Flexible Computing Advanced User Guide

Transcription

1 Flexible Computing Advanced User Guide Version September 2015

2 proprietary notice copyright, France Telecom Group All rights reserved. confidentiality All information contained in this document is strictly confidential and is provided for the sole purpose of responding to Customer s request and shall not be used for any other purpose. Customer shall not publish or disclose this information, in whole or in part, to any other party without the prior written permission of France Telecom Group. Many of the products, services, and company names referred to in this document are registered trademarks. They are all hereby acknowledged. obligations and conditions This document is subject to contract and does not constitute a binding offer from France Telecom Group. France Telecom Group reserves the right to revise this document, which will be subject to finalization and agreement by France Telecom Group and Customer prior to incorporating in a final contract between the parties. In the event that any assumption on which France Telecom Group has based its proposal or any information provided by Customer changes or is incorrect, France Telecom Group reserves the right to revise any portion of this document accordingly. Implementation of any services detailed in this document is subject to applicable regulations in force on the date the services are to be implemented. France Telecom Group operates its services under the Orange Business Services brand 2 / 30

3 Glossary Abbreviation LB VDC VM OS MW OVF GW VCD FCA VSE vapp B2B B2B2B Load Balancer description Virtual Data Center (resources pool: CPU / RAM / Storage) Virtual Machine Operating System MiddleWare Open Virtualization Format GateWay VMware vcloud Director Flexible Computing Advanced Virtual firewall (or vshield in VMware terminology) Virtual application made up of a set of VMs, VSEs and networks A business which has an organization for its own needs A business which has an organization whose VDCs it resells to other customer businesses 3 / 30

4 Contents 1 Additional references vcloud Director user guide vshield administration guide Introduction Purpose of the document The Flexible Computing Advanced offering The typical organization provided Template catalog Components for accessing the offering VCD web portal VCD API Main concepts of the offerings General concepts Network concepts Network interconnections Network services Conventions and default settings Operations Obtaining new resources Obtaining a new organization Obtaining a new VDC Managing users Managing a VDC Managing a catalog Creating a vapp or a VM Using services for OBS templates Connecting to external networks Internet access Business VPN OBS service zone Description Resources Virtual Data Center (VDC) description Types of configuration available B2B configuration (or standard single tenant customer) B2B2B configuration (or standard multi-tenant customer) B2B2B Pass Service configuration (or SaaS provider customer) / 30

5 1 Additional references 1.1 vcloud Director user guide Document in English vcd_51_users_guide.pdf 1.2 vshield administration guide Document in English vshield_51_admin.pdf 5 / 30

6 2 Introduction 2.1 Purpose of the document This user guide describes the Flexible Computing Advanced offering and the main operations that the user is required to perform. This document is organized as follows: chapter 2 is this introduction, providing a general description of the service offering chapter 3 describes the components providing access to the offering chapter 4 describes the main operations chapter 5 describes the service catalog linked to the OBS vapp catalog. 2.2 The Flexible Computing Advanced offering The Flexible Computing Advanced offering allows the creation of virtual Data Centers (VDC) which the customer may freely organize (creation and organization of networks internal to the VDC, configuration of services such as NAT or Firewall) and use to deploy and execute their vapps. These VDCs are grouped together within an organization. The resources provided via the VDCs enable the following: Creating / deleting security zones Creating / deleting / starting up / shutting down vapps Grouping VMs in vapps Creating / deleting / starting up / shutting down VMs Deploying vapps in defined security zones These operations are accessible directly on the web portal or by using the API. Several roles are available for users: Organization administrator: responsible for managing the resources and users of the organization. vapp author: user authorized to create/import vapp templates into the organization s private catalog Basic user Secure access to the VMs, i.e. via the console accessible from the VCD portal. Direct access via a standard protocol such as SSH or RDS is possible, but must be configured by the customer. 2.3 The typical organization provided Each customer is supplied with an organization. This organization systematically consists of: 1 VDC (i.e. a CPU/RAM/Storage resource pool) Access to the public catalog of vapp templates offered by OBS 6 / 30

7 Several global settings are made at the level of this organization: Runtime Lease : maximum runtime for a vapp Storage Lease : maximum storage time for unused vapps and vapp templates Quotas : limits on the number of vapps that can be restarted and stored in a VDC by a given user. Maximum number of Remote Consoles per user per VM. Maximum number of connection attempts allowed before a user account is blocked. By default, no limits are set. The organization administrator can set limits for these parameters via the VCD portal. The customer can sign up for infrastructure options such as: Connection to the Internet Connection to a Business VPN BVPN Gallery partner option Public IP addresses Additional VDC These options are also available by making a change request to the platform administrator via the change request portal (MSCT). 7 / 30

8 2.4 Template catalog The OBS public catalog includes templates for the following virtual machines: Debian 6 64 bits US Debian 6 64 bits FR Debian 6 32 bits US Debian 6 32 bits FR Debian 7 64 bits US Debian 7 64 bits FR Debian 7 32 bits US Debian 7 32 bits FR Ubuntu bits US Ubuntu bits FR Ubuntu bits US Ubuntu bits FR Ubuntu bits US Ubuntu bits FR Ubuntu bits US Ubuntu bits FR Ubuntu bits US Ubuntu bits FR Ubuntu bits US Ubuntu bits FR CentOS 6 64 bits US CentOS 6 64 bits FR CentOS 6 32 bits US CentOS 6 32 bits FR Suse 11 SP3 64 bits US Suse 11 SP3 64 bits FR Suse 11 SP3 32 bits US Suse 11 SP3 32 bits FR Windows Server bits US STD Windows Server 2008 R2 64 bits FR STD Windows Server 2008 R2 64 bits US WEB Windows Server 2008 R2 64 bits US STD Windows Server 2008 R2 64 bits US ENT Windows Server 2008 R2 64 bits FR WEB Windows Server 2008 R2 64 bits FR STD Windows Server 2008 R2 64 bits FR ENT Windows Server 2012 R2 64 bits US STD Windows Server 2012 R2 64 bits FR STD Windows Server bits US STD Windows Server bits FR STD Red Hat 6 (from june 2016) 64 bits US Red Hat 6 (from june 2016) 64 bits FR Jun-15 Red Hat 6 (from june 2016) 32 bits US Jun-15 Red Hat 6 (from june 2016) 32 bits FR Jun-15 The customer may also deploy their own software components (OS and applications). 8 / 30

9 3 Components for accessing the offering 3.1 VCD web portal Orange Business Services provides customer administrators with access to the VCD tool, which they can use to administer the organization provided. This tool is available in the form of a web portal, accessible via the Internet and the Business VPN Gallery. The access url is: This portal is used to perform common administration operations: Description Managing users (add/delete/edit) Managing the private catalog (import/delete templates and media) Managing vapps/vms (create/delete/edit) Shutting down/starting up vapps/vms Managing internal networks (add/delete/edit) Configuring VSEs (NAT, Load balancing, Firewalling, VPN IPsec, etc.) 3.2 VCD API The VCD tool is also accessible in the form of a REST API. The access url is: The user ID (login/password) is the same as for the web portal. The two access modes can be used to perform the same operations. The vcloud development kits (SDK) supplied by VMware ( can be used to simplify client development for the VCD API. The versions supported are 5.5 (installed version) and 5.1 (backwards compatible). 9 / 30

10 4 Main concepts of the offerings 4.1 General concepts vapp: a vapp refers to a group of virtual machines, which may be interconnected by one or more private network(s). These VMs may be heterogeneous in terms of hardware configuration (number of vcpus, RAM, storage, etc.) or software (OS). Starting up or shutting down a vapp results in starting up or shutting down the VMs it contains. The order in which the VMs of the vapp start up or shut down can be configured. Below are a few examples of vapps: VSE VSE Org-Net : Public Org-Net : Public vapp vapp Front Server vdc vdc vapp-net : Internal Web Server 1/2/3/4 BackEnd Server Customer Organization Figure 1: Web server farm Customer Organization Figure 2: "2-tiers" application Virtual Data Center (VDC): a VDC is a set of resources available to create and run vapps. These resources are a volume of CPU, RAM and storage. Organization: an organization is a structure containing one or more VDCs. It is the organization s administrator who is responsible for creating users and managing their rights. They are also the one who administers the VDCs (catalog, vapps/vms, internal networks) and configures the services of the network gateways (vshield). An organization may contain organization networks (shared by all VDCs). It is connected to external networks by gateways (vshield Edge). 4.2 Network concepts There are three types of network: The external networks (External Networks) are networks located outside of an organization, such as the Internet, a Business VPN or a service network of the underlying infrastructure. The VDC networks (Org VDC Networks) are virtual networks within a VDC (which may or may not be shared by all VDCs within a given organization). They may be isolated or routed (connected to an external network via a vshield gateway). 10 / 30

11 vapp Networks are virtual networks internal to a vapp. They may be isolated, routed or directly connected to a VDC network Network interconnections There are five interconnection configurations for these various network types: Ext-Net : Public VSE 4 Org-Net : Public NAT/Routed Org-Net : Public 5 Org-Net : Isolated vapp vapp vapp vapp-net : internal vapp-net : internal vapp-net : internal vdc vapp to Organization Organization to external Customer Organization 1- The vapp network is connected to a VDC network via a vapp gateway. These two networks have different addressing plans, and communication is by routing or NAT, depending on the configuration of the gateway. 2- The vapp network is directly connected to a VDC network. These two networks share the same addressing space. 3- The vapp network is isolated. It is typically used to interconnect several VMs. 4- The VDC network is connected to an external network via a vshield gateway. These two networks have different addressing plans, and communication is by routing or NAT, depending on the configuration of the gateway. 5- The VDC is isolated (i.e. it is not connected to an external network). It is typically used to interconnect several vapp networks. There are even isolated vapp networks for interconnecting several VMs of a vapp with a network that is strictly internal to the vapp (not connected to a VDC network) Network services The Services provided by a vshield Edge vary according to whether it is defined at VDC or vapp level. A vshield Edge at VDC level supplies the following services: 11 / 30

12 - DHCP - NAT (Source NAT or Destination NAT) - Firewalling - Static route - VPN - Load balancing - Traffic shaping This type of vshield Edge is created in High Availability (HA) mode. A vshield Edge at vapp level supplies the following services: - DHCP - NAT (IP translation or port translation) - Firewalling - Static route A vshield Edge at vapp level is not configured in High Availability mode. 4.3 Conventions and default settings The vshields are named according to a set of naming conventions: <VDCName>_BVPN: interconnection gateway to the BVPN <VDCName>_Internet: interconnection gateway to the Internet <VDCName>_CSSA: interconnection gateway to the service zone By default, these gateways are linked to the following org VDC networks respectively: obs-org-adm : network to access the service zone, using a private OBS address obs-internet-access : network to access the Internet, using a private address obs-vpn-access : network to access the BVPN, using a public address not routed to the Internet 12 / 30

13 5 Operations 5.1 Obtaining new resources Obtaining a new organization Each new organization must be ordered from OBS via a Flexible Computing Advanced order form Obtaining a new VDC A VDC is added to an existing organization via a change request made using the MSCT tool User management The organization administrator may use the VCD tool to create new users (see illustration below). The user management procedures are described in detail in chapter 2 of the VCD user guide VCD [1.1] Managing a VDC Adding resources to a VDC Resources (CPU, RAM, Storage) are added to a VDC within an existing organization via a change request made using the MSCT tool Creating and configuring internal VDC networks Internal VDC networks are created and administered on the Org VDC Networks tab, which is accessed by selecting a VDC in the Administration section of the organization s administrator interface. 13 / 30

14 Figure 3: Creating a VDC network Figure 4: Configuring the services o f a V D C n e t w o r k The procedures for managing VDC networks are described in detail in chapter 3 of the VCD user guide [1.1] Creating and configuring internal vapp networks The vapp networks are accessible via the Networking tab of each vapp. 14 / 30

15 Figure 5: Adding a vapp network Figure 6: Configuring the services The procedures for managing VDC networks are described in detail in chapter 8 (p. 71) of the VCD user guide [1.1] Configuring a firewall 15 / 30

16 Figure 7: Configuring the Firewall rules Configuring a load balancer The load balancer is available on the VDC gateways ( vshield Edge ) but not on the vapp gateways. The mechanisms available are described in detail in chapter 9 of the vshield user guide [1.2] Managing a catalog Catalogs can be managed in the Catalogs section. This section contains the organization s private catalogs as well as the public catalogs provided by OBS (in the My Organization s Catalogs section and the Public Catalogs section in the left-hand pane respectively). Figure 8: Access to the private catalogs The vapp Templates and Media tabs can be used to view the catalogs content (templates and ISO files respectively) or import content (by uploading it). 16 / 30

17 By selecting content, the contextual menu (right click) can be used to export (download) this content. Figure 9 : Exporting a vapp template In this screen, it is possible to create new private catalogs in a VDC (whose storage space will be used to host the catalog s templates and media). Likewise, a template can be imported into a catalog by clicking Transfer (see figure below). Figure 10: Importing a vapp template The procedures for managing VDC catalogs are described in detail in chapter 5 of the VCD user guide [1.1]. 17 / 30

18 5.1.6 Creating a vapp or VM vapps and VMs are created in the My Cloud section. vapps can be created from scratch ( Build New vapp action) or from a catalog template ( Add a vapp from catalog action). Figure 11: Building a vapp vapps are built using a wizard, which lets the user type in the necessary information and add virtual machines to the vapp. Figure 12: Adding a VM to a new vapp The procedures for creating vapps and VMs are described in detail in chapters 8 and 9 of the VCD user guide respectively [1.1]. 18 / 30

19 From a template vapps are created from a catalog by using a wizard, which lets the user choose the template to instantiate, then choose the VDC in which to deploy the vapp and the VDC network(s) to which this vapp will be attached. Figure 13: choosing a template for the new vapp Figure 14: Choosing the destination VDC 19 / 30

20 Specific features of the OBS catalog templates SID management for Windows VMs The Change SID box must be checked for Windows VMs before the first start-up. If the VM has been started up without having completed this step, it can be done afterwards, by shutting down the VM then restarting it via the Force Recustomization option. Connection login For Windows VMs, the connection login is administrator For Linux VMs, the connection login is root Password management Password management must be put in place before starting up the VM, in order to be able to connect to it. 20 / 30

21 Please note, a Windows VM password must follow the rules below: Not contain all or part of the user s account name Be at least 8 characters long Contain characters from three of the four following categories: Uppercase characters from the English alphabet (A to Z) Lowercase characters from the English alphabet (a to z) Base 10 figures (0 to 9) Non-alphabetic characters (for example!, $, #, %) If the VM has been started up without having completed this step, it can be done afterwards, by shutting down the VM then restarting it via the Force Recustomization option. 21 / 30

22 5.1.7 Using services for OBS templates The services are hosted in a service zone, accessible via the CSSA external network. This connection takes the form of a VSE (placed in a VDC), accessible from a shared VDC network (i.e. accessible from all the organization s VDCs) obs-org-adm. The services are preconfigured at template level so they can be used as soon as instantiation takes place. It is important to remember that disabling the VSE s firewall rules or improper configuration can expose connected virtual machines to security risks. 22 / 30

23 6 Connecting to external networks 6.1 Internet access The connection of an organization to the Internet takes the form of a VSE (placed in a VDC) providing interconnection with the Internet. By default, the VSE has a public IP address and therefore implements a "1 for N" NAT. The customer may request to have additional public IP addresses to expose some of these virtual machines to the Internet (the "destination" NAT configuration is to be done by the customer on the VSE). It is important to remember that disabling the VSE s firewall rules or improper configuration can expose connected virtual machines to security risks. By default, the VSE is configured to block all flows (ANY -> ANY DROP type firewall rule). The flows are to be opened by the customer (VSE configuration). Also by default, an internal access network ( /24) is created to connect vapps to this VSE. More details are provided in the sections describing typical customer configurations ( B2B vs. B2B2B ). 6.2 Business VPN Just as with Internet access, a BVPN connection takes the form of a VSE connected to the BVPN access platform. The filtering and NAT rules are also to be configured by the customer. It is important to remember that disabling the VSE s firewall rules or improper configuration can expose connected virtual machines to security risks. By default, an internal access network is created to connect vapps to this VSE. To avoid any address conflicts with the customer s internal address, this access network uses a public address that is not routed to the Internet. More details are provided in the sections describing typical customer configurations ( B2C vs. B2B2C ). 6.3 OBS service zone Description Orange Business Service provides a service zone used by the templates in its public template catalog. This zone includes the following services: Update proxy for Linux virtual machines Windows update server (WSUS) Windows license activation server (KMS) Update server for the Sophos antivirus program NTP server The services in this zone are accessible via an external network, and therefore via an interconnection VSE. This VSE is delivered with an internal access network that uses an address specific to OBS (see configuration types and the user guide for more details). 23 / 30

24 OBS has sole responsibility for this service zone, which is designed for the virtual machines created from the vapp templates supplied by OBS. 24 / 30

25 7 resources 7.1 Virtual Data Center (VDC) description Orange Business Services presents the resources of an organization in the form of a Virtual Data Center including CPU Power, RAM, storage (Silver and/or Gold level) and one or more VSEs providing an interconnection with external networks (Internet or BVPN). These resources make it possible to create virtual machines. CPU power is shown as a value in GHz (processor power). RAM is shown as a value in GB (random access memory). storage is shown as a value in GB (storage for virtual machines). It is possible to have both Silver and Gold storage at the same time for a given VDC. A Virtual Data Center has its own specific resources (quantities can be modified via the MSCT change request tool). Choosing the resources of a Virtual Data Center therefore involves choosing maximum values (CPU, RAM & storage). There is no limit on the number of VDCs an organization can have: it is therefore possible to allocate VDCs to particular purposes (prod/pre-prod/test etc.) or to different teams or entities. By default: Resources are allocated per virtual machine. The CPU and RAM quantities needed are allocated globally upon start-up. The virtual machines use vcpus of1, 2 or 3GHz. It is not possible to use more vcpus than the VDC can contain (for example: a VDC of 10GHz can use 3 single vcpu VMs at 3GHz). This default allocation method corresponds to the Pay As You Go model with resource guarantee, in VMware terminology. 25 / 30

26 8 Types of configuration available 8.1 B2B configuration (or standard single tenant customer) This configuration corresponds to a customer who is the administrator and sole user of their VDCs, with no connection to any third-party BVPNs. This configuration is illustrated in the diagrams below: Internet Ext-net: internet VPN Customer 01 VPN Customer 02 VSE Gateway Internet VSE Gateway VPN Org-net shared : Public vapp VSE vapp vapp VSE vapp vdc Silver vdc Gold Org-net shared : VPN Org-net : Public VSE Gateway Internet vapp VSE Gateway VPN vapp Org-net : VPN vdc Silver Anti-Virus vapp vapp VSE vapp VSE vapp Zone CSSA Org-net-: Admin VSE vapp VSE vapp Gateway Admin VSE CSSA Fw Windows Activation CSSA Interco Org-net-shared: Admin Organisation Customer 1 OCfB à Val de Reuil VSE Gateway Admin operated by OCfB Organisation Customer 2 operated by OCfB Figure 15: overview with 2 "B2B" customers 26 / 30

27 Figure 16: detailed view of a "B2B organization A specific feature of this configuration is the sharing of interconnections to external networks (OBS service zone, Internet and customer s BVPN). By default the corresponding VSEs are accessible via internal access networks (respectively obsorg-adm for the OBS service zone, "obs-internet-access" for Internet access and "Obs-vpn-access" for BVPN access) that are "shared" and thus accessible from all VDCs in the organization. By default, these networks use the addresses below: obs-org-adm : an OBS internal address range in the format X.Y/24 obs-internet-access : /24 obs-vpn-access : /24 27 / 30

28 8.2 B2B2B configuration (or standard multi-tenant customer) This configuration corresponds to a customer who is the sole administrator of their VDCs, but wants to provide access to their VDCs to third parties (customers, partners, etc.). This configuration is illustrated in the diagrams below: Internet Ext-net: internet VPN Customer 01 VPN Customer 02 Org operated by ACME VSE Gateway Internet VSE Gateway VPN VSE Gateway Internet VSE Gateway VPN Nagios Syslog Org-net: Public Org-net: Public vapp vapp vapp vapp Org-net: VPN Org-net: VPN VSE vapp VSE vapp VSE vapp VSE vapp vdc admin ACME Org-net-shared: Admin ACME vdc customer 01 vdc customer 02 vdc customer n VPN. Figure 17: overview of a "B2B2B" configuration In this configuration, the interconnections to external networks are not shared but dedicated to a VDC. Typically, the FCA customer will have a VDC to deploy their own tools / servers ("VDC admin") connected to their own BVPN. They will then have a set of VDCs for their customers / partners, each connected to the BVPN of that third party. The access networks to the BVPN and Internet VSEs will by default use the same addresses as the "B2C" configuration (respectively /24 for Internet and /24 for BVPN), which will not cause an address conflict since they are internal to each VDC. The access network to the FCA customer s VPN can be shared in order to be exposed to all VDCs in the organization, but in this case vapp VSEs implementing a NAT should be put in place, so as not to cause an address conflict with the access networks for third-party BVPNs (or use an address range compatible with both the third-party BVPN and the FCA customer s BVPN). 28 / 30

29 8.3 B2B2B Pass Service configuration (or SaaS provider customer) This configuration corresponds to a customer who is the sole administrator of their VDCs and wants to expose the services/applications they host via the OBS BVPN Gallery and/or the Internet. This configuration is illustrated in the diagrams below: 29 / 30

30 In this configuration, the FCA customer will typically have a VDC to deploy their own tools/servers ( VDC admin ), connected to their own BVPN. They will also have one (or more) VDC hosting the services/applications they want to offer as an SaaS provider. This VDC will naturally be connected to the desired exposure channels: the Internet and the BVPN Gallery offering. The customer shall take particular care to: configure the destination NAT on the Internet access VSE (to target the virtual machines to be exposed and their public IP addresses) choose an appropriate address for the access network to the BVPN Gallery VSE, which must be compatible with the exposure restrictions of this offering (such as the use of public IP addresses routed to the Internet) 30 / 30