Guest

Cisco Services Modules

Cisco Prime Network Services Controller Data Sheet

  • Viewing Options

  • PDF (836.2 KB)
  • Feedback

Introduction

Today’s dynamic data centers require IT departments to apply frequent changes to networking infrastructures that consist of virtual and physical service instances, such as firewalls, load balancers, routers, traffic accelerators, and switches. Traditional methods and tools are inadequate in these environments.

Initiating and maintaining such infrastructure changes properly and consistently requires a networking management solution with advanced automation and resource-management capabilities. Ideal solutions give IT the ability to rapidly automate common infrastructure solutions from predefined, or golden, templates that can be applied through the network consistently, according to meticulous standards.

In addition, enterprises are increasingly moving to hybrid clouds to gain the benefits of both public clouds and private clouds. Private clouds have their advantages. They allow enterprises to privately control data and design, customize their infrastructure, and control aspects of their security. However, private clouds are usually less agile than public clouds and can be expensive to run to meet peak demand. Enterprises face a number of challenges when extending the data center to the cloud provider:

   Network security: The connection from the enterprise data center to the cloud must be secure and encrypted. It must not compromise critical corporate data as it is transported to the cloud. In addition, after transporting the workload, the enterprise needs to control any connection made to the cloud service, maintaining the same security level provided for that workload in its private premises.

   Application dependencies: Applications should not require redesign when they move to a new cloud environment. For example, they should not require changes to IP address, Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), or other infrastructure parameter changes.

   Management complexity: A cloud provider’s network policies should be consistent with the policies and configuration used in the enterprise data center and should be controlled through the same security policy management framework.

The Cisco Prime Network Services Controller addresses these complex network challenges. It offers a single solution to manage virtual network infrastructure and automate processes. The solution promotes standardization and consistent execution of policies, helping staff save time, so they can focus on optimizing the network environment.

Cisco Prime Network Services Controller supports current shifts in IT, leading to more standardized, automated dynamic infrastructure and networks. As part of the larger Cisco Nexus® 1000V Switch solution, this Cisco® Unified Management solution fully integrates with the Cisco ASA 1000V Cloud Firewall, the Cisco Virtual Security Gateway (VSG) for Nexus 1000V Series Switch, and Citrix NetScaler 1000V virtual load balancer. In addition, Cisco Prime Network Services Controller supports Cisco Cloud Service Router (CSR) 1000V and Citrix NetScaler VPX virtual load balancer. Using this combination of virtual services brings numerous possibilities for customers to build virtual data centers with all required components to provide best-in-class cloud services.

Cisco Prime Network Services Controller also plays a major part in Cisco hybrid cloud solutions as the cloud manager platform of the Cisco Intercloud solution. It addresses challenges in hybrid cloud management and helps provide a secure policy management foundation that can combine the benefits of both public and private clouds. The virtual networking and security components of Cisco Intercloud make it possible to deploy virtual data centers across private and public clouds, which is the foundation of any successful private cloud and hybrid cloud deployment.

Developed for cloud environments on virtualized infrastructure, the Cisco Prime Network Services Controller is also highly scalable and provides network infrastructure automation with multitenancy capabilities.

Product Overview

Cisco Prime Network Services Controller is the primary management element for Cisco Nexus 1000V virtual switches and services that help enable a transparent, scalable, and automation-centric network management solution for virtualized data center and hybrid cloud environments. Cisco Nexus 1000V Switches and services deliver a highly secure multitenant environment by adding virtualization intelligence to the data center network. These virtual switches are built to scale for cloud networks. Support for Virtual Extensible LAN (VXLAN) helps enable a highly scalable LAN segmentation and broader virtual machine mobility.

With Cisco Prime Network Services Controller, centralized management of Cisco virtual services can be performed by an administrator using the GUI or programmatically through the XML API. The controller is built on an information-model architecture in which each managed device is represented by the subcomponents (or objects), which are parametrically defined. This approach provides a flexible and simple mechanism for provisioning and managing virtualized infrastructure, using Cisco VSG, Cisco ASA 1000V Cloud Firewall, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V virtual services. (See Figure 1 for a topology example and Figure 2 for a more detailed view of the components.)

Figure 1.      Cisco Virtual Data Center Topology Example

Figure 2.      Logical View of a Basic Service Implemented Through Hypervisors

Cisco Intercloud

With Cisco Intercloud, the enterprise network can be more securely extended to the cloud because enterprise network and security configurations such as VLANs and policies can be extended to the cloud. Using Cisco Prime Network Services Controller, workloads can be migrated from the enterprise data center to the public cloud, while retaining the same IP addresses and other networking parameters, which helps avoid the need to redesign the application.

Using Cisco Prime Network Services Controller, workloads in the public cloud can use the same security policies as their counterparts in the enterprise data center. System administrators get the policy consistency and network visibility they require, while retaining control of the cloud environment as a transparent extension of the enterprise data center.

In addition, customers gain a unified view of workloads across the enterprise data center (private cloud) and public cloud. They can select and migrate workloads from the enterprise data center to the public cloud (Figure 3).

Figure 3.      Cisco Intercloud Structure with Cisco Prime Network Services Controller

Virtual Services Management

Cisco Prime Network Services Controller provides several important benefits that increase efficiency for administration teams:

   Rapid and scalable deployment through dynamic, template-based policy management based on security profiles, policy sets, and policy rules

   Transparent operation management through an XML API that can enable programmatic integration with Cisco Intelligent Automation for Cloud (IAC), as well as third-party management and orchestration tools

   Collaboration across security, network, and server teams while maintaining administrative separation and reducing errors through a deployment and resource-management model that is consistent and repeatable

The Cisco Prime Network Services Controller framework provides centralized device and policy management of Cisco VSG, the Cisco ASA 1000V Cloud Firewall, the Cisco CSR 1000V router, and Citrix NetScaler VPX or NetScaler 1000V load balancers in virtual data centers (VDCs) and multitenant private and public cloud environments.

As shown in Figure 4, Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V address different aspects of virtualized data center environments:

   Cisco VSG offers a zone-based firewall solution for inter-virtual machine traffic that travels from server to server or from client to server.

   Cisco ASA 1000V offers edge security services, including gateway service, firewall, Network Address Translation (NAT), VPN, Dynamic Host Configuration Protocol (DHCP), and more.

   Both Cisco VSG and Cisco ASA 1000V have tight integration with Cisco Nexus 1000V, and both are managed by a single management platform (Cisco Prime Network Services Controller).

   The Cisco CSR 1000V is a single-tenant router in a virtual form factor that delivers routing (BGP, OSPF, EIGRP, etc.), the Cisco IOS® Software zone-based firewall, NAT, VPN, DHCP, and ACLs.

   Citrix NetScaler VPX and 1000V provide web application load balancing, acceleration, security, and offload feature sets in a simple, easy-to-install virtual appliance.

Figure 4.      Cisco Prime Network Services Controller Framework

Support for Multiple Hypervisors

The Cisco Prime Network Services Controller platform can support multiple virtual machine managers through their APIs and support multiple hypervisor types including Microsoft Hyper-V, VMware vSphere, and OpenStack KVM.

In a VMware vSphere environment, Cisco Prime Network Services Controller integrates with VMware vCenter and supports Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V. Cisco Prime Network Services Controller allows users to configure Cisco Nexus 1000V vPath service chaining for Cisco VSG, Cisco ASA 1000V, and Citrix NetScaler 1000V.

In a Microsoft Hyper-V environment, Cisco Prime Network Services Controller integrates with Microsoft SCVMM and supports Cisco VSG.

In an OpenStack environment, Cisco Prime Network Services Controller integrates with OpenStack and supports CSR 1000V and NetScaler VPX.

Virtual Services Integration with Cisco Dynamic Fabric Automation

As network infrastructure and fabric management become more complex, virtual and physical server deployment is becoming difficult to configure. Cisco Dynamic Fabric Automation (DFA) is a set of innovations under Cisco Unified Fabric that delivers fabric optimization, management, and automation capabilities. The innovations are unique in that they simplify the network architecture and configurations, which allows for the safety of the automation. That, in turn, allows for the single open point of integration of the fabric with the compute/storage orchestrators. Cisco DFA brings a superior level of integration that allows IT to simplify operation and bring up new services quickly with end-to-end fabric visibility, which results in increased agility and lower operating costs.

Cisco Prime Network Services Controller plays a critical role in the Cisco DFA solution with services integration. The controller integrates with Cisco Prime Data Center Network Manager (DCNM) to support Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V services in a VMware vSphere environment. In an OpenStack environment, Cisco Prime Network Services Controller supports virutal services, including CSR 1000V and CitrixNetScaler VPX. By communicating with the Cisco Prime DCNM, the controller enables orchestration of network services dynamically using service profile templates. In addition, it supports license automation for CSR 1000V, Citrix NetScaler VPX, and Citrix NetScaler 1000V.

Features and Benefits

Consistent, Efficient Execution of Service Policies

Cisco Prime Network Services Controller uses security profiles for template-based configuration of security policies - a collection of security policy sets and integrated policies and rules that can be predefined and applied on demand at virtual machine instantiation. This profile-based approach significantly simplifies authoring, deployment, and management of security policies, such as for dense multitenant environments, while enhancing deployment agility and scaling. Security profiles also help reduce administrative errors and simplify audits.

The XML API for Cisco Prime Network Services Controller facilitates integration with northbound network provisioning tools for programmatic network and service instantiation, provisioning, and management of Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and NetScaler 1000V. The option to employ programmatic control of those virtual appliances can greatly simplify operating processes and reduce infrastructure management costs.

Nondisruptive Administration Model

By providing visual and programmatic controls, Cisco Prime Network Services Controller helps the security operations team author and manage security policies for virtualized infrastructure, and it can also enhance collaboration with the server and network operations teams. This nondisruptive administration model helps ensure administrative segregation of duties to reduce errors and simplify regulatory compliance and auditing. Cisco Prime Network Services Controller operates in conjunction with the Cisco Nexus 1000V VSM to achieve the following workflow:

   Security administrators can author and manage security profiles and manage Cisco VSG and Cisco ASA 1000V instances. Security profiles are referenced in Cisco Nexus 1000V port profiles.

   Network administrators can author and manage port profiles, as well as manage Cisco Nexus 1000V distributed virtual switches. Port profiles with referenced security profiles are available in VMware vCenter through a Cisco Nexus 1000V VSM programmatic interface with VMware vCenter.

   Network administrators can further scale applications provisioned on the virtual data center using robust routing on Cisco CSR 1000V and load balance with Citrix NetScaler 1000V, all controlled through the same single pane of glass on Cisco Prime Network Services Controller.

   Server administrators can select an appropriate port profile in VMware vCenter when instantiating a virtual machine.

Figure 5 displays a possible setup to manage security policies in a multitenant data center.

Figure 5.      Managing Services Policy in a Multitenant Data Center

Efficient Management for Easier Scalability

Cisco Prime Network Services Controller implements an information-model architecture in which each managed device, such as Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX, as well as the Citrix NetScaler 1000V virtual machine form factor with vPath integration, is represented by the object-information model of the device. This model-based architecture helps enable the use of:

   Stateless managed devices: Security policies (security templates) and object configurations are abstracted into a centralized repository and used as a template against any virtual device type.

   Dynamic device allocation: A centralized resource management function manages pools of devices that are commissioned (deployed) in service and a pool of devices available for commissioning. This approach simplifies large-scale deployments because managed devices can be pre-instantiated and then configured on demand. In addition, devices can be instantiated using the Cisco Prime Network Services Controller GUI or API.

   Device configuration templates and policy configuration templates: The templates are separated into the different technologies (routing templates for routers, firewall templates for firewalls, and load-balancing templates for load balancers) but are still embedded in the same multitenant model and management control.

   Scalable management: A distributed management-plane function is implemented using an embedded or external agent for each managed device to promote greater scalability.

Table 1 shows the primary features and benefits of Cisco Prime Network Services Controller.

Table 1.       Features and Benefits

Feature

Description

Benefits

Device management through policy-based templates

Cisco Prime Network Services Controller provides central management of Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V.

Simplifies provisioning and troubleshooting of multiple virtual services in a scale-out data center.

Load-balancing profiles

An application networking profile represents the Citrix NetScaler VPX or NetScaler 1000V server farm and related features and attributes.

Simplifies provisioning, reduces administrative errors during load balancing policy changes, reduces audit complexities, and helps enable a highly scale-out data center environment.

Routing profiles

A networking profile represents the Cisco CSR 1000V routing policy and routing-related features and attributes.

Simplifies provisioning, reduces administrative errors during routing policy changes, reduces audit complexities, and helps enable a highly scale-out data center environment.

Security profiles

A security profile represents the Cisco VSG or Cisco ASA 1000V security policy configuration in a profile (template).

Simplifies provisioning, reduces administrative errors during security policy changes, reduces audit complexities, and helps enable a highly scale-out data center environment.

Generic device configuration profiles

A set of policy-based templates to be deployed on devices for management, logging, monitoring, authorizations, high-availability clustering, and more.

Simplifies provisioning, reduces administrative errors during any virtual device configuration changes, reduces audit complexities, and helps enable a highly scale-out data center environment.

Stateless device provisioning

The management agents in Cisco VSG, Cisco ASA 1000V, and Cisco CSR 1000V are stateless, receiving information from Cisco Prime Network Services Controller.

  Enhances scalability
  Provides robust endpoint failure recovery without loss of configuration state

Cisco Intercloud policies and templates

Instantiate Cisco Intercloud switches in private and public cloud, create secure tunnel, and transport workloads across with the required security.

  Provides ability to extend private cloud networks into public providers (Amazon Web Services [AWS] in this release)
  Introduces a framework for a virtual data center in hybrid cloud environments
  Controls workloads migration and workload transformation with security enhancements

Security policy management

Security policies are authored, edited, and provisioned centrally.

  Simplifies operation and management of security policies
  Helps ensure that security intent is accurately represented in the associated security policies

Support virtual services for DFA environments

Cisco Prime Network Services Controller obtains tenant information and allows virtual services to be added to DFA virtual overlay networks.

  Allows a network administrator to control virtual overlay networks and their services

Context-aware security policies

Cisco Prime Network Services Controller obtains virtual machine context from VMware vCenter.

Allows a security administrator to institute highly specific policy controls across the entire virtual infrastructure

Dynamic security policy and zone provisioning

Cisco Prime Network Services Controller interacts with the Cisco Nexus 1000V VSM to bind the security profile to the corresponding Cisco Nexus 1000V port profile. When virtual machines are dynamically instantiated by server administrators and appropriate port profiles applied, their association with trust zones is also established.

Helps enable security profiles to stay aligned with rapid changes in the virtual data center

Multitenant (scale-out) management

Cisco Prime Network Services Controller is designed to manage Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and 1000V policies in a dense, multitenant environment so that administrators can rapidly add and delete tenants and update tenant-specific configurations and policies.

  Reduces administrative errors
  Helps ensure segregation of duties in administrative teams
  Simplifies audit procedures

Role-based access control (RBAC)

RBAC simplifies operation tasks across different types of administrators, while allowing subject-matter experts to continue with their normal procedures.

  Reduces administrative errors
  Enables detailed control of user privileges
  Simplifies auditing requirements

XML-based API

The Cisco Prime Network Services Controller XML API allows external system management and orchestration tools to programmatically provision Cisco VSG, Cisco ASA 1000V, Cisco CSR 1000V, and Citrix NetScaler VPX and NetScaler 1000V.

  Allows use of best-in-class management software
  Offers transparent and scalable operation management

Software Packaging

Table 2 lists the software packages available for Cisco Prime Network Services Controller.

Table 2.       Packages and Descriptions

Package

Description

Open virtualization format (OVF)

  Downloadable OVF virtual appliance in the form of a single file with the .ova extension
  Deployed with OVF templates and packages

ISO format

  Downloadable ISO file that can be mounted on a virtual machine

System Requirements

Table 3 lists the systems requirements for Cisco Prime Network Services Controller.

Table 3.       Components and Specifications

Component

Minimum Specifications

Cisco Prime Network Services Controller Virtual Appliance

  4 virtual CPUs at 1.5 GHz
  RAM: 4 GB
  Hard disk (vdisk): 20 GB plus 200 GB on disk 2
  Network interfaces: 1 (management)

Cisco Prime Network Services Controller Device Adapter

  2 virtual CPUs at 1.5 GHz
  RAM: 2 GB
  Hard disk (vdisk): 20 GB
  Network interfaces: 1 (management)

Hypervisor and hypervisor manager

  VMware vSphere with at least Release 5.0, with VMware ESX or ESXi (Releases 5.0 and later)
  VMware vCenter with at least Release 5.0
  Microsoft Hyper-V Server 2012 (Standard or Data Center) and Microsoft Hyper-V Server 2012 R2 (Standard or Data Center)
  Microsoft SCVMM 2012 SP1 (UR2) and Microsoft SCVMM 2012 R2
  OpenStack Grizzly with KVM
  Amazon EC2 virtual environment

Web browsers (clients) supported

  Internet Explorer 9.0 or later, Mozilla Firefox 11.0 or later, and Chrome 18.0 or later
  Adobe Flash Player plug-in 11.2 or later

Interfaces and protocols

  XML API, HTTP/HTTPS, Lightweight Directory Access Protocol (LDAP), syslog, SNMP, and SCP

Extensibility of Management API

Cisco Prime Network Services Controller integrates with management and orchestration solutions such as Cisco Intelligent Automation for Cloud (IAC) through its northbound API, through which it can support provisioning of virtual infrastructure. Cisco Prime Network Services Controller also supports integration with a variety of third-party orchestration systems.

Licensing and Ordering

Cisco Prime Network Services Controller is the management platform for Cisco VSG and Cisco ASA 1000V, and it is mandatory for those offerings. Although Cisco Prime Network Services Controller is installed like a stand-alone product, it is offered as part of a bundle that includes either Cisco VSG or Cisco ASA 1000V, and it is added automatically when ordering those products.

Cisco Prime Network Services Controller is included as part of the bundle for the Cisco Intelligent Automation for Cloud Virtualized Server offering to manage Cisco CSR 1000V and Citrix NetScaler VPX, in addition to Cisco VSG and Cisco ASA 1000V.

For managing Cisco CSR 1000V and Citrix NetScaler VPX and 1000V in environments without Cisco IAC (such as in Cisco DFA and other deployments), customers need to order a license for each instance of Cisco CSR 1000V and Citrix NetScaler VPX and NetScaler 1000V managed by Cisco Prime Network Services Controller.

Please contact your Cisco representative to help you determine and place the appropriate order for your particular environment.

Service and Support

Cisco Software Application Support plus Upgrades (SASU) is a comprehensive support service that helps you maintain and enhance the availability, security, and performance of your business-critical applications. Cisco SASU includes the following resources:

   Software updates and upgrades: The Cisco SASU service provides timely, uninterrupted access to software updates and upgrades to help you keep existing systems stable and network release levels current. Updated releases, including major upgrade releases that may include significant architectural changes and new capabilities for your licensed feature set, are available by software download from Cisco.com or by CD ROM shipment.

   Cisco Technical Assistance Center (TAC): Cisco TAC engineers provide accurate, rapid diagnosis and resolution of software application problems to help you reduce outages and performance degradation. These specialized software application experts are trained to support Cisco Prime Network Services Controller. Their expertise is available to you 24 hours a day, 365 days a year, by telephone, fax, email, or the Internet.

   Online support: Cisco SASU provides access to a wide range of online tools and communities to help you resolve problems quickly, support business continuity, and improve competitiveness.

For More Information

For additional information about Cisco Prime Network Services Controller and related products, please visit the following links:

   Cisco Prime Network Services Controller: http://www.cisco.com/go/services-controller.

   Cisco Intelligent Automation software: http://www.cisco.com/go/ia.

   Cisco Dynamic Fabric Automation: http://www.cisco.com/go/dfa.

   Cisco Nexus Intercloud: http://www.cisco.com/go/intercloud.

   Cisco Virtual Security Gateway: http://www.cisco.com/go/vsg.

   Cisco ASA 1000V Cloud Firewall: http://www.cisco.com/go/asa1000v.

   Cisco Cloud Services Router 1000V: http://www.cisco.com/go/csr1000v.

   Citrix NetScaler 1000V: http://www.cisco.com/go/ns1000v.

   Cisco Nexus 1000V Switches: http://www.cisco.com/go/nexus1000v.

   Cisco NX-OS Software: http://www.cisco.com/go/nxos.

   Microsoft Hyper-V: http://www.microsoft.com/en-us/server-cloud/hyper-v-server/default.aspx.

   VMware vSphere: http://www.vmware.com/products/vsphere/.