path: root/doc/book-enea-nfv-access-example-usecases/doc/vnf_chaining.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<chapter id="vnf_chaining">
  <title>VNF Chaining Example Use-case</title>

  <section id="VNF_chain_intro">
    <title>Introduction</title>

    <para>The following decribes an example of how to setup and configure a
    branch-to-branch service comprised on two commercial VNFs (SD-WAN +
    Firewall). This service will run in a service chain on top of the Enea NFV
    Access virtualization platform, deployed through the Enea uCPE Manager. In
    the example setup the following commercial VNFs are used: Juniper vSRX as
    the SD-WAN VNF and Fortigate as the Router/Firewall.</para>

    <para>The setup requires two physical appliances (uCPEs), each of them
    having three DPDK-compatible NICs and one interface available for uCPE
    management (i.e. connected to Enea uCPE Manager). On each uCPE, one of the
    DPDK-compatible interfaces is connected back-to-back with one interface
    from the other uCPE device. This link simulates a WAN/uplink
    connection.</para>

    <para>Optionally, one additional device (PC/laptop) can be connected on
    the LAN port of each branch to run LAN-to-LAN connectivity tests.</para>

    <figure>
      <title>Example Setup</title>

      <mediaobject>
        <imageobject>
          <imagedata align="center" fileref="images/example_setup.png"
                     scale="88" />
        </imageobject>
      </mediaobject>
    </figure>

    <note>
      <para>For simplicity, the image above does not present the
      management-plane, which will be described in the Setup steps.</para>
    </note>
  </section>

  <section id="prere">
    <title>Prerequisites</title>

    <para>The following files are needed for this example use case:</para>

    <itemizedlist>
      <listitem>
        <para>Juniper vSRX VNF image, vSRX-Site&lt;x&gt;.iso as the Cloud-Init
        files. This VNF/image is not provided by Enea. Please contact Juniper
        to get this image.</para>
      </listitem>

      <listitem>
        <para>Fortigate VNF image. This image is provided by Enea.</para>
      </listitem>

      <listitem>
        <para>vSRX-domain-update-script. This file is provided by Enea.</para>
      </listitem>

      <listitem>
        <para>FortiFW-Site&lt;x&gt;.conf as the Cloud-Init file(s). This file
        is provided by Enea.</para>
      </listitem>

      <listitem>
        <para>license as the Cloud-Init content in the Cloud-Init tab files.
        For license files for the VNFs, please contact the VNF
        provider.</para>
      </listitem>
    </itemizedlist>
  </section>

  <section id="crateing_setup">
    <title>Creating the setup</title>

    <para>Both branches in the example have similar setups, therefore
    necessary step details are presented for only one branch. The second
    branch shall be configured in the same way, adapting as needed the
    corresponding VNFs configuration files.</para>

    <orderedlist>
      <listitem>
        <para>Assign three physical interfaces to the DPDK (one for
        management, one WAN and one for LAN). In the example, one of these
        interfaces gets an IP through DHCP and it will be used exclusively for
        the management plane.</para>
      </listitem>

      <listitem>
        <para>Create the following OVS-DPDK bridges:</para>

        <itemizedlist>
          <listitem>
            <para><literal>vnf_mgmt_br</literal>. Used by VNF management
            ports.</para>
          </listitem>

          <listitem>
            <para><literal>wan_br</literal>. Used by the service uplink
            connection. In our case, Juniper vSRX will have its WAN virtual
            interface in this bridge.</para>
          </listitem>

          <listitem>
            <para><literal>sfc_br</literal>. Used for creating the service
            chain. Each VNF will have a virtual interface in this
            bridge.</para>
          </listitem>

          <listitem>
            <para><literal>lan_br</literal>. Used for the LAN interface of the
            Fortigate FW.</para>
          </listitem>
        </itemizedlist>
      </listitem>

      <listitem>
        <para>Add corresponding DPDK ports (see Step 1) to the management, WAN
        and LAN bridges (<literal>sfc_br</literal> does not have a physical
        port attached to it).</para>

        <note>
          <para>The networking setup (Steps 1-3) can be modeled using the
          Offline Configuration entry, so that it is automatically provisioned
          on the uCPE, once it gets enrolled into the management system (uCPE
          Manager).</para>
        </note>
      </listitem>

      <listitem>
        <para>Onboard Juniper vSRX using the VNF Onboarding Wizard:</para>

        <itemizedlist>
          <listitem>
            <para>The Flavor selected must have at least 2 vCPUs and 4 GB RAM
            since vSRX is quite resource consuming.</para>

            <para>Tested-inhouse with 4 vCPUs/ 6 GB RAM.</para>
          </listitem>

          <listitem>
            <para>Add three virtual interfaces: management, WAN and
            LAN.</para>
          </listitem>

          <listitem>
            <para>Select <literal>ISO</literal> on the Cloud-Init tab.</para>
          </listitem>
        </itemizedlist>
      </listitem>

      <listitem>
        <para>Onboard Fortigate FW using the VNF Onboarding Wizard:</para>

        <itemizedlist>
          <listitem>
            <para>The Flavor selected can be quite light in resources, e.g. 1
            vCPU and 2 GB RAM.</para>
          </listitem>

          <listitem>
            <para>Add three virtual interfaces: management, WAN and
            LAN.</para>
          </listitem>

          <listitem>
            <para>Select <literal>ConfigDrive</literal> on the Cloud-Init
            tab.</para>
          </listitem>

          <listitem>
            <para>Add <literal>license</literal> as the Cloud-Init content in
            the Cloud-Init tab files.</para>
          </listitem>
        </itemizedlist>

        <note>
          <para>Steps 4-5 are done only once, i.e. they will not be repeated
          for Site 2.</para>
        </note>
      </listitem>

      <listitem>
        <para>Create the vSRX instance:</para>

        <itemizedlist>
          <listitem>
            <para>Use <filename>vSRX-Site1.iso</filename> as the Cloud-Init
            file.</para>
          </listitem>

          <listitem>
            <para>The <literal>Domain Update Script</literal> field can be
            left empty for the Atom C3000 architecture, while for XeonD the
            <filename>vSRX-domain-update-script</filename> file will be
            used.</para>
          </listitem>

          <listitem>
            <para>Add virtual interfaces:</para>

            <itemizedlist>
              <listitem>
                <para>Management interface added to
                <literal>vnf_mgmt_br</literal>.</para>
              </listitem>
            </itemizedlist>

            <itemizedlist>
              <listitem>
                <para>WAN interface added to <literal>wan_br</literal>.</para>
              </listitem>
            </itemizedlist>

            <itemizedlist>
              <listitem>
                <para>LAN interface added to <literal>sfc_br</literal>.</para>
              </listitem>
            </itemizedlist>
          </listitem>
        </itemizedlist>

        <note>
          <para>The login/password values for the vSRX VNF are
          <literal>root/vsrx1234</literal>, respectively.</para>
        </note>
      </listitem>

      <listitem>
        <para>Create the Fortigate FW instance:</para>

        <itemizedlist>
          <listitem>
            <para>Use <filename>FortiFW-Site1.conf</filename> as Cloud-Init
            file.</para>
          </listitem>

          <listitem>
            <para>Add <filename>.lic</filename> (not part of the folder) as
            the license file.</para>
          </listitem>

          <listitem>
            <para>Add virtual interfaces:</para>

            <itemizedlist>
              <listitem>
                <para>Management interface added to
                <literal>vnf_mgmt_br</literal>.</para>
              </listitem>
            </itemizedlist>

            <itemizedlist>
              <listitem>
                <para>WAN interface added to <literal>sfc_br</literal>.</para>
              </listitem>
            </itemizedlist>

            <itemizedlist>
              <listitem>
                <para>LAN interface added to <literal>lan_br</literal>.</para>
              </listitem>
            </itemizedlist>
          </listitem>
        </itemizedlist>

        <note>
          <para>The login/password values for the Fortigate VNF are
          <literal>admin/&lt;empty password&gt;</literal>,
          respectively.</para>
        </note>
      </listitem>
    </orderedlist>

    <para>At this point the service will be up and running on Site1. Repeat
    the necessary steps for Site2, by changing the configuration files
    accordingly. After the service is deployed on both branches, the VPN
    tunnel is established and LAN to LAN visibility can be verified by
    connecting one device on each uCPE LAN port. See <link
    linkend="test_setup">Testing the setup</link> for details on how to
    proceed.</para>
  </section>

  <section id="test_setup">
    <title>Testing the setup</title>

    <para>Before testing LAN to LAN connectivity, preliminary tests of service
    can be run to ensure everything was set up properly.</para>

    <para>Before testing LAN to LAN connectivity, one can run preliminary
    tests of service to ensure everything was set-up properly. For instance,
    by connecting to vSRX CLI (any site), one can test IKE security
    associations:</para>

    <programlisting>root@Atom-C3000:~ # cli</programlisting>

    <programlisting>root@Atom-C3000&gt; show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
1588673 UP     2f2047b144ebfce4  0000000000000000  Aggressive     10.1.1.2
...
root@Atom-C3000&gt; show security ike security-associations index 1588673 detail
...</programlisting>

    <para>Also, from the vSRX CLI, a user can check that the VPN tunnel was
    established and get statistics of the packets passing the tunnel:</para>

    <programlisting>root@Atom-C3000&gt; show security ipsec security-associations
...
root@Atom-C3000&gt; show security ipsec statistics index &lt;xxxxx&gt;
...</programlisting>

    <para>From the Fortigate Firewall CLI on Site 1, one can check
    connectivity to the remote Fortigate FW (from Site 2):</para>

    <programlisting>FGVM080000136187 # execute ping 192.168.168.2
PING 192.168.168.2 (192.168.168.2): 56 data bytes
64 bytes from 192.168.168.2: icmp_seq=0 ttl=255 time=0.0 ms
64 bytes from 192.168.168.2: icmp_seq=1 ttl=255 time=0.0 ms
64 bytes from 192.168.168.2: icmp_seq=2 ttl=255 time=0.0 ms
...</programlisting>

    <para>Since VNF management ports were configured to get IPs through DHCP,
    the user can use a Web-based management UI to check and modify the
    configuration settings of both vSRX and Fortigate.</para>

    <para>For example, in the case of vSRX, from the VNF CLI you can list the
    virtual interfaces as below:</para>

    <programlisting>root@Atom-C3000&gt; show interfaces terse
...
fxp0.0                  up    up   inet     172.24.15.92/22
gre                     up    up
ipip                    up    up
...</programlisting>

    <para>When using provided configurations, the VNF management port for
    Juniper vSRX is always <literal>fxp0.0</literal>.</para>

    <para>In the case of Fortigate, from the VNF CLI you can list the virtual
    interfaces as such:</para>

    <programlisting>FGVM080000136187 # get system interface
== [ port1 ]
name: port1   mode: dhcp  ip: 172.24.15.94 255.255.252.0   status: up netbios-forward:
disable      type: physical   netflow-sampler: disable    sflow-sampler: disable...
...</programlisting>

    <para>When using provided configurations, the VNF management port for
    Fortigate is always <literal>port1</literal>.</para>

    <note>
      <para>Please note that VNF management ports will get dynamically
      allocated IPs only if the physical NIC used for management is configured
      to get its IP through DHCP (see Step 1 from above).</para>
    </note>

    <para>If functionality is as intended, LAN-to-LAN connectivity can be
    checked (through the VPN tunnel) by using two devices (PC/laptop)
    connected to the LAN ports of each uCPE. Optionally, these devices can be
    simulated by using Enea's sample VNF running on both uCPEs and connected
    to the <literal>lan_br</literal> on each side. Please note that
    instructions for onboarding and instantiating this VNF is not in the scope
    of this document.</para>

    <para>Since Fortigate VNF, which is acting as router and firewall, is
    configured to be the DHCP server for the LAN network, the device interface
    connected to the uCPE LAN port has to be configured to get dinamically
    assigned IPs. These IPs are in the 172.0.0.0/24 network for Site1 and the
    172.10.10.0/24 network for Site2. Therefore, site-to-site connectivity can
    be checked (from Site1) as such:</para>

    <programlisting>root@atom-c3000:~# ping 172.10.10.2
PING 172.10.10.1 (172.10.10.2): 56 data bytes
...</programlisting>
  </section>

  <section id="limitations">
    <title>Limitations</title>

    <para>Below is a list of known limitations:</para>

    <itemizedlist>
      <listitem>
        <para>The vSRX VNF has no trust-to-untrust and untrust-to-trust
        policies (only trust-to-vpn and vpn-to-trust were configured).
        Therefore, uCPEs were not configured for a "direct Internet access"
        use-case.</para>
      </listitem>

      <listitem>
        <para>The Fortigate VNF has no "real" firewall policies set, i.e. all
        traffic from LAN is allowed to pass through the WAN interface and
        vice-versa.</para>
      </listitem>
    </itemizedlist>
  </section>
</chapter>