Network Segmentation Manager has the following prerequisites:
You have installed the Cisco Nexus 1000V software and configured the following using the Cisco Nexus 1000V Installation and Upgrade Guide
You have a vCenter Server configured in vCloud Director and vShield Manager.
See the Cisco Nexus 1000V and VMware Compatibility Information for information on the version
compatibility of
the vCloud Director and vShield Manager for Cisco Nexus 1000V.
You have associated a vShield Manager with every vCenter Server.
You have created an organization in vCloud Director.
You have created provider and organization vDC in vCloud Director.
Ensure that Virtual Supervisor Module (VSM) has an active SVS connection.
Ensure that Virtual Supervisor Module (VSM)- Virtual Ethernet Module (VEM) connectivity is functioning.
You have added hosts to Cisco Nexus 1000V.
Ensure that the user specified for NSM on vShield Manager is a network administrator.
Guidelines and Limitations
Network Segmentation feature has the following configuration guidelines and limitations:
You must enable the VLANs that are going to be used through NSM and add them to the uplink.
Ensure that the infrastructure has port 443 open.
You must enable feature http-server on Cisco Nexus 1000V in order to allow web service communication.
You must enable the segmentation feature in order to use NSM for Virtual Extensible Local Area Network (VXLAN) via vCloud Director. In a network segmentation policy, VXLAN is used for a segmentation policy. See the Cisco Nexus 1000V VXLAN Configuration Guide.
Default Settings
Parameters
Default
VLAN policy (port-profile template)
default_vlan_template
segmentation policy (port-profile template)
default_segmentation_template
The default port-profiles default_vlan_template and default_segmentation_template are created automatically.
Note
If a network creation request comes with a tenant ID and backing type that does not match a network segmentation policy, the default_vlan_template or default_segmentation_template is used during network creation from vCloud Director. For more information, see the Cisco Nexus 1000V VXLAN Configuration Guide. See the Cisco Nexus 1000V and VMware Compatibility Information for information on the supported network pool in vCloud Director with
Cisco Nexus 1000V.
Configuring the Network Segmentation Manager
The following section guides you through the NSM configuration process shown in the following figure. After completing each procedure, return to this section to make sure that you have completed all required procedures in the correct sequence.
When you enable the NSM feature, the default port profiles are created automatically. This step is not required if you use the default port-profiles (default_vlan_template and default_segmentation_template).
When you enable the NSM feature, the default network segmentation policies are created automatically. This step is required only if the port profiles created in the previous step need to be inherited to the network segmentation policies for specific tenant IDs.
Creating a Port Profile for Network Segmentation Policies
You can create a port profile to use features of Cisco Nexus 1000V for network segmentation policies.
Before You Begin
You must be logged in to the CLI in EXEC mode.
The VSM must be connected to vCenter Server.
The NSM feature is enabled.
Procedure
Command or Action
Purpose
Step 1
switch# configure terminal
Enters global configuration mode.
Step 2
switch(config)# port-profile [ type vethernet ]name
Enters port profile configuration mode for the named port profile.
Step 3
switch(config-port-prof)# no shutdown
Administratively enables all ports in the profile.
Step 4
switch(config-port-prof)# state enabled
Enables the port profile and applies its configuration to the assigned ports.
Step 5
switch(config-port-prof)# show running-config port-profile
(Optional)
Displays the configuration for verification.
This example shows how to create a segmentation type port profile and display the output:
switch# configure terminal
switch(config)# port-profile type vethernet ABC_profile_segmentation
switch(config-port-prof)# no shutdown
switch(config-port-prof)# state enabled
switch(config-port-prof)# show running-config port-profile ABC_profile_segmentation
!Command: show running-config port-profile ABC_profile_segmentation
!Time: Thu Dec 1 19:58:44 2011
version 4.2(1)SV1(5.1)
port-profile type vethernet ABC_profile_segmentation
no shutdown
state enabled
switch(config-port-prof)#
Creating Network Segmentation Policies
Network segmentation policies are a set of policies that inherit customized port profiles. The policy type can be either VLAN or Segmentation. This policy type corresponds to the network pool type in the vCloud Director. VLAN network segmentation policies are used for networks created from VLAN-backed network pools. Segmentation network segmentation policies are used for networks created from network isolation-backed network pools in the vCloud Director 1.5 and VXLAN-backed network pools in the vCloud Director 5.1.
The network segmentation policies also contains a tenant ID and a reference to a port profile that may contain other policies for Cisco Nexus 1000V features. Each tenant ID is unique and can be associated with only one Segmentation and one VLAN network segmentation policy. The tenant ID correlates to the Organization Universally Unique Identifier (UUID) in the vCloud Director. For more information on retrieving the organization UUID from VMware vCloud Director, see 2012943.
Note
If a network segmentation policy with a tenant ID is not created, the default_vlan_template or default_segmentation_template is used during network creation from vCloud Director. For more information, see the Cisco Nexus 1000V VXLAN Configuration Guide. See the Cisco Nexus 1000V and VMware Compatibility Information for information on the supported network pool in vCloud Director with
Cisco Nexus 1000V.
Before You Begin
You are logged in to the CLI in EXEC mode.
The NSM feature is enabled.
You know the tenant IDs for tenants that require non default network segmentation policies. The tenant IDs for network segment policies can be found on vCloud Director. It is located in the address bar of the browser when viewing an organization.
In the following example, https://[VCloud_director_IP]/cloud/#/vAppListPage?org=91e87e80-e18b-460f-a761-b978c0d28aea
the tenant ID is "91e87e80-e18b-460f-a761-b978c0d28aea"
Adds a description of up to 80 ASCII characters to the policy.
Step 4
switch(config-network-segment-policy)# type { segmentation | VLAN }
Defines the network segmentation policy type. The policy type can be Segmentation or VLAN. For segmentation policy, VXLAN is used. For more information, see the Cisco Nexus 1000V VXLAN Configuration Guide .
The policy type corresponds to the network pools (VLAN-backed or network isolation-backed) in the vCloud Director.
Once configured, the type cannot be changed.
Step 5
switch(config-network-segment-policy)# id {vCloud Director Organization tenant-id }
Associates the network segmentation policy with the tenant ID. The tenant ID correlates to the Organization UUID in the vCloud Director and cannot be changed once it is configured.
Associates the port profile with the network segmentation policy. Each network created that uses this network segmentation policy will inherit the associated port profile.
Step 7
switch(config-network-segment-policy)# show running-config network-segment policy
(Optional)
Displays the network segmentation policy configuration.
This example shows how to create a NSM policy for ABC Inc. for VXLAN networks.
switch# configure terminal
switch(config)# network-segment policy abc-policy-vxlan
switch(config-network-segment-policy)# description network segmentation policy for ABC for
VXLAN networks
switch(config-network-segment-policy)# type segmentation
switch(config-network-segment-policy)# id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
switch(config-network-segment-policy)# import port-profile ABC_profile_segmentation
switch(config-network-segment-policy)# show running-config network-segment policy abc-policy-vxlan
!Command: show running-config network-segment policy abc-policy-vxlan
!Time: Fri Aug 26 18:34:50 2011
version 4.2(1)SV1(5.1)
feature network-segmentation-manager
network-segment policy abc-policy-vxlan
description network segmentation policy for ABC for VXLAN networks
id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
type segmentation
import port-profile port-profile ABC_profile_segmentation
switch(config-network-segment-policy)#
This example shows how to create a NSM policy for ABC Inc. for VLAN networks:
switch# configure terminal
switch(config)# network-segment policy abc-policy-vlan
switch(config-network-segment-policy)# description network segmentation policy for ABC for
VLAN networks
switch(config-network-segment-policy)# type vlan
switch(config-network-segment-policy)# id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
switch(config-network-segment-policy)# import port-profile ABC_profile_vlan
switch(config-network-segment-policy)#
Note
As a best practice, if a tenant specific policy is defined through network segmentation policies, you should define it for both segmentation and VLAN types.
Registering vShield Manager with Network Segmentation Manager
Before You Begin
You are logged in to vShield Manager.
You are logged in to vShield Manager.
The vShield Manager is connected to vCenter Server.
The NSM feature is enabled.
You know the range of multicast addresses.
You know the segment ID pool.
Ensure that the segment ID range allocated to vShield Manager does not overlap with other instances in the network or VXLANs used on the Cisco Nexus 1000V.
Ensure that the user specified for NSM on vShield Manager is a network administrator.
Procedure
Step 1
Verify the vShield Manager version.
In vShield Manger 5.0.1 or 5.0.2, perform the following steps:
In the Settings and Report pane, click Configuration.
Click Networking. The Edit Settings window opens.
Enter the segment ID pool. The segment ID pool should be greater than 5000.
Enter the multicast address range.
Click Ok.
In vShield Manger 5.1, perform the following steps:
In the Settings and Report pane, click Configuration.
Click Networking. The Edit Settings window opens.
Enter the segment ID pool. The segment ID pool should be greater than 5000.
Enter the multicast address range.
Click Ok.
Step 2
In the vShield Manager, navigate to the External Switch Providers window.
Step 3
Enter the name of the switch.
Step 4
Enter the NSM API service URL (https://Cisco-VSM-IP-Address/n1k/services/NSM).
Step 5
Enter the network administrator username and password.
Step 6
Accept the network SSL thumbprint.
Step 7
In the External Switch Providers window, a green check mark in the Status solumn indicates that the connection between vShield Manager and NSM is established.
Step 8
You can verify the registration of the vShield Manager with NSM by entering the following command on the Cisco Nexus 1000V CLI:
Example:
switch# show network-segment manager switch
switch: default_switch
state: enabled
dvs-uuid: d4 e7 12 50 89 db 3b c4-8d 4d 4c 36 ca 1c d1 f0
dvs-name: nexus1000v
mgmt-srv-uuid: 087F202C-8937-4F1E-8676-6F714C1AB96C
reg status: registered
last alert: 30 seconds ago
connection status: connected
switch#
Unregistering vShield Manager with Network Segmentation Manager
Before You Begin
You are logged in to vShield Manager.
The vShield Manager is registered with NSM
Procedure
Step 1
In the vShield Manager, navigate to the Settings and Report window.
Step 2
In the Settings and Reports pane, click Configuration.
Step 3
Click Networking. The Edit Settings window opens.
Step 4
In the External Switch Providers pane, click the Delete link for the switch that you wish to unregister.
Step 5
You can verify that the vShield Manager has been unregistered by enetering the following command on the Cisco Nexus 1000V CLI:
Create port profiles for segmentation and VLAN policies.
Example:
switch# configure terminal
switch(config)# port-profile type vethernet ABC_profile_segmentation
switch(config-port-prof)# no shutdown
switch(config-port-prof)# state enabled
switch# configure terminal
switch(config)# port-profile type vethernet ABC_profile_vlan
switch(config-port-prof)# no shutdown
switch(config-port-prof)# state enabled
switch(config-port-prof)#
Step 3
Create a NSM policy.
Example:
switch# configure terminal
switch(config)# network-segment policy abc-policy-vxlan
switch(config-network-segment-policy)# description network segmentation policy for ABC for
VXLAN networks
switch(config-network-segment-policy)# type segmentation
switch(config-network-segment-policy)# id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
switch(config-network-segment-policy)# import port-profile ABC_profile_segmentation
switch# configure terminal
switch(config)# network-segment policy abc-policy-vlan
switch(config-network-segment-policy)# description network segmentation policy for ABC for
VLAN networks
switch(config-network-segment-policy)# type vlan
switch(config-network-segment-policy)# id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
switch(config-network-segment-policy)# import port-profile ABC_profile_vlan
switch(config-network-segment-policy)#
Step 4
Verify the configuration.
Example:
switch# configure terminal
switch(config)# show running-config network-segment policy abc-policy-vxlan
!Command: show running-config network-segment policy abc-policy-vxlan
!Time: Fri Aug 26 18:34:50 2011
version 4.2(1)SV1(5.1)
feature network-segmentation-manager
network-segment policy abc-policy-vxlan
description network segmentation policy for ABC for VXLAN networks
id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
type segmentation
import port-profile port-profile ABC_profile_segmentation
switch(config)#
Changing a Port Profile Associated with a Network Segmentation Policy
During a network creation in the vCloud Director, network segmentation policies are created on the NSM and these network segmentation policies are inherited on a port profile. In order to associate a different port profile with the deployed network, you can change the port profile associated with the network segmentation policy.
To change the port profile associated with the network segmentation policy perform the following steps:
Manually remove the inheritance for the existing port profile. See section "Removing Inherited Policies from a Port Profile" in the Cisco Nexus 1000V Port Profile Configuration Guide for more information.
Step 3
Manually inherit the new port profile that will be associated with the network segmentation policy. See section "Inheriting a Configuration from a Port Profile" in the Cisco Nexus 1000V Port Profile Configuration Guide for more information.
Forces the new port profile to be used and migrates existing the networks to the new port profile. Each network created that uses this network segmentation policy will inherit the associated port profile.
Note
The force option overrides any checks in the NSM that prevent you from modifying the port profile. After updating the network segmentation policy, a warning is displayed listing any networks that are not inheriting the new port profile.
Step 4
switch(config-network-segment-policy)# show running-config network-segment
(Optional)
Displays the network segmentation policy configuration.
This example shows how to update the network segmentation policy:
switch# configure terminal
switch(config)# show running-config network-segment policy abc-policy-vxlan
network-segment policy abc-policy-vxlan
description network segmentation policy for ABC for VXLAN networks
type segmentation
id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
import port-profile ABC_profile_segmentation
switch(config)# network-segment policy abc-policy-vxlan
switch(config-network-segment-policy)# import port-profile ABC_profile_segmentation_new
force
switch(config)# show running-config network-segment policy abc-policy-vxlan
network-segment policy abc-policy-vxlan
description network segmentation policy for ABC for VXLAN networks
type segmentation
id f5dcf127-cdb0-4bdd-8df5-9515d6dc8170
import port-profile ABC_profile_segmentation_new
switch#
Changing the Network Segmentation Policy Associated with a Network
During a network creation in the vCloud Director, network segmentation policies are created on the NSM. In order to use other non default policies for any new or old networks associated with an Organization vDC in the vCloud Director, you must change the network segmentation policy associated with a network.
To change the network segmentation policy associated with a network, perform the following steps:
Manually remove the inheritance of the port profile associated with the network segmentation policy from the network. See section "Removing Inherited Policies from a Port Profile" in the Cisco Nexus 1000V Port Profile Configuration Guide for more information.
Step 3
Manually inherit the new port profile that will be associated with the network segmentation policy on the network. See section "Inheriting a Configuration from a Port Profile" in the Cisco Nexus 1000V Port Profile Configuration Guide for more information.
Migrates the the networks from the default network segmentation policy to the nondefault destination network segmentation policy.
isolation_id: Tenant ID of for the networks to be migrated.
nw_type: Type of networks (VLAN or Segmentation) to be migrated
policy: Name of the destination network segmentation policy to migrate to.
Note
If there are any existing networks that match the tenant ID and type, but are not inheriting the port profile associated with the destination network segmentation policy, a warning will be displayed listing the port-profiles that are not migrated.
Step 3
switch(config)# show network-segment network
(Optional)
Displays the networks associated with a network segmentation policy.
This example shows how to migrate networks to the non default segmentation policy:
switch(config)# show network-segment network
network dvs.VCDVStenantid_vlan-74e36255-e588-4357-8abe-15d2cc7feaec
tenant id: da5c49a8-dd1b-4326-9da0-3c5e6a2c1b87
network-segment policy: default_segmentation_template
segment id: 4107
multicast ip: 225.0.0.1
switch(config)# network-segment policy migrate id da5c49a8-dd1b-4326-9da0-3c5e6a2c1b87
type segmentation dest-policy org_seg
switch(config)#
Note
In case a warning appears then, first manually remove the inheritance of the port profile associated with the network segmentation policy from the network. Then, manually inherit the new port profile that will be associated with the network segmentation policy on the network. See the Cisco Nexus 1000V Port Profile Configuration Guide for more information.