Installation Requirements

This chapter includes the hardware, software, and network requirements for installing Cisco Managed Services Accelerator (MSX).


Note

This chapter lists the minimum system requirements.

AWS vs OpenStack

The Cisco MSX solution is tested to operate in environments residing on AWS (for MSX as a Service) and OpenStack (for on-premise) cloud computing platforms. FedRAMP deployments will run in a FedRAMP-specific AWS environment that has a subset of approved services that address government-specific needs.

At a high level, the installation process for AWS, as opposed to OpenStack, only differs at the initial stages up to and including the execution of the isolated.yml script. From that point on, once the infrastructure is laid down and containers are running on Docker and orchestrated by Kubernetes, there are few differences in how MSX is installed or operates. Functionality in AWS will be handled by services that differ from those of OpenStack, but those operations should be invisible to administrators and users.

Hardware Requirements

Most of the hardware and software deployment requirements are the same for AWS and OpenStack. Any differences will be mentioned in this section.

When installing MSX on AWS, administrators should have an Amazon Web Services account. The default quotas set by Amazon should be enough for an administrator to perform one MSX installation. If additional functionality or instances are required, then the administrator will need to purchase additional quotas to facilitate those installations.

The MSX installer creates at least eight 50 GB volumes and nine 10 GB volumes, plus two 50 GB volumes for each service pack. You need 1000 GB for the full deployment. Ensure that you have allocated sufficient OpenStack Cinder volume.

The following are the minimum requirements for deploying MSX in a single DC mode and applies for a single data center.

  • vCPU: A minimum of 136 vCPUs

  • RAM: 272 GB

  • Volume Storage: 361 GB

  • Volume Count: 19

  • Instance: 25

  • Floating IPs (OpenStack): 4

  • Elastic IPs (AWS): 7

    • AZ Nat IPs: 3

    • Edge Nodes: 2

    • Inception Host: 1

    • CSR Hub: 1 (Optional)

  • Key Pair: 1

  • Network: 4

  • Port: 30

  • Router: 1

  • Security Group: 13

  • Security Group Rule: 75

Software Requirements

You need the following software to install MSX:

  • CentOS-7-x86_64-GenericCloud-1804_02.qcow2 (OpenStack)

  • CentOS Linux x86_64 (Latest) (AWS)


    Note

    If you require encryption at rest data protection, then you must create your own encrypted volume.

  • Docker 18.09 or higher recommended

  • Keystone v3 (OpenStack)

For more information on other requirements specific to OpenStack, see Preparing OpenStack for an Installation.

NTP Leap-Second Considerations

NTP servers should adjust leap seconds automatically at the server end. For example, the Amazon Time Sync Service automatically smooths any leap seconds that are added to UTC. To ensure consistent leap-second handling, OpenStack deployments should use the same NTP server for all functions across the system.

Network Requirements

The table below provides a list of network settings required during the MSX installation.

Table 1. Network Prerequisites

Network Requirements

Comments/Actions

Floating IP addresses

Reserve seven floating IP addresses.

These floating IP addresses are required for the following components:

  • Two for the Edge nodes

  • One for Inception

  • One for CSR HUB

  • Three for AZ Nat IPs

Note 

If you are installing MSX in the Dual DC mode, you need one additional floating IP address for the CSR VPN.

NAT IP addresses

Note 

This is a specific requirement for the SD-WAN service pack, if you are installing it in the Dual DC mode.

Reserve six NAT IP addresses for connectivity to vOrchestrator - three NAT IP addresses each for Active DC and Passive DC.

DNS Mapping for the MSX Portal

  1. Register the MSX portal domain name to a DNS of your choice. Ensure that the name is <vms_subdomain>. The <vms_domain> is mapped to both floating IP addresses of the two edge nodes.

  2. Register a subdomain.

Port Requirements

These topics list the required ports for Cisco MSX.

OpenStack Ports

The MSX installation container must have HTTP access to the following ports on the OpenStack host that MSX is being installed on:

  • Keystone: 5000

  • Cinder: 8776

  • Nova: 8774

  • Neutron: 9696

AWS Ports

Port access is not an issue for AWS installations. Administrators should, however, ensure that users have access to Amazon Web Services and test that no firewalls are blocking such access. Additionally, you should remember to configure the proxy settings in main.yml to enable proper Internet access for environments that utilize proxies.

SD-WAN and SD-Branch-Specific Ports

The table below lists the ports required for the SD-WAN and the SD-Branch service packs.

Table 2. SD-WAN and SD-Branch-Specific Ports on MSX

Protocol

Port Numbers

Usage

Used for

TCP

443 (HTTPS), 80(HTTP), 22 (SSH)

SD-WAN, SD-Branch

REST calls from MSX and to log in to devices.

TCP

830

SD-WAN, SD-Branch

Net-Conf for NSO communication.

TCP

22021

22022

22023

22024

22025

VNFs Ports

Port forwarding from NFVIS to the deployed VNF.

Each deployed VNF requires one port for NSO to connect to it through NFVIS.

Five ports allocated for VNF Port Forwarding based on number of VNFs to be deployed in the network.

You can change these to different port numbers.

Deployment Sizing

The table below lists the sizing information for a production mode deployment of MSX into a single DC. When deploying in a dual DC mode, the sizing information will apply to each data center.

Table 3. MSX Deployment Sizing

VM

Quantity

OpenStack Flavor

OpenStack vCPU Total

OpenStack RAM (GB) Total

OpenStack Disk (GB) Total

Inception

1

m1.medium

2

4

40

Kubernetes Master

3

m1.large

12

24

240

Kubernetes Edge Node

2

m1.large

8

16

160

Kubernetes Node

12

m1.xlarge

96

192

960

Kubernetes ES Node

3

m1.xlarge

24

48

240

Kubernetes SA Node

3

m1.xlarge

24

48

240

CSR Hub (1000v)

1

small.csr1000v

2

4

0

CSR VPN (1000v)

See Note 1

small.csr1000v

ESC Node

2

m1.large

Total

25

168

336

1880

Note 1: When you deploy MSX in Dual DC mode, only one CSR VPN instance is created.

Note 2: You must allocate one floating IP address for each Edge Node.

Required Resources for New Nodes

The table below lists the required resources needed per node type when you add a node.

Table 4. Required Resources Nodes

VM

OpenStack Flavor

vCPU

RAM (GB)

Disk (GB)

AWS Instance Type

AWS vCPU

AWS RAM (GB)

Kubernetes Node

m1.xlarge

8

16

80

m4.2xlarge

8

32

Kubernetes SA Node

m1.xlarge

8

16

80

m4.2xlarge

8

32

Kubernetes ES Node

m1.xlarge

8

16

80

m4.2xlarge

8

32

Kubernetes Edge Node

m1.large

4

8

80

m4.xlarge

2

8

Note: For every additional Edge node, you need to allocate one floating IP.

Adding Kubernetes Nodes

The following section describes the process for adding (non-master) Kubernetes nodes to a standard deployment. For default sizing details, see Deployment Sizing. You can add nodes before or after an initial installation.

To add Kubernetes nodes, update the appropriate variables in group_vars/all/main.yml to reflect your desired sizing. For example: 

additional_kubernetes_nodes: <num_additional_nodes> 
    additional_es_nodes: <num_additional_nodes> 
    additional_sa_nodes: <num_additional_nodes> 
    additional_edge_nodes: <num_additional_nodes>
If you set the variables before an initial deployment, the new nodes will be created during the regular playbook workflow. Alternatively, if you need to add additional Kubernetes nodes after you deploy a system, run the following playbook to create and configure the new nodes: 
ansible-playbook add-node.yml