VNF Integration and Support in CloudStack - Wei Zhou - ShapeBlue
1 like1,225 views
The document discusses the integration and support of Virtualized Network Functions (VNF) in Apache CloudStack 4.19, highlighting its functionalities such as CRUD operations for VNF images/templates and deployment management for VNF appliances. It covers use cases for VNFs, how to build custom VNF images, and the necessary configurations for VNF templates. The future work section indicates ongoing efforts to enhance VNF integration with aims for automation and improved user experience.
VNF Integration and Support in CloudStack - Wei Zhou - ShapeBlue
- 1. VNF Integration and Support in CloudStack 4.19 CloudStack Collaboration Conference, 23 - 24 November 2023
- 2. Who am I ? Wei Zhou Software Architect @ Shapeblue 2012.12 Joined Apache CloudStack community 2013.05 Became an Apache CloudStack committer 2017.03 Became an Apache CloudStack PMC member Email: weizhou@apache.org Github: @weizhouapache
- 3. 01 Introduction 02 Use cases 03 Build your own VNF images 04 Work with VNF templates 05 Deploy VNF appliances 06 Summary and Future work Contents
- 4. 01 Introduction Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 5. What are VNF Virtualized network functions (VNF): • Software applications which implement network functions • Run as virtual machines on top of hypervisors • Replace physical network devices and reduce the costs Network function virtualization (NFV) • An architecture to manage VNF images and instances Network Function Virtualization with Apache Cloudstack (Presented by Alex in CCC 2021 ) https://events.hubilo.com/cloudstack-collaboration-conference/session/95229
- 6. What network functions can be virtualized ? Including but not limited to • Gateways (Storage, VOIP, etc) • NAT (SNAT, DNAT) • Firewall • Load balancing • DHCP/DNS • VPN • Tunneling (VXLAN, NVGRE, MPLSoUDP, etc) • Security (IDS, IPS) • WAN Acceleration/Optimization • Transparent proxy • ...
- 7. Where/How to get VNF images Get from vendors • service providers (Cisco, etc) • hypervisor marketplace (VMware, etc) • cloud providers (Google cloud, Microsoft Azure, etc) • others (ESTI OSM, etc) Build your own VNF images
- 8. Get VNF images from vendors Cisco virtual routers
- 9. Get VNF images from vendors VMware
- 10. Get VNF images from vendors Google Cloud
- 11. Get VNF images from vendors
- 12. VNF appliance: CloudStack VR Provided features • SourceNat, StaticNat, • Firewall, PortForwarding, LB (Load balancing) • DHCP, DNS, VPN, etc Tightly coupled with Apache CloudStack • No CLI • No WebUI • No API • Lack of some features (OpenVPN, Dynamic routing, Security, etc) • Limited performance Next-Gen Virtual Router (Presented by Rohit in CCC 2021 ) https://events.hubilo.com/cloudstack-collaboration-conference/session/95287
- 13. VNF integration in CloudStack 4.19 Requirements (Stage 1) • Support CRUD operations of VNF images/templates • Configurable nics and details for VNF templates • Support deployment and management for VNF appliances • Automatically program network rules for management interfaces of VNF appliances • Display access information for VNF appliances
- 14. 02 Use cases of VNF Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 15. Use case 1: Silverpeak (HPE Aruba) SD-WAN Connect some small~medium sites/branches
- 16. Use case 2: Riverbed WAN Optimization Connect 2 VPCs in separated zones • Each with a full stack 3-tiers application
- 17. Use case 3: PFSense Firewall Connect VMs in MGMT, LAN and DMZ
- 18. 03 Build your own VNF images Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 19. Build your own VNF images Step 0: Choose a Router OS Options: • pfSense • OpnSense • Vyos • MikroTik • Linux distributions (Alpine Linux, Debian, etc) • ...
- 20. Build your own VNF images Steps • Register ISO • Deploy VM from ISO • Configure services via VM Console • Create template from VM
- 21. Build your own VNF images Step 2: Deploy VM from ISO
- 22. Build your own VNF images Step 3: Configure services via VM Console
- 23. Build your own VNF images Step 3: Configure services via VM Console
- 24. Build our own VNF images Step 3: Configure services via VM Console
- 25. Build your own VNF images Step 4: Create template from VM VNF Template is ready for use !
- 26. 04 Work with VNF templates Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 28. Update a regular template to VNF template
- 30. Configure VNF template: Add VNF Nic Device ID: • The device ID of the VNF nic. • The device id must be consecutive and start from 0. • The NIC with deviceId=0 will be the default NIC Name Required Management NIC Description
- 31. Configure VNF template: Add VNF Detail Options for access methods
- 32. Configure VNF templates: example
- 33. 05 Deploy VNF appliances Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 37. Network rules to be applied Network type Network rules Isolated network - Acquire a public IP - Enable static nat - Create firewall rules for ssh/http/https ports shared network with security groups - Create a new security group - Add rules to allow traffic to ssh/http/https ports L2 network, VPC tier, or Shared network without security groups - No rules
- 38. Cluster/Pod/Host Boot type and boot mode Userdata SSH key pairs Affinity groups (HA cluster with primary/secondary nodes) NIC multiqueue number and packed virtqueues enabled (KVM only) IO Thread and driver policy (KVM only)
- 43. VM on L2-001 VM on L2-002
- 44. Comparison VPC-based solution pfSense-based solution Networks All VPC tiers are in same parent CIDR All network CIDRs are configurable Existing network cannot be added to a VPC Existing network can be attached to VNF appliance Features Source NAT/Static NAT Source NAT / 1:1 Load balancing haproxy (installed by Package Manager) Port forwarding Port forward L2TP VPN / Site-to-Site VPN IPsec / L2TP / OpenVPN Network ACL Firewall rules (ingress/egress) Private gateways (Attach extra NICs to VNF appliance) Static Routes Static Routes (NOT rely on private gateways) DHCP/DNS DHCP/DNS Userdata (Use ConfigDrive) Others: Virtual IP, DNS Forwarder, Dynamic DNS, Dymamic Routing/BGP/OSPF (via FRR), etc
- 45. 06 Summary and Future work Contents CloudStack Collaboration Conference, 23 - 24 November 2023
- 46. Summary Support VNF templates • CRUD operations • configurations Support VNF applicances • CRUD operations • Automatically program network rules for access
- 47. Future work Still in the early stage of VNF integration and support Goal: Allow users to use VNF appliances with little manual intervention. • Ideally VNF applicances are configured automatically. • Like auto-configuration on CloudStack Virtual Routers. Challenges • Access layer: SSH, REST api, unix sockets, etc. (TCP proxy or tunnel may be required) • Data model: json, xml, arguments of shell commands, API parameters, etc • Upgrade
- 48. Idea: New network offering
- 50. Idea: new framework and plugins plugin framework for VNF plugins • CloudStack Virtual Router • pfSense • VyOS • ......
- 51. Acknowledgement Alex Mattioli Jithin Raju Lucian Burlacu Daan Hoogland Thanks for the design, reviews and testing !
- 52. Q & A Email: weizhou@apache.org CloudStack Collaboration Conference, 23 - 24 November 2023
- 53. Thank you ! Email: weizhou@apache.org CloudStack Collaboration Conference, 23 - 24 November 2023
- 54. References Design document on cwiki • https://cwiki.apache.org/confluence/display/CLOUDSTACK/VNF+Appliance+Integration Cisco VNF images • https://www.cisco.com/c/en/us/solutions/service-provider/network-functions- virtualization-nfv/index.html#~virtual-routers • https://www.cisco.com/c/en/us/solutions/service-provider/network-functions- virtualization-nfv/index.html#~featured-vnfs OpenStack tacker • https://docs.openstack.org/tacker/latest/admin/index.html VNF Templates and Appliances • https://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_a ppliances.html