Table Of Contents
Virtualization Configuration Quick Start
Creating a Resource Class for Resource Management
Allocating Resources within a Resource Class
Changing the Resource Allocation of a Resource Class
Configuring a Context Description
Configuring a VLAN for a Context
Associating a Context with a Resource Class
Changing the Resource Class of a Context
Creating and Configuring User Roles
Creating and Configuring Domains
Example of a Virtualization Configuration
Configuring Virtualization
This chapter describes how to create and configure virtualization for your ACE. As the global administrator (SuperUser), you configure and manage all contexts through the Admin context, which contains the basic settings for each virtual device or context. Each context that you configure contains its own set of policies, interfaces, resources, and administrators.
This chapter contains the following major sections:
•
Virtualization Configuration Quick Start
•
•
•
Note
Virtualization Configuration Quick Start
Table 2-1 provides a quick overview of the steps required to create and configure the virtualization feature. Each step includes the command-line interface (CLI) command required to complete the task.
Managing ACE Resources
You can allocate system resources to multiple contexts by creating and defining one or more resource classes and then associating the contexts with a resource class. The section contains the following topics:
•
•
•
Creating a Resource Class for Resource Management
You can create a resource class to allocate and manage system resources by one or more contexts. The ACE supports a maximum of 100 resource classes. After you create and configure the resource class, use the member command in context configuration mode to assign a resource class to the context (see the "Associating a Context with a Resource Class" section). To create a resource class, use the resource-class command in configuration mode. The syntax of the command is as follows:
resource-class name
For the name argument, enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/Admin(config)# resource-class RC1host1/Admin(config-resource)To remove the resource class from the configuration, enter:
host1/Admin(config)# no resource-class RC1When you remove a resource class from the ACE, any contexts that were members of that resource class automatically become members of the default resource class. The default resource class allocates a minimum of 0.00 percent to a maximum of 100.00 percent of all ACE resources to each context. You cannot modify the default resource class.
Allocating Resources within a Resource Class
When you plan the initial resource allocations for the virtual contexts in your configuration, allocate only the minimum required or estimated resources. The ACE protects resources that are in use, so to decrease a context's resources, those resources must be unused. Although it is possible to decrease the resource allocations in real time, it may require additional management overhead to clear any used resources before reducing them. Therefore, it is considered a best practice to initially keep as many resources in reserve as possible and allocate the unused reserved resources as needed.
To address scaling and capacity planning, we recommend that new ACE installations do not exceed 60 to 80 percent of the module's total capacity. To accomplish this goal, create a reserved resource class with a guarantee of 20 to 40 percent of all the ACE resources and configure a virtual context dedicated solely to ensuring that these resources are reserved. Then, you can efficiently distribute such reserved resources to contexts as capacity demands for handling client traffic increase over time.
You can allocate all resources or individual resources to all member contexts of a resource class. For example, you can allocate only concurrent connections or sticky table memory or management traffic, to name a few. To allocate system resources to all members (contexts) of a resource class, use the limit-resource command in resource-class configuration mode.
The syntax of this command is as follows:
limit-resource {acl-memory | all | buffer {syslog} | conc-connections | mgmt-connections | proxy-connections | rate {bandwidth | connections | inspect-conn | mac-miss | mgmt-traffic | ssl-bandwidth | syslog} | regexp | sticky | xlates} {minimum number} {maximum {equal-to-min | unlimited}}
The arguments and keywords are as follows:
•
•
•
•
•
•
•
–
When you configure a minimum bandwidth value for a resource class in the ACE, the ACE subtracts that configured value from the total bandwidth maximum value of all contexts in the ACE, regardless of the resource class with which they are associated. The total bandwidth rate of a context consists of the following two components:
throughput—Limits through-the-ACE traffic. This is a derived value (you cannot configure it directly) and it is equal to the bandwidth rate minus the mgmt-traffic rate for the 4-Gbps and 8-Gbps licenses. With a 16-Gbps license, this value is calculated slightly differently. For details, see the examples of the show resource-usage command output below.
mgmt-traffic—Limits management (to-the-ACE) traffic in bytes per second. This parameter is independent of the limit-resource all minimum command. To guarantee a minimum amount of management traffic bandwidth, you must explicitly allocate a minimum percentage to management traffic using the limit-resource rate mgmt-traffic minimum command. When you allocate a minimum percentage of bandwidth to management traffic, the ACE subtracts that value from the maximum available management traffic bandwidth for all contexts in the ACE. By default, management traffic is guaranteed a minimum bandwidth rate of 0 and a maximum bandwidth rate of 1 Gbps, regardless of which bandwidth license that you install in the ACE.
For details about how the ACE manages bandwidth for throughput and management traffic rates, see the examples of the show resource-usage command output that follow. For each bandwidth license, there are examples for the default values, 25 percent minimum allocation to all resources, and both a 25 percent minimum allocation to all resources and a 10 percent minimum allocation to management traffic. The output has been modified to show only the relevant fields. All values are in bytes per second; to convert to bits per second, multiply each value by 8.
switch/Admin# show resource usageExample 2-1 Default Show Resource Usage Command Output for 4-Gbps License
Example 2-2 Show Resource Usage Command Output for 4-Gbps License with 25 Percent Minimum Allocation for All Resources (continued)
Example 2-3 Show Resource Usage Command Output for 4-Gbps License with 25 Percent Minimum Allocation for All Resources and 10 Percent Minimum Allocation for Management Traffic
Example 2-4 Default Show Resource Usage Command Output for 8-Gbps License
Example 2-5 Show Resource Usage Command Output for 8-Gbps License with 25 Percent Minimum Allocation for All Resources
Example 2-6 Show Resource Usage Command Output for 8-Gbps License with 25 Percent Minimum Allocation for All Resources and 10 Percent Minimum Allocation for Management Traffic
Example 2-7 Default Show Resource Usage Command Output for 16-Gbps License
Example 2-8 Show Resource Usage Command Output for 16-Gbps License with 25 Percent Minimum Allocation for All Resources
Example 2-9 Show Resource Usage Command Output for 16-Gbps License with 25 Percent Minimum Allocation for All Resources and 10 Percent Minimum Allocation for Management Traffic
–
–
–
–
–
•
•
•
•
Example 2-10 Show Resource Usage Command Output for 4-Gbps License with 25 Percent Minimum Allocation for Bandwidth (continued)
All other contexts in the ACE would have the same maximum values as shown in Example 2-10, but would have zero minimum values. Compare the values in Example 2-10 with the values in Example 2-2, which represents one context in a resource class.
•
Note
If you lower the limits for one context (context A) in order to increase the limits of another context (context B), you may experience a delay in the configuration change because the ACE will not lower the limits of context A until the resources are no longer being used by the context.
For example, to allocate 20 percent of all resources (minimum and maximum) to all member contexts of the resource class, enter:
(config-resource)# limit-resource all minimum 20% maximum equal-to-minTo restore resource allocation to the default values of 0 percent minimum and 100 percent maximum for all resources to all member contexts, enter:
(config-resource)# no limit-resource allTable 2-2 lists the managed system resources of the ACE. You can limit these resources per context or for all contexts associated with the resource class by using the limit-resource command. See the "Allocating Resources within a Resource Class" section.
Changing the Resource Allocation of a Resource Class
If you (as the global Admin) need to change the resource allocation in a resource class of which two or more user contexts are members, you may do so at any time by entering the appropriate CLI commands. (For details about allocating resources, see the "Allocating Resources within a Resource Class" section.) However, the shift in resources between the contexts does not take place immediately unless the appropriate resources are available to accommodate the change. In most cases, to effect a change in resource allocation, you must inform the context administrators involved to ensure that the new resource allocation is possible.
For example, suppose that context A is using 100 percent of the available resources of the class and you want to allocate 50 percent of the resources to context A and 50 percent of the resources to context B. Although the CLI accepts your resource allocation commands, context B cannot allocate 50 percent of the resources until context A deallocates 50 percent of its resources.
In this case, you must perform the following:
•
•
Note
Configuring a Context
A context provides a user view into the ACE and determines the resources available to a user. This section contains the following topics:
•
•
•
•
Creating a Context
To create a context, use the context command in configuration mode. The syntax of this command is as follows:
context name
The name argument is a unique identifier of the context. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create a context called C1, enter:
host1/Admin(config)# context C1host1/Admin(config-context)#To remove the context from the configuration, enter:
host1/Admin(config)# no context C1Configuring a Context Description
You can enter a description for the context by using the description command in context configuration mode. The syntax of this command is as follows:
description text
For the text argument, enter a description as an unquoted text string with a maximum of 240 alphanumeric characters.
For example, enter:
host1/Admin(config-context)# description context for accounting usersTo remove the context description from the configuration, enter:
host1/Admin(config-context)# no descriptionConfiguring a VLAN for a Context
The ACE uses class maps and policy maps to classify (filter) traffic and direct it to different interfaces (VLANs) using a service policy. A context uses VLANs to receive packets classified for that VLAN. To allocate one or more existing VLANs on which a user context can receive packets, use the allocate-interface command in context configuration mode in the Admin context. You can enter this command multiple times to specify multiple VLANs for a user context.
Note
The syntax of this command is as follows:
allocate-interface vlan number1
For the number argument, enter the number of an existing VLAN or a range of VLANs that you want to assign to the context as integers from 2 to 4094.
Note
For example, to allocate VLAN 100 to a context, enter:
host1/Admin(config-context)# allocate-interface vlan 100To allocate an inclusive range of VLANs from VLAN 100 through VLAN 200 to a context, enter:
host1/Admin(config-context)# allocate-interface vlan 100-200To deallocate a VLAN from a context, enter:
host1/Admin(config-context)# no allocate-interface vlan 100To deallocate a range of VLANs from a context, enter:
host1/Admin(config-context)# no allocate-interface vlan 100-200
Note
Associating a Context with a Resource Class
Resource classes limit the resources available to one or more contexts. If you do not specify a resource class, the context automatically is a member of the default resource class. The default resource class allocates a minimum of 0.00 percent to a maximum of 100.00 percent of all ACE resources to each context. You can associate a context with only one resource class. For more information about resource classes, see the "Creating a Resource Class for Resource Management" section. To associate a context with a resource class, use the member command in context configuration mode.
The syntax of this command is as follows:
member class
For the class argument, enter the name of an existing resource class as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. For information about configuring a resource class, see the "Creating a Resource Class for Resource Management" section.
For example, to associate a context with the RC1 resource class, enter:
host1/Admin(config-context)# member RC1To disassociate a context from the RC1 resource class, enter:
host1/Admin(config-context)# no member RC1Changing the Resource Class of a Context
To remove a context from a resource class, use the no member command in context configuration mode (see the "Associating a Context with a Resource Class" section). When you remove a context from a resource class, the ACE releases all resources associated with that context and makes the resources available to other contexts in the class.
To associate the same context with a different resource class, use the member command in context configuration mode (see the "Associating a Context with a Resource Class" section). When you add a context to a resource class, the ACE adds only those resources that can remain within their configured limits. If you want to allocate additional resources to the context, you can do so if the resources are available. Otherwise, you must first release some resources from other contexts within the resource class. For details about modifying the resource allocation among contexts, see the "Changing the Resource Allocation of a Resource Class" section.
Moving Between Contexts
You can move between contexts by using the changeto command in Exec mode or the do changeto command in configuration mode. You must have one of the predefined user roles in the Admin context to use the changeto command. For information about the predefined user roles, see the "Role-Based Access Control" section in Chapter 1, Overview. Context administrators, who have access to multiple contexts, must explicitly log in to the other contexts to which they have access.
Note the following operating considerations when moving between contexts:
•
•
–
–
The syntax of this command is as follows:
changeto name
The name argument specifies the identifier of an existing context. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/Admin# changeto C1host1/C1#Creating and Configuring User Roles
User roles determine the privileges that a user has, the commands that a user can enter, and the actions that a user can perform in a particular context. For a list of the predefined roles that the ACE provides, see Chapter 1, Overview. To display the predefined roles in the CLI, enter the show role command in Exec mode. The global administrator or a context administrator can configure additional roles. You can apply the roles that you create only in the context in which you create them.
To configure roles, use the role command in configuration mode. The syntax of this command is as follows:
role name
The name argument is an identifier associated with a role. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
If you do not assign a role to a new user, the default role is Network-Monitor. For users that you create in the Admin context, the default scope of access is the entire device. For users that you create in other contexts, the default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair using the username command (see the "Configuring a User" section).
For example, enter:
host1/C1(config)# role TECHNICIANhost1/C1(config-role)#To remove the role from the configuration, enter:
host1/C1(config)# no role TECHNICIANAfter you create a user role, you can limit the features that a user has access to and the commands the user can enter for that feature by configuring rules for that role. To assign privileges per feature to a role, use the rule command in role configuration mode.
The syntax of this command is as follows:
rule number {permit | deny} {create | modify | debug | monitor} [feature {AAA | access-list | config-copy | connection | dhcp | fault-tolerant | inspect | interface | loadbalance | nat | pki | probe | real-inservice | routing | rserver | serverfarm | ssl | sticky | syslog | vip}]
The keywords, arguments, and options are as follows:
•
•
•
•
•
•
•
•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
For example, to configure a rule that allows a role to create and configure real servers, enter:
host1/C1(config-role)# rule 1 permit create rserverTo remove the rule from a role, enter:
host1/C1(config-role)# no rule 1 permit create rserverCreating and Configuring Domains
A domain is the namespace in which a user operates. When you create a context, the ACE automatically creates a default domain (default-domain) for that context. You can configure a maximum of 63 additional domains in each context. For information about configuring a context, see the "Configuring a Context" section. To create a domain, use the domain command in configuration mode. The syntax of this command is as follows:
domain name
For the name argument, enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create a domain called D1, enter:
host1/C1(config)# domain D1host1/C1(config-domain)#To remove a domain from the configuration, enter:
host1/C1(config)# no domain D1
Note
After you create a domain, you can associate configurable objects with that domain (for example, a real server, server farm, interface, and so on). To associate a configurable object with a domain, use the add-object command in domain configuration mode.
The syntax of this command is as follows:
add-object {access-list {ethertype | extended} | all | class-map | interface {bvi | vlan} | parameter-map | policy-map | probe | rserver | script | serverfarm | sticky} name
The keywords, arguments, and option are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
For example, to associate an interface called VLAN 10 with the domain, enter:
host1/C1(config-domain)# add-object interface vlan 10To remove the object from the domain, enter:
host1/C1(config-domain)# no add-object interface vlan 10Configuring a User
The ACE creates two default user accounts at startup: admin and www. The admin user is the global administrator and cannot be deleted. The ACE uses the www user account for the XML interface and cannot be deleted.
The global administrator (admin) assigns one user in each context as the context administrator. The context administrator can then log in to the context or contexts for which he or she is responsible and create additional users.
If you do not assign a role to a new user, the default role is Network-Monitor. For users that you create in the Admin context, their default scope of access is the entire device. For users that you create in other contexts, their default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair.
To create a user, use the username command in configuration mode. The syntax of this command is as follows:
username name1 [password [0 | 5] {password}] [expire date] [role name2 {domain name3 name4 . . . namen}]
The keywords, arguments, and options are as follows:
•
•
•
•
•
, . / = + - ^ @ ! % ~ # $ * ( )
Note that the ACE encrypts clear text passwords in the running-config.
Note
•
•
•
For example, enter:
host1/C1(config)# username USER1 password MYSECRET expire 2005-12-31 role TECHNICIAN domain D1 default-domainhost1/C1(config)# username USER2 password HERSECRET expire 2005-12-31 role Admin domain default-domain D2To delete a user from the configuration, enter:
host1/C1(config)# no username USER1Example of a Virtualization Configuration
The following running-configuration example shows a basic virtualization configuration with one user-defined context, one resource class, one domain, and one user.
resource-class RC1limit-resource rate syslog minimum 10.00 maximum equal-to-minlimit-resource acl-memory minimum 10.00 maximum unlimitedaccess-list ACL1 line 10 extended permit ip any anyrserver host RS1ip address 192.168.2.251inservicerserver host RS2ip address 192.168.2.252inserviceserverfarm host SF1rserver RS1inservicerserver RS2inservicedomain D1add-object access-list extended ACL1add-object rserver RS1add-object rserver RS2add-object serverfarm SF1role SLB-Admincontext C1allocate-interface vlan 100-200description accounting departmentmember RC1username JANE password 5 adropgijaeprgja9erjg2uWgtce1 role SLB-Admin domain D1
