Chapter 1. Overview

Information About Cisco Nexus 1000V for KVM on Red Hat Enterprise Linux OpenStack Platform

Information About the Red Hat Enterprise Linux OpenStack Platform Installer

Topology with Openstack in Standalone Mode

Topology with OpenStack in High-Availability Mode

Hosts and Services Used in OpenStack Standalone Deployments

Hosts and Services Used in OpenStack High-Availability Deployments

Chapter 2. System Requirements

Networking Requirements

Hardware Requirements

Supported Software

Cisco Nexus 1000V for KVM Software Packages

Chapter 3. Installing the Cisco Nexus 1000V VEM

Guidelines and Limitations

Installing the RHEL-OSP Installer Host

Configuring the Provisioning Hosts

Creating a New OpenStack Deployment

Adding the n1kv_vem Class to a Host Group

Configuring the Controller Parameters

Configuring the Neutron Compute Parameters

Configuring the Neutron Networker Parameters

Configuring FQDN Parameters on a Specific Host

Configuring Additional Parameters in the cisco_plugin.ini File

Configuring Additional Parameters in the n1kv.conf File

Setting Up the Cisco Yum Repository

Installing Additional cisco_n1kv_plugin Patches

Chapter 4. Installing the Cisco Nexus 1000V VSM

Installing the VSM

Setting Up the VSM's Initial Configuration

Information About Installing a VSM on the Cisco Nexus Cloud Services Platform

Installing a VSM on the Cisco Nexus Cloud Services Platform

Chapter 5. Installing and Configuring the VXLAN Gateway

Information About the VXLAN Gateway Deployment

Guidelines and Limitations for Cisco Nexus 1000V VXLAN Gateway

Steps to Install and Configure VXLAN Gateway

Configuring Port Profiles on the VSM

Configuring a Port Profile for the Uplink on the VXLAN Gateway

Configuring a Port Profile for the VTEP on the VXLAN Gateway

Installing the VXLAN Gateway as a VM Using RHEL-OSP Installer

Installing the VXLAN Gateway on a Cloud Services Platform

Creating and Deploying a VXLAN Gateway

Configuring the VXLAN Gateway Using the Setup Script

Modifying the Initial Setup Script Parameters

Configuring the VXLAN Gateway Data and Management Interfaces Using OpenStack dashboard

Guidelines and Limitations for the OpenStack Dashboard

Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack Dashboard

Creating a Trunk Network Profile Using OpenStack Dashboard

Creating a VLAN Network Profile Using OpenStack Dashboard

Creating a Network Using the OpenStack Dashboard

Creating a Subnet for a Network Using the OpenStack Dashboard

Booting a VXLAN Gateway VM

Configuring the VXLAN Gateway Data and Management Interfaces Using the OpenStack CLI

Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack CLI

Creating the VXLAN Gateway Data Interface

Creating a VXLAN Gateway Management Interface

Booting a VXLAN Gateway VM

Example of VXLAN Gateway Interface Configuration

VXLAN Gateway and High Availability

Configuring the VXLAN Gateway HA Mode as Standalone

Configuring the VXLAN Gateway as an HA Pair

Verifying the VXLAN Gateway Configuration

Managing the VXLAN-to-VLAN Mappings on the VXLAN Gateway

Appendix A. Sample Configuration File

Sample Configuration File

Chapter 1. Overview

This chapter contains the following sections:

- Information About Cisco Nexus 1000V for KVM on Red Hat Enterprise Linux OpenStack Platform

- Information About the Red Hat Enterprise Linux OpenStack Platform Installer

Information About Cisco Nexus 1000V for KVM on Red Hat Enterprise Linux OpenStack Platform

The Cisco Nexus 1000V for KVM consists of these main components:

- Virtual Ethernet Module (VEM)—A software component that is deployed on each kernel-based virtual machine (VM) host. Each VM on the host is connected to the VEM through virtual Ethernet (vEth) ports. The VEM is a hypervisor-resident component and is tightly integrated with the KVM architecture.

- Virtual Supervisor Module (VSM)—The Management component that controls multiple VEMs and helps in the definition of VM-focused network policies. It is deployed either as a virtual appliance on any KVM host or on the Cisco Cloud Services Platform appliance. The VSM is integrated with OpenStack using the OpenStack Neutron Plug-in.

- Red Hat Enterprise Linux OpenStack Platform (RHEL-OSP)—Red Hat Enterprise's Linux operating system with the Red Hat's implementation of the latest OpenStack. RHEL-OSP provides interacting services that control its computing, storage, and networking resources and is the foundation on which to build a private or public Infrastructure-as-a-Service (IaaS) cloud.

Information About the Red Hat Enterprise Linux OpenStack Platform Installer

The Cisco Nexus 1000V for KVM uses Redhat’s deployment management tool called Red Hat Enterprise Linux OpenStack Platform Installer (RHEL-OSP Installer) to install the Cisco Nexus 1000V for KVM on RHEL in an OpenStack cloud environment.

Red Hat Enterprise Linux OpenStack Platform provides the foundation to build a private or public Infrastructure-as-a-Service (IaaS) cloud on top of Red Hat Enterprise Linux.

Topology with Openstack in Standalone Mode

The Cisco Nexus 1000V for KVM can be deployed with OpenStack in standalone mode (not functioning in high-availability (HA) mode). However, we recommend that you always deploy the VSM in active/standby HA mode. The following topology diagram illustrates this deployment.

Topology with OpenStack in Standalone Mode

Topology with OpenStack in High-Availability Mode

The Cisco Nexus 1000V for KVM can be deployed with OpenStack in high-availability (HA) mode. However, we recommend that you always deploy the VSM in active/standby HA mode. The following topology diagram illustrates this deployment.

Topology with OpenStack in High-Availability Mode

Hosts and Services Used in OpenStack Standalone Deployments

The following table lists and describes the primary OpenStack hosts and services that you need when deploying Openstack in standalone mode.

Hosts

OpenStack Service

OpenStack Platform Installer

OpenStack Platform Installer

Controller (Neutron)

Neutron Server

Database (MySQL)

Messaging (RabbitMQ/QPID)

Heat

Ceilometer

Keystone

Glance

Nova

Cinder

Horizon

Compute (Neutron)

Ceilometer Agent

Virtual Ethernet Module (VEM)

Nova-compute

Neutron Networker

Layer 3 Agent

DHCP Agent

Metadata Agent

VEM

Neutron

Hosts and Services Used in OpenStack High-Availability Deployments

The following table lists and describes the primary OpenStack hosts and services that you need when deploying Openstack in HA mode.

Hosts

OpenStack Service

OpenStack Platform Installer

OpenStack Platform Installer

HA Controller

Neutron

Database (Galera)

Messaging

Pacemaker Cluster

HAProxy Load Balancer

Keystone

Glance

Virtual Ethernet Module (VEM)

Cinder

Horizon

Compute (Neutron)

Virtual Ethernet Module (VEM)

Nova-compute

Chapter 2. System Requirements

This chapter contains the following sections:

- Supported Software

- Cisco Nexus 1000V for KVM Software Packages

Networking Requirements

The following table describes the minimum networking requirements that the hosts in your Cisco Nexus 1000V for KVM deployment must meet.

Minimum Networking Requirements for Hosts

Host

Networking Requirement

Installer

- Provisioning interface

- Public network interface (Access to the Internet.)

- IPMI network interface

Controller

- Provisioning interface

- IPMI interface

Compute

- Provisioning interface

- IPMI interface

- Data interface

Networker

- Provisioning interface

- IPMI interface

- Data interface

HA Controller[1]

- Provisioning interface

- IPMI interface

- Data interface

VSM

- Provisioning interface

- IPMI interface

[1] Used only in an OpenStack High-Availability deployment. An HA Controller combines the functions of the controller and the networker. Therefore, it must have a provisioning interface, IPMI interface, and at least one data interface.

Hardware Requirements

The following tables list the minimum hardware requirements for deploying the Cisco Nexus 1000V for KVM.

Minimum Hardware Requirements

Node

Memory (GB)

Hard Drive (GB)

CPU or vCPU

Node Type

Compute

24

50

2

Server

Network

24

10

2

Server

VSM

4

4

2

VM

VXLAN Gateway as a VM on compute node

4

10

2

VM

Supported Software

Cisco Nexus 1000V for KVM with supports the software in the following table.

Name

Supported Versions

RHEL (for OpenStack Platform Installer hosts)

6.6

RHEL (for provisioning hosts)

7.0

OpenStack

Icehouse

Note

Depending on your specific Cisco Nexus 1000V for KVM release, it is your responsibility to monitor and install all relevant Linux patches on Linux hosts.

Cisco Nexus 1000V for KVM Software Packages

The Cisco Nexus 1000V for KVM software packages are available from two locations: Cisco.com and the Cisco Yum repository. The following table lists the package name and version.

Package Name

Version

VSM

5.2.1.SK3.2.1

VEM

5.2.1.SK3.2.1

VXLAN-GATEWAY

5.2.1.SK3.2.1

Chapter 3. Installing the Cisco Nexus 1000V VEM

This chapter contains the following sections:

- Guidelines and Limitations

- Installing the RHEL-OSP Installer Host

- Configuring the Provisioning Hosts

Guidelines and Limitations

- In VXLAN multicast mode, the VTEP ports on the compute and network hosts need to respond to incoming IGMP query traffic for the multicast group to which they belong. However, the default firewall rules (iptables) drop the incoming IGMP query traffic from reaching the VTEP interfaces. In order to allow this traffic, a firewall rule needs to be configured on the respective compute and network hosts, as follows:

#iptables -I INPUT 1 -p igmp -j ACCEPT

Note

In OpenStack HA deployments, you need to set this firewall rule on the controller host as well, because the controller host also functions as a network host.

- If no other interfaces other than the management interface come up after you reboot, you can either manually bring up the interfaces by entering ifconfig interface_name or change the ONBOOT parameter to yes in the /etc/sysconfig/network and the /etc/sysconfig/network-scripts/ifcfg-"interface name" files.

Installing the RHEL-OSP Installer Host

Procedure

Step 1

Bring up a VM or bare metal server with RHEL 6.6 with base installation.

Step 2

Configure the name servers and mgmt IP address (eth0).

Step 3

If you are deploying the Cisco Nexus 1000V for KVM behind a firewall, configure a proxy host.

1. Identify the values of the hostname and port in the /etc/yum.conf file. The line in the file that specifies the hostname and port is as follows:

proxy=http:hostname:port

2. In the /etc/rhsm/rhsm.conf file, modify the hostname and port variables to match the values of the ones configured in teh /etc/yum.conf file.

proxy_hostname=hostname
proxy_port=port

Step 4

Assign an IP address to the provisioning interface. The RHEL-OSP provides the DHCP for its clients from the subnet that you enter.

Step 5

Register the RHEL server.

subscription-manager register

Step 6

Attach the RHEL server to a repository pool.

1. List the subscription pools that are available.

subscription-manager list --available

2. Enable the repository pool.

subscription-manager attach --pool    pool-id

Note:
Make sure to enable a pool that has RHEL-OSP installer entitlement.

Step 7

Enable repositories in the selected pools.

subscription-manager repos --enable=rhel-6-server-openstack-5.0-rpms
subscription-manager repos --enable=rhel-6-server-openstack-foreman-rpms
subscription-manager repos --enable=rhel-6-server-rpms
subscription-manager repos --enable=rhel-6-server-rhscl-6-rpms

Step 8

Install rhel-osp-installer.

yum install -y rhel-osp-installer

Step 9

Verify that a valid fully qualified domain name (FQDN) hostname has been configured in the /etc/hosts file by entering the following command:

hostname -f

If the command fails to return a hostname, you must configure one in the /etc/hosts file. The leftmost column is the ip_address to be resolved. The next column is the hostname, and the last column is an optional alias.

Note:
You must assign a FQDN to the machine on which you intend to install RHEL-OSP Installer. The FQDN identifies the domain that the RHEL-OSP Installer uses as its provisioning network.

The FQDN must not conflict with any existing domain name to prevent resource conflicts.

IPAddress     Hostname               Alias
203.0.10.3    web.openna.com        web

Step 10

Install the RHEL-OSP Installer by executing the rhel-osp-installer on the Forman server's command line. For the detailed procedure, see the Red Hat Enterprise Linux OpenStack Platform 5 Deploying OpenStack: Enterprise Environments (Red Hat Enterprise Linux OpenStack Platform Installer) guide, Section 2.4.5., Installing the Red Hat Enterprise Linux OpenStack Platform Installer.

Step 11

Access the OpenStack Platform Installer's web user interface through its public IP address. If you have a private IP address, add an iptable rule so that you can access the web user interface.

Step 12

Log in to the OpenStack Platform Installer's web user interface using the login credentials. Username/password credentials are the ones that you see at the end of the RHEL-OSP Installer execution.

Step 13

Enable IP forwarding by entering the following command at the command line prompt:

sysctl -w net.ipv4.ip_forward=1

Step 14

Configure the same command shown in step 13 in the /etc/sysctl.conf file.

Step 15

Execute the following IP table rules at the command line prompt:

iptables -I FORWARD -i eth1 -j ACCEPT
iptables -I FORWARD -o eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Step 16

If you are running RHEL-OSP installer version rhel-osp-installer-0.4.7-1.el6ost.noarch or lower, replace the /usr/share/openstack-foreman-installer/puppet/modules/quickstack/templates/cisco_plugins.ini.erb file with the one available in the Cisco yum repository. For information, see Click Here .

Configuring the Provisioning Hosts

To deploy Red Hat Enterprise Linux OpenStack Platform (RHEL-OSP), you must add hosts to the RHEL-OSP Installer to use for provisioning. For the instructions on how to add these hosts, see Chapter 4, "Configuring Hosts" in the Red Hat Enterprise Linux OpenStack Platform 5 Deploying OpenStack: Enterprise Environments (Red Hat Enterprise Linux OpenStack Platform Installer) guide.

Creating a New OpenStack Deployment

You need to create a new OpenStack deployment.

Procedure

Step 1

Launch the RHEL-OSP Installer graphical user interface (GUI).

Step 2

From the Red Hat Enterprise Linux OpenStack Platform Installer window, choose OpenStack Installer > Deployments.

Step 3

From the OpenStack Deployments window, click New Deployment.

Step 4

In the Deployment Settings pane, do the following:

1. In the Name field, enter a name for the deployment.

2. For the High Availability option, choose one of the following:

- If you are deploying OpenStack in standalone mode, choose Controllers/Compute.

- If you are deploying OpenStack in HA mode, choose High Availability Controllers/Compute.

3. For the Networking option, click Neutron Networking.

4. Click Next.

Step 5

In the Network Configuration pane, create two subnets: one for external traffic and another for tenant traffic.

1. Click New Subnet.

2. In the New Subnet dialog box, complete the fields according to your network topology and click Create Subnet.

3. Repeat steps a and b to create the second subnet.

4. Drag and drop the External box from the Available Network Traffic Types area to the subnet for external traffic that you just created.

5. Drag and drop the Tenant box from the Available Network Traffic Types area to the subnet for tenant traffic that you just created.

6. Click Next.

Step 6

From the Services Overview pane, review the list of services to be deployed. If you are satisfied, click Next.

Step 7

In the Services Configuration pane, do the following:

1. In the Neutron Service Configuration pane, for the Tenant Network Type, click VLAN Segmentation and enter the VLAN ranges.

2. For the Core PlugIn Type, click N1KV Core Plugin and enter the VSM IP address and password.

3. In the Services area, click Glance and choose the appropriate backend driver.

4. In the Services area, click Cinder and choose the appropriate backend driver.

5. Click Submit.
You are returned to the Red Hat Enterprise Linux OpenStack Platform Installer window and the deployment that you just created is displayed.

Adding the n1kv_vem Class to a Host Group

You must add the VEM puppet class (neutron::agents::n1kv_vem) to different host groups depending on whether you are deploying OpenStack in standalone mode or High-Availability (HA) mode. When OpenStack is deployed in HA mode, the HA Controller provides the Neutron Networker services. So, in an OpenStack HA deployment, you add VEM to the HA Controller host group.

Procedure

Step 1

From the Red Hat Enterprise Linux OpenStack Platform Installer window, choose OpenStack Installer > Deployments.

Step 2

From the Red Hat Enterprise Linux OpenStack Platform Installer window, choose Configure > Puppet Classes.

Step 3

In the Search field, enter n1kv_vem.

Step 4

Click the neutron::agents::n1kv_vem class name. The Edit Puppet Class pane opens.

Step 5

In the Puppet Class tab, in the Host Group field, choose the name of the host group that you want to add the VEM puppet class to.
For an OpenStack standalone deployment, you need to add the puppet class to:

- base_RedHat_7/deployment_name/Compute(Neutron) host group

- base_RedHat_7/deployment_name/NeutronNetworker host group

For an OpenStack HA deployment, you need to add the puppet class to:

- base_RedHat_7/Deployment_Name/Compute(Neutron) host group

- base_RedHat_7/Deployment_Name/HA Controller host group

Step 6

Click the Smart Class Parameter tab.

Step 7

In the Smart Class Parameter pane, click the required parameters. See table below.
Note:   Configure optional parameters as required by your network topology.

Step 8

For each parameter, check the Override checkbox and configure the appropriate default value.

Step 9

Click Submit

n1kv_vem Parameters

Parameter Name

Description

Example

n1kv_vsm_ip

IP address of the Virtual Supervisor Module (VSM). The default is 127.0.0.1.

127.0.0.1

n1kv_vsm_domain_id

Domain ID of the VSM. The default is 1000.

1000

host_mgmt_intf

Management interface of the node where the VEM is installed. The default is eth0.

eth0

uplink_profile (Optional)

Uplink interfaces that will be managed by the VEM. You must also specify the uplink port profile that configures these interfaces. The default is undefined (empty).

Note:
The uplink interface cannot be the same as the management interface on the compute node.

eth1: port-profile 1
eth2: port-profile 2

vtep_config (Required for VXLAN Gateway)

Virtual tunnel interface configuration for the VXLAN tunnel endpoints. The default is undefined (empty).

To remove one of the vteps (leaving at least one remaining vtep), delete the vtep from the vtep_config file, save the file, and trigger puppet in the compute/network notes.

To delete all of the vteps, remove the variable by clicking X in front of the variable in the Compute Host Group Parameters pane.

vtep1:
profile: virtprof1
ipmode: dhcp
vtep2:
profile:virtprof2
ipmode: static
ipaddress: 192.0.2.1
netmask: 255.255.255.0

node_type (Optional)

Type of node, either compute or network. The default is compute.

For networker nodes, the node type is network.

compute

vteps_in_the_same_subnet (Required for VXLAN Gateway)

Parameter to indicate whether the VXLAN tunnel interfaces (vteps) belong to the same IP subnet. If they belong to the same subnet, set this parameter to true. If they belong to different subnets, set this parameter to false. The default is false.

If the parameter is set to true, you must modify the following sysctl:ipv4 values:

- rp_filter (reverse path filtering)—Set this parameter to 2 (Loose). The default is 1 (Strict).

- arp_ignore (arp reply mode)—Set this parameters to 1: reply only if target ip matches that of incoming interface. The default is 0.

- arp_announce (arp announce mode) set to 1. Default is 0

Note:
Setting this parameter to false causes no change in the sysctl settings and does not revert changes made if it was originally set to true.

For detailed descriptions of these parameters, see the Linux Documentation at the following URL:

Click Here

Configuring the Controller Parameters

You must configure the controller parameters.

Before You Begin
For deployments with OpenStack in HA mode, ensure that you have added the VEM puppet class to the HA controller host group. For deployments with OpenStack in standalone mode, you do not add the VEM puppet class to the controller (Neutron) host group. For information, see Click Here .

Procedure

Step 1

From the Configure window, choose Configure > Host Groups.
Notice that compute, controller, and Neutron networker host groups have been formed under the deployment that you created.

Step 2

Do one of the following:

- For OpenStack in standalone mode, choose the Choose the base_RedHat_7/Deployment_Name/Controller (Neutron) host group.

- For OpenStack in HA mode, choose the Choose the base_RedHat_7/Deployment_Name/HA Controller host group.

Step 3

Click the Parameters tab.

Step 4

Click Override for all of the parameters that you want to define. See the table below.

Step 5

Scroll down to the bottom of the window.

Step 6

Change the following parameters to the appropriate values.

Neutron Controller Parameters

Name

Description

Value

cisco_nexus_plugin

The Cisco Nexus 1000V Plugin does not require this to be defined.

Remove the value in this field.

cisco_vswitch_plugin

Name of the Cisco Nexus Neutron Plugin

neutron.plugins.cisco.n1kv.n1kv_neutron_plugin. N1kvNeutronPluginV2

security_group_api

The full class name of the security API class.

Nova

neutron_conf_additional_params

Additional Neutron configuration parameters. Change only the network_auto_schedule parameter to false.

network_auto_schedule:false

ml2_mechanism_drivers[1]

["openvswitch"]

[1] Applies to OpenStack HA deployments only.

Step 7

Click Submit.

Configuring the Neutron Compute Parameters

You must configure the n1kv_vem class parameters for the Neutron Compute host group.

Before You Begin
Ensure that you have added the VEM puppet class to the Neutron Compute host group. For information, see Click Here .

You must bring up the Neutron Compute host group with the VEM installed in both standalone and HA deployments.

Procedure

Step 1

From the Configure window, choose Configure > Host Groups.
Notice that compute, controller, and Neutron networker host groups have been formed under the deployment that you created.

Step 2

For OpenStack in standalone mode, choose the Choose the base_RedHat_7/Deployment_Name/Neutron Compute host group.

Step 3

Click the Parameters tab.

Step 4

Click Override for all of the parameters that you want to define. See the table below.

Step 5

Scroll down to the bottom of the window.

Step 6

Change the following parameters to the appropriate values.

Compute (Neutron) Parameters

Parameter Name

Description

Example

agent_type

OVS is installed by the n1kv_puppet, so you need to disable the OVS agent installation that uses the compute puppet.

none

security_group_api

—

nova

Step 7

Click Submit.

Configuring the Neutron Networker Parameters

You need to configure the Neutron Networker parameters.

Before You Begin
Ensure that you have added the VEM puppet class to the Neutron Networker host group. For information, see Click Here .

You must bring up a Neutron Networker host group with the VEM installed.

Procedure

Step 1

From the Configure window, choose Configure > Host Groups.
Notice that compute, controller, and Neutron networker host groups have been formed under the deployment that you created.

Step 2

For OpenStack in standalone mode, choose the Choose the base_RedHat_7/Deployment_Name/Neutron Networker host group.

Step 3

Click the Parameters tab.

Step 4

Click Override for all of the parameters that you want to define. See the table below.

Step 5

Scroll down to the bottom of the window.

Step 6

Change the following parameters to the appropriate values.

Networker Puppet Parameters

Name

Description

Value

agent_type

OVS is installed by the n1kv_pupper, so you need to disable the OVS agent installation that uses the compute puppet.

None

Step 7

Click Submit.

Configuring FQDN Parameters on a Specific Host

If you need to configure the fully qualified domain name (FQDN) parameter differently on one host than the other hosts in a group, you can use this procedure.

Procedure

Step 1

From the Red Hat Enterprise Linus OpenStack Platform Installer window, choose Configure > Puppet Classes.

Step 2

Enter n1kv_vem in the Search field and click Search.

Step 3

Choose the neutron::agents::n1kv_vem class name and click the Smart Class Parameter tab.

Step 4

In the Smart Class Parameter pane, click each parameter that you want to change and check the Override checkbox in the corresponding pane to the right.

Step 5

Scroll down to the Override Value For Specific Hosts area and provide the host specific configuration based on the FQDN of the host.

Step 6

Click Submit.

Configuring Additional Parameters in the cisco_plugin.ini File

If you need to, you can add additional parameters to the cisco_plugin.ini file.

Procedure

Step 1

Log in to Foreman server

Step 2

Open the /usr/share/openstack-foreman-installer/puppet/modules/quickstack/templates/cisco_plugins.ini.erb file.

Step 3

Add the variable you with its corresponding value in the proper location.

Step 4

Log in to the controller and trigger Puppet.

Configuring Additional Parameters in the n1kv.conf File

You need to configure additional parameters int he n1kv.conf file.

Procedure

Step 1

Log into the Foreman server.

Step 2

Open the /usr/share/openstack-puppet/modules/neutron/templates/n1kv.conf.erb file.

Step 3

Add the variable that you need with its corresponding value.

Step 4

Log into the corresponding node where VEM is installed and trigger Puppet.

Setting Up the Cisco Yum Repository

You can set up the Cisco Yum repository.

Before You Begin
Make sure that the Cisco Yum repository is reachable at the following URL: Click Here .

Procedure

Step 1

Edit the /etc/yum.repos.d/cisco_os.repo file.

Step 2

Add the following configuration:

[cisco-os]
name=External repo for Cisco nexus 1000v served over HTTPS
baseurl=https://cnsg-yum-server.cisco.com/yumrepo
enabled=1
gpgcheck=1
gpgkey=https://cnsg-yum-server.cisco.com/yumrepo/RPM-GPG-KEY
sslverify=1

Step 3

Save and close the file.

Installing Additional cisco_n1kv_plugin Patches

There are mandatory and optional patches for the cisco_n1kv_plugin in the Cisco Yum repository. These patches are named using the RPM naming convention, as follows:

cisco-n1kv-openstack-neutron-<mandatory/optional>-patch-<openstack-neutron-version>.noarch.rpm
cisco-n1kv-openstack-dashboard-<mandatory/optional>-patch-<openstack-dashboard-version>.noarch.rpm

Note

Mandatory patches must be installed on controller hosts in both OpenStack standalone and HA deployments.

Before You Begin
Make sure that the Cisco Yum repository has been configured. See Setting Up the Cisco Yum Repository.

Download the patch. You can use the wget cisco_repository_path/patch_name.rpm command.

Patches that have a mandatory tag must be installed. Patches that have an optional tag can be installed based on your preference. Use the rpm -qpil file.rpm or yum info file.rpm command to determine which bug fixes are included in the patches. The patches are located in the Cisco Yum repository.

Procedure

Step 1

Install the patches from the Cisco-os repository.

yum install –y patch_name

Step 2

Restart the Neutron server and dashboard (httpd) services.

service neutron-server restart
service httpd restart

Chapter 4. Installing the Cisco Nexus 1000V VSM

This chapter contains the following sections:

Installing the VSM

The Virtual Supervisor Module (VSM) can be installed in stand-alone or high-availability (HA) mode. Although we highly recommend high availability mode, it is not mandatory. This procedure covers installation for both stand-alone and HA modes.

If you are installing VSMs in HA mode, deploy the first VSM (including setting up the initial configuration), then repeat step 4 to create the second VSM and proceed with setting up the initial configuration. See Setting Up the VSM's Initial Configuration.

Before You Begin
Make sure that you have RHEL7 physical servers for VSM active and standby hosts, as recommended. (See Topology with Openstack in Standalone Mode and Topology with OpenStack in High-Availability Mode.)

Make sure that the Cisco Yum repository has been set up correctly. For information, see Setting Up the Cisco Yum Repository.

Make sure the servers in the provisioning network have connectivity to the RHEL7 physical sever where the VSM is installed as a VM.

Procedure

Step 1

Download the VSM image from the Cisco yum repository.
Note:   You can also download the image from Cisco.com.

yum install nexus-1000v-iso

The VSM image is downloaded to /opt/cisco/vsm/.

Step 2

Create an OVS bridge.

ovs-vsctl add-br bridge-name

Note:
If you do not already have the OVS package, it is available in rhel-7-server-openstack-5.0-rpms. To install it, enter the following command:

yum install -y openvswitch

Step 3

Customize the VSM domain XML file according to your setup. Use the following table as a guide:

Parameter

Variable Example

Description

Domain name

<name>vsm</name>

Domain name of the VSM VM.

UUID

<uuid>85badf15-1234-4819-1234-8c3d50641375</uuid>

A universally unique identifier (UUID) of the VM.

RAM

<memory unit='KiB'>4096000</memory> <currentMemory unit='KiB'>4096000</currentMemory>

RAM allocated to the VSM VM. A minimum of 4-GB RAM is required for a VSM.

Make sure both the memory unit and currentMemory unit variables are set to 4 GB.

vCPU

<vcpu placement='static'>2</vcpu>

Virtual CPUs allocated to the VSM VM. A minimum of 2 vCPUs is required.

Source file location of the disk

<source file='/var/lib/libvirt/images/vsm.img />

Source file location of the VM hard disk drive that you created.

Source file location of CDROM

<source file='/opt/cisco/vsm/n1000v-dk9.5.2.1.SK1.3.0.78.iso’/>

Source file location of the VSM ISO image.

Note:
The image is located at /opt/cisco/vsm/.

Interface-related parameters

<mac address='0e:1f:1f:1f:45:2e'/>

Unique identifier of a network interface. The VSM requires three initial interfaces. Make sure that all MAC address are unique among all of the VMs.

<source bridge='vsm-br'/>

The bridge name that you created when you created the OVS bridge and brought up the VM.

<parameters interfaceid='14054688-1444-46db-b981-0aba3172b956'/>

Universally unique identifier (UUID) of the interface. Make sure that all interface IDs are unique among all of the VMs.

Step 4

Deploy the VSM as a VM on a server using above xml file. If the RHEL-OSP Installer is also a VM on a bare metal server, the VSM can be deployed on the same server as the RHEL-OSP Installer VM.

1. Create a hard disk for the VM.

qemu-img create DIR_path/vsm.img 10G

Example:

# qemu-img create /var/lib/libvirt/images/vsm.img 10G

qemu-img create /var/lib/libvirt/images/vsm.img 10G

2. Define and start the VSM VM.

virsh define xml_name
virsh start domain_name

Example:

# virsh define vsm.xml
virsh start vsm

3. If the domain VSM fails to start and permission denied errors occur, determine whether the enforcing mode is set to enforcing or permissive:

getenforce

4. If the Enforcing message is returned, set the enforcement to permissive by entering the following command:

setenforce 0

5. Repeat step b.

What to Do Next

Proceed to Setting Up the VSM's Initial Configuration.

Setting Up the VSM's Initial Configuration

Before you can use your VSM, you must configure some initial information on it. You can accept most of the default configuration. However, you must configure some required parameters.

Procedure

Step 1

Log in to the VSM console.
Note:
You can use virt-manager to log in to the VSM console. Virt-manager is available in rhel-7-server-rpms. To access virt-manager, enter the following command:

yum install –y virt-manager

The System Admin Account Setup script begins.

Step 2

Configure the parameters by accepting the defaults or entering the desired values. Ensure that you enter values in the following required parameters:

- Admin password

- HA role (standalone for non-HA mode, primary or secondary for HA pair)

- Domain ID (For an HA pair, enter the same domain ID for both the primary and secondary VSMs. After entering the domain ID for the secondary VSM, the VSM reboots, discovers the primary VSM, and forms the HA pair. From the primary VSM , enter the show module command to verify that the primary VSM recognizes two modules, one primary/active module and the other secondary/standby module. The secondary VSM configuration is complete.)

- Switch name

- Mgmt0 IPv4 address

- Mgmt0 IPv4 netmask

- Default gateway IPv4 address

When you are done, the setup script displays all of the configuration settings.

Step 3

At the prompt, verify the configuration settings and enter either yes to accept them or no to edit them.

Step 4

If you are satisfied with the configuration, at the Use this configuration and save it prompt, enter y. The configuration is saved.

Step 5

Log in to the VSM.

1. At the login prompt, enter the admin login.

2. At the password prompt, enter the admin password

Step 6

Create a default port profile named default-pp by entering the following commands:

configure terminal
port-profile type vethernet default-pp
no shutdown
state enabled
publish port-profile
copy running-config startup-config

Step 7

Create a port profile named uplink by entering the following commands:

configure terminal
port-profile type ethernet uplink
switchport mode trunk
switchport trunk allowed starting_vlan-ending_vlan
no shutdown
state enabled
publish port-profile
copy running-config startup-config

Step 8

Define the VLAN range to be used:

configure terminal
vlan starting_vlan-ending_vlan
copy running-config startup-config

Information About Installing a VSM on the Cisco Nexus Cloud Services Platform

If you choose to install a Virtual Supervisor Module (VSM) on the Cisco Nexus Cloud Services Platform, you must install all primary and secondary VSMs on the Cisco Nexus Cloud Services Platform. You cannot install any other VSMs as a VM.

Installing a VSM on the Cisco Nexus Cloud Services Platform

Before You Begin
Copy the VSM ISO or OVA file to the bootflash:repository/ of the Cisco Nexus Cloud Services Platform.

Procedure

Step 1

Create a virtual service blade.

switch(config)# show virtual-service-blade summary

---------------------------------------------------------------------------------
Name        HA-Role       HA-Status     Status               Location
---------------------------------------------------------------------------------
switch(config)# virtual-service-blade vsm-1
switch(config-vsb-config)# virtual-service-blade-type new nexus-1000v-dk9.5.2.1.SK3.1.2.iso
switch(config-vsb-config)# show virtual-service-blade summary

--------------------------------------------------------------------------------------
Name        HA-Role       HA-Status     Status                   Location
--------------------------------------------------------------------------------------
vsm-1       PRIMARY       NONE          VSB NOT PRESENT          PRIMARY
vsm-1       SECONDARY     NONE          VSB NOT PRESENT          SECONDARY

switch(config-vsb-config)#

Step 2

Configure the control, packet, and management interface VLANs for static and flexible topologies.

switch(config-vsb-config)# interface management vlan 100
switch(config-vsb-config)# interface control vlan 101
switch(config-vsb-config)# interface packet vlan 101

Step 3

Configure two vCPUs and the size of the RAM to 4 GB for the VSM.

switch(config-vsb-config)# ramsize 4096
switch(config-vsb-config)# numcpu 2

If desired, you can verify these settings with the following command:

switch(config-vsb-config)# show virtual-service-blade name vsm-1

Step 4

Configure the Cisco Nexus 1000V for KVM on the Cisco Nexus Cloud Services Platform.

switch(config-vsb-config)# enable
Enter vsb image: [nexus-1000v.4.2.1.SV2.2.1.iso]
Enter domain id[1-1023]: 127
Management IP version [V4/V6]: [V4]
Enter Management IP address: 192.0.2.79
Enter Management subnet mask: 255.255.255.0
IPv4 address of the default gateway: 192.0.2.1
Enter HostName: n1000v
Enter the password for ‘admin’: password
Note: VSB installation is in progress, please use show virtual-service-blade commands to check the installation status.
switch(config-vsb-config)#

Step 5

Display the primary and secondary VSM status.

switch(config-vsb-config)# show virtual-service-blade summary

--------------------------------------------------------------------------------------
Name        HA-Role       HA-Status     Status                   Location
--------------------------------------------------------------------------------------
vsm-1       PRIMARY       NONE          VSB POWER ON IN PROGRESS PRIMARY
vsm-1       SECONDARY     ACTIVE        VSB POWERED ON           SECONDARY

Step 6

Log in to the VSM.

switch(config)# virtual-service-blade vsm-1
switch(config-vsb-config)# login virtual-service-blade vsm-1
Telnet escape character is ‘^\’.
Trying 192.0.2.18...
Connected to 192.0.2.18.
Escape character is ‘^\’.

Nexus 1000v Switch
n1000v login: admin
Password:
Cisco Nexus operating System (NX-OS) Software
TAC support: http://www/cisco.com/tac
Copyright (c) 2002-2012, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained in this software are
owned by other third parties and used and distributed under
license. Certain components of this software are licensed under
the GNU General Public License (GPL) version 2.0 or the GNU
Lesser General Public License (LGPL) Version 2.1. A copy of each
such license is available at
http://www.opensource.org/licenses/gpl-2.0.php and
http://www.opensource.org/licenses/lgpl-2.1.php
switch#

Step 7

Enable the following features in the VSM to ensure that OpenStack can configure the networks appropriately:

- http-server

- network-segmentation-manager

- segmentation

What to Do Next

- Collect the information required for the site.pp file, as described in VSM-Related Configuration.

- Create the build server, as described in Creating the Build Server.

Chapter 5. Installing and Configuring the VXLAN Gateway

This chapter contains the following sections:

- Information About the VXLAN Gateway Deployment

- Guidelines and Limitations for Cisco Nexus 1000V VXLAN Gateway

- Steps to Install and Configure VXLAN Gateway

- Configuring Port Profiles on the VSM

- Verifying the VXLAN Gateway Configuration

- Managing the VXLAN-to-VLAN Mappings on the VXLAN Gateway

Information About the VXLAN Gateway Deployment

The Virtual Extensible Local Area Network (VXLAN) Gateway has the following deployment requirements:

- To configure the VXLAN Gateway, you must install the Advanced Edition license on the Cisco Nexus 1000V switch.

- vCPU and memory requirements:

- Two vCPUs for each Virtual Machine (VM)

- 4-GB RAM

- 10-GB virutal disk space

- Network requirements:

- Management interface

- Gateway uplink interface

- VTEP interface

This figure shows the VXLAN Gateway deployment.

VXLAN Gateway Deployment on the Cloud Services Platform (CSP)

Guidelines and Limitations for Cisco Nexus 1000V VXLAN Gateway

VXLAN Gateways have the following configuration guidelines and limitations:

- You must configure the VSM to use the Layer 3 control. We strongly recommend that VSM Layer 3 control is through mgmt 0. For more information about Layer 3 control, see the Cisco Nexus 1000V System Management Configuration Guide.

- A single VSM can manage a maximum of eight VXLAN Gateway high availability (HA) clusters.

- You must configure the HA mode of the VXLAN Gateway as standalone or primary/secondary so that when you bring up the VXLAN Gateway, the HA state is either active or standby and the VXLAN-to-VLAN mappings are either active or pending. If you do not configure an HA role for the VXLAN Gateway, when you bring up the VXLAN Gateway, the HA state is unknown, and VXLAN-to-VLAN traffic is not processed.

- The VXLAN Gateway virtual machine (VM) uses two vCPUs; one vCPU for management traffic and one vCPU for the data interface.

Steps to Install and Configure VXLAN Gateway

There are several key steps to install and configure a VXLAN Gateway.

Procedure

Command or Action

Purpose

Step 1

Create two port profiles on the switch (VSM): one for the uplinks on the gateway and one for the VTEP interface.

See Configuring a Port Profile for the Uplink on the VXLAN Gateway and Configuring a Port Profile for the VTEP on the VXLAN Gateway.

Step 2

Deploy the VXLAN Gateway.

Choose one of the following deployment models:

- Deploy as a VM. See Installing the VXLAN Gateway as a VM Using RHEL-OSP Installer.

- Deploy on Cloud Services Platform (CSP). See Installing the VXLAN Gateway on a Cloud Services Platform.

Step 3

Create the VXLAN Gateway data and management interfaces.

Choose one of the following methods:

- Configuring the VXLAN Gateway Data and Management Interfaces Using OpenStack dashboard

- Configuring the VXLAN Gateway Data and Management Interfaces Using the OpenStack CLI

Step 4

Configure high availability on the VSMs. You must configure the HA mode of the VXLAN Gateway as standalone or primary/secondary so that when you bring up the VXLAN Gateway, the HA state is either active or standby and the VXLAN-to-VLAN mappings are either active or pending. If you do not configure an HA role for the VXLAN Gateway, when you bring up the VXLAN Gateway, the HA state is unknown, and VXLAN-to-VLAN traffic is not processed.

See Configuring the VXLAN Gateway HA Mode as Standalone.

Step 5

Set up the VXLAN-to-VLAN mappings on the VXLAN Gateway.

See Managing the VXLAN-to-VLAN Mappings on the VXLAN Gateway.

Step 6

Verify the VXLAN Gateway installation and configuration.

(Optional)
See Verifying the VXLAN Gateway Configuration.

Configuring Port Profiles on the VSM

You must create port profiles on the VSM before you can install and configure the VXLAN Gateway.

- Configuring a Port Profile for the Uplink on the VXLAN Gateway

- Configuring a Port Profile for the VTEP on the VXLAN Gateway

Configuring a Port Profile for the Uplink on the VXLAN Gateway

Before installing the VXLAN Gateway, you must create two port profiles on the switch (VSM), one for the uplinks on the gateway and one for the VXLAN Tunnel Endpoint (VTEP) interface.

Before You Begin

- Ensure that the VSM is configured in the Advanced mode by entering the svs switch edition advanced configuration command to enable Advanced mode.

- Ensure that the VXLAN feature is enabled on the VSM by entering the feature segmentation configuration command to enable VXLANs on the VSM.

- Ensure that the VXLAN Gateway is enabled on the VSM by entering the feature vxlan-gateway configuration command.

- Ensure that the interfaces of the upstream switch are configured with a matching port channel and VLAN trunk configuration.

Procedure

Command or Action

Purpose

Step 1

vsm# configure terminal

Enters global configuration mode.

Step 2

vsm# encapsulation profile segment name

Creates an encapsulation profile to contain the VLAN-to-VXLAN mappings.

Step 3

vsm(config-vxlan-encap-prof)# dot1q VLAN-ID bridge-domain bd-name

Maps a VLAN to a VXLAN. The VXLAN is specified through the bridge-domain name.

Note:
The bridge-domain name and VLAN-ID you provide are not created during the port-profile configuration. The bridge-domain name and the VLAN ID that you provide should be in an active state or the mapping is held in an inactive state until you create the bridge-domain name and VLAN ID.

Note:
Repeat this step to specify additional mappings.

Step 4

vsm(config)# port profile type ethernet name

Creates a port profile of type ethernet for the VXLAN Gateway uplink.

Note:
You must provide a port-profile name when prompted while executing the setup script to configure the VXLAN Gateway.

Step 5

vsm(config-port-prof)# switchport mode trunk

Designates that the interfaces are to be used as trunking ports. A trunk port transmits untagged packets for the native VLAN and transmits encapsulated, tagged packets for all other VLANs.

Step 6

vsm(config-port-prof)# switchport trunk allowed vlan vlan list

Specifies the list of VLANs allowed on the gateways uplink. This list should consist of all the mapped VLANs and the VLAN for the VTEP virtual interface.

Step 7

vsm(config-port-prof)# mtu mtu size in bytes

Designates the MTU size. For VXLAN traffic to be functional, you must set the MTU size as 1550. If you do not set the MTU size, the default of 1500 is used. The size must be an even number between 1500 and 9000. The MTU configured on an interface takes precedence over the MTU configured on a port profile.

Step 8

vsm(config-port-prof)# service instance 1-4096

(Optional)
Defines a place holder for mappings. The range is from 1 to 4096.

Note:
You do not need to execute the service instance and the encapsulation command at this stage to bring up the gateway. These commands are optional and you can add the mappings later once the port profiles are configured.

Step 9

vsm(config-port-prof-svc)#encapsulation profile name

Specifies the encapsulation profile for the port profile.

Step 10

vsm(config-port-prof-srv)# exit

(Optional)
Exits from the service instance mode.

Step 11

vsm(config-port-prof)# no shutdown

Administratively enables all ports in the profile.

Step 12

vsm(config-port-prof)# state enabled

Enables the port profile and applies its configuration to the assigned ports.

Step 13

vsm(config-port-prof)# publish port-profile

Publishes the port profile.

This example shows how to configure and display the gateway mappings:

vsm# configuration terminal
vsm(config)# port-profile type ethernet gw-uplink
vsm(config)# switchport mode trunk
vsm(config)# switchport trunk allowed vlan 1545
vsm(config)# mtu 1550
vsm(config-port-prof)# service instance 1
vsm(config-port-prof)# encapsulation profile gw_mappings
vsm(config-port-prof-srv)# encapsulation profile segment gw-segment
vsm(config-port-prof-srv)# encapsulation dot1q 753 bridge-domain bd-753
vsm(config-port-prof-srv)# exit
vsm(config-port-prof)# channel-group auto
vsm(config-port-prof)# no shutdown
vsm(config-port-prof)# state enabled
vsm(config-port-prof)# publish port-profile

Configuring a Port Profile for the VTEP on the VXLAN Gateway

You can create a port profile that can be applied to the VTEP virtual interface on the VXLAN Gateway.

Procedure

Command or Action

Purpose

Step 1

vsm# configure terminal

Enters global configuration mode.

Step 2

vsm(config) # port-profile type vethernet port-profile name

Configures a port profile for the VTEP on the VXLAN gateway.

Note:
You must provide a port profile name when prompted while executing the setup script to configure the VXLAN Gateway.

Step 3

vsm(config-port-prof) # switchport mode access

Designates that the interfaces are to be used as a trunking ports. A trunk port transmits untagged packets for the native VLAN and transmits encapsulated, tagged packets for all other VLANs.

Step 4

vsm(config-port-prof) # switchport access vlan vlan-id-access

Assigns an access VLAN ID to this port profile. The VLAN ID provided must be added to the allowed VLAN set of the uplink port profile. This VLAN should not be mapped to any VXLAN.

Note:
If you do not specify a VLAN ID, VLAN 1 is used automatically.

Step 5

vsm(config-port-prof ) # capability vxlan

Configures the capability VXLAN feature on the specified virtual ethernet port and enables encapsulation and decapsulation of VXLAN packets.

Step 6

vsm(config-port-prof) # transport ip address ip-address netmask network mask [gateway ip-address]

Configures the IP address, netmask, and gateway for the VTEP.
Note:
If you have VTEPs that are in different subnets, you must specify the gateway IP address. If a gateway is not provided, the VXLAN Gateway uses ARP to reach the remote VTEP.

Step 7

vsm(config-port-prof)# no shutdown

Administratively enables all ports in the profile.

Step 8

vsm(config-port-prof)# state enabled

Enables the port profile and applies its configuration to the assigned ports.

Step 9

vsm(config-port-prof)# publish port-profile

Publishes the port profile.

This example displays how to configure a VTEP on the VXLAN gateway:

vsm# configure terminal
vsm(config)# port-profile type vethernet gw-vtep
vsm(config-port-prof)# switchport mode access
vsm(config-port-prof)# switchport access vlan 760
vsm(config-port-prof)# capability vxlan
vsm(config-port-prof)# transport ip address 192.0.2.1 255.255.255.0 gateway 192.0.2.254
vsm(config-port-prof)# no shutdown
vsm(config-port-prof)# state enabled
vsm(config-port-prof)# publish port-profile

Installing the VXLAN Gateway as a VM Using RHEL-OSP Installer

You install the VXLAN Gateway as a VM on compute hosts.

Before You Begin

- Ensure that the Cisco Yum repository has been added to the yum repository list. If it has not been added, see Setting Up the Cisco Yum Repository

- Ensure that the host on which you create the VXLAN Gateway VM meets the networking requirements, as described in Minimum Networking Requirements.

- Create the required port profiles in the VSM, as described in Configuring Port Profiles on the VSM.

- If you are not using DHCP to configure IP addresses of the VTEPs, ensure that static IP addresses are configured on the VTEPs. See

Procedure

Step 1

Source the keystonerc_admin file.

/root/keystonerc_admin

If the keystonerc_admin file is not found, change the password and authorization URL of the openrc file, and source the openrc file instead. This example shows the OS_PASSWORD and OS_AUTH_URL parameters that you need to define in the openrc file.

export OS_NO_CACHE=true
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=<password>
export OS_AUTH_URL=http://<IP>/v2.0/
export OS_AUTH_STRATEGY=keystone
export OS_REGION_NAME=RegionOne
export CINDER_ENDPOINT_TYPE=publicURL
export GLANCE_ENDPOINT_TYPE=publicURL
export KEYSTONE_ENDPOINT_TYPE=publicURL
export NOVA_ENDPOINT_TYPE=publicURL
export QUANTUM_ENDPOINT_TYPE=publicURL

Step 2

Download the VXLAN Gateway image.

yum update
yum install nexus-1000v-vxgw
ls /opt/cisco/vxgw/
image_name

Step 3

Upload the image to Glance.

glance image-create --name=IMG_NAME --is-public=true --property hw_vif_model=virtio --property hw_disk_bus=ide --property hw_cdrom_bus=ide --container-format=ovf --disk-format=qcow2 < /opt/cisco/vxgw/image_name

Installing the VXLAN Gateway on a Cloud Services Platform

There are three basic steps to install the VXLAN Gateway on a Cloud Services Platform.

Procedure

Step 1

Create and deploy the VXLAN Gateway.
For details, see Creating and Deploying a VXLAN Gateway

Step 2

Configure the VXLAN Gateway.
For details, see Configuring the VXLAN Gateway Using the Setup Script

Step 3

Modify and customize the initial setup script.
For details, see Modifying the Initial Setup Script Parameters

- Creating and Deploying a VXLAN Gateway

- Configuring the VXLAN Gateway Using the Setup Script

- Modifying the Initial Setup Script Parameters

Creating and Deploying a VXLAN Gateway

You can create and deploy a VXLAN Gateway as a VSB on all Cisco Nexus Cloud Services Platforms.

Before You Begin
You must be logged in to the Cisco Nexus Cloud Services Platform on which you want to install the VXLAN Gateway.

Procedure

Command or Action

Purpose

Step 1

CSP# copy scp:// server where the VXGW image is located source path iso image of vxlan gw bootflash:repository >

Copies the VXLAN gateway image to the bootflash/repository on the CCPA Manager.

Step 2

CSP# configure terminal

Enters global configuration mode.

Step 3

CSP(config) # virtual-service-blade name of the VXLAN GW VSB

Creates a VXLAN Gateway VSB.

Step 4

CSP(config-vsb-config) # virtual-service-blade-type new iso image of the vxlan gw

Deploys the downloaded VXLAN Gateway. The image is always populated from the bootflash or repository and there is no need to specify the path.

Step 5

CSP(config-vsb-config) # interface gw-uplink1 uplink Physical-Interface Cloud Services Platform

Assigns a physical interface on the Cloud Services Platform to the gateway uplink. GigabitEthernet3 through GigabitEthernet6 are available in the flexible mode physical interfaces. You must configure the port channels using LACP on the upstream switches.

Step 6

CSP(config-vsb-config) # interface gw-uplink1 mode passthrough

Configures the gateway uplink as passthrough. The corresponding Gigabit Ethernet interface cannot be shared with other VSBs on the Cloud Services Platform.

Step 7

CSP(config-vsb-config) # interface gw-uplink2 uplink Physical-Interface Cloud Services Platform

Assigns a physical interface on the Cloud Services Platform to the gateway uplink. GigabitEthernet3 through GigabitEthernet6 are available in the flexible mode physical interfaces. You must configure the port channels using LACP on the upstream switches.

Step 8

CSP(config-vsb-config) # interface gw-uplink2 mode passthrough

Configures the gateway uplink as passthrough. The corresponding Gigabit Ethernet interface cannot be shared with other VSBs on the Cloud Services Platform.

Step 9

CSP(config-vsb-config) # interface management vlan vlan id

Allows the specified VLAN ID on the management uplink. The VLAN range is from 1 to 4096.

Step 10

CSP(config-vsb-config) # interface management uplink interface

Specifies the interface as either a physical interface of the Cloud Services Platform or a port channel interface previously created on the Cloud Services Platform.

Step 11

Use one of the following commands to deploy a gateway:

- CSP(config-vsb-config)# enable

- CSP(config-vsb-config)# enable primary

- CSP(config-vsb-config)# enable secondary

Use the enable command to install two VSBs, one on the primary Cloud Services Platform and another on the secondary cloud services platform.

Use the enable primary command to deploy the gateway in standalone mode on the primary Cloud Services Platform.

Use the enable secondary command to deploy the gateway in standalone mode on the secondary Cloud Services Platform.

Initiates a setup script to configure the VXLAN gateway, IP address, subnet mask, gateway, hostname, and password for the VXLAN gateway VSB. You are also required to specify the details of the VSMs domain ID, IP address, primary and secondary MAC addresses on the control interface. For more information, see Setup Script to Configure the VXLAN Gateway.

This example shows how to bring up a gateway as a VSB on a VSA pair:

CSP# configure terminal
CSP(config)# virtual-service-blade VXLAN-GW
CSP(config-vsb-config)# virtual-service-blade-type new vxgw.4.2.1.SV2.2.0.264.iso
CSP(config-vsb-config)# interface gw-uplink1 uplink GigabitEthernet3
CSP(config-vsb-config)# interface gw-uplink2 uplink GigabitEthernet4
CSP(config-vsb-config)# interface gw-uplink1  mode passthrough
CSP(config-vsb-config)# interface gw-uplink2  mode passthrough
CSP(config-vsb-config)# interface management uplink GigabitEthernet1
CSP(config-vsb-config)# interface management vlan 751
CSP(config-vsb-config)# enable

Configuring the VXLAN Gateway Using the Setup Script

After you enter enable while installing a VXLAN Gateway as a VSB, the setup script to configure the VXLAN gateway is executed. The setup script configures the following parameters on the VXLAN gateway:

- IP address, network mask, and default gateway for both the primary and secondary VXLAN Gateway Management interface

- VSM details—Domain ID, IP address, primary MAC address, and secondary MAC address of the VSM control interface

- Port profiles used for the VXLAN Gateway uplink and VTEP

Procedure

Step 1

On the command prompt, enter the VSB image and press Enter.

Enter VSB image:x.x.x.x.x.x.x.iso: [vxgw.5.2.1.SK1.2.1.iso]

Step 2

Enter the VSM domain ID. The range is from 1 to 1023.

Enter domain [1-1023]:405

Note:
You can get the domain ID by entering the show svs domain command on the VSM.

Step 3

Enter the management IP version.

Management IP version [V4]:v4

Step 4

Configure the management IP address to interface mgmt 0 on the VXLAN Gateway that is deployed on the primary Cloud Services Platform.

Enter management IP address of service module on primary: 192.168.1.104

Note:
If you are deploying the gateway in the standalone mode on the secondary Cloud Services Platform, enter the IP address, network mask, and the default gateway address for the primary as 0.0.0.0.

Step 5

Enter the management subnet mask.

Enter management subnet mask of service module on primary: 255.255.255.0

Step 6

Enter the management default gateway.

Enter default gateway IP address of service module on primary: 192.168.1.1

Step 7

Configure the management IP address to interface mgmt 0 on the VXLAN gateway deployed on the secondary Cloud Services Platform.

Enter management IP address of service module on secondary: 192.168.1.105

Note:
If you are deploying the gateway in the standalone mode on the primary Cloud Services Platform, enter the IP address, network mask, and the default gateway address for the secondary as 0.0.0.0.

Note:
In a HA deployment, we recommend that the IP address that you provide is in the same subnet as the one provided in Step 5.

Step 8

Enter the management subnet mask.

Enter management subnet mask of service module on secondary: 255.255.255.0

Step 9

Enter the management interface default gateway.

Enter default gateway IP address of service module on secondary: 192.168.1.1

Step 10

Enter the VXLAN Gateway hostname.

Enter HostName: VXLAN-GW-DOCS

Step 11

Enter the login credentials.

Enter the password for admin:Sfish123

Step 12

Enter the IP address of the VSM.

VSM L3 Ctrl IPv4 address:192.168.1.210

Step 13

Enter the uplink trunk port profile configured on the VSM.

Enter VSM uplink port-profile name: gw-uplink

Note:
Enter the dedicated uplink trunk port profile for the VXLAN Gateway pair created on the VSM.

Step 14

Enter the VTEP profile name.

Enter VTEP port-profile name: gw-vtep

Note:
Enter the same VTEP port profile name created on the VSM.

This example shows how to bring up the VXLAN Gateway:

CSP(config-vsb-config)# enable
Enter vsb image: [vxgw.4.2.1.SV2.2.0.264.iso]
Enter the VSM domain id[1-4095]: 405
Enter Management IP version [V4]: [V4]
Enter Management IP address of service module on primary: 192.168.1.104
Enter Management subnet mask of service module on primary: 255.255.255.0
Enter default gateway IP address of service module on primary: 192.168.1.1
Enter management IP address of service module on secondary: 192.168.1.105
Enter management subnet mask of service module on secondary: 255.255.255.0
Enter default gateway IP address of service module on secondary: 192.168.1.1
Enter HostName: VXLAN-GW-DOCS
Enter the password for 'admin': Sfish123
VSM L3 Ctrl IPv4 address : 192.168.1.210
Enter VSM uplink port-profile name: gw-uplink
Enter VTEP port-profile name: gw-vtep
Note: VSB installation is in progress, please use show virtual-service-blade commands to check the installation status.
CSP(config-vsb-config)#

Modifying the Initial Setup Script Parameters

After executing the setup script for the first time, if you need to modify any of the setup parameters, use the following commands on the VSM:

Note

If an HA pair is installed, ensure that you apply the same changes individually on both gateway modules.

Note

Ensure the port profile that you update is first saved on the VSM.

Procedure

Command or Action

Purpose

Step 1

vsm(config)# service module update port-profile type ethernet name VXLAN Gateway Uplink port-profile name

Modifies the VXLAN Gateway uplink port profile from the VSM.

Step 2

vsm(config)# service module update port-profile type vethernet name VXLAN Gateway VTEP port-profile name

Modifies the VXLAN Gateway VTEP port profile from the VSM.

Configuring the VXLAN Gateway Data and Management Interfaces Using OpenStack dashboard

- Guidelines and Limitations for the OpenStack Dashboard

- Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack Dashboard

- Creating a Trunk Network Profile Using OpenStack Dashboard

- Creating a VLAN Network Profile Using OpenStack Dashboard

- Creating a Network Using the OpenStack Dashboard

- Creating a Subnet for a Network Using the OpenStack Dashboard

- Booting a VXLAN Gateway VM

Guidelines and Limitations for the OpenStack Dashboard

The OpenStack dashboard has the following guidelines and limitations when you use it to create virtual networks for Cisco Nexus 1000V for KVM:

- To create a network profile and associate it with a tenant, you must log in to the OpenStack dashboard as a user with admin privileges. Any user can use a network profile that is associated with a tenant.

- You cannot create policy profiles or assign them to a tenant in OpenStack dashboard. You must first create them as part of the port profiles in the VSM. The OpenStack dashboard retrieves them from the VSM and displays them on the Router dashboard.

Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack Dashboard

Before You Begin
Create one or more port profiles in the VSM. These port profiles are displayed as policy profiles in OpenStack dashboard. For more information, see Configuring a Port Profile for the Uplink on the VXLAN Gateway and Configuring a Port Profile for the VTEP on the VXLAN Gateway.

Procedure

Step 1

If you have not already done so, log in to OpenStack dashboard as a user with admin privileges.

Step 2

Create a network profile of type trunk.
See Creating a Trunk Network Profile Using OpenStack Dashboard.

Step 3

Create a network profile of type VLAN.
See Creating a VLAN Network Profile Using OpenStack Dashboard.

Step 4

Create one or more networks for the network profiles.
See Creating a Network Using the OpenStack Dashboard.

Step 5

Create a subnet for each network.
See Creating a Subnet for a Network Using the OpenStack Dashboard.

You do not need to create a port for the network. OpenStack dashboard creates a port for the network when you launch the instance.

Step 6

Create and launch the VM instance.
See Booting a VXLAN Gateway VM.

Creating a Trunk Network Profile Using OpenStack Dashboard

Before You Begin

- Create one or more policy profiles as part of the port profiles in the VSM.

- Create one or more tenants in OpenStack dashboard.

Procedure

Step 1

In the Navigation pane, click the Router dashboard.

Step 2

In the Cisco Nexus 1000v panel, click Create Network Profile.

Step 3

In the Create Network Profile dialog box, do the following:

1. In the Name field, enter a unique name for the network profile.
The name can have a maximum length of 255 characters and can contain uppercase or lowercase characters, numerals, and special characters such as an "at" sign (@), ampersand (&), and exclamation point (!).

2. From the Segment Type drop-down list, choose Trunk.

3. From the Sub Type drop-down list, choose VLAN.

4. From the Project multi-select list, choose one or more tenants that you want to associate with this network profile.

5. Click Create Network Profile.

OpenStack dashboard creates the network profile and then updates the OpenStack Neutron database and the VSM.

What to Do Next

Create one or more networks.

Creating a VLAN Network Profile Using OpenStack Dashboard

Before You Begin

- Create one or more policy profiles as part of the port profiles in the VSM.

- Create one or more tenants in OpenStack dashboard.

Procedure

Step 1

In the Navigation pane, click the Router dashboard.

Step 2

In the Cisco Nexus 1000v panel, click Create Network Profile.

Step 3

In the Create Network Profile dialog box, do the following:

1. In the Name field, enter a unique name for the network profile.
The name can have a maximum length of 255 characters and can contain uppercase or lowercase characters, numerals, and special characters such as an "at" sign (@), ampersand (&), and exclamation point (!).

2. From the Segment Type drop-down list, choose VLAN.
Separate the first and last segments in the range with a hyphen (-). For example, enter a range of 80-86. For a segment type of VLAN, the range can be from 1 to 3967 or from 4048 to 4093.

3. In the Segment Range field, enter the segment range for the network profile.
For example, enter a range of 80-86. For a segment type of VLAN, the range can be from 1 to 3967 or from 4048 to 4093.

4. In the Physical Network field, enter the name of the associated physical network.

5. From the Project multi-select list, choose one or more tenants that you want to associate with this network profile.

6. Click Create Network Profile.

OpenStack dashboard creates the network profile and then updates the OpenStack Neutron database and the VSM.

What to Do Next

Create one or more networks.

Creating a Network Using the OpenStack Dashboard

You must perform this procedure twice: once to create a network with the trunk network profile and again to create a network with the VLAN network profile.

Procedure

Step 1

In the Navigation pane, click Admin > Networks.

Step 2

In the Networks panel, click Create Network.

Step 3

In the Create Network dialog box, do the following:

1. In the Name field, enter a unique name for the network.
The name can have a maximum length of 255 characters and can contain uppercase or lowercase characters, numerals, and special characters such as an "at" sign (@), ampersand (&), and exclamation point (!).

2. From the Project drop-down list, choose a tenant that you want to associate with this network.
This tenant should be the same tenant that you use for the network profile.

3. From the Network Profile drop-down list, choose the network profile you want to associate with the network.
For the VXLAN Gateway, choose the trunk network profile that you already created.

4. Check the Admin State check box.
You can accept the defaults for the Shared check box and the External Network check box. By default, these check boxes are unchecked.

5. Click Create Network.

Step 4

For the VXLAN Gateway, perform this procedure again to create another network and choose the VLAN network profile that you already created.

What to Do Next

Create a subnet for the network.

Creating a Subnet for a Network Using the OpenStack Dashboard

You must perform this procedure twice: once to create a subnet in the trunk network that you already created and again to create a subnet in the VLAN network that you already created.

Note

Do not enable DHCP on these subnets.

Procedure

Step 1

In the Navigation pane, click Admin > Networks.

Step 2

In the Networks panel, click the network to which you want to add a subnet.
For the VXLAN Gateway, choose the trunk network that you already created.

Step 3

In the Create Subnet dialog box, click the Subnet tab an do the following:

1. In the Name field, enter a unique name for the subnet.
The name can have a maximum length of 255 characters and can contain uppercase or lowercase characters, numerals, and special characters such as an "at" sign (@), ampersand (&), and exclamation point (!).

2. In the Network Address field, enter the address for the subnet.
The subnet address must be in classless interdomain routing (CIDR) format. For example, 192.168.0.0/16.

3. From the IP Version drop-down list, choose IPv4.

4. Optional: In the Gateway IP field, enter a gateway IP address for the subnet.

Step 4

Optionally, click the Subnet Detail tab and do the following:

1. (Optional) Click the Enable DHCP checkbox.

2. Enter one or more allocation pools in the Allocation Pools text box.

3. Enter one or more name servers in the DNS Name Servers text box.

4. Enter one or more host routes in the Host Routes text box.

Step 5

Click Create to create the subnet.

Step 6

For the VXLAN Gateway, perform this procedure again to create another network and choose the VLAN network that you already created.

Booting a VXLAN Gateway VM

You must manually create the port IDs and launch the VM instance using OpenStack commands.

Procedure

Step 1

neutron port-create trunk-network-name --n1kv:profile_id VSM-policy-profile-id

Creates the trunk port ID for the VXLAN Gateway data interface.

Step 2

neutron port-create vxgw-mgmt-network-name --n1kv:profile_id VSM-policy-profile-id

Creates the management port ID for the VXLAN Gateway management interface.

Step 3

nova boot --image image_id --flavor 3 nic port-id= trunk_port-id nic port-id= access_port-id vxlan_gateway_name

Launches the VXLAN Gateway VM.

Note:   In this command, you must specify the first NIC as a trunk port and the second NIC as an access port.

Note:   You must specify flavor 3, because flavor 3 provides the two vCPUs that the VM requires.

Step 4

nova list

Lists the active servers.

Configuring the VXLAN Gateway Data and Management Interfaces Using the OpenStack CLI

- Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack CLI

- Creating the VXLAN Gateway Data Interface

- Creating a VXLAN Gateway Management Interface

- Booting a VXLAN Gateway VM

- Example of VXLAN Gateway Interface Configuration

Steps to Configure the VXLAN Gateway Interfaces Using the OpenStack CLI

Before You Begin
Create one or more port profiles in the VSM. For more information, see Configuring a Port Profile for the Uplink on the VXLAN Gateway and Configuring a Port Profile for the VTEP on the VXLAN Gateway.

Procedure

Command or Action

Purpose

Step 1

If you have not already done so, log in to the OpenStack CLI as a user with admin privileges.

—

Step 2

Create the VXLAN Gateway data interface.

For details, see Creating the VXLAN Gateway Data Interface.

Step 3

Create theVXLAN Gateway management interface.

For details, see Creating a VXLAN Gateway Management Interface.

Step 4

Boot the VXLAN Gateway VM.

For details, see Booting a VXLAN Gateway VM.

Creating the VXLAN Gateway Data Interface

Procedure

Command or Action

Purpose

Step 1

neutron cisco-network-profile-create network_profile_name trunk sub_type vlan

Creates a network profile with a segment type of trunk and a subtype of vlan.

Step 2

neutron cisco-network-profile-list

Displays the Cisco network profile IDs.

Step 3

neutron net-create network_name --n1kv:profile_id network_profile_id

Creates a network using the network profile.

Step 4

neutron subnet-create network_name cidr_blocks --name subnet_name --disable-dhcp

Creates a subnet for the network profile.

Note:   Although you configure the VXLAN Gateway data interface manually, the create-subnet command still requires that you specify an IP address block. However, this value is not used and is ignored.

Step 5

neutron cisco-policy-profile-list

Lists the policy profiles available in neutron.

Step 6

neutron port-create network_name n1kv:profile_id cisco_policy_profile_id

Creates a trunk port. For network_name, specify the name of the network that you created in Step 3. For cisco_policy_profile_id, specify one of the Cisco policy profile IDs from the list of available profiles obtained in Step 5.

Note:   To create a second instance of the VXLAN Gateway virtual machine (for example, for an HA pair), perform this step again.

Creating a VXLAN Gateway Management Interface

Procedure

Command or Action

Purpose

Step 1

neutron cisco-network-profile-create network_profile_name vlan --segment_range segment_range --physical_network network_name

Creates a VLAN access network profile.

Step 2

neutron cisco-network-profile-list

Displays the Cisco network profile IDs.

Step 3

neutron net-create network_name --n1kv:profile_id network_profile_id

Creates an access network.

Step 4

neutron subnet-create network_name cidr_blocks --name subnet_name

Creates a subnet for the access network segment profile.

Step 5

neutron cisco-policy-profile-list

Lists the policy profiles available in Neutron.

Step 6

neutron port-create network_name n1kv:profile_id cisco_policy_profile_id

Creates an access port. Use a Cisco policy profile ID from the list of available profiles listed in Step 5.

Booting a VXLAN Gateway VM

You must manually launch a VM instance using the OpenStack CLI.

Procedure

Command or Action

Purpose

Step 1

neutron port-create trunk-network-name --n1kv:profile_id VSM-policy-profile-id

Creates the trunk port ID for the VXLAN Gateway data interface.

Step 2

neutron port-create vxgw-mgmt-network-name --n1kv:profile_id VSM-policy-profile-id

Creates the management port ID for the VXLAN Gateway management interface.

Step 3

Launch the VXLAN Gateway VM.

nova boot --image image_id --flavor 3 --nic port-id= trunk_port-id --nic port-id= access_port-id vxlan_gateway_name
Note:   In this command, you must specify the first NIC as a trunk port and the second NIC as an access port. Also, you must specify flavor 3 (m1.medium), because flavor 3 provides the two vCPUs that the VM requires.

Step 4

List the active servers.

nova list

Example of VXLAN Gateway Interface Configuration

This example shows how to configure a VXLAN Gateway VM with a trunk network profile named aug-net and a VLAN network profile named test-2.

root@server:~# neutron cisco-credential-create 172.23.181.101 n1kv --tenant-id 1234-1234-1234-1234 --user_name admin --password mypwd
root@server:~# neutron cisco-network-profile-create aug-net-prof trunk sub_type vlan
root@server:~# neutron net-create aug-net --n1kv:profile_id 999e6dc-7a55-4c4a-839e-9aa22957ba99
root@server:~# neutron subnet-create aug-net 110.10.10.0/24 --name augsubnet --disable-dhcp
root@server:~# neutron cisco-policy-profile-list
+--------------------------------------+---------------+
| id                                   | name          |
+--------------------------------------+---------------+
| 0dc6bb6d-2929-466f-abed-6e4c0f25c3be | test-prof     |
| 4c4455e5-95d6-4185-80a1-a028e27fc8bd | trk-policy    |
| 63964f53-178c-440a-8f09-301ce021498d | acc-policy    |
| 652fbfd7-0c40-41d0-bc34-5a0fda4b2ca7 | dhcp_pp       |
| 964fb14c-59cc-48d4-a4d4-abc52965fb7c | q-n1kv-policy |
+--------------------------------------+---------------+
root@server:~# neutron port-create aug-net --n1kv:profile_id 4c4455e5-95d6-4185-80a1-a028e27fc8bd
root@server:~# neutron cisco-network-profile-create test2 vlan --segment_range 400-499 --physical_network q-n1k
root@server:~# neutron net-create q-n1k --n1kv:profile_id 2e464910-f452-4865-9793-6bd70a4c0cf6
root@server:~# neutron subnet-create q-n1k 110.10.10.0/24 --name q-110.10.10.0/24
root@server:~# neutron cisco-policy-profile-list
+--------------------------------------+---------------------------+
| id                                   | name                      |
+--------------------------------------+---------------------------+
| 5cdd9b93-c109-4455-a740-746a9d59c340 | NSM_template_vlan         |
| 691b2497-b435-495a-b140-e3ebe0835e75 | test-2                    |
| 7fc8d34b-cadd-4ca0-a85c-e18aecedd308 | NSM_template_segmentation |
| 83cc0410-7781-42b5-abb1-3b00921bfcc5 | test-1                    |
+--------------------------------------+---------------------------+
root@server:~# neutron port-create q-n1k --n1kv:profile_id 99cc0410-7781-42b5-abb1-3b00921bfcc5
root@server:~# nova boot --image vxlan-gateway --flavor 3 --nic port-id=d341926c-21ca-48cd-ae18-c51f899f6d3f
root@server:~#

VXLAN Gateway and High Availability

The operation of high availability (HA) involves the following terminology:

- Cluster—A cluster is a pair of gateway modules that operate together as a single HA module. Each cluster is distinguished by a unique cluster ID. A gateway module that is deployed in a standalone mode of operation is assigned a dummy cluster ID of 0.

- HA role—The gateway modules that make up an HA cluster are assigned separate roles. One is designated as primary and the other as secondary. This role decides which of the two modules goes to active state first and which stays in a standby state. These states persist until the active module fails. In the event of any failure in the active gateway module, the standby gateway module detects the failure and moves to the active state. This way, one of the two modules is always providing active service.

- HA state— At any given time, only one gateway module from a given cluster is actively performing the gateway function. The other module stays in the standby state pending the failure of the active module. A gateway module can be in the active or standby state. In addition, there is a transient initial state called the Init state. In this state, a gateway is either waiting to be assigned a role or negotiating its state with its peer.

After a gateway module is installed and brought up, the VSM assigns a role to the gateway module and can result in one of the following transitions:

- Unconfigured-Init to Standalone-Active

- Unconfigured-Init to Primary-Active

- Unconfigured-Init to Secondary-Standby

- Standalone-Active to Primary-Active

- Standalone-Active to Secondary-Active

For all other combinations, we recommend that you first fall back to the Unconfigured-Init mode by using the no service VXLAN Gateway module command and then proceed to the desired role or states.

Note

Roles must be preassigned to module numbers in the VSM. When a VXLAN gateway is attached to the VSM on that module, it inherits the role and state that are assigned by the VSM.

You must configure the HA mode of the VXLAN Gateway as standalone or primary/secondary so that when you bring up the VXLAN Gateway, the HA state is either active or standby and the VXLAN-to-VLAN mappings are either active or pending. If you do not configure an HA role for the VXLAN Gateway, when you bring up the VXLAN Gateway, the HA state is unknown, and VXLAN-to-VLAN traffic is not processed.

Configuring the VXLAN Gateway HA Mode as Standalone

You can create a service module in a standalone mode. Perform these steps on the VSM.

Before You Begin
Roles must be preassigned to module numbers in the VSM. When a VXLAN gateway is attached to the VSM on that module, it inherits the role and state that are assigned by the VSM.

Procedure

Command or Action

Purpose

Step 1

vsm(config)# service mod role standalone

Configures the service module as standalone active.

Step 2

vsm(config)# show module service

Displays the service module number, cluster ID, role, HA mode, and status.

This example shows how to display the cluster ID mapping and the details about active, standby, and standalone service modules:

vsm(config)# show module service
Mod  Cluster-id  Role            HA Mode       Status
---  ----------  -----------     ----------    -------
36        0      Standalone      Standalone    Active

Configuring the VXLAN Gateway as an HA Pair

You can create a service module as a HA pair. Perform these steps on the VSM.

Before You Begin
You must create a second instance of the VXLAN Gateway VM.

Procedure

Command or Action

Purpose

Step 1

vsm(config)# service modNo1 role primary ha-cluster clusterNo

Configures the service module in HA and adds a primary service module to a cluster.

Step 2

vsm(config)# service modNo2 role secondary ha-cluster clusterNo

Configures another service module as secondary in the same cluster.

Step 3

vsm(config)# show module service-module

Displays the service module number, cluster ID, role, HA mode, and status.

This example shows how to display the cluster ID mapping and the details about active, standby, and standalone service modules:

vsm(config)# show module service
Mod  Cluster-id  Role        HA Mode    Status
--- ---------- ----------- ---------- -------
9    1        Primary          HA       Active
10   1        Secondary        HA       Standby

To switch over between the active and standby VXLAN gateway, enter the following command on the VSM:

vsm# service ha-cluster <1-8> switchover

Verifying the VXLAN Gateway Configuration

To display the VXLAN gateway (GW) installation and configuration information, perform one of the following tasks on the VSM:

Command

Purpose

show running-config port-profile gw-uplink

Displays the configuration of the port profile assigned to the VXLAN gateway uplinks.

show running-config port-profile gw-vtep

Displays the configuration of the port profile assigned to the VXLAN VTEP.

show module

Displays the VXLAN gateway service modules.

show module service

Verifies the role of the VXLAN gateway module and displays the cluster ID mapping and the details about active, standby, and standalone service modules.

show vxlan gateway interface

Displays if the VTEPs are configured properly.

show interface vethernet 6

Displays if both the VTEP Virtual Ethernet interfaces are in up state.

show port-channel summary

Displays if the port channels are up for gateway service modules.

show bridge-domain mappings

Displays VXLAN gateway mappings.

show switch edition

Displays if the VSM is in Advanced mode.

show feature

Displays if the VXLAN gateway is enabled on the VSM.

show virtual-service-blade summary
Note:
You must enter this command from the Cloud Services Platform.

Displays the status of the VXLAN gateway VSB as it transitions from the VSB DEPLOY IN PROGRESS to VSB POWERED ON.

show virtual-service-blade

Note:
You must enter this command from the Cloud Services Platform.

Displays the VXLAN Gateway configuration.

show encapsulation profile

Displays the VLAN-to-VXLAN mappings for all encapsulation profiles or for the specified encapsulation profile.

This example shows how to display the status of the VXLAN gateway VSB:

CSP# show virtual-service-blade summary

-------------------------------------------------------------------------------
Name                HA-Role     HA-Status   Status                   Location
-------------------------------------------------------------------------------
VXLAN-GW            PRIMARY     ACTIVE      VSB POWERED ON           PRIMARY
VXLAN-GW            SECONDARY   ACTIVE      VSB POWERED ON           SECONDARY

This example shows how to display the VXLAN gateway configuration:

CSP# show virtual-service-blade
virtual-service-blade VXLAN-GW
Description:
Slot id:        1
Host Name:      VXLAN-GW-DOCS
Management IP:  192.168.1.104
VSB Type Name :  vx-gw-1.5
Configured vCPU:           3
Operational vCPU:           3
Configured Ramsize:        2048
Operational Ramsize:        2048
Disksize:       3
Heartbeat:      154764

Legends:   P -  Passthrough
--------------------------------------------------------------------------
Interface           Type         MAC     VLAN    State   Uplink-Int
Pri  Sec Oper  Adm
--------------------------------------------------------------------------
VsbEthernet1/1  gw-uplink1 0002.3d71.a303        up   up Gi3(P) Gi3(P)
VsbEthernet1/2  management 0002.3d71.a302  751   up   up Gi1    Gi1
VsbEthernet1/3  gw-uplink2 0002.3d71.a304        up   up Gi4(P) Gi4(P)
internal          NA        NA       NA    up   up
HA Role: Primary
HA Status: ACTIVE
Status:       VSB POWERED ON
Location:     PRIMARY
SW version:
HA Role: Secondary
HA Status: ACTIVE
Status:       VSB POWERED ON
Location:     SECONDARY
SW version:
VSB Info:
Domain ID : 405

This example shows how to display the port-profile configuration assigned to the VXLAN Gateway uplinks:

vsm# show running-config port-profile gw-uplink

port-profile type ethernet gw-uplink
switchport mode trunk
switchport trunk allowed vlan 1,81,751-760
mtu 1550
channel-group auto mode active
no shutdown
state enabled

This example shows how to display the port-profile configuration assigned to the VXLAN VTEP:

vsm# show running-config port-profile gw-vtep

port-profile type vethernet gw-vtep
switchport mode access
switchport access vlan 760
capability vxlan
transport ip address 182.168.1.253 255.255.255.0 gateway 182.168.1.1
no shutdown
state enabled

This example shows how to display the VXLAN Gateway service modules as soon as they are online:

vsm# show module
Mod  Ports  Module-Type                       Model               Status
---  -----  --------------------------------  ------------------  ------------
1    0      Virtual Supervisor Module         Nexus1000V          ha-standby
2    0      Virtual Supervisor Module         Nexus1000V          active *
11   332    Virtual Ethernet Module           NA                  ok
18   332    Virtual Ethernet Module           NA                  ok
20   13     Virtual Service Module            VXLAN Gateway       ok
21   13     Virtual Service Module            VXLAN Gateway       ok
22   13     Virtual Service Module            VXLAN Gateway       ok

Mod  Sw                  Hw
---  ------------------  ------------------------------------------------
1    5.2(1)SK1(2.1)      0.0
2    5.2(1)SK1(2.1)      0.0
11   5.2(1)SK1(2.1)      Linux 3.2.0-23-generic
18   5.2(1)SK1(2.1)      Linux 3.8.0-29-generic
20   5.2(1)SK1(2.1)      Linux 2.6.27.10
21   5.2(1)SK1(2.1)      Linux 2.6.27.10
22   5.2(1)SK1(2.1)      Linux 2.6.27.10

Mod  Server-IP        Server-UUID                           Server-Name
---  ---------------  ------------------------------------  --------------------
1    192.0.2.166      NA                                    NA
2    192.0.2.166      NA                                    NA
11   192.0.2.147      47DE0F4A-8072-0E4D-A218-84A2C058FF3C  vxlan-gw-ubuntu
18   192.0.2.54       EE04B285-6BA6-5642-AC8E-EDB12D07811B  vxlan-gw-ubuntu2
20   192.0.2.90       7a4f6171-3235-4fd2-9797-80149df55171  ab-vxgw-1110
21   192.0.2.53       48ad3898-401f-4377-8de1-dcfa22df78ec  VxLanGW
22   192.0.2.55       5a996a7e-fa85-4630-89e5-18a3a3b413b8  VxLanGW
* this terminal session

This example shows how to display the cluster ID mapping and the details about active, standby, and standalone service modules:

vsm# show module service
Mod  Cluster-id  Role        HA Mode    Status
--- ---------- ----------- ---------- -------
9    1        Primary          HA       Active
10   1        Secondary        HA       Standby

This example shows how to display the module for virtual Ethernet interface binding:

vsm(config-if)# show vxlan gateway interface
-----------------------------------------------------------------
Port     IPAddress     Netmask     Gateway Mod Status Role
-----------------------------------------------------------------
Veth6     192.0.2.253  255.255.255.0    192.168.1.1 9     up Active
Veth22     192.0.2.253  255.255.255.0    192.168.1.1 10  up Standby

This example shows how to display whether both the VTEP virtual Ethernet interfaces are in up state:

vsm# show interface vethernet 6
Vethernet6 is up
Port description is VXLANGW VTEP, Network Adapter 1
Hardware: Virtual, address: 0002.3d71.a303 (bia 0002.3d71.a303)
Owner is VM "VXLANGW VTEP", adapter is Network Adapter 1
Active on module 9
Port-Profile is gw-vtep
Port mode is access
5 minute input rate 8 bits/second, 0 packets/second
5 minute output rate 0 bits/second, 0 packets/second
Rx
6 Input Packets 6 Unicast Packets
0 Multicast Packets 588 Broadcast Packets
468 Bytes
Tx
34321 Output Packets 34321 Unicast Packets
33609 Multicast Packets 24 Broadcast Packets 33633 Flood Packets
2193700 Bytes
0 Input Packet Drops 0 Output Packet Drops

vsm# show interface vethernet 22
Vethernet22 is up
Port description is VXLANGW VTEP, Network Adapter 1
Hardware: Virtual, address: 0002.3d71.a383 (bia 0002.3d71.a383)
Owner is VM "VXLANGW VTEP", adapter is Network Adapter 1
Active on module 10
Port-Profile is gw-vtep
Port mode is access
5 minute input rate 8 bits/second, 0 packets/second
5 minute output rate 0 bits/second, 0 packets/second
Rx
6 Input Packets 6 Unicast Packets
0 Multicast Packets 25 Broadcast Packets
468 Bytes
Tx
33742 Output Packets 33742 Unicast Packets
33609 Multicast Packets 133 Broadcast Packets 33742 Flood Packets
2158956 Bytes
0 Input Packet Drops 0 Output Packet Drops

This example shows how to display whether the port channels are up for VXLAN Gateway service modules:

vsm# show port-channel summary
Flags:  D - Down        P - Up in port-channel (members)
I - Individual  H - Hot-standby (LACP only)
s - Suspended   r - Module-removed
S - Switched    R - Routed
U - Up (port-channel)
--------------------------------------------------------------------------------
Group Port-       Type     Protocol  Member Ports
Channel
--------------------------------------------------------------------------------
1     Po1(SU)     Eth      NONE      Eth3/3(P)    Eth3/4(P)    Eth3/5(P)
Eth3/6(P)
2     Po2(SU)     Eth      NONE      Eth4/3(P)    Eth4/4(P)    Eth4/5(P)
Eth4/6(P)
3     Po3(SU)     Eth      NONE      Eth5/3(P)    Eth5/4(P)    Eth5/5(P)
Eth5/6(P)
4     Po4(SU)     Eth      NONE      Eth6/3(P)    Eth6/4(P)    Eth6/5(P)
Eth6/6(P)
5     Po5(SU)     Eth      NONE      Eth7/3(P)    Eth7/4(P)    Eth7/5(P)
Eth7/6(P)
6     Po6(SU)     Eth      NONE      Eth8/4(P)
7     Po7(SU)     Eth      LACP      Eth9/1(P)    Eth9/3(P)
8     Po8(SU)     Eth      LACP      Eth10/1(P)   Eth10/3(P)

This example shows how to display VXLAN Gateway mappings:

vsm# show bridge-domain mappings
-------------------------------------------------------------------------------
Interface       Module  Serv Inst  Vlan  BD-Name
-------------------------------------------------------------------------------
port-channel7   9       753        753   bd-753
port-channel8   10      753        753   bd-753

This example shows how to display the IP address for module binding:

vsm(config-if)# show module service mgmt-int
--------------------------------------------------------------------------------
Mod Interface-Name IP-address Speed MTU
--------------------------------------------------------------------------------
4 Mgmt0 10.10.10.2             0     0
5 Mgmt0 10.10.10.3             0     0
Remember the management IP address user installs gateway with
(in this example 10.10.10.2, which occupies module slot 4)

This example shows how to display whether the VSM is in Advanced mode:

vsm# show switch edition
Switch Edition: Advanced

Advanced Features
Feature Name    Feature State
-----------------------------
vxlan-gateway   enabled

Licenses Available: 1020
Licenses In Use: 4
License Expiry Date: 13 Jun 2013

This example shows how to display whether the VXLAN Gateway is enabled on the VSM:

vsm# show feature
Feature Name          Instance  State
--------------------  --------  --------
cts                   1         enabled
dhcp-snooping         1         enabled
http-server           1         enabled
lacp                  1         enabled
netflow               1         disabled
network-segmentation  1         enabled
port-profile-roles    1         disabled
private-vlan          1         disabled
segmentation          1         enabled
sshServer             1         enabled
tacacs                1         disabled
telnetServer          1         disabled
vtracker              1         enabled
vxlan-gateway         1         enabled

Perform one of the following tasks on the VXLAN Gateway. If your VSM is on Layer 3 through management and your gateway is also on the same management subnet, use the attach module service module number command to acces the gateway CLI. If your VSM is on Layer 3 through control, you can access the gateway CLI from any machine on that control subnet. This example shows the VSM which is on Layer 3 control.

Command

Purpose

show redundancy config

Displays the high availability status.

This example shows how to display the HA status:

gw# show redundancy config

HA Manager Node Information:

Cluster Node Count: 2

Local Node:
state          : Active
HA mode        : High Availability
uuid           : 56fa6753-4dc5-4a7d-ad07-cc817114f838
cluster_id     : 1
node_priority  : 2
node_type      : VXLAN Gateway
ipaddr [mgmt]  : 192.168.1.104

Peer Node 1:
state          : Standby
uuid           : 4cbd05df-b3e5-468a-9497-89aa3fae8153
node_type      : VXLAN Gateway
ipaddr [mgmt]  : 192.168.1.105

This example shows how to display the VLAN-to-VXLAN mappings for all encapsulation profiles:

gw# show encapsulation profile

-------------------------------------------------------------------------------
Vlan Bridge-domain
-------------------------------------------------------------------------------
2100 segment5050
2055 segment5031
2056 segment5032
2057 segment5033
2058 segment5034

Managing the VXLAN-to-VLAN Mappings on the VXLAN Gateway

The VLAN-to-VXLAN mappings that are configured on a gateway module can be managed by editing the port profile applied on the gateway uplink modules. To add or remove a mapping, perform these steps on the VSM.

Procedure

Command or Action

Purpose

Step 1

vsm# configure terminal

Enters global configuration mode.

Step 2

vsm(config)# encapsulation profile segment name

Creates an encapsulation profile to contain the VLAN-to-VXLAN mappings.

Step 3

vsm(config-vxlan-encap-prof)# dot1q VLAN-ID bridge-domain bd-name

Maps a VLAN to a VXLAN. The VXLAN is specified through the bridge-domain name.

Note:
The bridge-domain name and VLAN ID that you provide are not created during the port-profile configuration. The bridge-domain name and the VLAN ID that you provide should be in an active state or the mapping is held in an inactive state until you create the bridge-domain name and VLAN ID.

Note:
Repeat this step to specify additional mappings.

Note:   To remove a mapping, use the no form of this command.

Step 4

vsm(config-vxlan-encap-prof)# exit

Exits the current configuration mode.

Step 5

vsm(config)# port-profile port-profile-name

Specifies the name of the port-profile applied to the VXLAN Gateway uplink interface.

Step 6

vsm(config-port-prof)# service instance 1 to 4096

Defines a place holder for mappings. The range is from 1 to 4096.

Note:
Port profiles that contain the service instance keyword cannot be used for a non-VXLAN gateway module.

Step 7

vsm(config-port-prof-srv)# encapsulation profile name

Assigns the specified encapsulation profile to the port profile.

Step 8

vsm(config-port-prof-srv)# copy running-config startup-config

Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.

This example shows how to configure VXLAN-to-VLAN mappings on the VXLAN gateway:

vsm# configure terminal
vsm(config)# encapsulation profile segment mgmt_mappings
vsm(config-vxlan-encap-prof)# dot1q 1555 bridge-domain vxlan6000
vsm(config-vxlan-encap-prof)# dot1q 1557 bridge-domain vxlan6002
vsm(config-vxlan-encap-prof)# dot1q 1558 bridge-domain vxlan6003
vsm(config-vxlan-encap-prof)# dot1q 1559 bridge-domain vxlan6004
vsm(config-vxlan-encap-prof)# exit
vsm(config)# port-profile Uplink-All-VXGW
vsm(config-port-prof)# service instance 2
vsm(config-port-prof)# encapsulation profile mgmt_mappings
vsm(config-prot-prof-srv)# copy running-config startup-config

vsm(config)# show run port-profile Uplink-All-VXGW
port-profile type ethernet Uplink-All-VXGW
switchport mode trunk
switchport trunk allowed vlan 1545-1575,1577-1605
mtu 1550
service instance 2
encapsulation dot1q 1555 bridge-domain vxlan6000
encapsulation dot1q 1557 bridge-domain vxlan6002
encapsulation dot1q 1558 bridge-domain vxlan6003
encapsulation dot1q 1559 bridge-domain vxlan6004
no shutdown
state enabled

vsm(config)# show port-profile usage
port-profile Uplink-All-VXGW
port-channel1
port-channel5
Ethernet7/1
Ethernet7/3

vsm(config)# show run interface ethernet 7/1 expand-port-profile
interface Ethernet7/1
switchport mode trunk
switchport trunk allowed vlan 1545-1575,1577-1605
mtu 1550
channel-group auto mode active
service instance 2
no shutdown
encapsulation dot1q 1557 bridge-domain vxlan6002
encapsulation dot1q 1555 bridge-domain vxlan6000
encapsulation dot1q 1558 bridge-domain vxlan6003
no shutdown

Appendix A. Sample Configuration File

This appendix contains the following section:

- Sample Configuration File

Sample Configuration File

<domain type='kvm' id='15'>
<name>vsm</name>
<uuid>85badf15-1234-4819-1234-8c3d50641375</uuid>
<memory unit='KiB'>4096000</memory>
<currentMemory unit='KiB'>4096000</currentMemory>
<vcpu placement='static'>2</vcpu>
<resource>
<partition>/machine</partition>
</resource>
<os>
<type arch='x86_64' machine='pc-i440fx-rhel7.0.0'>hvm</type>
<boot dev='cdrom'/>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='localtime'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/libexec/qemu-kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='raw'/>
<source file='/var/lib/libvirt/images/vsm.img />
<target dev='hda' bus='ide'/>
<alias name='ide0-0-0'/>
<address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source file='/opt/cisco/vsm/n1000v-dk9.5.2.1.SK1.3.0.78.iso’/>
<target dev='hdb' bus='ide'/>
<readonly/>
<alias name='ide0-0-1'/>
<address type='drive' controller='0' bus='0' target='0' unit='1'/>
</disk>
<controller type='usb' index='0'>
<alias name='usb0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<controller type='ide' index='0'>
<alias name='ide0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
</controller>
<controller type='pci' index='0' model='pci-root'>
<alias name='pci.0'/>
</controller>
<interface type='bridge'>
<mac address='0e:1f:1f:1f:45:2e'/>
<source bridge='vsm-br'/>
<virtualport type='openvswitch'>
<parameters interfaceid='14054688-1444-46db-b981-0aba3172b956'/>
</virtualport>
<target dev='vsm-vnet0'/>
<model type='e1000'/>
<alias name='net0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</interface>
<interface type='bridge'>
<mac address='0e:23:32:23:45:3e'/>
<source bridge='vsm-br'/>
<virtualport type='openvswitch'>
<parameters interfaceid='f888e6e2-51c0-4e78-a3d9-6633f0acaf55'/>
</virtualport>
<target dev='vsm-vnet1'/>
<model type='e1000'/>
<alias name='net1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</interface>
<interface type='bridge'>
<mac address='0e:1f:cd:cd:45:4e'/>
<source bridge='vsm-br'/>
<virtualport type='openvswitch'>
<parameters interfaceid='d8346acc-f13c-4814-b874-37083a6582b1'/>
</virtualport>
<target dev='vsm-vnet2'/>
<model type='e1000'/>
<alias name='net2'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</interface>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='5906' autoport='yes' listen='0.0.0.0' keymap='en-us'>
<listen type='address' address='0.0.0.0'/>
</graphics>
<video>
<model type='cirrus' vram='9216' heads='1'/>
<alias name='video0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
</video>
<memballoon model='virtio'>
<alias name='balloon0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</memballoon>
</devices>
<seclabel type='none' model='selinux'/>
</domain>