blob: 4a5cd06fd59c87341d57715e3f6b7c79ed715326 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
|
<?xml version="1.0" encoding="ISO-8859-1"?>
<chapter id="inband_management">
<title>In-band Management Example Use-case</title>
<para>In the case of an NFV Access device installed on a network with
limited access, In-band management can be a solution to manage the device
and to pass data traffic (through only one physical interface). This example
use-case will show how to enable In-band management on the NFV Access
device and to access a VNF on the same physical interface.</para>
<section id="inband_mg_uc_preq">
<title>Prerequisites</title>
<para>System requirements for the uCPE device:</para>
<itemizedlist>
<listitem>
<para>1 x Network Interface for WAN and management.</para>
</listitem>
<listitem>
<para>1 x Network Interface for LAN.</para>
</listitem>
</itemizedlist>
<note>
<para>No other physical port for In-band management can be used.
<remark>FIXME: What does this mean?</remark></para>
</note>
<para>The following files are needed for this example use case:</para>
<itemizedlist>
<listitem>
<para>FortiGate VNF image. This file is provided by the local Fortinet
sales representatives in your region.</para>
</listitem>
<listitem>
<para>FortiGate VNF license file. This file is provided by the local
Fortinet sales representatives in your region.</para>
</listitem>
<listitem>
<para>FortiGate specific documentation. This is provided by the local
Fortinet sales representatives in your region.</para>
</listitem>
<listitem>
<para>FortiGate configuration example files. These files are provided
with your Enea NFV Access release.</para>
</listitem>
</itemizedlist>
</section>
<section id="inband_mg_fortivnf_uc">
<title>In-band Management Activation</title>
<para>In-band management activation is done by creating a special bridge
which manages all traffic from the WAN interface. The active physical port
of the device (used by the device manager to communicate with the uCPE
Manager) will be connected to the In-band management bridge.</para>
<para>Once the In-band management bridge is activated, communication to
the uCPE Manager will be reactivated, passing through the bridge.</para>
<para>For further details, please see <olink targetdoc="book_enea_nfv_access_getting_started"
targetptr="in_band_managemen">in_band_managemen in <xi:include
href="../../s_docbuild/olinkdb/pardoc-names.xml"
xmlns:xi="http://www.w3.org/2001/XInclude"
xpointer="element(book_enea_nfv_access_getting_started/1)" /></olink>.</para>
<figure>
<title>NFV Access In-band management solution setup</title>
<mediaobject>
<imageobject>
<imagedata align="center" fileref="images/uc_ibm_solution_test.png"
contentwidth="600" />
</imageobject>
</mediaobject>
</figure>
<section id="inband_examuc_setup">
<title>Use-case Setup</title>
<para><emphasis role="bold">Network Configuration:</emphasis></para>
<orderedlist>
<listitem>
<para>Create an In-band management WAN Bridge (set
<literal>dpdkWan</literal> as the bridge type).</para>
</listitem>
<listitem>
<para>Bind the physical network interface that will be used for LAN
access to the <literal>DPDK</literal>.</para>
</listitem>
<listitem>
<para>Create a LAN Bridge and attach the DPDK LAN interface.</para>
</listitem>
</orderedlist>
<note>
<para>The WAN port of the very first VNF instantiated on the device
must be connected to the <literal>WAN</literal> bridge. All other VNFs
must be connected in chain with the first VNF.</para>
</note>
<para><emphasis role="bold">Onboarding the VNF:</emphasis></para>
<para>See onboarding parameters in <xref linkend="fortigate_firewall_uc_1" />.</para>
<para><emphasis role="bold">Instantiating the VNF:</emphasis></para>
<para>Instantiate the FortiGate VNF by filling the required fields with
the following values:</para>
<table>
<title>Instantiation Requirements</title>
<tgroup cols="2">
<colspec align="center" colwidth="1*" />
<colspec align="center" colwidth="4*" />
<thead>
<row>
<entry align="center">Field</entry>
<entry align="center">Description</entry>
</row>
</thead>
<tbody>
<row>
<entry align="left">Name</entry>
<entry align="left">Name of the VM which will be created on the
uCPE device.</entry>
</row>
<row>
<entry align="left">VNF Type</entry>
<entry align="left">Name of the onboarded VNF.</entry>
</row>
<row>
<entry align="left">uCPE Device</entry>
<entry align="left">Select the uCPE device where the VNF will be
instantiated.</entry>
</row>
<row>
<entry align="left">License file</entry>
<entry align="left">The FortiGate license file provided by
Fortinet.</entry>
</row>
<row>
<entry align="left">Configuration file</entry>
<entry align="left">The Firewall example configuration file provided
by Enea
(<filename>FGVM080000136187_20180828_0353_basic_fw.conf</filename>).</entry>
</row>
<row>
<entry align="left">Port1 - WAN</entry>
<entry align="left">Set the <literal>External Interface</literal> type to
<literal>DPDK</literal> and connect it to the <literal>ibm-wan-br</literal> ovs
bridge.</entry>
</row>
<row>
<entry align="left">Port2 - LAN1</entry>
<entry align="left">Set the <literal>Incoming Interface</literal> type to
<literal>DPDK</literal> and connect it to the <literal>lan-br</literal> ovs
bridge.</entry>
</row>
<row>
<entry align="left">Port3 - LAN2</entry>
<entry align="left">Set the <literal>Outgoing Interface</literal> type to
<literal>DPDK</literal> and connect it to the <literal>lan-br</literal> ovs
bridge.</entry>
</row>
</tbody>
</tgroup>
</table>
</section>
<section id="test_fortvnf_inband">
<title>Testing the Use-case</title>
<para>Once the VNF is instantiated, the setup is complete and ready for
testing. Connect the test machine to the LAN port. It will receive an IP
address from the FortiGate VNF and be able to access the
internet.</para>
<para>At this stage, three types of traffic are passing through the WAN
port on the same IP address:</para>
<itemizedlist>
<listitem>
<para>Device management traffic from the uCPE Manager.</para>
</listitem>
<listitem>
<para>FortiGate management interface traffic from a web
browser.</para>
</listitem>
<listitem>
<para>Data traffic from the LAN to the internet.</para>
</listitem>
</itemizedlist>
<para>If you have access from the uCPE Manager to the device as shown
above, this demonstrates that device management traffic passes through
the In-band management WAN bridge successfully.</para>
<para>To access the management interface of the VNF, connect from a web
browser to the public IP address of the device e.g.
<literal>https://<IP></literal>. From a Test machine connected on
the LAN port, try a test ping to the internet e.g. "ping
8.8.8.8".</para>
</section>
</section>
</chapter>
|
