Feedback
Table Of Contents
Virtualization Configuration Quick Start
Creating a Resource Class for Resource Management
Configuring a Context Description
Configuring a VLAN for a Context
Associating a Context with a Resource Class
Creating and Configuring User Roles
Creating and Configuring Domains
Example of a Virtualization Configuration
Configuring Virtualization
This chapter describes how to create and configure virtualization for your ACE. As the global administrator (SuperUser), you configure and manage all contexts through the Admin context, which contains the basic settings for each virtual device or context. Each context that you configure contains its own set of policies, interfaces, resources, and administrators.
This chapter contains the following major sections:
•
Virtualization Configuration Quick Start
•
•
•
•
Note
Virtualization Configuration Quick Start
Table 2-1 provides a quick overview of the steps required to create and configure the virtualization feature. Each step includes the command-line interface (CLI) command required to complete the task.
Creating a Resource Class for Resource Management
You can create a resource class to allocate and manage system resources by one or more contexts. The ACE supports a maximum of 100 resource classes. After you create and configure the resource class, use the member command in context configuration mode to assign a resource class to the context (see the "Associating a Context with a Resource Class" section). To create a resource class, use the resource-class command in configuration mode. The syntax of the command is as follows:
resource-class name
For the name argument, enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/Admin(config)# resource-class RC1host1/Admin(config-resource)To remove the resource class from the configuration, enter:
host1/Admin(config)# no resource-class RC1When you remove a resource class from the ACE, any contexts that were members of that resource class automatically become members of the default resource class. The default resource class allocates a minimum of 0.00 percent to a maximum of 100.00 percent of all ACE resources to each context. You cannot modify the default resource class.
Allocating Resources
When you plan the initial resource allocations for the virtual contexts in your configuration, allocate only the minimum required or estimated resources. The ACE protects resources that are in use, so to decrease a context's resources, those resources must be unused. Although it is possible to decrease the resource allocations in real time, it may require additional management overhead to clear any used resources before reducing them. Therefore, it is considered a best practice to initially keep as many resources in reserve as possible and allocate the unused reserved resources as needed.
To address scaling and capacity planning, we recommend that new ACE installations do not exceed 60 to 80 percent of the appliance's total capacity. To accomplish this goal, create a reserved resource class with a guarantee of 20 to 40 percent of all the ACE resources. Configure a virtual context dedicated solely to ensuring that these resources are reserved. Then, you can efficiently distribute such reserved resources to contexts as capacity demands for handling client traffic increase over time.
You can allocate all resources or individual resources to all member contexts of a resource class. For example, you can allocate only concurrent connections or sticky table memory. To allocate system resources to all members (contexts) of a resource class, use the limit-resource command in resource-class configuration mode. The syntax of this command is as follows:
limit-resource {acc-connections | acl-memory | all | buffer {syslog} | conc-connections | http-comp | mgmt-connections | proxy-connections | rate {bandwidth | connections | inspect-conn | mac-miss | mgmt-traffic | ssl-connections | syslog} | regexp | sticky | xlates} {minimum number} {maximum {equal-to-min | unlimited}}
The arguments and keywords are as follows:
•
•
•
•
•
•
•
•
•
–
–
–
–
–
–
–
Note
•
•
•
•
•
Note
If you lower the limits for one context (context A) in order to increase the limits of another context (context B), you may experience a delay in the configuration change because the ACE will not lower the limits of context A until the resources are no longer being used by the context.
For example, to allocate 20 percent of all resources (minimum and maximum) to all member contexts of the resource class, enter:
(config-resource)# limit-resource all minimum 20% maximum equal-to-minTo restore resource allocation to the default values of 0 percent minimum and 100 percent maximum for all resources to all member contexts, enter:
(config-resource)# no limit-resource allTable 2-2 lists the managed system resources of the ACE. You can limit these resources per context or for all contexts associated with the resource class by using the limit-resource command. See the "Allocating Resources" section.
Configuring a Context
A context provides a user view into the ACE and determines the resources available to a user. To create a context, use the context command in configuration mode. The syntax of this command is as follows:
context name
The name argument is a unique identifier of the context. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create a context called C1, enter:
host1/Admin(config)# context C1host1/Admin(config-context)#To remove the context from the configuration, enter:
host1/Admin(config)# no context C1Configuring a Context Description
You can enter a description for the context by using the description command in context configuration mode. The syntax of this command is as follows:
description text
For the text argument, enter a description as an unquoted text string with a maximum of 240 alphanumeric characters.
For example, enter:
host1/Admin(config-context)# description context for accounting usersTo remove the context description from the configuration, enter:
host1/Admin(config-context)# no descriptionConfiguring a VLAN for a Context
The ACE uses class maps and policy maps to classify (filter) traffic and direct it to different interfaces (VLANs) using a service policy. A context uses VLANs to receive packets classified for that VLAN. To allocate one or more existing VLANs on which a user context can receive packets, use the allocate-interface command in context configuration mode in the Admin context. You can enter this command multiple times to specify multiple VLANs for a user context.
Note
The syntax of this command is as follows:
allocate-interface vlan number1
For the number argument, enter the number of an existing VLAN or a range of VLANs that you want to assign to the context as integers from 2 to 4094.
For example, to allocate VLAN 100 to a context, enter:
host1/Admin(config-context)# allocate-interface vlan 100To allocate an inclusive range of VLANs from VLAN 100 through VLAN 200 to a context, enter:
host1/Admin(config-context)# allocate-interface vlan 100-200To deallocate a VLAN from a context, enter:
host1/Admin(config-context)# no allocate-interface vlan 100To deallocate a range of VLANs from a context, enter:
host1/Admin(config-context)# no allocate-interface vlan 100-200
Note
Associating a Context with a Resource Class
Resource classes limit the resources available to one or more contexts. If you do not specify a resource class, the context automatically is a member of the default resource class. The default resource class allocates a minimum of 0.00 percent to a maximum of 100.00 percent of all ACE resources to each context. You can associate a context with only one resource class. For more information about resource classes, see the "Creating a Resource Class for Resource Management" section. To associate a context with a resource class, use the member command in context configuration mode.
The syntax of this command is as follows:
member class
For the class argument, enter the name of an existing resource class as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. For information about configuring a resource class, see the "Creating a Resource Class for Resource Management" section.
For example, to associate a context with the resource class RC1, enter:
host1/Admin(config-context)# member RC1To disassociate a context from a resource class, enter:
host1/Admin(config-context)# no member RC1Moving Between Contexts
You can move between contexts by using the changeto command in Exec mode or the do changeto command in configuration modes. You must have one of the predefined user roles in the Admin context to use the changeto command. For information about the predefined user roles, see the "Role-Based Access Control" section in Chapter 1, Overview. Context administrators, who have access to multiple contexts, must explicitly log in to the other contexts to which they have access. The syntax of this command is as follows:
changeto name
The name argument specifies the identifier of an existing context. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/Admin# changeto C1host1/C1#Creating and Configuring User Roles
User roles determine the privileges that a user has, the commands that a user can enter, and the actions that a user can perform in a particular context. For a list of the predefined roles that the ACE provides, see Chapter 1, Overview. To display the predefined roles in the CLI, enter the show role command in Exec mode. The global administrator or a context administrator can configure additional roles. You can apply the roles that you create only in the context in which you create them.
To configure roles, use the role command in configuration mode. The syntax of this command is as follows:
role name
The name argument is an identifier associated with a role. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
If you do not assign a role to a new user, the default role is Network-Monitor. For users that you create in the Admin context, the default scope of access is the entire device. For users that you create in other contexts, the default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair using the username command (see the "Configuring a User" section).
For example, enter:
host1/C1(config)# role TECHNICIANhost1/C1(config-role)#To remove the role from the configuration, enter:
host1/C1(config)# no role TECHNICIANAfter you create a user role, you can limit the features that a user has access to and the commands the user can enter for that feature by configuring rules for that role. To assign privileges per feature to a role, use the rule command in role configuration mode. The syntax of this command is as follows:
rule number {permit | deny} {create | modify | debug | monitor} [feature {AAA | access-list | config-copy | connection | dhcp | fault-tolerant | inspect | interface | loadbalance | nat | pki | probe | real-inservice | routing | rserver | serverfarm | ssl | sticky | syslog | vip}]
The keywords, arguments, and options are as follows:
•
•
•
•
•
•
•
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
For example, to configure a rule that allows a role to create and configure real servers, enter:
host1/C1(config-role)# rule 1 permit create rserverTo remove the rule from a role, enter:
host1/C1(config-role)# no rule 1 permit create rserverCreating and Configuring Domains
A domain is the namespace in which a user operates. When you create a context, the ACE creates a default domain (default-domain) for that context. You can create a maximum of 63 additional domains in each context. For information about configuring a context, see the "Configuring a Context" section. To create a domain, use the domain command in configuration mode. The syntax of this command is as follows:
domain name
For the name argument, enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create a domain called D1, enter:
host1/C1(config)# domain D1host1/C1(config-domain)#To remove a domain from the configuration, enter:
host1/C1(config)# no domain D1
Note
After you create a domain, you can associate configurable objects with that domain (for example, a real server, server farm, interface, and so on). To associate a configurable object with a domain, use the add-object command in domain configuration mode.
The syntax of this command is as follows:
add-object {access-list {ethertype | extended} | all | class-map | interface {bvi | vlan} | parameter-map | policy-map | probe | rserver | script | serverfarm | sticky} name
The keywords, arguments, and option are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
For example, to associate an interface called VLAN 10 with the domain, enter:
host1/C1(config-domain)# add-object interface vlan 10To remove the object from the domain, enter:
host1/C1(config-domain)# no add-object interface vlan 10Configuring a User
The ACE creates the following default user accounts at startup: admin, dm, and www.
•
•
Note
•
The global administrator (admin) assigns one user in each context as the context administrator. The context administrator can then log in to the context or contexts for which he or she is responsible and create additional users.
If you do not assign a role to a new user, the default role is Network-Monitor. For users that you create in the Admin context, their default scope of access is the entire device. For users that you create in other contexts, their default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair.
To create a user, use the username command in configuration mode. The syntax of this command is as follows:
username name1 [password [0 | 5] {password}] [expire date] [role name2 {domain name3 name4. . . namen}]
The keywords, arguments, and options areas follows:
•
•
•
•
•
, . / = + - ^ @ ! % ~ # $ * ( )
Note that the ACE encrypts clear text passwords in the running-config.
•
•
•
For example, enter:
host1/C1(config)# username USER1 password MYSECRET expire 2005-12-31 role TECHNICIAN domain D1 default-domainhost1/C1(config)# username USER2 password HERSECRET expire 2005-12-31 role Admin domain default-domain D2To delete a user from the configuration, enter:
host1/C1(config)# no username USER1Example of a Virtualization Configuration
The following running-configuration example shows a basic virtualization configuration with one user-defined context, one resource class, one domain, and one user.
resource-class RC1limit-resource rate syslog minimum 10.00 maximum equal-to-minlimit-resource acl-memory minimum 10.00 maximum unlimitedaccess-list ACL1 line 10 extended permit ip any anyrserver host RS1ip address 192.168.2.251inservicerserver host RS2ip address 192.168.2.252inserviceserverfarm host SF1rserver RS1inservicerserver RS2inservicedomain D1add-object access-list extended ACL1add-object rserver RS1add-object rserver RS2add-object serverfarm SF1role SLB-Admincontext C1allocate-interface vlan 100-200description accounting departmentmember RC1username JANE password 5 adropgijaeprgja9erjg2uWgtce1 role SLB-Admin domain D1
