path: root/doc/book-enea-nfv-access-example-usecases/doc/vnf_chaining.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<chapter id="vnf_chaining">
  <title>VNF Chaining Example Use-case</title>

  <para>The following is an example of how to setup and configure a
  branch-to-branch service comprised on two commercial VNFs (SD-WAN +
  Firewall). This service will run in a service chain on top of the Enea NFV
  Access virtualization platform, deployed through the Enea uCPE
  Manager.</para>

  <para>In the example setup the following commercial VNFs are used: Juniper
  vSRX as the SD-WAN VNF and Fortigate as the Router/Firewall.</para>

  <section id="VNF_chain_intro">
    <title>VNF Chaining with FortiGate</title>

    <section id="preq_chaining">
      <title>Prerequisites</title>

      <para>Two uCPE devices will be needed for this setup. The system
      requirements for each uCPE device are:</para>

      <itemizedlist>
        <listitem>
          <para>4 x Network Interfaces</para>
        </listitem>

        <listitem>
          <para>4 GB of RAM memory</para>
        </listitem>
      </itemizedlist>
      
      <note>
       <para>On each uCPE device, 3 interfaces need to be DPDK compliant and one
            of these needs to be connected back-to-back to the other uCPE
            device. This link simulates a WAN/uplink connection. Optionally,
            one additional device (PC/laptop) can be connected on the LAN port
            of each branch to run LAN-to-LAN connectivity tests.</para>
      </note>

      <para>The following files are needed for this example use-case:</para>
      
      <note><para>To procure the VNF image files and their licenses, please contact each respective VNF
      provider.</para></note>

      <itemizedlist>
        <listitem>
          <para>Fortigate VNF image file.</para>
        </listitem>

        <listitem>
          <para>Juniper vSRX VNF image file.</para>
        </listitem>
        
        <listitem><para>VNF Configuration files, provided with your Enea NFV Access Release:</para>
          <itemizedlist spacing="compact">
            <listitem><para><filename>vSRX-domain-update-script</filename>.</para></listitem>
            <listitem><para><filename>vSRX-Site&lt;x&gt;.iso</filename>.</para></listitem>
            <listitem><para><filename>FortiFW-Site&lt;x&gt;.conf</filename>.</para></listitem>
          </itemizedlist>      
        </listitem>
        </itemizedlist>  
    </section>

    <section id="exam_setup_chain">
      <title>Use-case Setup</title>

      <figure>
        <title>VNF Chaining with Fortigate</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center" contentwidth="600"
                       fileref="images/uc_vnf_chaining.png" />
          </imageobject>
        </mediaobject>
      </figure><remark>No info about vnf_mgmt_br?</remark>

      <para><emphasis role="bold">Network Configuration</emphasis>:</para>

      <para>Both branches in the example have similar setups, therefore
      necessary step details are presented for only one branch. The second
      branch shall be configured in the same way, adapting as needed the
      corresponding VNFs configuration files.</para>

      <orderedlist>
        <listitem>
          <para>Assign three physical interfaces to the DPDK (one for
          management, one WAN and one for LAN). In the example, one of these
          interfaces gets an IP through DHCP and it will be used exclusively
          for the management plane.</para>
        </listitem>

        <listitem>
          <para>Create the following OVS-DPDK bridges:</para>

          <itemizedlist>
            <listitem>
              <para><literal>vnf_mgmt_br</literal>. Used by VNF management
              ports.</para>
            </listitem>

            <listitem>
              <para><literal>wan_br</literal>. Used by the service uplink
              connection. In our case, Juniper vSRX will have its WAN virtual
              interface in this bridge.</para>
            </listitem>

            <listitem>
              <para><literal>sfc_br</literal>. Used for creating the service
              chain. Each VNF will have a virtual interface in this
              bridge.</para>
            </listitem>

            <listitem>
              <para><literal>lan_br</literal>. Used for the LAN interface of
              the Fortigate FW.</para>
            </listitem>
          </itemizedlist>
        </listitem>

        <listitem>
          <para>Add corresponding DPDK ports (see Step 1) to the management,
          WAN and LAN bridges (<literal>sfc_br</literal> does not have a
          physical port attached to it).</para>

          <note>
            <para>The networking setup (Steps 1-3) can be modeled using the
            Offline Configuration entry, so that it is automatically
            provisioned on the uCPE device, once it gets enrolled into the management
            system (uCPE Manager).</para>
          </note>
        </listitem>
      </orderedlist>

      <para><emphasis role="bold">Onboarding the VNFs</emphasis>:</para>

      <orderedlist>
        <listitem>
          <para>Onboard Juniper vSRX using the VNF by filling the required
          fields with the following values:</para>

          <itemizedlist spacing="compact">
            <listitem>
              <para>The Flavor selected must have at least 2 vCPUs and 4 GB RAM since vSRX is 
                quite resource consuming.</para>

              <para>Tested in-house with 4 vCPUs/ 6 GB RAM.</para>
            </listitem>

            <listitem>
              <para>Add three virtual interfaces: management, WAN and
              LAN.</para>
            </listitem>

            <listitem>
              <para>Select <literal>ISO</literal> as the Cloud-Init Datasource in the Cloud-Init 
                tab.</para>
            </listitem>
            <listitem>
            <para>Select <literal>cdrom</literal> as the Cloud-Init Disk Type in the Cloud-Init 
              tab.</para></listitem>
          </itemizedlist>
        </listitem>

        <listitem>
          <para>Onboard Fortigate FW using the VNF Onboarding Wizard:</para>

          <itemizedlist>
            <listitem>
              <para>The Flavor selected can be quite light in resource
              consumption, e.g. 1 CPU and 1 GB RAM.</para>
            </listitem>

            <listitem>
              <para>Add three virtual interfaces: management, WAN and
              LAN.</para>
            </listitem>

            <listitem>
              <para>Select <literal>ConfigDrive</literal> as the Cloud-Init Datasource in the 
                Cloud-Init tab.</para>
            </listitem>

			<listitem><para>Select <literal>cdrom</literal> as the Cloud-Init Disk 
                          Type in the Cloud-Init tab.</para></listitem>

            <listitem>
              <para>Add <literal>license</literal> as the Cloud-Init content
              in the Cloud-Init tab files.</para>
            </listitem>
          </itemizedlist>
        </listitem>
      </orderedlist>

      <para><emphasis role="bold">Instantiating the VNFs:</emphasis></para>

      <orderedlist>
        <listitem>
          <para>Create the vSRX instance:</para>

          <itemizedlist>
            <listitem>
              <para>Use <filename>vSRX-Site1.iso</filename> as the Cloud-Init
              file.</para>

              <note>
                <para>Please follow Juniper's documentation to create the
                <filename>vSRX-Site1.iso</filename> file.</para>
              </note>
            </listitem>

            <listitem>
              <para>The <literal>Domain Update Script</literal> field can be
              left empty for the Atom C3000 architecture, while for XeonD the
              <filename>vSRX-domain-update-script</filename> file will be
              used.</para>
            </listitem>

            <listitem>
              <para>Add virtual interfaces:</para>

              <itemizedlist>
                <listitem>
                  <para>Management interface added to
                  <literal>vnf_mgmt_br</literal>.</para>
                </listitem>

                <listitem>
                  <para>WAN interface added to
                  <literal>wan_br</literal>.</para>
                </listitem>

                <listitem>
                  <para>LAN interface added to
                  <literal>sfc_br</literal>.</para>
                </listitem>
              </itemizedlist>
            </listitem>
          </itemizedlist>

          <note>
            <para>The login/password values for the vSRX VNF are
            <literal>root/vsrx1234</literal>, respectively.</para>
          </note>
        </listitem>

        <listitem>
          <para>Create the Fortigate FW instance:</para>

          <itemizedlist>
            <listitem>
              <para>Use <filename>FortiFW-Site1.conf</filename> as the Cloud-Init
              file.</para>
            </listitem>

            <listitem>
              <para>Add <filename>.lic</filename> (not part of the folder) as
              the license file.</para>
            </listitem>

            <listitem>
              <para>Add virtual interfaces:</para>

              <itemizedlist>
                <listitem>
                  <para>Management interface added to
                  <literal>vnf_mgmt_br</literal>.</para>
                </listitem>

                <listitem>
                  <para>WAN interface added to
                  <literal>sfc_br</literal>.</para>
                </listitem>

                <listitem>
                  <para>LAN interface added to
                  <literal>lan_br</literal>.</para>
                </listitem>
              </itemizedlist>
            </listitem>
          </itemizedlist>

          <note>
            <para>The login/password values for the Fortigate VNF are
            <literal>admin/&lt;empty password&gt;</literal>,
            respectively.</para>
          </note>
        </listitem>
      </orderedlist>

      <para>At this point the service will be up and running on Site1. Repeat
      the steps to instantiate a VNF for Site2, by changing the configuration files
      accordingly.</para>

      <para>After the service is deployed on both branches, the VPN tunnel is
      established and LAN to LAN visibility can be verified by connecting one
      device on each uCPE LAN port.</para>
    </section>

    <section id="test_setup">
      <title>Testing the Use-case</title>

      <para>Before testing LAN to LAN connectivity, preliminary tests of
      service can be run to ensure everything was set up properly. For
      instance, by connecting to vSRX CLI (any site), one can test IKE
      security associations:</para>

      <programlisting>root@Atom-C3000:~ # cli
root@Atom-C3000&gt; show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
1588673 UP     2f2047b144ebfce4  0000000000000000  Aggressive     10.1.1.2
...
root@Atom-C3000&gt; show security ike security-associations index 1588673 detail
...</programlisting>

      <para>Also, from the vSRX CLI, a user can check that the VPN tunnel was
      established and get statistics of the packets passing the tunnel:</para>

      <programlisting>root@Atom-C3000&gt; show security ipsec security-associations
...
root@Atom-C3000&gt; show security ipsec statistics index &lt;xxxxx&gt;
...</programlisting>

      <para>From the Fortigate Firewall CLI on Site 1, one can check
      connectivity to the remote Fortigate FW (from Site 2):</para>

      <programlisting>FGVM080000136187 # execute ping 192.168.168.2
PING 192.168.168.2 (192.168.168.2): 56 data bytes
64 bytes from 192.168.168.2: icmp_seq=0 ttl=255 time=0.0 ms
64 bytes from 192.168.168.2: icmp_seq=1 ttl=255 time=0.0 ms
64 bytes from 192.168.168.2: icmp_seq=2 ttl=255 time=0.0 ms
...</programlisting>

      <para>Since VNF management ports were configured to get IPs through
      DHCP, the user can use a Web-based management UI to check and modify the
      configuration settings of both vSRX and Fortigate.</para>

      <para>For example, in the case of vSRX, from the VNF CLI you can list
      the virtual interfaces as below:</para>

      <programlisting>root@Atom-C3000&gt; show interfaces terse
...
fxp0.0                  up    up   inet     172.24.15.92/22
gre                     up    up
ipip                    up    up
...</programlisting>

      <para>When using provided configurations, the VNF management port for
      Juniper vSRX is always <literal>fxp0.0</literal>.</para>

      <para>In the case of Fortigate, from the VNF CLI you can list the
      virtual interfaces as such:</para>

      <programlisting>FGVM080000136187 # get system interface
== [ port1 ]
name: port1   mode: dhcp  ip: 172.24.15.94 255.255.252.0   status: up netbios-forward:
disable      type: physical   netflow-sampler: disable    sflow-sampler: disable...
...</programlisting>

      <para>When using provided configurations, the VNF management port for
      Fortigate is always <literal>port1</literal>.</para>

      <para>If functionality is as intended, LAN-to-LAN connectivity can be
      checked (through the VPN tunnel) by using two devices (PC/laptop)
      connected to the LAN ports of each uCPE. Optionally, these devices can
      be simulated by using Enea's sample VNF running on both uCPEs and
      connected to the <literal>lan_br</literal> on each side. Please note
      that instructions for onboarding and instantiating this VNF is not in
      the scope of this document.</para>

      <para>Since Fortigate VNF, which is acting as router and firewall, is
      configured to be the DHCP server for the LAN network, the device
      interface connected to the uCPE LAN port has to be configured to get
      dinamically assigned IPs. These IPs are in the 172.0.0.0/24 network for
      Site1 and the 172.10.10.0/24 network for Site2. Therefore, site-to-site
      connectivity can be checked (from Site1) as such:</para>

      <programlisting>root@atom-c3000:~# ping 172.10.10.2
PING 172.10.10.1 (172.10.10.2): 56 data bytes
...</programlisting>
    </section>
  </section>
</chapter>