Creating an Intercloud Fabric Cloud

This chapter contains the following sections:

Information About Intercloud Fabric Cloud

An Intercloud Fabric cloud is a secure connection between a private cloud and a provider cloud. An Intercloud Fabric cloud includes two virtual gateways: one on the private cloud and one on the provider cloud. The gateway on the private cloud is referred to as the Intercloud Fabric Extender, and the gateway on the provider cloud is referred to as the Intercloud Fabric Switch. A secure Layer 4 tunnel connects the gateways, thereby extending the Layer 2 private cloud network into the provider cloud.

Guidelines and Limitations

  • For the cloud provider Microsoft Azure:

    • You must register the certificate with the Microsoft Azure portal.

    • Intercloud Fabric will create a storage account with a name starting with pnsc and a container below that storage account with the name pnsc-sc in the region where the Intercloud Fabric cloud is created. This storage account will be created during the first upload call and will be used for all further uploads to the Microsoft Azure cloud.

  • All port profiles required for deploying a virtual machine must be created using Intercloud Fabric.

  • All port profiles required for creating an Intercloud Fabric cloud must be created using Intercloud Fabric.

  • All port profiles required for creating Intercloud network policies must be created using Intercloud Fabric.

  • All port profiles required for the Intercloud Fabric Firewall data interface and management interface must be created using Intercloud Fabric.

  • All port profiles required for virtual machines that need firewall protection in the Intercloud Fabric must be updated using PNSC to add the vPath configuration.

  • While cloning an Intercloud Fabric cloud, you must not migrate the source virtual machine or the destination virtual machine. Doing so will impact the cloning operation and any operations carried out on the destination virtual machine after migration.

Prerequisites

  • You have created an account in the provider cloud.

  • You have the credentials for the cloud provider, such as an access key and access ID for Amazon AWS, and a username, password, and URI for other supported providers.

    • In the Amazon Web Services GUI, you can access the security credentials for Intercloud Fabric by navigating to Sign In > Security Credentials > Access Keys (Access Key ID and Secret Access Key). Click the Access Keys (Access Key ID and Secret Access Key) (+) icon to obtain the AWS access key ID. To create a new access key, click Create New Access Key. Download the key file to get the access key ID and secret access key. Optionally, click the Show Access Key link to see the access key ID and the secret access key.

    • For Microsoft Azure, see Accessing Security Credentials for Intercloud Fabric in Microsoft Azure.

    • For Cisco ICFPP-based providers, you will receive a welcome email from Cisco with information about the security credentials.

  • You have installed the Intercloud Fabric infrastructure components.

    See Installing Intercloud Fabric Infrastructure Components.

  • If you are using Cisco Nexus 1000V in the private cloud, you have added the Cisco Nexus 1000V switch to Intercloud Fabric.

    See Adding a Network Element.

  • For Cisco ICFPP-based providers, you have configured the cloud instance and tenant in Cisco ICFPP for use with Intercloud Fabric. See the Cisco Intercloud Fabric Provider Platform Installation Guide.

  • To integrate VCD with Cisco ICFPP, see the Configuring VMware vCloud Director for Cisco ICFPP chapter in the Cisco Intercloud Fabric Provider Platform Installation Guide.

Creating an Intercloud Fabric Cloud Workflow

Installing the Intercloud Fabric cloud includes the following steps:

Procedure
    Step 1   Create Intercloud Fabric infrastructure policies, profiles, and pools. Pools can include a management IP address pool for the Intercloud Fabric Extender, a tunnel IP address pool for the Intercloud Fabric Extender, a management IP pool for the Intercloud Fabric Switch, an interface IP address pool for services, and an IP address pool for VMs in the cloud.

    See Creating Intercloud Fabric Infrastructure Policies.

    Note   

    You can also create the Intercloud Fabric infrastructure policies when you create the Intercloud Fabric cloud using the wizard.

    Step 2   Create port profiles for the Distributed Virtual Switch (DVS) in the private cloud.

    See Configuring Port Profiles and Port Groups.

    Step 3   Create management and data port profiles for the Intercloud Fabric Virtual Security Gateway.

    See Creating Port Profiles for the Intercloud Fabric Firewall.

    Step 4   Create an Intercloud Fabric cloud using the wizard.

    See Creating an Intercloud Fabric Cloud.

    Creating Intercloud Fabric Infrastructure Policies and Pools

    Successful implementation of an Intercloud Fabric cloud depends on the correct configuration of the following items:

    Procedure
      Step 1   Configure MAC address pools.

      See Adding a MAC Address Pool.

      Step 2   Add private subnets.

      See Adding a Private Subnet.

      Step 3   Create an IP group.

      See Adding an IP Group.

      Step 4   Configure tunnel profiles.

      See Configuring a Tunnel Profile.

      Step 5   Create port profiles.

      See Creating Port Profiles.

      Adding a MAC Address Pool

      Add a MAC address pool to allocate a group of MAC addresses to a virtual private cloud.


      Note

      Ensure that there is no overlapping MAC address pool for multiple Intercloud Fabric setups.

      Procedure
        Step 1   Log in to Intercloud Fabric.
        Step 2   Choose Policies > Intercloud Fabric Infrastructure Policies.
        Step 3   In the Intercloud Fabric Infrastructure Policies window, click the MAC Pool tab.
        Step 4   Click Add to create a MAC pool.

        The Add MAC Pool window appears.

        Step 5   Complete the following details:
        Name Description

        MAC Pool Name

        The name of the MAC pool.

        Start MAC Address

        The starting MAC address for the pool in 12-digit hexadecimal format.

        Count

        The number of addresses in the pool. The range is from 1000 to 10,000 MAC addresses.

        Step 6   Click Submit to create a MAC address pool.

        Adding a Private Subnet

        Define a private subnet for a virtual machine in the cloud. A private subnet is used to define the private IP space in the provider environment.


        Note

        Private subnets apply only to Microsoft Azure.

        Procedure
          Step 1   Log in to Intercloud Fabric.
          Step 2   Choose Policies > Intercloud Fabric Infrastructure Policies.
          Step 3   In the Intercloud Fabric Infrastructure Policies window, click the Private Subnet tab.
          Step 4   Click Add.

          The Add Subnet window appears.

          Step 5   Complete the following details:
          Name Description

          Subnet Name

          The name of the private subnet.

          Subnet Address

          The IP address of the subnet.

          Step 6   Click Submit to create a private subnet.

          Adding an IP Group

          An IP group protects cloud resources by ensuring that only the ports required for Intercloud Fabric are open to the public interface of the cloud VMs in an Intercloud Fabric cloud. The allowed IP addresses are typically the enterprise public IP space.

          The following ports are required for Intercloud Fabric:

          • SSH port: TCP 22

          • HTTPS port: TCP 443

          • RDP port: TCP 3389

          • Intercloud Fabric tunnel ports: TCP 6644 and 6646

          • Intercloud Fabric tunnel ports: UDP 6644 and 6646

          • Intercloud Fabric Router (CSR) VPN tunnel ports: UDP and TCP 500, 4500


          Note
          Failure to configure an IP group could permit unauthorized access to your cloud VMs, Intercloud Fabric Switch, and enterprise data center.
          Procedure
            Step 1   Log in to Intercloud Fabric.
            Step 2   Choose Policies > Intercloud Fabric Infrastructure Policies.
            Step 3   In the Intercloud Fabric Infrastructure Policies window, click the IP Group tab.
            Step 4   Click Add.

            The Add IP Group window appears.

            Step 5   Complete the following details:
            Name Description

            IP Group Name

            The name of the IP group.

            IPv4 Range

            The IP address and prefix for the range of IP addresses to add to the IP group.

            Step 6   Click Submit to create the IP group.

            Configuring a Tunnel Profile

            A tunnel profile pairs a connection parameter policy with a key policy to ensure secure communication for specific tunnel ports. After you configure tunnel profiles, you can apply them to tunnels between the following elements:

            • Intercloud Fabric Extender and Intercloud Fabric Switch

            • Intercloud Fabric Switch and a cloud VM

            A site-to-site tunnel profile is used for tunnels between Intercloud Fabric Extender and Intercloud Fabric Switch. An access tunnel profile is used for tunnels between an Intercloud Fabric Switch and cloud VMs.

            Procedure
              Step 1   Log in to Intercloud Fabric.
              Step 2   Choose Policies > Intercloud Fabric Infrastructure Policies.
              Step 3   In the Intercloud Fabric Infrastructure Policies window, click the Tunnel Profile tab.
              Step 4   Click Add.

              The Add Tunnel Profile window appears.

              Step 5   Complete the following details:
              Name Description

              Tunnel Profile Name

              The name of the tunnel profile.

              Site to Site Tunnel Profile

              Complete the following details to create a site-to-site tunnel profile.

              Protocol

              Choose the protocol to use for the trunk port profile: TCP or UDP. The default protocol is UDP.

              Use HTTPS

              Check this check box to allow the TCP tunnel to use port 443.

              This option is only available if you choose TCP from the Protocol drop-down list.

              In this mode, the encryption algorithm AES-256-GCM is used and the hash algorithm SHA-384 is used.

              Rekey Period

              The trunk port profile's rekey period, which is the length of time (in days, hours, minutes, and seconds) that can elapse before a new key must be generated. The minimum value is five minutes. The default value of 00:00:00:00 indicates that rekeying does not occur.

              This option is not available if you choose TCP from the Protocol drop-down list and check the Use HTTPS check box.

              Encryption Algorithm

              Choose the encryption method for the trunk port profile:

              • AES-128-CBC (default)

              • AES-128-GCM (not available if TCP is used)

              • AES-256-CBC

              • AES-256-GCM (not available if TCP is used)

              • None (not available if TCP is used)

              This option is not available if you choose TCP from the Protocol drop-down list and check the Use HTTPS check box.

              Hash Algorithm

              Choose the hash algorithm for the trunk port profile:

              • SHA-1 (default)

              • SHA-256

              • SHA-384

              This option is available if you choose AES-128-CBC, AES-256-CBC, or None in the Encrypt Algorithm field.

              This option is not available if you choose TCP from the Protocol drop-down list and check the Use HTTPS check box.

              Access Tunnel Profile

              Complete the following details to create an access tunnel profile.

              Use Same as the Site to Site Tunnel Profile

              Check this check box to use the same configuration as the site-to-site tunnel profile.

              Protocol

              Choose the protocol to use for the access trunk port profile: TCP or UDP. The default protocol is UDP.

              Rekey Period

              The access trunk port profile's rekey period, which is the length of time (in days, hours, minutes, and seconds) that can elapse before a new key must be generated. The minimum value is five minutes. The default value of 00:00:00:00 indicates that rekeying does not occur.

              Encryption Algorithm

              Choose the encryption method for the access trunk port profile:

              • AES-128-CBC (default)

              • AES-128-GCM

              • AES-256-CBC

              • AES-256-GCM

              • None

              Hash Algorithm

              Choose the hash algorithm for the access trunk port profile:

              • SHA-1 (default)

              • SHA-256

              • SHA-384

              This option is available if you choose AES-128-CBC, AES-256-CBC, or None in the Encrypt Algorithm field.

              Keep Alive Duration

              The length of time, in minutes and seconds, that a connection can exist with no activity before a keep alive message is sent. The default value is one second.

              Timeout

              The length of time, in minutes and seconds, that a connection can remain idle before it closes. The default value is five minutes.

              Step 6   Click Submit to create a tunnel profile.

              Creating Port Profiles

              Use this procedure to create port profiles in Intercloud Fabric.

              Procedure
                Step 1   Log in to Intercloud Fabric.
                Step 2   Choose Intercloud > Network.
                Step 3   Select the cloud from the All Clouds drop-down list.
                Step 4   In the IcfVSM tab, select the VSM.
                Step 5   Click the Add Port Profile button.

                The Add Port Profile appears.

                Step 6   Complete the following fields for the port profile:
                Name Description

                Port Profile Name

                The name of the port profile.

                VLAN ID

                The VLAN ID of the port profile.

                Enable for Services

                Enables the port profile for services.

                Note   

                Do not select this option if you are creating a management or data port profile. This option applies only when enabling firewall services on a cloud VM.

                (Optional) Org

                Choose an existing org or create a new one. An org is a structure used to store IP binding information. You can enable IP binding learning on the Intercloud Fabric Switch (VEM) by using the org org_name command. When IP bindings are learned on a VEM, the information is synchronized with PNSC and the Intercloud Fabric Firewall.

                This field displays only if you check the Enable for Services check box.

                (Optional) New Org Name

                The name of the org.

                This field displays only if you check the Enable for Services check box.

                Step 7   Click Next.
                Step 8   View the port profiles in the Port Profile tab.

                Configuring Port Profiles and Port Groups

                This section contains information about the port profiles and port groups that must be associated with the vNICs of Intercloud Fabric and Intercloud Fabric Extender.

                If you are using Cisco Nexus 1000V to deploy the virtual machines, you must create the port profiles in the Cisco Nexus 1000V VSM. If you are using VMware vSwitch or VDS, you must create the port groups in the vCenter. See the Cisco Nexus 1000V Port Profile Configuration Guide for information about creating port profiles. See the VMware vSphere documentation for information about creating port groups.

                Intercloud Fabric Extender has the following three vNICs:

                • Tunnel vNIC: The tunnel vNIC is used to provide a secure tunnel between Intercloud Fabric Extender and Intercloud Fabric Switch. The use of this vNIC is optional. If used, it must be associated with the access port profile or port group that provides internet access to the service provider. You can also use a management vNIC to provide a secure tunnel between Intercloud Fabric Extender and Intercloud Fabric Switch. By default, the management vNIC is used to provide a secure tunnel connection to the Intercloud Fabric Switch. While creating an Intercloud Fabric cloud, you can use the tunnel vNIC for creating a secure tunnel by checking the Advanced check box in the Intercloud Fabric cloud set up wizard.

                • Management vNIC: The management vNIC is used to provide management access to the Intercloud Fabric Extender and connectivity to PNSC, Intercloud Fabric VSM, and enterprise servers such as DNS and NTP. It must be associated with the access port profile or port group that provides management access to the Intercloud Fabric Extender and connectivity to PNSC, the Intercloud Fabric VSM, and the enterprise servers. It can also be used to establish a secure tunnel connection to an Intercloud Fabric Switch in the service provider network. If you use the management vNIC to provide a secure tunnel for the Intercloud Fabric Switch, you must associate it with a port profile or port group that also provides internet access to the service provider and management access.

                • Enterprise Data Trunk vNIC: The enterprise data trunk vNIC is used as an uplink to send or receive traffic over the secure tunnel. It must be associated with the trunk port profile or port group. The trunk port profile must contain all VLANs that will be extended to the provider cloud. If you use a VMware vSwitch or VDS in the private cloud, you must enable promiscuous mode for the port group associated with the data trunk vNIC.

                You can create a common access port profile or port group for the Intercloud Fabric and Intercloud Fabric Extender management vNIC. If you use the tunnel vNIC instead of the management vNIC to provide a secure tunnel connection to the Intercloud Fabric Switch, you should create a separate access port profile or port group.


                Note

                The VLANs specified in the trunk port profile for internal tunnel trunk interfaces for the Intercloud Fabric Extender and Intercloud Fabric Switch should exist in the trunk port profile for the Intercloud Fabric Extender trunk interface.

                If you use a VMware vSwitch, you must configure a port group for the Intercloud Fabric Extender tunnel interface. This port group should allow all VLANs in trunk mode.

                Procedure
                  Step 1   If the Cisco Nexus 1000V is used in the private cloud and you want to create a management port profile, use this configuration example: 
                  port-profile type vethernet VLAN-36
  vmware port-group
  switchport mode access
  switchport access vlan 36
  no shutdown
  state enabled
                  Step 2   If the Cisco Nexus 1000V is used in the private cloud and you want to create a tunnel port profile, use this configuration example: 
                  port-profile type vethernet VLAN-37
  vmware port-group
  switchport mode access
  switchport access vlan 37
  no shutdown
  state enabled
                  Step 3   If the Cisco Nexus 1000V is used in the private cloud and you want to create a trunk port profile, use this configuration example: 
                  port-profile type vethernet Trunk
  vmware port-group
  switchport mode trunk
  switchport trunk allowed vlan 36-37,208,1300-1315
  no shutdown
  state enabled

                  Adding a Network Element

                  If you use a Cisco Nexus 1000V switch, you must add the Cisco Nexus 1000V switch to Intercloud Fabric before creating an Intercloud Fabric cloud. After the Cisco Nexus 1000V switch is added as a network element in Intercloud Fabric, it appears under the Managed Network Element tab.

                  Procedure
                    Step 1   Log in to Intercloud Fabric.
                    Step 2   Choose Administration > Managed elements.
                    Step 3   In the Managed Network Elements tab, click Add Network Element.
                    Step 4   In the Add Network Element dialog box, complete the following fields:
                    Name Description

                    Pod

                    Choose the pod to which the network element belongs.

                    Device Category

                    Choose Cisco Nexus 1000V as the device category.

                    Device IP

                    The IP address for the Cisco Nexus 1000V switch.

                    Protocol

                    Choose the protocol to be used. The list may include the following:

                    • telnet

                    • ssh

                    • http

                    • https

                    Port

                    The port to use.

                    Login

                    The login name.

                    Password

                    The password associated with the login name.

                    Step 5   Click Submit.

                    Accessing Security Credentials for Intercloud Fabric in Microsoft Azure

                    Use this procedure to access the security credentials for Intercloud Fabric in Microsoft Azure.

                    Before You Begin

                    You have installed the infrastructure components.

                    Procedure
                      Step 1   Log in to Intercloud Fabric.
                      Step 2   Choose Intercloud > Infrastructure.
                      Step 3   In the Infrastructure tab, click Export Azure Certificate.
                      Step 4   Log in to the Microsoft Azure management portal.
                      Step 5   Choose Settings > Management Certificate.
                      Step 6   Click Upload to upload the certificate.
                      Step 7   In the Items page, select the subscription ID from the Subscription drop-down list located at the top.
                      What to Do Next

                      Use this subscription ID to create the Intercloud Fabric cloud in Intercloud Fabric.

                      Creating an Intercloud Fabric Cloud

                      Use this procedure to create an Intercloud Fabric cloud.

                      Before You Begin

                      • You have created a provider account.

                      • You know the credentials for the cloud provider.

                      • You have created a tunnel network with the name icfTunnelNet. This applies only to Intercloud Fabric in OpenStack environments.

                      • You have installed the infrastructure components.

                      • You have configured the port profiles for a distributed virtual switch (such as Cisco Nexus 1000V, VMware vSwitch, VMware VDS, or Microsoft Hyper-V switch) in the private cloud.

                      • You have created Intercloud Fabric infrastructure policies, such as a MAC pool, tunnel profile, and static IP pool.

                      • Optionally, you have configured a native VLAN to use for your VM network in vCenter. A native VLAN is useful in flat network environments when only one VLAN is present.

                      • If you are using a Cisco Nexus 1000V switch in the private cloud, you have added the switch to Intercloud Fabric. See Adding a Network Element.

                      • You have configured the Intercloud Fabric Extender trunk port profile for the VLANs that will be extended into the cloud.

                      • You have uploaded the services bundle to manage services. Choose Intercloud > Infrastructure > Upload Services Bundle to upload the services bundle.


                        Note

                        You do not need to upload the services bundle to manage the Intercloud Fabric Router (Integrated).

                      • You have the required configurations and hardware to enable a dedicated network connection between the public cloud and AWS VPC using AWS Direct Connect.


                        Note

                        Direct Connect can only be enabled for AWS VPC.


                        Note

                        When Direct Connect is enabled, the provider's private IP address that is assigned to the Intercloud Fabric Switch will be used by PNSC and the Intercloud Fabric Extender to establish a tunnel.

                      Procedure
                        Step 1   Log in to Intercloud Fabric.
                        Step 2   Choose Intercloud > IcfCloud.
                        Step 3   Click the IcfCloud tab and then click Setup.

                        The Cloud Setup wizard appears.

                        Step 4   Complete the following fields for Account Credentials:
                        Note    Many of the fields in the following table are displayed only if you create a new provider account. In addition, the fields that are displayed are specific to the provider.

                        Name Description

                        Cloud Name

                        The name of the virtual account that you are creating in Intercloud Fabric Director. This name can contain from 1 to 16 alphanumeric characters, including hyphens, underscores, periods, and colons. You cannot change this name after the object has been saved.

                        Cloud Type

                        Choose the provider cloud type.

                        Sub Type

                        Choose the sub type (Classic or VPC) for Amazon Web Services.

                        Provider Account

                        Choose an existing provider or create a new provider account.

                        Based on the selected provider account, the appropriate fields are displayed.

                        Provider Account Name

                        The name of the provider account.

                        Access ID

                        The alphanumeric text string that identifies the account owner.

                        Access Key

                        The unique key for the account.

                        URI

                        The unique resource identifier for the account.

                        Username

                        The username for the provider cloud in the format username@tenant-name.

                        Password

                        The password.

                        Validate Credentials

                        Click to validate credentials. You must validate the credentials to populate the remaining fields.

                        Enable Direct Connect

                        Check the Enable Direct Connect check box to enable the Intercloud Fabric administrator to create an Intercloud Fabric cloud by establishing a dedicated network connection between public clouds and a configured Amazon Web Services VPC.

                        Location

                        Choose the location of the provider cloud.

                        Provider VPC

                        Choose the VPC for the provider cloud.

                        Provider Private Subnet

                        Enter the private subnet for the provider cloud.

                        Step 5   Click Next.
                        Step 6   Complete the following fields for Configuration Details:

                        Name

                        Description

                        Network Configuration

                        Check the Advanced check box to create new polices or click Next to proceed with the default values.

                        MAC Pool

                        Choose a default or existing MAC pool, or create a new MAC pool.

                        See Adding a MAC Address Pool to create a new MAC pool.

                        Tunnel Profile

                        Choose a default or existing tunnel profile, or create a new tunnel profile.

                        See Configuring a Tunnel Profile to create a new tunnel profile.

                        IP Group

                        Choose a default or existing IP group, or create a new IP group.

                        See Adding an IP Group to create a new IP group.

                        Private Subnet

                        Choose a default or existing private subnet, or create a new private subnet.

                        See Adding a Private Subnet to create a new private subnet.

                        Services

                        ICF Firewall (VSG)

                        Check the ICF Firewall check box to create an Intercloud Fabric Firewall (VSG) template.

                        Selecting this option results in a service template being made available for this cloud. To configure the service, use PNSC.

                        See Installing Intercloud Fabric Firewall.

                        ICF Router (Integrated)

                        Supported on Azure clouds only.

                        Check the ICF Router (Integrated) check box to create an ICF Router (Integrated) instance on the associated Intercloud Fabric cloud instance.

                        After the ICF Router (Integrated) is instantiated, you can configure it in PNSC as described in Installing and Configuring Intercloud Fabric Router (Integrated) Workflow.

                        ICF Router (CSR)

                        Check the ICF Router (CSR) check box to create an Intercloud Fabric Router (CSR) template.

                        Selecting this option results in a service template being made available for this cloud. To configure the service, use PNSC.

                        See Installing and Configuring Intercloud Fabric Router (CSR).

                        Cloud Services Router (CSR) Management VLAN

                        Enter the management VLAN ID for the Intercloud Fabric Router (CSR).

                        This VLAN is used to manage the Intercloud Fabric Router (CSR).

                        To access this property, you must check the ICF Router (CSR) check box.

                        Step 7   Click Next.
                        Step 8   Complete the following fields for Secure Cloud Extension:
                        Note   

                        Not all fields apply when you create Intercloud Fabric clouds in Microsoft environments.

                        Name Description

                        Intercloud Extender Network

                        Complete the following fields for the Intercloud Fabric Extender.

                        VM Manager

                        Choose a VM manager for the Intercloud Fabric Extender.

                        Datacenter

                        Choose a data center in which to deploy the Intercloud Fabric Extender.

                        Data Trunk Network

                        Choose the trunk interface on the Intercloud Fabric Extender for data traffic.

                        Management Interface Network

                        Choose the management interface on the Intercloud Fabric Extender for data traffic.

                        Management VLAN

                        Choose the VLAN for the management interface. This VLAN must match the VLAN specified in the management IP pool policy.

                        Management IP Pool Policy

                        Choose the IP pool policy for the management interface or create a new IP pool policy.

                        See Creating a Static IP Pool Policy to create a new IP pool policy.

                        Separate Mgmt and Tunnel Interface

                        Check this check box to use different VLANs for the management interface and tunnel interface. If this check box is not checked, the same VLAN is used for the tunnel interface and the management interface by default.

                        To access this property, you must check the Advanced check box.

                        Tunnel Interface Network

                        Choose the tunnel interface on the Intercloud Fabric Extender for data traffic.

                        This drop-down list displays only if you check the Separate Mgmt and Tunnel Interface check box.

                        Tunnel VLAN

                        Choose the VLAN for the tunnel interface.

                        This field displays only if you check the Separate Mgmt and Tunnel Interface check box.

                        Tunnel IP Pool Policy

                        Choose the IP pool policy for the tunnel interface or create a new IP pool policy.

                        See Creating a Static IP Pool Policy to create a new IP pool policy.

                        This drop-down list displays only if you check the Separate Mgmt and Tunnel Interface check box.

                        Intercloud Extender Placement/Association

                        ICX

                        (Microsoft environments only) Select the host for the Intercloud Fabric Extender.

                        To specify a data store for a Primary Intercloud Extender and Secondary Intercloud Extender, check the Advanced check box and then check the High Availability check box.

                        Host

                        Select the host for the Intercloud Fabric Extender.

                        For high availability, check the Advanced check box and then check the High-Availability check box to specify the host for the Primary Intercloud Extender and Secondary Intercloud Extender.

                        Datastore

                        Select the data store for the Intercloud Fabric Extender.

                        For high availability, check the Advanced check box and then check the High-Availability check box to specify the data store for the Primary Intercloud Extender and Secondary Intercloud Extender.

                        To access this property, you must check the Advanced check box.

                        Intercloud Switch Network

                        Complete the following fields for the Intercloud Fabric Switch in the cloud.

                        To access this property, you must check the Advanced check box.

                        Management VLAN

                        Choose the VLAN for the management interface.

                        Management IP Pool Policy

                        Choose the IP policy for the management interface or create a new IP pool policy.

                        See Creating a Static IP Pool Policy to create a new IP pool policy.

                        Native VLAN

                        (Optional) Specify a native VLAN to use for your VM network in vCenter. A native VLAN is useful in flat network environments when only one VLAN is present.

                        VSG Service Interface

                        To access this property, you must check the ICF Firewall (VSG) check box.

                        This service interface is created on the Intercloud Fabric Switch and is used to communicate with the Intercloud Fabric Firewall data interface.

                        VLAN

                        Choose the VLAN for the service interface. The VLAN is used to communicate between the Intercloud Fabric Switch and the Intercloud Fabric Firewall and can be a private VLAN, completely isolated from other VLANs.

                        IP Pool Policy

                        Choose the IP pool policy for the service interface or create a new IP pool policy.

                        VSG Management

                        To access this property, you must check the ICF Firewall (VSG) check box.

                        VSG Management VLAN

                        Choose the VLAN for the management interface. This VLAN is used to manage the Intercloud Fabric Firewall.

                        Step 9   Click Next.

                        The Summary window provides a summary of the Intercloud Fabric cloud.

                        Step 10   Click Submit.
                        Step 11   To view the task status:
                        1. In the IcfCloud tab, locate the service request number of the task.
                        2. Choose Organizations > Service Requests.
                        3. Click the Service Request tab.
                        4. Locate the service request number or enter the service request number in the search field.
                        5. Click View Details to view detailed information, such as workflow status, logs, and input information for the service request.

                        Managing Services

                        Use this procedure to manage services after creating an Intercloud Fabric cloud.

                        Before You Begin

                        • You have created an Intercloud Fabric cloud.

                        • You have uploaded the services bundle to manage services. Choose Intercloud > Infrastructure > Upload Services Bundle to upload the services bundle.


                          Note

                          You do not need to upload the services bundle to manage Intercloud Fabric Router (Integrated).

                        Procedure
                          Step 1   Log in to Intercloud Fabric.
                          Step 2   Choose Intercloud > IcfCloud.
                          Step 3   Select the Intercloud Fabric cloud and click Manage Services.

                          The Manage Services window appears.

                          Step 4   Complete the following fields for Manage Services:

                          Name

                          Description

                          ICF Firewall

                          Check the ICF Firewall check box to create an Intercloud Fabric Firewall (VSG) template.

                          Service Interface VLAN

                          Enter the VLAN for the service interface. The VLAN is used to communicate between the Intercloud Fabric Switch and the Intercloud Fabric Firewall and can be a private VLAN, completely isolated from other VLANs.

                          This service interface is created on the Intercloud Fabric Switch and is used to communicate with the Intercloud Fabric Firewall data interface.

                          This field displays only if you check the ICF Firewall check box.

                          Service Interface IP Pool Policy

                          Choose the IP pool policy for the service interface or create a new IP pool policy.

                          See Creating a Static IP Pool Policy to create a new IP pool policy.

                          This field displays only if you check the ICF Firewall check box.

                          VSG Management VLAN

                          Enter the VLAN for the management interface. This VLAN is used to manage the Intercloud Fabric Firewall.

                          This field displays only if you check the ICF Firewall check box.

                          Note   

                          The firewall management port profile is automatically created when you select the Intercloud Fabric Firewall service while creating an Intercloud Fabric cloud. The Intercloud Fabric cloud name is added as a prefix to the name of the port profile and the VLAN ID is added as a suffix to the name of the port profile; for example, icf-amz1_VSG_Management_72.

                          ICF Router (CSR)

                          Check the ICF Router (CSR) check box to create an Intercloud Fabric Router (CSR) template.

                          CSR Management VLAN

                          Enter the management VLAN ID for the Intercloud Fabric Router (CSR).

                          This field displays only if you check the ICF Router (CSR) check box.

                          ICF Router (Integrated)

                          Check the ICF Router (Integrated) check box to create an ICF Router (Integrated).

                          Step 5   Click Submit.

                          Cloning an Intercloud Fabric Cloud

                          Use this procedure to clone an Intercloud Fabric cloud. When you clone an Intercloud Fabric cloud, you can modify all the fields except the provider account information.

                          Click 1-click Clone to create an Intercloud Fabric cloud clone with the same settings as the original Intercloud Fabric cloud.

                          Note

                          1-click Clone is not supported for creating Intercloud Fabric clouds in Microsoft environments.

                          Procedure
                            Step 1   Log in to Intercloud Fabric.
                            Step 2   Choose Intercloud > IcfCloud.
                            Step 3   In the IcfCloud window, click the IcfCloud tab.
                            Step 4   In the IcfCloud tab, select the Intercloud Fabric cloud and click Clone.

                            The Cloud Setup wizard appears.

                            Step 5   Complete the following fields for Account Credentials:
                            Name Description

                            Cloud Name

                            The name of the virtual account that you are creating in Intercloud Fabric Director. This name can contain from 1 to 16 alphanumeric characters, including hyphens, underscores, periods, and colons. You cannot change this name after the object has been saved.

                            Cloud Type

                            Choose the provider cloud type.

                            Sub Type

                            Choose the sub type (Classic or VPC) for Amazon Web Services.

                            Provider Account

                            Choose an existing provider or create a new provider account.

                            Based on the selected provider account, the appropriate fields are displayed.

                            Provider Account Name

                            The name of the provider account.

                            Access ID

                            The alphanumeric text string that identifies the account owner.

                            Access Key

                            The unique key for the account.

                            URI

                            The unique resource identifier for the account.

                            Username

                            The username for the provider cloud, in the format username@tenant name.

                            Password

                            The password.

                            Validate Credentials

                            Click to validate credentials. You must validate the credentials to populate the remaining fields.

                            Enable Direct Connect

                            Check the Enable Direct Connect check box to enable the ICF administrator to create an Intercloud Fabric cloud by establishing a dedicated network connection between public clouds and the configured Amazon Web Services VPC.

                            Location

                            Choose the location of the provider cloud.

                            Provider VPC

                            Choose the provider VPC for the provider cloud.

                            Provider Private Subnet

                            Enter the private subnet for the provider cloud.

                            Step 6   Click Next.
                            Step 7   Complete the following fields for Configuration Details:
                            Name Description

                            Network Configuration

                            Check the Advanced check box to create new polices or click Next to proceed with the default values.

                            MAC Pool

                            Choose a default or existing MAC pool, or create a new MAC pool.

                            See Adding a MAC Address Pool to create a new MAC pool.

                            Tunnel Profile

                            Choose a default or existing tunnel profile, or create a new tunnel profile.

                            See Configuring a Tunnel Profile to create a new tunnel profile.

                            IP Group

                            Choose a default or existing IP group, or create a new IP group.

                            See Adding an IP Group to create a new IP group.

                            Private Subnet

                            Choose a default or existing private subnet, or create a private subnet.

                            See Adding a Private Subnet to create a new private subnet.

                            Services

                            ICF Firewall (VSG)

                            Check the ICF Firewall check box to create an Intercloud Fabric Firewall (VSG) template.

                            Selecting this option results in the service template being made available for this cloud. To configure the service, use PNSC.

                            See Installing Intercloud Fabric Firewall.

                            ICF Router (Integrated)

                            Check the ICF Router (Integrated) check box to create an ICF Router (Integrated) template.

                            ICF Router (CSR)

                            Check the ICF Router (CSR) check box to create an Intercloud Fabric Router (CSR) template.

                            Selecting this option results in the service template being made available for this cloud. To configure the service, use PNSC.

                            See Installing and Configuring Intercloud Fabric Router (CSR).

                            Cloud Services Router (CSR) Management VLAN

                            Enter the management VLAN ID for the Intercloud Fabric Router (CSR).

                            This VLAN is used to manage Intercloud Fabric Router (CSR).
                            Step 8   Click Next.
                            Step 9   Complete the following fields for Secure Cloud Extension:
                            Note   

                            Not all fields apply when you create Intercloud Fabric clouds in Microsoft environments.

                            Name Description

                            Intercloud Extender Network

                            Complete the following fields for the Intercloud Fabric Extender.

                            VM Manager

                            Choose a VM manager for the Intercloud Fabric Extender.

                            Datacenter

                            Choose a data center to deploy the Intercloud Fabric Extender.

                            Data Trunk Network

                            Choose the trunk interface on the Intercloud Fabric Extender for data traffic.

                            Management Interface Network

                            Choose the management interface on the Intercloud Fabric Extender for data traffic.

                            Management VLAN

                            Choose the VLAN for the management interface. This VLAN must match the VLAN specified in the management IP pool policy.

                            Management IP Pool Policy

                            Choose the IP pool policy for the management interface or create a new IP pool policy.

                            See Creating a Static IP Pool Policy to create a new IP pool policy.

                            Separate Mgmt and Tunnel Interface

                            Check this check box to use different VLANs for the management interface and tunnel interface. If this check box is not checked, the same VLAN is used for the tunnel interface and the management interface by default.

                            To choose this option, you must check the Advanced check box.

                            Tunnel Interface Network

                            Choose the tunnel interface on the Intercloud Fabric Extender for data traffic.

                            This drop-down list displays only if you check the Separate Mgmt and Tunnel Interface check box.

                            Tunnel VLAN

                            Choose the VLAN for the tunnel interface.

                            This field displays only if you check the Separate Mgmt and Tunnel Interface check box.

                            Tunnel IP Pool Policy

                            Choose the IP pool policy for the tunnel interface or create a new IP pool policy.

                            See Creating a Static IP Pool Policy to create a new IP pool policy.

                            This drop-down list displays only if you check the Separate Mgmt and Tunnel Interface check box.

                            Intercloud Extender Placement / Association

                            ICX

                            (Microsoft environments only) Select the host for the Intercloud Fabric Extender.

                            To specify the data store for a Primary Intercloud Extender and Secondary Intercloud Extender, check the Advanced check box and then check the High Availability check box.

                            Host

                            Select the host for the Intercloud Fabric Extender.

                            For high availability, check the Advanced check box and then check the High-Availability check box to specify the host for the Primary Intercloud Extender and Secondary Intercloud Extender.

                            Datastore

                            Select the data store for the Intercloud Fabric Extender.

                            For high availability, check the Advanced check box and then check the High-Availability check box to specify the data store for the Primary Intercloud Extender and Secondary Intercloud Extender.

                            To choose this option, you must check the Advanced check box.

                            Intercloud Switch Network

                            Complete the following fields for the Intercloud Fabric Switch in the cloud.

                            To choose this option, you must check the Advanced check box.

                            Management VLAN

                            Choose the VLAN for the management interface.

                            Management IP Pool Policy

                            Choose the IP policy for the management interface or create a new IP pool policy.

                            See Creating a Static IP Pool Policy to create a new IP pool policy.

                            Native VLAN

                            You can configure a native VLAN for your VM network in vCenter. A native VLAN is useful in flat network environments when only one VLAN is present.

                            VSG Service Interface

                            To choose this option, you must check the ICF Firewall (VSG) check box.

                            This service interface is created on the Intercloud Fabric Switch and is used to communicate with the Intercloud Fabric Firewall data interface.

                            VLAN

                            Choose the VLAN for the service interface. The VLAN is used to communicate between the Intercloud Fabric Switch and Intercloud Fabric Firewall and can be a private VLAN, completely isolated from other VLANs.

                            IP Pool Policy

                            Choose the IP policy for the service interface or create a new IP pool policy.

                            VSG Management

                            To choose this option, you must check the ICF Firewall (VSG) check box.

                            VSG Management VLAN

                            Choose the VLAN for the management interface. This VLAN is used to manage the Intercloud Fabric Firewall.

                            Step 10   Click Next.

                            The Summary window lists a summary of the Intercloud Fabric cloud.

                            Step 11   Click Submit to clone the Intercloud Fabric cloud.
                            Step 12   To view the task status:
                            1. In the IcfCloud tab, locate the service request number of the task.
                            2. Choose Organizations > Service Requests.
                            3. Click the Service Request tab.
                            4. Locate the service request number or enter the service request number in the search field.
                            5. Click View Details to view detailed information such as workflow status, logs, and input information for the service request.