 95 | <listitem> |
93 | <para>Connect ETH0 to the Lab Network (for Enea uCPE Manager communications).</para> | 96 | <para>Connect ETH0 to the Lab Network (for Enea uCPE Manager |
97 | communications).</para> | ||
94 | </listitem> | 98 | </listitem> |
95 | 99 | ||
96 | <listitem> | 100 | <listitem> |
@@ -103,23 +107,22 @@ | |||
103 | <para>Create three OVS bridges, one for each DPDK network interface | 107 | <para>Create three OVS bridges, one for each DPDK network interface |
104 | (WAN, LAN1 and LAN2).</para> | 108 | (WAN, LAN1 and LAN2).</para> |
105 | 109 | ||
106 | <para>Alternatively, the firewall can be setup to use bridges as | 110 | <para>Alternatively, the firewall can be setup to use bridges as |
107 | connection points for the FortiGate VNF, by replacing the OVS-DPDK | 111 | connection points for the FortiGate VNF, by replacing the OVS-DPDK |
108 | bridges with SR-IOV connection points.</para> | 112 | bridges with SR-IOV connection points.</para> |
109 | |||
110 | <para>Please note that while previously three physical interfaces were | ||
111 | presumed necessary for VNF connection, in the case of a firewall setup | ||
112 | only two physical interfaces are required for the data path (one for WAN | ||
113 | and one for LAN).</para> | ||
114 | 113 | ||
115 | <para>Only two interfaces will be configured as DPDK, with two bridges | 114 | <para>Please note that while previously three physical interfaces |
116 | created, one for each type of connection.</para> | 115 | were presumed necessary for VNF connection, in the case of a |
116 | firewall setup only two physical interfaces are required for the | ||
117 | data path (one for WAN and one for LAN). Only two interfaces will be | ||
118 | configured as DPDK, with two bridges created, one for each type of | ||
119 | connection.</para> | ||
117 | 120 | ||
118 | <note> | 121 | <note> |
119 | <para>At VNF instantiation instead of assigning distinct bridges for | 122 | <para>At VNF instantiation instead of assigning distinct bridges |
120 | each LAN interface, only one will be used for both LAN1 and LAN2, with | 123 | for each LAN interface, only one will be used for both LAN1 and |
121 | no changes in WAN interface configuration.</para> | 124 | LAN2, with no changes in WAN interface configuration.</para> |
122 | </note> | 125 | </note> |
123 | </listitem> | 126 | </listitem> |
124 | </orderedlist> | 127 | </orderedlist> |
125 | 128 | ||
@@ -147,8 +150,8 @@ | |||
147 | </listitem> | 150 | </listitem> |
148 | 151 | ||
149 | <listitem> | 152 | <listitem> |
150 | <para><emphasis role="bold">Interfaces</emphasis>: Add 3 | 153 | <para><emphasis role="bold">Interfaces</emphasis>: Add 3 interfaces |
151 | interfaces (wan, lan1 and lan2).</para> | 154 | (wan, lan1 and lan2).</para> |
152 | </listitem> | 155 | </listitem> |
153 | 156 | ||
154 | <listitem> | 157 | <listitem> |
@@ -221,9 +224,9 @@ | |||
221 | 224 | ||
222 | <note> | 225 | <note> |
223 | <para>The names of the ports used during instantiation need to be | 226 | <para>The names of the ports used during instantiation need to be |
224 | the same as the ones described above, as the same names will be used in | 227 | the same as the ones described above, as the same names will be |
225 | the configuration files provided for this example use-case. | 228 | used in the configuration files provided for this example |
226 | </para> | 229 | use-case.</para> |
227 | </note> | 230 | </note> |
228 | </listitem> | 231 | </listitem> |
229 | </itemizedlist> | 232 | </itemizedlist> |
@@ -276,7 +279,7 @@ | |||
276 | <para>Two uCPE devices will be needed for this setup. The system | 279 | <para>Two uCPE devices will be needed for this setup. The system |
277 | requirements for each uCPE device are:</para> | 280 | requirements for each uCPE device are:</para> |
278 | 281 | ||
279 | <itemizedlist> | 282 | <itemizedlist spacing="compact"> |
280 | <listitem> | 283 | <listitem> |
281 | <para>4 x Network Interfaces</para> | 284 | <para>4 x Network Interfaces</para> |
282 | </listitem> | 285 | </listitem> |
@@ -292,15 +295,17 @@ | |||
292 | 295 | ||
293 | <para>The following files are needed for this example use-case:</para> | 296 | <para>The following files are needed for this example use-case:</para> |
294 | 297 | ||
295 | <itemizedlist> | 298 | <itemizedlist spacing="compact"> |
296 | <listitem> | 299 | <listitem> |
297 | <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and | 300 | <para>FortiGate VNF image. Please contact Fortinet to get a VNF |
298 | its license file.</para> | 301 | image and its license file.</para> |
299 | </listitem> | 302 | </listitem> |
300 | 303 | ||
301 | <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access | 304 | <listitem> |
302 | release: <filename>fortigate-sdwan<x>.conf</filename>.</para></listitem> | 305 | <para>VNF Configuration file(s), provided with your Enea NFV Access |
303 | </itemizedlist> | 306 | release: <filename>fortigate-sdwan<x>.conf</filename>.</para> |
307 | </listitem> | ||
308 | </itemizedlist> | ||
304 | </section> | 309 | </section> |
305 | 310 | ||
306 | <section id="forti_examsetup_uc2"> | 311 | <section id="forti_examsetup_uc2"> |
@@ -316,12 +321,12 @@ | |||
316 | </imageobject> | 321 | </imageobject> |
317 | </mediaobject> | 322 | </mediaobject> |
318 | </figure> | 323 | </figure> |
319 | 324 | ||
320 | <note> | 325 | <note> |
321 | <para>When connecting, the uCPE devices can use a back-to-back or a VPN connection. | 326 | <para>When connecting, the uCPE devices can use a back-to-back or a |
322 | An appropriate interface with the required capabilities needs to be chosen for | 327 | VPN connection. An appropriate interface with the required |
323 | this purpose.</para> | 328 | capabilities needs to be chosen for this purpose.</para> |
324 | </note> | 329 | </note> |
325 | 330 | ||
326 | <para><emphasis role="bold">Network Configuration:</emphasis></para> | 331 | <para><emphasis role="bold">Network Configuration:</emphasis></para> |
327 | 332 | ||
@@ -333,23 +338,28 @@ | |||
333 | <para>Each VNF instance will have a virtual interface for VNF | 338 | <para>Each VNF instance will have a virtual interface for VNF |
334 | management, for the WAN network and for LAN communication.</para> | 339 | management, for the WAN network and for LAN communication.</para> |
335 | 340 | ||
336 | <para><emphasis role="bold">Setup of an Intel Whitebox uCPE device</emphasis>:</para> | 341 | <para><emphasis role="bold">Setup of an Intel Whitebox uCPE |
342 | device</emphasis>:</para> | ||
337 | 343 | ||
338 | <orderedlist> | 344 | <orderedlist> |
339 | <listitem> | 345 | <listitem> |
340 | <para>Connect the <literal>VNFMgr</literal> interfaces to the Lab Network for VNF management access.</para> | 346 | <para>Connect the <literal>VNFMgr</literal> interfaces to the Lab |
347 | Network for VNF management access.</para> | ||
341 | </listitem> | 348 | </listitem> |
342 | 349 | ||
343 | <listitem> | 350 | <listitem> |
344 | <para>Directly connect the <literal>WAN</literal> interfaces back to back (using a cable) or connected via VPN.</para> | 351 | <para>Directly connect the <literal>WAN</literal> interfaces back to |
352 | back (using a cable) or connected via VPN.</para> | ||
345 | </listitem> | 353 | </listitem> |
346 | 354 | ||
347 | <listitem> | 355 | <listitem> |
348 | <para>Connect the <literal>LAN</literal> interfaces to the Test Machine.</para> | 356 | <para>Connect the <literal>LAN</literal> interfaces to the Test |
357 | Machine.</para> | ||
349 | </listitem> | 358 | </listitem> |
350 | 359 | ||
351 | <listitem> | 360 | <listitem> |
352 | <para>Connect the <literal>ETH0</literal> interfaces to the Lab Network (for Enea uCPE Manager communications).</para> | 361 | <para>Connect the <literal>ETH0</literal> interfaces to the Lab |
362 | Network (for Enea uCPE Manager communications).</para> | ||
353 | </listitem> | 363 | </listitem> |
354 | 364 | ||
355 | <listitem> | 365 | <listitem> |
@@ -434,9 +444,11 @@ | |||
434 | will fail.</para> | 444 | will fail.</para> |
435 | </note> | 445 | </note> |
436 | 446 | ||
437 | <para><emphasis role="bold">Instantiating the FortiGate VNF</emphasis>:</para> | 447 | <para><emphasis role="bold">Instantiating the FortiGate |
448 | VNF</emphasis>:</para> | ||
438 | 449 | ||
439 | <para>Instantiate the FortiGate VNF by filling the required fields with the following values:</para> | 450 | <para>Instantiate the FortiGate VNF by filling the required fields with |
451 | the following values:</para> | ||
440 | 452 | ||
441 | <itemizedlist spacing="compact"> | 453 | <itemizedlist spacing="compact"> |
442 | <listitem> | 454 | <listitem> |
@@ -462,8 +474,9 @@ | |||
462 | <listitem> | 474 | <listitem> |
463 | <para><emphasis role="bold">Configuration file</emphasis>: The | 475 | <para><emphasis role="bold">Configuration file</emphasis>: The |
464 | SD-WAN example configuration files provided by Enea: | 476 | SD-WAN example configuration files provided by Enea: |
465 | <literal>fortigate-sdwan1.conf</literal> for the FortiGate VNF on uCPE device 1 and | 477 | <literal>fortigate-sdwan1.conf</literal> for the FortiGate VNF on |
466 | <literal>fortigate-sdwan2.conf</literal> for the FortiGate VNF on uCPE device 2.</para> | 478 | uCPE device 1 and <literal>fortigate-sdwan2.conf</literal> for the |
479 | FortiGate VNF on uCPE device 2.</para> | ||
467 | </listitem> | 480 | </listitem> |
468 | 481 | ||
469 | <listitem> | 482 | <listitem> |
@@ -494,10 +507,10 @@ | |||
494 | the second VNF instantiation.</para> | 507 | the second VNF instantiation.</para> |
495 | 508 | ||
496 | <note> | 509 | <note> |
497 | <para>The names of the ports used during instantiation need to be the | 510 | <para>The names of the ports used during instantiation need to be the |
498 | same as the ones described above, as the same names will be used in | 511 | same as the ones described above, as the same names will be used in |
499 | the configuration files provided for this example use-case.</para> | 512 | the configuration files provided for this example use-case.</para> |
500 | </note> | 513 | </note> |
501 | </section> | 514 | </section> |
502 | 515 | ||
503 | <section id="forti_test_uc2"> | 516 | <section id="forti_test_uc2"> |
@@ -518,8 +531,11 @@ | |||
518 | Machine-2.</para> | 531 | Machine-2.</para> |
519 | </note> | 532 | </note> |
520 | 533 | ||
521 | <para>The Test Machine connected to <literal>uCPE device 1</literal> should be able to ping the Test Machine connected to <literal>uCPE device 2</literal> in this setup, over the WAN connection. The FortiGate VNF management interface can be accessed from a web | 534 | <para>The Test Machine connected to <literal>uCPE device 1</literal> |
522 | browser on the Lab Machine. For more details please see <olink | 535 | should be able to ping the Test Machine connected to <literal>uCPE |
536 | device 2</literal> in this setup, over the WAN connection. The FortiGate | ||
537 | VNF management interface can be accessed from a web browser on the Lab | ||
538 | Machine. For more details please see <olink | ||
523 | targetdoc="book_enea_nfv_access_example_usecases" | 539 | targetdoc="book_enea_nfv_access_example_usecases" |
524 | targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include | 540 | targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include |
525 | href="../../s_docbuild/olinkdb/pardoc-names.xml" | 541 | href="../../s_docbuild/olinkdb/pardoc-names.xml" |
@@ -587,7 +603,10 @@ virsh console <id of FortiGate VNF></programlisting> | |||
587 | <orderedlist> | 603 | <orderedlist> |
588 | <listitem> | 604 | <listitem> |
589 | <para>Deploy the FortiGate Firewall in its default | 605 | <para>Deploy the FortiGate Firewall in its default |
590 | settings.</para><remark>Maybe more info about how to do it should be added here.</remark> | 606 | settings.</para> |
607 | |||
608 | <remark>Maybe more info about how to do it should be added | ||
609 | here.</remark> | ||
591 | </listitem> | 610 | </listitem> |
592 | 611 | ||
593 | <listitem> | 612 | <listitem> |