Page tree

Contents

Note

Before you issue commands with Nova, ensure that your environment contains the necessary credentials. You can do this by sourcing the keystonerc_admin file that is created during the OpenStack installation. For more information, refer to the section Getting Credentials for a CLI in the OpenStack CLI Guide.


To install vNIOS for KVM in OpenStack:

  1. In OpenStack, run source keystonerc_admin to set up the OpenStack environment.
  2. Upload the qcow2 file for the specified vNIOS for KVM model to OpenStack. For more information, see Requirements.
  3. Set up the OpenStack flavors, as described in Setting Up vNIOS OpenStack Flavors.
  4. Import the vNIOS instance into OpenStack, as described in Importing vNIOS Instance into OpenStack.
  5. Start an instance, as described in Starting a vNIOS Instance in OpenStack Environment.

Setting Up vNIOS OpenStack Flavors

After you upload the qcow2 file, set up the OpenStack flavors for your vNIOS models. Each flavor corresponds to different vCPU, RAM, disk size, and functionality.
Infoblox enables you to choose the size of the virtual disk that you use for reporting. To do so, you must create a vNIOS instance and associate an additional disk with it. You can add an ephemeral disk in the flavor that is used to create an instance. Note that the value for the ephemeral disk must be a non-zero.
To set up the vNIOS OpenStack flavors, run the following command:

nova flavor-create --is-public true <name> <ID> <Memory> <disk> <cpu> --swap 0
--ephemeral 0
where

  • name defines the name for the vNIOS for KVM instance. For reporting, mention the name of the reporting model.
  • ID defines the unique OpenStack flavor ID for the KVM instance.
  • memory disk and cpu specify the flavors of the vNIOS for KVM instance.
  • ephemeral defines the additional disk that is required to configure the reporting model.

Following is a sample command:

nova flavor-create --is-public true vnios-1425.160 6 8192 160 4 --swap 0 --ephemeral 0

For list of vNIOS OpenStack flavors with their specifications, refer vNIOS for KVM Virtual Appliance Models.

To manage the vNIOS OpenStack flavors, use the standard Nova API. For example, run nova flavor-list to show the created flavors.

Importing vNIOS Instance into OpenStack

Use the following command to create the vNIOS instance in OpenStack:

glance image-create --name <the name of the vNIOS image> --visibility public
--container-format bare --disk-format qcow2 --file <location of the image>

Example:

glance image-create --name vnios-820 --visibility public --container-format bare
--disk-format qcow2 --file
/tmp/nios-7.3.3-318825-2016-03-04-23-16-19-55G-820-disk1.qcow2

Setting Up Security Groups

When you set up your OpenStack environment, you can create an additional security group "vnios-sec-group" or add certain protocol rules to existing or default security groups to allow specific network traffic. You can configure basic settings as described in the Basic Configuration section, or configure optional settings as described in the Advanced Configuration section. These sections contain sample scripts you can use to establish specific protocol rules.

Basic Configuration

Creating security group "vnios-sec-group":

#vNIOS security group
neutron security-group-rule-create vnios-sec-group

HTTPS communications:

# https
neutron security-group-rule-create --protocol tcp --port-range-min 443 --port-range-max
443 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 443 --port-range-max
443 --ethertype IPv6 vnios-sec-group

Advanced Configuration

Grid communications:

#tunnels
neutron security-group-rule-create --protocol udp --port-range-min 1023
--port-range-max 1023 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 1023
--port-range-max 1023 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 1194
--port-range-max 1195 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 1194
--port-range-max 1195 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 2114
--port-range-max 2114 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 2114
--port-range-max 2114 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 802 --port-range-max 802 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 802 --port-range-max 802 --ethertype IPv6 vnios-sec-group

Optional for other protocols:

# dhcp
neutron security-group-rule-create --protocol udp --port-range-min 67 --port-range-max
69 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 67 --port-range-max
69 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 647 --port-range-max 647 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 647 --port-range-max 647 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 546 --port-range-max
547 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 546 --port-range-max
547 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 546 --port-range-max
547 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 546 --port-range-max
547 --ethertype IPv6 vnios-sec-group
# ntp
neutron security-group-rule-create --protocol tcp --port-range-min 123 --port-range-max

123 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 123 --port-range-max
123 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 123 --port-range-max
123 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 123 --port-range-max
123 --ethertype IPv6 vnios-sec-group

# dns
neutron security-group-rule-create --protocol tcp --port-range-min 53 --port-range-max
53 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 53 --port-range-max
53 --ethertype IPv6 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 53 --port-range-max
53 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 53 --port-range-max
53 --ethertype IPv6 vnios-sec-group

# ftp
neutron security-group-rule-create --protocol tcp --port-range-min 20 --port-range-max
21 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 20 --port-range-max
21 --ethertype IPv6 vnios-sec-group

# syslog
neutron security-group-rule-create --protocol udp --port-range-min 514 --port-range-max
514 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol udp --port-range-min 514 --port-range-max
514 --ethertype IPv6 vnios-sec-group

# reporting
neutron security-group-rule-create --protocol tcp --port-range-min 9997
--port-range-max 9997 --ethertype IPv4 vnios-sec-group
neutron security-group-rule-create --protocol tcp --port-range-min 9997
--port-range-max 9997 --ethertype IPv6 vnios-sec-group

# ICMP
neutron security-group-rule-create --protocol icmp --ethertype IPv4 vnios-sec-group neutron security-group-rule-create --protocol icmp --ethertype IPv6 vnios-sec-group

The following screen shot illustrates how to set up the security group rules.

Starting a vNIOS Instance in OpenStack Environment

To start a vNIOS instance:

  1. Ensure that you have already specified the vNIOS flavors and provided a unique name for the instance you want to spin up. For the list of available flavors, see vNIOS for KVM Virtual Appliance Models.
    Execute the neutron port-create command to create port IDs for the network interfaces (MGMT and LAN1/HA). You can use the security-group option to associate the vNIOS instance with the security group(s) you have created. For information, see Setting Up Security Groups. (Optionally, you can associate the vNIOS instance with a security group when you execute the nova boot command.)

    Note

    Do not reuse the OpenStack neutron port of the deleted instances. When you reuse the neutron port of a deleted instance, a mismatch in the MAC address between the VM interface and the host VF might happen during NIC bonding. Also, the neutron port does not function properly when you reuse it repeatedly. 


    Following is a neutron example:

    $ neutron port-create --security-group <name of the security group> 
    For an HA pair, you must also execute the allowed-address-pairs option to define the VIP port for the HA configuration, using the VRRP MAC address and the Virtual Router ID you use. Following is an example:
    $ neutron port-create VIP –-allowed-address-pairs list=true mac_address= 00:00:5e:00:01:c8 ip_address=10.0.0.22 

  2. For an HA pair configuration only, ensure that you set allow_duplicate_networks=true in the nova.conf file to remove the restriction of allowing only one interface for each network in OpenStack.
  3. Run the neutron port list command to view the network and port IDs generated for all network interfaces so you can copy and paste them into the nova boot command.
  4. Execute the nova boot command in OpenStack to spin up the vNIOS instance. (Note: Use the custom name you came up with when creating flavors).
    Following is an example:
    nova boot --config-drive False --image
    <nios-7.3.0-314352-2016-01-29-05-02-02-160G-1425-disk1.qcow2> --flavor <vnios1410.160>
    – security-groups <name of the security group> --nic net-id=<the network ID for the MGMT interface> --nic net-id=<the network ID for the LAN1/HA interface only if you are configuring an HA pair> --nic port-id=<the IP address ID for the LAN1 interface>
    <my-vm-name>
    where
    • security-groups defines the security group with which this vNIOS instance associates. For information about how to create rules for security groups, see Setting Up Security Groups.
    • nic net-id specifies the network ID for the MGMT interface. Note that when provisioning an HA pair, you must also specify the network ID for the LAN1/HA interface. For more information, see Sample Commands for Provisioning an HA Pair.
    • nic port-id specifies the IP address ID for the LAN1/HA interface.

      Note

      For the vNIOS appliance to run in OpenStack, you must specify at least two networks, MGMT and LAN1. To remove networks, use the neutron net-delete command. If some of the networks remain, use OpenStack Horizon to manually remove them.

    • my-vm-name defines the unique name of the VM.
      The vNIOS for KVM instance automatically spins up after the nova boot command is executed.
  5. Go to OpenStack Horizon and select the previously launched instance.
  6. Click the Console tab.
  7. When the Infoblox login prompt appears, log in with the default user name and password.
    login: admin
    password: infoblox

    The Infoblox prompt appears: Infoblox >
  8. You must have valid licenses before you can configure the vNIOS appliance. To obtain permanent licenses, first use the Infoblox > show version command to obtain the serial number of the vNIOS appliance, and then visit the Infoblox Support web site at https://support.infoblox.com. Log in with the user ID and password you receive when you register your product online at
    http://www.infoblox.com/support/customer/evaluation-and-registration.
    If the vNIOS virtual appliance does not have the Infoblox licenses required to run NIOS services and to join a Grid, you can use the set temp_license command to generate and install a temporary 60-day license.
  9. From the list of licenses, select the Grid, vNIOS, and other relevant licenses for your vNIOS virtual appliance.

    Note

    You must have both the Grid and vNIOS licenses for the vNIOS virtual appliance to join a Grid (2 and 8 from the list).

  10. In OpenStack Horizon, go to InstanceOverview and copy the floating IP address of the instance.
  11. Go back to the console and run the set network command. Not required for Elastic Scaling.
  12. Go to the Infoblox Grid Manager and enable the NAT mode for the Grid member:
    1. Click Grid -> Grid Manager -> Members -> Network.
    2. Select the Grid member and click Edit.
    3. Click Network -> Advanced.
    4. Click Enable NAT Compatibility and enter the floating IP address.
    5. Click Save & Close.

    Note

    For an HA Grid Master, ensure that you specify these settings for both nodes.


    After you confirm your network settings, the Infoblox Grid Manager automatically restarts. You can then proceed to set up a Grid, as described in Setting Up a Grid.


Terminating vNIOS Instances

To terminate vNIOS instances, go to Horizon, select the instance and select "Terminate Instance" from the drop-down menu on the right hand side of the panel.

  • No labels

This page has no comments.