This document provides step by step instruction to deploy vedge-cloud and vm-series paloalto firewall with optimal service chain performance.   Software versions used in this Guide NFVIS version 3.10.1 on ENCS platform vedge-cloud 18.4.0 paloalto vm-series 18.3.1   Login to NFVIS local portal and First step is to upload the vedge-cloud and vm-series-paloalto-firewall image packages into image repository. Image packages can be built using the following instructions. how-to-create-a-vedge-cloud-package-for-nfvis how-to-create-a-paloalto-firewall-package-for-nfvis   CPU type, number of vcpu's, type of networking (SRIOV, OVS, OVS-DPDK) will influence the throughput performance through service chain. For optimal networking, use SRIOV and OVS-DPDK. Enable OVS-DPDK system-wide on NFVIS Enable OVS DPDK Deploy vedge-cloud with site specific information and point the sdwan router to  vManage orchestrator Deploy vedge Deploy paloalto firewall and point to panorama server   Deploy vm-series paloalto firewall Verify vedge in site 122 is discovered in vManage vedge cloud in site 122   Verify vm-series in site 122 is discovered in Panorama server vmseries deployed and licensed   ... View more

 This is a Howto step-by-step instruction for creating a vedge-cloud VNF package for deployment in NFVIS.  What is a VNF package?  VNF package is essentially a set of files bundled for ease of distribution and automation of deployment. VNF package typically contains the disk image(s), bootstrap configuration(s), meta-data that represents the capability, manifest file that confirms integrity.  Why package? Creating a VNF package is not mandatory however it has it advantages Provides a way to scale out deployments.  Support for Day 0 configuration for Cisco and 3rd party VNFs The packaging utility creates a tar.gz file which contains The raw QCOW2 file. Note: ISO, vmdk formats would require conversion to qcow2 before package can be created.  Image properties file Supported and default profiles Day 0 configs Image properties file is created by using either the GUI or using the packaging utility provided with every release. Note: DNAC NFV app is a recommended solution for Automation and Assurance of VNF service chain across 100's of Enterprise sites. VNF package created by NFVIS packaging tool would be imported to DNAC Image repository. How to Package? There are at least 2 common ways to build a package. Method 1. GUI approach, available via NFVIS local portal Method 2. Python script based tool downloaded from NFVIS local portal Method 1   : NFVIS Local Portal based Image Packaging Image Packaging for NFVIS Part 1 Image packaging for NFVIS part 2 Image packaging for NFVIS part 3   Next step is to register the package that was built for use in the local system. Alternately, the package can be downloaded for use via an orchestrator like DNA Center. Note :   For file sizes larger than 1GB, SCP based copy would be a faster and reliable method. By default SCP is disabled in NFVIS system. SCP can be enabled from specific source IP using the following CLI.   nfvis(config)# system settings ip-receive-acl 0.0.0.0/0 service scpd priority 2 action accept nfvis(config-ip-receive-acl-0.0.0.0/0)# commit Method 2 :   Download and Execute python script based tool Refer Method 2 here https://community.cisco.com/t5/network-architecture-documents/how-to-create-a-vm-package-for-nfvis/ta-p/3732265 ... View more

This document describes step by step procedure to Design and Deploy SDWAN Router and Firewall on NFVIS platform.  Hardware and Software used in this guide DNAC 1.2.5 NFVIS Version 3.9.2 FC4 ENCS5408/K9 vedge-cloud Prerequisites NFVIS installed on (supported) hardware and access to the local management Web-GUI. DNAC installed on appliance and access to the management GUI. Step-by-step instructions This document assumes that Sites, Network Settings are created and available in the DNAC system. Upload Images into image repository Import vedge-cloud sdwan and paloalto firewall packages onto DNAC image repository   upload vedge-cloud upload paloalto firewall package for NFVIS Select version for use in design and deployment Create vBranch Network Design   Platform and WAN Select Network Functions   Add Custom Network   Switch Config Custom Config Templates Design Complete Associate Design and Site(s)   Configure vManage access info in DNAC vManage info in DNAC settings Discover device and add to Inventory Discover Device Provision vBranch Provision workflow start Provision Router WAN Address   Complete bootstrap configuration for VNFs   Verify design and Deploy   DNAC starts deploying design with configuration   Provision complete Success ... View more

This is a Howto step-by-step instruction for creating a VNF package for deployment in NFVIS.  What is a VNF package?  VNF package is essentially a set of files bundled for ease of distribution and automation of deployment. VNF package typically contains the disk image(s), bootstrap configuration(s), meta-data that represents the capability, manifest file that confirms integrity.  Why package? Creating a VNF package is not mandatory however it has it advantages Provides a way to scale out deployments.  Support for Day 0 configuration for Cisco and 3rd party VNFs The packaging utility creates a tar.gz file which contains The raw QCOW2 file. Note: ISO, vmdk formats would require conversion to qcow2 before package can be created.  Image properties file Supported and default profiles Day 0 configs Image properties file is created by using either the GUI or using the packaging utility provided with every release. Note: DNAC NFV app is a recommended solution for Automation and Assurance of VNF service chain across 100's of Enterprise sites. VNF package created by NFVIS packaging tool would be imported to DNAC Image repository. How to Package? There are at least 2 common ways to build a package. Method 1. GUI approach, available via NFVIS local portal Method 2. Python script based tool downloaded from NFVIS local portal Method 1 : NFVIS Local Portal based Image Packaging Image Packaging for NFVIS     Image Packaging for NFVIS (Contd.)   Next step is to register the package that was built for use in the local system. Alternately, the package can be downloaded for use via an orchestrator like DNA Center. Note : For file sizes larger than 1GB, SCP based copy would be a faster and reliable method. By default SCP is disabled in NFVIS system. SCP can be enabled from specific source IP using the following CLI.   nfvis(config)# system settings ip-receive-acl 0.0.0.0/0 service scpd priority 2 action accept nfvis(config-ip-receive-acl-0.0.0.0/0)# commit Image Packaging for NFVIS Complete Method 2 : Download and Execute python script based tool Untar the downloaded file and the following files are part of the package. Python 2.7+ environment is required for executing the script. tar -xvf nfvisvmpackagingtool.tar nfvpt.py image_properties_template.xml tool-usage-examples.txt     Example Usage for ASAv: NOTE: --bootstrap1 day0-config (The bootstrap filename **must** be day0-config as ASAv only looks for this filename nfvpt.py -o asav961-201 -i asav961-201.qcow2 -n ASAv -t firewall -r 961-201 --monitored true --bootstrap day0-config:filename1 --min_vcpu 1 --max_vcpu 4 --min_mem 1024 --max_mem 8192 --min_disk 8 --max_disk 16 --vnic_max 8 --optimize true --profile ASAv5,"ASAv5 profile",1,1024,8192 --profile ASAv10,"ASAv10 profile",1,4096,8192 --profile ASAv30,"ASAv30 profile",4,8192,16384 --default_profile ASAv5   Example Usage for ISRv: NOTE: --bootstrap1 ovf-env.xml (The bootstrap filename **must** be ovf-env.xml as ISRv only looks for this filename nfvpt.py -o isrv.16.03.01 -i isrv-universalk9.16.03.01.qcow2 -n ISRv.16.03.01 -t ROUTER -r 16.03.01 --monitored true --privileged true --bootstrap ovf-env.xml:file1,ios-xe.txt:file2 --min_vcpu 2 --max_vcpu 8 --min_mem 4096 --max_mem 8192 --min_disk 8 --max_disk 8 --vnic_max 8 --optimize true --profile ISRv-small,"ISRv small profile",2,4096,8192 --profile ISRv-medium,"ISRv medium profile",4,4096,8192 --default_profile ISRv-small --sriov_list igb,igbvf,i40evf --custom tech_package,ax   Example Usage for 3rd Party VM with config drive (ISO) mounted at specific path on the VM: nfvpt.py -o test.1.0 -i test-1.0.qcow2 -n TEST -t OTHER -r 1.0 --monitored true --privileged true --bootstrap /:bootstrap.xml,/license/lic.txt:license.txt --min_vcpu 2 --max_vcpu 8 --min_mem 4096 --max_mem 8192 --min_disk 8 --max_disk 8 --vnic_max 8 --optimize true --profile small,"small profile",2,4096,8192 --profile medium,"medium profile",4,4096,8192 --default_profile small in this case test.1.0.pkg : bootstrap.xml get mounted as bootstrap.xml at root and license.txt get mounted as /license/lic.txt   Example Usage for vedge-cloud  nfvpt.py -o vedge18.3.1 -i viptela-edge-genericx86-64.qcow2  -n vedge.18.03.01 -t ROUTER -r 18.03.01 --monitored false --privileged true --bootstrap /openstack/latest/user_data:cloudinit.cfg,/openstack/latest/meta_data.json:meta_data,/openstack/latest/vendor_data.json:vendor_data --min_vcpu 2 --max_vcpu 8 --min_mem 4096 --max_mem 8192 --min_disk 8 --max_disk 8 --vnic_max 8 --optimize true --nocloud true --profile vEdge-small,"vEdge small  profile",2,4096,8192 --profile vEdge-Standard,"vEdge Standard profile",4,4096,8192 --default_profile vEdge-Standard --custom ORGNAME, --custom OTP, --custom UUID, --custom SYSTEM_IP, --custom VBOND, --custom SITE_ID,   There are 3 files to be passed as bootstrap config files, please follow the information below and create the 3 files and make them available in the same directory as the nfvpt.py File 1 : cloudinit.cfg      Action : save the text below in file, name it cloudinit.cfg     Content-Type: multipart/mixed; boundary="===============8815267485200512281==" MIME-Version: 1.0 --===============8815267485200512281== Content-Type: text/cloud-config; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="cloud-config" #cloud-config vinitparam: - otp : ${OTP} - vbond : ${VBOND} - uuid : ${UUID} - org : ${ORGNAME} --===============8815267485200512281== Content-Type: text/cloud-boothook; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="config-6978c2a4-8f5e-4489-8500-80e8048f60ad.txt" #cloud-boothook system personality vedge device-model vedge-cloud chassis-number ${UUID} ztp-status success config-template-name "vEdge-cloud-template" pseudo-confirm-commit 300 ! system personality vedge device-model vedge-cloud host-name vedgecloud1 system-ip ${SYSTEM_IP} domain-id 1 site-id ${SITE_ID} no route-consistency-check organization-name "${ORGNAME}" vbond ${VBOND} port 12346 aaa auth-order local radius tacacs usergroup basic task system read write task interface read write ! usergroup netadmin ! usergroup operator task system read task interface read task policy read task routing read task security read ! user admin password $6$siwKBQ==$wT2lUa9BSreDPI6gB8sl4E6PAJoVXgMbgv/whJ8F1C6sWdRazdxorYYTLrL6syiG6qnLABTnrE96HJiKF6QRq1 ! ! logging disk enable ! ! ! omp no shutdown graceful-restart advertise connected advertise static ! security ipsec authentication-type sha1-hmac ah-sha1-hmac ! ! vpn 0 name "Transport VPN" interface ge0/0 ip dhcp-client tunnel-interface encapsulation ipsec no allow-service bgp allow-service dhcp allow-service dns allow-service icmp no allow-service sshd no allow-service netconf no allow-service ntp no allow-service ospf no allow-service stun ! no shutdown ! ! vpn 1 interface ge0/1 no shutdown ! ! vpn 512 name "Transport VPN" interface eth0 ip dhcp-client no shutdown ! ! ! ! --===============8815267485200512281==--   File2 : meta_data    Action : save the text below in file, name it meta_data     {"uuid":"myinstance.mydomain.com"}   File3: vendor_data  Action : save the text below in file, name it vendor_data     {"test":"sample"} ... View more

Background : There is growing interest for SDWAN capability on NFVIS based virtual branch. SDWAN XE code enables SDWAN with key features that are part of IOS XE codebase, including WAN diversity option with T1/E1, LTE, etc.  This Howto document provides the required information for creating a virtual branch with SDWAN XE image.    Hardware and Software versions used ENCS 54xx hardware NFVIS 3.8.1 or above SDWAN XE ISRv 16.9.2 or above vManage suite 18.3.1 or above   Prerequisites NFVIS installed on a hardware with access to the on-box web GUI Access to vManage management, path for control connections from SDWAN devices. Device serial file with ISRv specific UUID and Tokens available in vManage.    Step-by-Step Instructions Step 1 : Prepare vmanage, vsmart, vbond to authenticate root-certificate and deploy device certificate after verification of one time use token. Create and attach template to Device ID with site-specific parameters populated. This allows for vmanage to generate bootstrap config for use in step 3. Step 2 : Upload Image and create/deploy the SDWAN XE virtual instance on NFVIS/ENCS. In this step, bootstrap config is generated from vmanage for DeviceID and passed on to the virtual instance deployed at remote site with this specific file name ciscosdwan_cloud_init.cfg Step 3 : Verify that the the SDWAN XE virtual instance on-boarded is accepted by vManage suite.   Step 1 Associate Template in vManage to a device   Confirm Attaching Device to Template is Successful   Generate Bootstrap Configuration   Select and Generate Bootstrap config in Default format   copy-n-paste or download bootstrap configuration  Step 2 : Upload SDWANXE image onto device and Deploy the Router instance   Upload SDWAN XE image into Image repository Image Registration Successful  Deploying an SDWAN instance with day 0 bootstrap configuration.   Deploy SDWAN XE router Verify registration of router to vManage Token is validated and device certificate is pushed ... View more