summaryrefslogtreecommitdiffstats
path: root/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml
diff options
context:
space:
mode:
Diffstat (limited to 'doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml')
-rw-r--r--doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml139
1 files changed, 79 insertions, 60 deletions
diff --git a/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml b/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml
index a56fc0a..b5e7803 100644
--- a/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml
+++ b/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml
@@ -27,7 +27,7 @@
27 27
28 <para>System requirements for the uCPE device:</para> 28 <para>System requirements for the uCPE device:</para>
29 29
30 <itemizedlist> 30 <itemizedlist spacing="compact">
31 <listitem> 31 <listitem>
32 <para>4 x Network Interfaces</para> 32 <para>4 x Network Interfaces</para>
33 </listitem> 33 </listitem>
@@ -43,16 +43,17 @@
43 43
44 <para>The following file(s) are needed for this example use-case:</para> 44 <para>The following file(s) are needed for this example use-case:</para>
45 45
46 <itemizedlist> 46 <itemizedlist spacing="compact">
47 <listitem> 47 <listitem>
48 <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and 48 <para>FortiGate VNF image. Please contact Fortinet to get a VNF
49 its license file.</para> 49 image and its license file.</para>
50 </listitem> 50 </listitem>
51 51
52 <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access 52 <listitem>
53 release: <filename>fortigate-basic-fw.conf</filename>.</para> 53 <para>VNF Configuration file(s), provided with your Enea NFV Access
54 release: <filename>fortigate-basic-fw.conf</filename>.</para>
54 </listitem> 55 </listitem>
55 </itemizedlist> 56 </itemizedlist>
56 </section> 57 </section>
57 58
58 <section id="exam_setup_fortifirewall"> 59 <section id="exam_setup_fortifirewall">
@@ -72,9 +73,11 @@
72 <para><emphasis role="bold">Network Configuration</emphasis>:</para> 73 <para><emphasis role="bold">Network Configuration</emphasis>:</para>
73 74
74 <para>Since the firewall uses three External Network Interfaces, three 75 <para>Since the firewall uses three External Network Interfaces, three
75 bridges need to be configured. Each bridge provides the ability to connect a physical network interface to the virtual network interface of a VM.</para> 76 bridges need to be configured. Each bridge provides the ability to
77 connect a physical network interface to the virtual network interface of
78 a VM.</para>
76 79
77 <para><emphasis role="bold">Setup of the uCPE device:</emphasis></para> 80 <para><emphasis role="bold">Setup of the uCPE device:</emphasis></para>
78 81
79 <orderedlist> 82 <orderedlist>
80 <listitem> 83 <listitem>
@@ -90,7 +93,8 @@
90 </listitem> 93 </listitem>
91 94
92 <listitem> 95 <listitem>
93 <para>Connect ETH0 to the Lab Network (for Enea uCPE Manager communications).</para> 96 <para>Connect ETH0 to the Lab Network (for Enea uCPE Manager
97 communications).</para>
94 </listitem> 98 </listitem>
95 99
96 <listitem> 100 <listitem>
@@ -103,23 +107,22 @@
103 <para>Create three OVS bridges, one for each DPDK network interface 107 <para>Create three OVS bridges, one for each DPDK network interface
104 (WAN, LAN1 and LAN2).</para> 108 (WAN, LAN1 and LAN2).</para>
105 109
106 <para>Alternatively, the firewall can be setup to use bridges as 110 <para>Alternatively, the firewall can be setup to use bridges as
107 connection points for the FortiGate VNF, by replacing the OVS-DPDK 111 connection points for the FortiGate VNF, by replacing the OVS-DPDK
108 bridges with SR-IOV connection points.</para> 112 bridges with SR-IOV connection points.</para>
109
110 <para>Please note that while previously three physical interfaces were
111 presumed necessary for VNF connection, in the case of a firewall setup
112 only two physical interfaces are required for the data path (one for WAN
113 and one for LAN).</para>
114 113
115 <para>Only two interfaces will be configured as DPDK, with two bridges 114 <para>Please note that while previously three physical interfaces
116 created, one for each type of connection.</para> 115 were presumed necessary for VNF connection, in the case of a
116 firewall setup only two physical interfaces are required for the
117 data path (one for WAN and one for LAN). Only two interfaces will be
118 configured as DPDK, with two bridges created, one for each type of
119 connection.</para>
117 120
118 <note> 121 <note>
119 <para>At VNF instantiation instead of assigning distinct bridges for 122 <para>At VNF instantiation instead of assigning distinct bridges
120 each LAN interface, only one will be used for both LAN1 and LAN2, with 123 for each LAN interface, only one will be used for both LAN1 and
121 no changes in WAN interface configuration.</para> 124 LAN2, with no changes in WAN interface configuration.</para>
122 </note> 125 </note>
123 </listitem> 126 </listitem>
124 </orderedlist> 127 </orderedlist>
125 128
@@ -147,8 +150,8 @@
147 </listitem> 150 </listitem>
148 151
149 <listitem> 152 <listitem>
150 <para><emphasis role="bold">Interfaces</emphasis>: Add 3 153 <para><emphasis role="bold">Interfaces</emphasis>: Add 3 interfaces
151 interfaces (wan, lan1 and lan2).</para> 154 (wan, lan1 and lan2).</para>
152 </listitem> 155 </listitem>
153 156
154 <listitem> 157 <listitem>
@@ -221,9 +224,9 @@
221 224
222 <note> 225 <note>
223 <para>The names of the ports used during instantiation need to be 226 <para>The names of the ports used during instantiation need to be
224 the same as the ones described above, as the same names will be used in 227 the same as the ones described above, as the same names will be
225 the configuration files provided for this example use-case. 228 used in the configuration files provided for this example
226 </para> 229 use-case.</para>
227 </note> 230 </note>
228 </listitem> 231 </listitem>
229 </itemizedlist> 232 </itemizedlist>
@@ -276,7 +279,7 @@
276 <para>Two uCPE devices will be needed for this setup. The system 279 <para>Two uCPE devices will be needed for this setup. The system
277 requirements for each uCPE device are:</para> 280 requirements for each uCPE device are:</para>
278 281
279 <itemizedlist> 282 <itemizedlist spacing="compact">
280 <listitem> 283 <listitem>
281 <para>4 x Network Interfaces</para> 284 <para>4 x Network Interfaces</para>
282 </listitem> 285 </listitem>
@@ -292,15 +295,17 @@
292 295
293 <para>The following files are needed for this example use-case:</para> 296 <para>The following files are needed for this example use-case:</para>
294 297
295 <itemizedlist> 298 <itemizedlist spacing="compact">
296 <listitem> 299 <listitem>
297 <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and 300 <para>FortiGate VNF image. Please contact Fortinet to get a VNF
298 its license file.</para> 301 image and its license file.</para>
299 </listitem> 302 </listitem>
300 303
301 <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access 304 <listitem>
302 release: <filename>fortigate-sdwan&lt;x&gt;.conf</filename>.</para></listitem> 305 <para>VNF Configuration file(s), provided with your Enea NFV Access
303 </itemizedlist> 306 release: <filename>fortigate-sdwan&lt;x&gt;.conf</filename>.</para>
307 </listitem>
308 </itemizedlist>
304 </section> 309 </section>
305 310
306 <section id="forti_examsetup_uc2"> 311 <section id="forti_examsetup_uc2">
@@ -316,12 +321,12 @@
316 </imageobject> 321 </imageobject>
317 </mediaobject> 322 </mediaobject>
318 </figure> 323 </figure>
319 324
320 <note> 325 <note>
321 <para>When connecting, the uCPE devices can use a back-to-back or a VPN connection. 326 <para>When connecting, the uCPE devices can use a back-to-back or a
322 An appropriate interface with the required capabilities needs to be chosen for 327 VPN connection. An appropriate interface with the required
323 this purpose.</para> 328 capabilities needs to be chosen for this purpose.</para>
324 </note> 329 </note>
325 330
326 <para><emphasis role="bold">Network Configuration:</emphasis></para> 331 <para><emphasis role="bold">Network Configuration:</emphasis></para>
327 332
@@ -333,23 +338,28 @@
333 <para>Each VNF instance will have a virtual interface for VNF 338 <para>Each VNF instance will have a virtual interface for VNF
334 management, for the WAN network and for LAN communication.</para> 339 management, for the WAN network and for LAN communication.</para>
335 340
336 <para><emphasis role="bold">Setup of an Intel Whitebox uCPE device</emphasis>:</para> 341 <para><emphasis role="bold">Setup of an Intel Whitebox uCPE
342 device</emphasis>:</para>
337 343
338 <orderedlist> 344 <orderedlist>
339 <listitem> 345 <listitem>
340 <para>Connect the <literal>VNFMgr</literal> interfaces to the Lab Network for VNF management access.</para> 346 <para>Connect the <literal>VNFMgr</literal> interfaces to the Lab
347 Network for VNF management access.</para>
341 </listitem> 348 </listitem>
342 349
343 <listitem> 350 <listitem>
344 <para>Directly connect the <literal>WAN</literal> interfaces back to back (using a cable) or connected via VPN.</para> 351 <para>Directly connect the <literal>WAN</literal> interfaces back to
352 back (using a cable) or connected via VPN.</para>
345 </listitem> 353 </listitem>
346 354
347 <listitem> 355 <listitem>
348 <para>Connect the <literal>LAN</literal> interfaces to the Test Machine.</para> 356 <para>Connect the <literal>LAN</literal> interfaces to the Test
357 Machine.</para>
349 </listitem> 358 </listitem>
350 359
351 <listitem> 360 <listitem>
352 <para>Connect the <literal>ETH0</literal> interfaces to the Lab Network (for Enea uCPE Manager communications).</para> 361 <para>Connect the <literal>ETH0</literal> interfaces to the Lab
362 Network (for Enea uCPE Manager communications).</para>
353 </listitem> 363 </listitem>
354 364
355 <listitem> 365 <listitem>
@@ -434,9 +444,11 @@
434 will fail.</para> 444 will fail.</para>
435 </note> 445 </note>
436 446
437 <para><emphasis role="bold">Instantiating the FortiGate VNF</emphasis>:</para> 447 <para><emphasis role="bold">Instantiating the FortiGate
448 VNF</emphasis>:</para>
438 449
439 <para>Instantiate the FortiGate VNF by filling the required fields with the following values:</para> 450 <para>Instantiate the FortiGate VNF by filling the required fields with
451 the following values:</para>
440 452
441 <itemizedlist spacing="compact"> 453 <itemizedlist spacing="compact">
442 <listitem> 454 <listitem>
@@ -462,8 +474,9 @@
462 <listitem> 474 <listitem>
463 <para><emphasis role="bold">Configuration file</emphasis>: The 475 <para><emphasis role="bold">Configuration file</emphasis>: The
464 SD-WAN example configuration files provided by Enea: 476 SD-WAN example configuration files provided by Enea:
465 <literal>fortigate-sdwan1.conf</literal> for the FortiGate VNF on uCPE device 1 and 477 <literal>fortigate-sdwan1.conf</literal> for the FortiGate VNF on
466 <literal>fortigate-sdwan2.conf</literal> for the FortiGate VNF on uCPE device 2.</para> 478 uCPE device 1 and <literal>fortigate-sdwan2.conf</literal> for the
479 FortiGate VNF on uCPE device 2.</para>
467 </listitem> 480 </listitem>
468 481
469 <listitem> 482 <listitem>
@@ -494,10 +507,10 @@
494 the second VNF instantiation.</para> 507 the second VNF instantiation.</para>
495 508
496 <note> 509 <note>
497 <para>The names of the ports used during instantiation need to be the 510 <para>The names of the ports used during instantiation need to be the
498 same as the ones described above, as the same names will be used in 511 same as the ones described above, as the same names will be used in
499 the configuration files provided for this example use-case.</para> 512 the configuration files provided for this example use-case.</para>
500 </note> 513 </note>
501 </section> 514 </section>
502 515
503 <section id="forti_test_uc2"> 516 <section id="forti_test_uc2">
@@ -518,8 +531,11 @@
518 Machine-2.</para> 531 Machine-2.</para>
519 </note> 532 </note>
520 533
521 <para>The Test Machine connected to <literal>uCPE device 1</literal> should be able to ping the Test Machine connected to <literal>uCPE device 2</literal> in this setup, over the WAN connection. The FortiGate VNF management interface can be accessed from a web 534 <para>The Test Machine connected to <literal>uCPE device 1</literal>
522 browser on the Lab Machine. For more details please see <olink 535 should be able to ping the Test Machine connected to <literal>uCPE
536 device 2</literal> in this setup, over the WAN connection. The FortiGate
537 VNF management interface can be accessed from a web browser on the Lab
538 Machine. For more details please see <olink
523 targetdoc="book_enea_nfv_access_example_usecases" 539 targetdoc="book_enea_nfv_access_example_usecases"
524 targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include 540 targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include
525 href="../../s_docbuild/olinkdb/pardoc-names.xml" 541 href="../../s_docbuild/olinkdb/pardoc-names.xml"
@@ -587,7 +603,10 @@ virsh console &lt;id of FortiGate VNF&gt;</programlisting>
587 <orderedlist> 603 <orderedlist>
588 <listitem> 604 <listitem>
589 <para>Deploy the FortiGate Firewall in its default 605 <para>Deploy the FortiGate Firewall in its default
590 settings.</para><remark>Maybe more info about how to do it should be added here.</remark> 606 settings.</para>
607
608 <remark>Maybe more info about how to do it should be added
609 here.</remark>
591 </listitem> 610 </listitem>
592 611
593 <listitem> 612 <listitem>