path: root/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<chapter id="vnf_fortigate">
  <title>FortiGate VNF Example Use-cases</title>

  <para>FortiGate virtual appliances feature all of the security and
  networking services common to traditional hardware-based FortiGate
  appliances. The virtual appliances can be integrated in Firewall or SD-WAN
  solution development.</para>

  <section id="fortigate_firewall_uc_1">
    <title>FortiGate VNF as a Firewall</title>

    <para>Enea provides an example of a simple basic firewall configuration
    for the FortiGate VNF. FortiGate In-Band Management is a feature used for
    running FortiGate Management traffic over WAN.</para>

    <para>Instructions on how to alter the default configuration are provided
    in section <olink targetdoc="book_enea_nfv_access_example_usecases"
    targetptr="fortigate_webmg">FortiGate VNF Web Management in the
    <xi:include href="../../s_docbuild/olinkdb/pardoc-names.xml"
    xmlns:xi="http://www.w3.org/2001/XInclude"
    xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>
    Manual.</para>

    <section id="forti_firewall_prereq">
      <title>Prerequisites</title>

      <para>System requirements for the uCPE device:</para>

      <itemizedlist>
        <listitem>
          <para>4 x Network Interfaces</para>
        </listitem>

        <listitem>
          <para>4 cores</para>
        </listitem>

        <listitem>
          <para>4 GB of RAM memory</para>
        </listitem>
      </itemizedlist>

      <para>The following file(s) are needed for this example use-case:</para>

      <itemizedlist>
        <listitem>
          <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and
          its license file.</para>
        </listitem>

        <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access
        release: <filename>fortigate-basic-fw.conf</filename>.</para>
        </listitem>
        </itemizedlist>
    </section>

    <section id="exam_setup_fortifirewall">
      <title>Use-case Setup</title>

      <figure>
        <title>Fortigate VNF as a Firewall</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center" contentwidth="600"
                       fileref="images/uc_fortigate_fw.png" />
          </imageobject>
        </mediaobject>
      </figure>

      <para><emphasis role="bold">Network Configuration</emphasis>:</para>

      <para>Since the firewall uses three External Network Interfaces, three
      bridges need to be configured. Each bridge provides the ability to connect a physical network interface to the virtual network interface of a VM.</para>

	<para><emphasis role="bold">Setup of the uCPE device:</emphasis></para>

      <orderedlist>
        <listitem>
          <para>Connect WAN to the Lab Network.</para>
        </listitem>

        <listitem>
          <para>Connect LAN1 to the Test Machine.</para>
        </listitem>

        <listitem>
          <para>Leave LAN2 unconnected.</para>
        </listitem>

        <listitem>
          <para>Connect ETH0 to the Lab Network (for Enea uCPE Manager communications).</para>
        </listitem>

        <listitem>
          <para>Select the uCPE device, access
          <literal>Configuration</literal> and bind the three physical network
          interfaces to DPDK.</para>
        </listitem>

        <listitem>
          <para>Create three OVS bridges, one for each DPDK network interface
          (WAN, LAN1 and LAN2).</para>

      <para>Alternatively, the firewall can be setup to use bridges as
      connection points for the FortiGate VNF, by replacing the OVS-DPDK
      bridges with SR-IOV connection points.</para>

      <para>Please note that while previously three physical interfaces were
      presumed necessary for VNF connection, in the case of a firewall setup
      only two physical interfaces are required for the data path (one for WAN
      and one for LAN).</para>

      <para>Only two interfaces will be configured as DPDK, with two bridges
      created, one for each type of connection.</para>

      <note>
        <para>At VNF instantiation instead of assigning distinct bridges for
        each LAN interface, only one will be used for both LAN1 and LAN2, with
        no changes in WAN interface configuration.</para>
      </note>
        </listitem>
      </orderedlist>

      <para><emphasis role="bold">Onboarding the VNF:</emphasis></para>

      <para>Onboard the FortiGate VNF by filling the required fields with the
      following values:</para>

      <itemizedlist spacing="compact">
        <listitem>
          <para><emphasis role="bold">VM Image File</emphasis>: Provide the
          path to the FortiGate VNF qcow2 image.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Memory in MB</emphasis>: 1024</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Num of CPUs</emphasis>: 1</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Storage in GB</emphasis>: 20</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Interfaces</emphasis>: Add 3
          interfaces (wan, lan1 and lan2).</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Datasource</emphasis>:
          ConfigDrive</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Disk Type</emphasis>:
          cdrom</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init content file</emphasis>: Add
          a license file entry.</para>
        </listitem>
      </itemizedlist>

      <para><emphasis role="bold">Instantiating the VNF:</emphasis></para>

      <para>Instantiate the FortiGate VNF by filling the required fields with
      the following values:</para>

      <itemizedlist spacing="compact">
        <listitem>
          <para><emphasis role="bold">Name</emphasis>: Name of the VM which
          will be created on the uCPE device.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">VNF Type</emphasis>: Name of the
          onboarded VNF.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">uCPE Device</emphasis>: Select the uCPE
          device where the VNF will be instantiated.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">License file</emphasis>: The FortiGate
          license file provided by Fortinet.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Configuration file</emphasis>: The
          Firewall example configuration file provided by Enea
          (<filename>fortigate-basic-fw.conf</filename>).</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port1 - WAN</emphasis>: Set the
          <literal>External Interface</literal> type to
          <literal>DPDK</literal> and connect it to the
          <literal>wan_br</literal> ovs bridge.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port2 - LAN1</emphasis>: Set the
          <literal>Incoming Interface</literal> type to
          <literal>DPDK</literal> and connect it to the
          <literal>lan1_br</literal> ovs bridge.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port3 - LAN2</emphasis>: Set the
          <literal>Outgoing Interface</literal> type to
          <literal>DPDK</literal> and connect it to the
          <literal>lan2_br</literal> ovs bridge.</para>

          <note>
            <para>The names of the ports used during instantiation need to be
            the same as the ones described above, as the same names will be used in
            the configuration files provided for this example use-case.
            </para>
          </note>
        </listitem>
      </itemizedlist>
    </section>

    <section id="testing_fortigate_uc_1">
      <title>Testing the Use-case</title>

      <para>Connect the Test Machine on the LAN interface and access the
      internet from the Test Machine to use the firewall on the uCPE
      device.</para>

      <note>
        <para>The connected Test Machine can be a laptop or a uCPE device. It
        must have one interface configured to get a dynamic IP from a DHCP
        server. The <literal>dhclient &lt;interface&gt;</literal> command can
        be used to request an IP address. The received IP must be in the
        172.16.1.2 - 172.16.1.255 range.</para>
      </note>

      <para>The FortiGate VNF management interface is accessible through the
      WAN interface. The WAN IP address can be used from a web browser on the
      Lab Machine to access the FortiGate VNF Management Web UI. Please check
      <olink targetdoc="book_enea_nfv_access_example_usecases"
      targetptr="fortigate_webmg">FortiGate VNF web management<xi:include
      href="../../s_docbuild/olinkdb/pardoc-names.xml"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>
      for more information.</para>
    </section>
  </section>

  <section id="fortigate_sdwan_vpn">
    <title>FortiGate VNF as an SD-WAN or a VPN</title>

    <para>SD-WAN decouples the network from the management plane, detaching
    traffic management and monitoring functions from hardware. Most forms of
    SD-WAN technology create a virtual overlay that is transport-agnostic,
    i.e. it abstracts underlying private or public WAN connections.</para>

    <para>For deployment, the user plugs in WAN links into the device, which
    automatically configures itself with the network.</para>

    <para>Example SD-WAN configurations for the FortiGate VNF are provided by
    Enea.</para>

    <section id="forti_sdwan_vpn_prereq">
      <title>Prerequisites</title>

      <para>Two uCPE devices will be needed for this setup. The system
      requirements for each uCPE device are:</para>

      <itemizedlist>
        <listitem>
          <para>4 x Network Interfaces</para>
        </listitem>

        <listitem>
          <para>4 cores</para>
        </listitem>

        <listitem>
          <para>4 GB of RAM memory</para>
        </listitem>
      </itemizedlist>

      <para>The following files are needed for this example use-case:</para>

      <itemizedlist>
        <listitem>
          <para>FortiGate VNF image. Please contact Fortinet to get a VNF image and
          its license file.</para>
        </listitem>

        <listitem><para>VNF Configuration file(s), provided with your Enea NFV Access
        release: <filename>fortigate-sdwan&lt;x&gt;.conf</filename>.</para></listitem>
        </itemizedlist>
    </section>

    <section id="forti_examsetup_uc2">
      <title>Use-case Setup</title>

      <figure>
        <title>Fortigate VNF as an SD-WAN or a VPN</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center" contentwidth="600"
                       fileref="images/uc_fortigate_sdwan.png" />
          </imageobject>
        </mediaobject>
      </figure>
      
       <note>
         <para>When connecting, the uCPE devices can use a back-to-back or a VPN connection. 
           An appropriate interface with the required capabilities needs to be chosen for 
           this purpose.</para>
          </note>

      <para><emphasis role="bold">Network Configuration:</emphasis></para>

      <para>Since the SD-WAN VNF uses three External Network Interfaces, three
      bridges need to be configured. Each bridge provides the ability to
      connect a physical network interface to the VM's virtual network
      interface.</para>

      <para>Each VNF instance will have a virtual interface for VNF
      management, for the WAN network and for LAN communication.</para>

      <para><emphasis role="bold">Setup of an Intel Whitebox uCPE device</emphasis>:</para>

      <orderedlist>
	   <listitem>
          <para>Connect the <literal>VNFMgr</literal> interfaces to the Lab Network for VNF management access.</para>
        </listitem>

        <listitem>
          <para>Directly connect the <literal>WAN</literal> interfaces back to back (using a cable) or connected via VPN.</para>
        </listitem>

        <listitem>
          <para>Connect the <literal>LAN</literal> interfaces to the Test Machine.</para>
        </listitem>

        <listitem>
          <para>Connect the <literal>ETH0</literal> interfaces to the Lab Network (for Enea uCPE Manager communications).</para>
        </listitem>

        <listitem>
          <para>Select uCPE Device 1, access <literal>Configuration</literal>
          and bind the three physical network interfaces to the DPDK.</para>
        </listitem>

        <listitem>
          <para>Create three OVS bridges, one for each DPDK network interface
          (VNF management, WAN and LAN).</para>
        </listitem>

        <listitem>
          <para>Repeat the steps above for uCPE device 2.</para>
        </listitem>
      </orderedlist>

      <para><emphasis role="bold">Onboarding the VNF</emphasis>:</para>

      <para>Onboard the FortiGate VNF by filling the required fields with the
      following values:</para>

      <itemizedlist spacing="compact">
        <listitem>
          <para><emphasis role="bold">VM Image File</emphasis>: Provide the
          path to the FortiGate VNF qcow2 image.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Memory in MB</emphasis>: 1024</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Num of CPUs</emphasis>: 1</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Storage in GB</emphasis>: 20</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Interfaces</emphasis>: Add 3 interfaces
          in the same order as listed below:</para>

          <itemizedlist spacing="compact">
            <listitem>
              <para><emphasis role="bold">vnfmgr</emphasis>: to connect it to
              the <literal>vnfmgmt_br</literal> bridge.</para>
            </listitem>

            <listitem>
              <para><emphasis role="bold">wan:</emphasis> to connect it to the
              <literal>wan_br</literal> bridge.</para>
            </listitem>

            <listitem>
              <para><emphasis role="bold">lan:</emphasis> to connect it to the
              <literal>lan_br</literal> bridge.</para>
            </listitem>
          </itemizedlist>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Datasource</emphasis>:
          ConfigDrive</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Disk Type</emphasis>:
          cdrom</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init content file</emphasis>: Add
          a license file entry.</para>
        </listitem>
      </itemizedlist>

      <note>
        <para>The order of the interfaces that need to be added must be
        exactly as listed above or else onboarding and in turn instantiation
        will fail.</para>
      </note>

      <para><emphasis role="bold">Instantiating the FortiGate VNF</emphasis>:</para>

      <para>Instantiate the FortiGate VNF by filling the required fields with the following values:</para>

      <itemizedlist spacing="compact">
        <listitem>
          <para><emphasis role="bold">Name</emphasis>: Name of the VM which
          will be created on the uCPE device.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">VNF Type</emphasis>: Name of the
          onboarded VNF.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">uCPE Device</emphasis>: Select the uCPE
          device where the VNF will be instantiated.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">License file</emphasis>: The FortiGate
          license file provided by Fortinet.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Configuration file</emphasis>: The
          SD-WAN example configuration files provided by Enea:
          <literal>fortigate-sdwan1.conf</literal> for the FortiGate VNF on uCPE device 1 and
          <literal>fortigate-sdwan2.conf</literal> for the FortiGate VNF on uCPE device 2.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port1 - VNF Mgr</emphasis>: Set the type
          to <literal>DPDK</literal> and connect it to the
          <literal>vnfmgmt_br</literal> bridge.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port2 - WAN</emphasis>: Set the type to
          <literal>DPDK</literal> and connect it to the
          <literal>wan_br</literal> bridge.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Port3 - LAN</emphasis>: Set the type to
          <literal>DPDK</literal> and connect it to the
          <literal>lan_br</literal> bridge.</para>
        </listitem>
      </itemizedlist>

      <para>Instantiate the FortiGate VNF on uCPE device 1 using the
      <literal>sdwan1</literal> example configuration file.</para>

      <para>To complete the branch-to-branch setup, configure <literal>uCPE
      device 2</literal> in the same way as <literal>uCPE device 1</literal>.
      Make sure to use the <literal>sdwan2</literal> configuration file for
      the second VNF instantiation.</para>

      <note>
        <para>The names of the ports used during instantiation need to be the 
          same as the ones described above, as the same names will be used in 
          the configuration files provided for this example use-case.</para>
          </note>
    </section>

    <section id="forti_test_uc2">
      <title>Testing the Use-case</title>

      <para>Once the full SD-WAN setup is in place a VPN connection needs to
      be established between the two uCPE devices. The Test Machines can be
      connected to the LAN interface on each uCPE device.</para>

      <para>The connected Test Machine can be a laptop or a uCPE device that
      has one interface configured to get a dynamic IP from a DHCP server. The
      <command>dhclient &lt;interface&gt;</command> command can be used to
      request an IP address.</para>

      <note>
        <para>The received IP must be in the 172.16.1.2 - 172.16.1.255 range
        for Test Machine-1 and in the 172.16.2.2 - 172.16.2.255 range for Test
        Machine-2.</para>
      </note>

      <para>The Test Machine connected to <literal>uCPE device 1</literal> should be able to ping the Test Machine connected to <literal>uCPE device 2</literal> in this setup, over the WAN connection.  The FortiGate VNF management interface can be accessed from a web
      browser on the Lab Machine. For more details please see <olink
      targetdoc="book_enea_nfv_access_example_usecases"
      targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include
      href="../../s_docbuild/olinkdb/pardoc-names.xml"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>.</para>

      <note>
        <para>In this SD-WAN VPN setup example, bridges were used as
        connection points for the FortiGate VNF. It is possible to replace
        OVS-DPDK bridges with SR-IOV connection points.</para>
      </note>
    </section>
  </section>

  <section id="fortigate_webmg">
    <title>FortiGate VNF Web Management</title>

    <para>In order to check the IP address assigned to the FortiGate VNF you
    need to connect to the FortiGate CLI.</para>

    <orderedlist>
      <listitem>
        <para>SSH to the uCPE Device (Username: root) and connect to the
        FortiGate VNF console:</para>

        <programlisting>virsh list
virsh console &lt;id of FortiGate VNF&gt;</programlisting>
      </listitem>

      <listitem>
        <para>To access the FortiGate CLI, use <literal>admin</literal> as the
        user, leaving the password blank/empty, and press enter.</para>

        <para>Use the CLI command <literal>get system interface</literal> to
        get the dynamic interfaces configuration.</para>
      </listitem>

      <listitem>
        <para>Use the IP address assigned for the management interface in the
        web browser (<literal>https://&lt;IP&gt;</literal>), to access the
        FortiGate VNF Web Management Interface. Use the same credentials as
        before to login.</para>
      </listitem>

      <listitem>
        <para>Browse through the configuration and perform changes according
        to your setup:</para>

        <figure>
          <title>The FortiGate VNF Web Management Interface</title>

          <mediaobject>
            <imageobject>
              <imagedata align="center" contentwidth="600"
                         fileref="images/fortinet_interface.png" />
            </imageobject>
          </mediaobject>
        </figure>
      </listitem>

      <listitem>
        <para>Optionally, alter the default FortiGate example configuration
        provided by Enea, through the following steps:</para>

        <orderedlist>
          <listitem>
            <para>Deploy the FortiGate Firewall in its default
            settings.</para><remark>Maybe more info about how to do it should be added here.</remark>
          </listitem>

          <listitem>
            <para>Connect to the FortiGate VNF Web Management interface with a
            web browser.</para>
          </listitem>

          <listitem>
            <para>Modify the FortiGate configuration in the FortiGate VNF Web
            Management as needed.</para>
          </listitem>

          <listitem>
            <para>Store the updated configuration in a file, so it may be used
            at the next FortiGate VNF instantiation.</para>
          </listitem>
        </orderedlist>
      </listitem>
    </orderedlist>
  </section>
</chapter>