Customer Management Instructions: Juniper vsrx or Cisco CSR 1000v Service Launch Guide

Transcription

1 AT&T FlexWare Applications: Customer Management Instructions Customer Management Instructions: Juniper vsrx or Cisco CSR 1000v Service Launch Guide This guide is designed to assist customers in understanding what steps to take to launch their Juniper Networks and Cisco Virtual Router application (vsrx & vcsr). AT&T Recommendations: Network administrators should have a working knowledge of Juniper vsrx or Cisco CSR 1000v Virtual Router configuration administration. Network administrator should thoroughly review the Juniper vsrx or Cisco CSR 1000v documentation and be familiar with Juniper vsrx or Cisco CSR 1000v configuration options and details. Please note that customer is fully responsible for the configuration and policies on the Juniper Networks and Cisco Virtual Routers. Section One: Service Launch Requirements Step 1: Review the Juniper vsrx or Cisco CSR 1000v Documentation (NOTE: website and documentation are maintained by Juniper Networks and/or Cisco) 1. Juniper vsrx / Firefly Perimeter Software Documentation- Provides detailed information on all aspects of Juniper vsrx router administration (by version) Cisco CSR 1000v Software Documentation - Provides detailed information on all aspects of Cisco CSR 1000v router administration (by version) 3. The following guides are recommended reading. vsrx Administration Guide for KVM Configuring vsrx Basic Cisco CSR 1000v Series Cloud Service Router Software Configuration Guide

2 Step 2: Verify the Layer-2 configuration settings on the AT&T FlexWare Device LAN Port-0 through LAN Port-7 can be configured on the AT&T FlexWare Device to be used either as an Access or Trunk port. A single VLAN can be mapped to an Access port while one or more VLANs can be mapped to a Trunk port. By default, all LAN ports on the AT&T FlexWare Device will be activated as Access ports. This default can be overridden before the AT&T FlexWare device is turned-up if the new parameters are collected during the initial data gathering consultation for the service. Note: The layer-2 LAN port usage type and VLAN-to-LAN mapping in the AT&T FlexWare Device can only be modified by AT&T before or after the AT&T FlexWare Device is turned-up. If the settings are not correct or needs to be modified after the AT&T FlexWare device is turned up, then the customer will need to submit a change request to have AT&T change the layer-2 settings. Fig. 1: FlexWare Device Default Setting with AVPN Transport and Customer Managed vrouter Fig. 2: FlexWare Device Default Layer-2 Settings Port Port Usage Port Type vlanid vsrx vcsr1k Comments 0 LAN1 Access 3001 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-0 1 LAN2 Access 3002 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-1 2 LAN3 Access 3003 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-2 3 LAN4 Access 3004 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-3 4 LAN5 Access 3005 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-4 5 LAN6 Access 3006 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-5 6 LAN7 Access 3007 GE-0/0/ GigE Access Port with VLAN-3001 mapped to Port-6 7 LAN8 Access 4087 GE-0/0/ GigE /24 by default 8 WAN1 RJ45 Transport Transport GE-0/0/2.xxxx GigE3.xxxx WAN1 circuit with an RJ45 interface 9 WAN2 RJ45 Transport Transport GE-0/0/3.xxxx GigE4.xxxx WAN2 circuit with an RJ45 interface 10 WAN1 SFP Transport Transport GE-0/0/2.xxxx GigE3.xxxx WAN1 circuit with an SFP interface 11 WAN2 SFP Transport Transport GE-0/0/3.xxxx GigE4.xxxx WAN2 circuit with an SFP interface 12 Not Used Not Used Not Used Not Used Not Used Not Used 13 Not Used Not Used Not Used Not Used Not Used Not Used N/A N/A N/A N/A GE-0/0/5.xxxx GigE6.xxxxx Reserved for vfw (unsecured) N/A N/A N/A N/A GE-0/0/6.xxxx GigE7.xxxxx Reserved for vfw (secured) N/A N/A N/A N/A GE-0/0/7.xxxx GigE8.xxxxx Reserved for vwanx (in-path) N/A N/A N/A N/A GE-0/0/8.xxxx GigE9.xxxxx Reserved for vwanx (primary IP) 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property. Page 2

3 Step 3: Verify configuration settings and policies in Juniper vsrx or Cisco CSR 1000v. Note: An AT&T Technician will be online with the customer to complete Step 3 as part of the test and turn-up process. Customers located locally or remotely to the AT&T FlexWare Device can log into the vrouter for the first time using either a WAN or LAN interface IP address that was activated on the vrouter. The vrouter s WAN interfaces are enabled with IP connectivity using the IP addresses supplied with the WAN circuits. For AT&T VPN, the addresses are copied from the AT&T VPN circuit/port orders, and for all other transports the addresses are collected during the initial data gathering consultation for the service. In addition, when the vrouter is activated it will be connected to LAN Port-7 with IP connectivity using a common default private address, /24, that would allow a local user to plug a workstation into Port-7 to reach the vrouter directly. The customer can also request to override the LAN Port-7 default address, if necessary, to something else during the initial data gathering consultation. For vrouters which are connected to the Internet, the AT&T Technician can enable the Internet interface as part of the test and turn-up process if that is the only way that the customer is able to log into the vrouter for the first time, and the customer should immediately apply their security parameters to complete Step 3. In all other cases, the Internet interfaces will be kept in a disabled state, allowing the customer to enable and apply its security parameters at a more convenient time. After the following steps, the Juniper Networks and/or Cisco vrouter is now operational and the customer is free to add any additional policies that are desired. 1. Access the Juniper vsrx or Cisco CSR 1000v vrouter. Telnet or SSH to the vrouter_ip, using either a WAN IP address or the LAN Port-7 IP address. Both Telnet and SSH are enabled when the vrouter is activated. 2. Use the logon userid and password that is provided to the customer by the AT&T enablement Engineer during the meeting to turn-up the FlexWare Device. 3. Enable Authentication, Authorization, and Accounting (AAA) to secure the vrouter. 4. Enable NTP with the proper date and time. This is required for the Cisco CSR 1000v, since the Cisco License is dependent on the current date and time. 5. Verify that the customer is able to apply a simple configuration change (i.e. add an IP address to an unused interface). 6. Apply the customer s routing policies since the vrouter will not attempt to advertise any routes across the WANs when it is first activated 7. Apply the customer s security parameters including changing the logon password to secure the vrouter and your network(s) AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property. Page 3

4 Section Two: Additional Configuration Guidelines The customer should regularly backup your vrouter configuration. Since the vrouter is customer managed, AT&T does not have visibility into the actual configuration and AT&T does not perform standard backups of the vrouter. AT&T can upgrade the vrouter to the latest supported version upon request via the support process. The customer must not Add/Remove/Change the WAN IP addresses and VLANs (virtual local area network) on the Router without a Change Order MACD. Note: The AT&T FlexWare Device changes are required to support these changes and this information was provided by the customer during the pre-installation process. MACD orders are required for any changes in the customer s layer-2 topology settings. The customer should not do a hard shutdown on the vrouter. Note: Use reboot function only - IF HARD SHUTDOWN OF vrouter OCCURS, IT WILL HAVE TO BE BROUGHT UP MANUALLY BY AT&T THROUGH A SUPPORT TICKET The customer should not lose the admin password. AT&T DOES NOT HAVE CAPABILITY TO RESET PASSWORD SINCE vrouter IS CUSTOMER MANAGED. The customer should not apply any configurations that will lock you out of the vrouter. The customer should not upgrade/downgrade the firmware to a version that is not currently supported for the AT&T FlexWare Device offer. The customer should not enable an Internet interface without properly securing the vrouter and your network(s). The customer should not issue any license command that may invalidate the Cisco throughput/feature license. The default LAN Port-7 connection could be used to connect to the vrouter locally if the in-band WAN connection is lost or corrupted. If the vrouter is totally inaccessible, then the customer should seek assistance from AT&T via the support process. Customer Responsibilities: vrouter configuration and policy management The customer will have access to the vrouter through a WAN and LAN IP address when the vrouter is turned over to the customer. The vrouter can be configured by the customer using the same mechanisms as used to configure a physical Juniper or Cisco router. Command Line Interface (CLI) is possible using either Telnet or Secure Shell (SSH). Customer access using a physical console on the AT&T FlexWare Device is not available AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property. Page 4

5 In the event of a power failure, the AT&T FlexWare Device will reboot and reactivate the vrouter to the last known configuration. Useful Juniper vsrx or Cisco CSR 1000v documentation Refer to the vendor webpage for documentation. vrouter Monitoring and Reporting The customer is responsible for any Juniper vsrx or Cisco CSR 1000v specific health monitoring SNMP (simple network management protocol)/system logs (SYSLOG) monitoring can be setup to monitor customer provided network management infrastructure. The customer is responsible to supply the tools needed to collect statistics from the vrouter and to generate reports for the vrouter. vrouter Backup and Firmware Upgrade The customer is responsible for backup of vrouter configuration. The customer is responsible to schedule any firmware upgrade. Customers must contact AT&T prior to any firmware upgrade to confirm upgrade version is supported by the AT&T FLEXWARE DEVICE offer. AT&T Responsibilities: Provide Initial installation, configuration and licensing of the vrouter AT&T will provision the vrouter with an initial configuration as specified by the customer in consultation with the AT&T Lead Engineer. AT&T will do the networking and initial vrouter configuration on the FlexWare Device. AT&T will monitor the FlexWare Device State of the vrouter VM (virtual machine) will only be monitored for up/down status. AT&T will confirm that VM is in an up status at all times and restart, if necessary. AT&T operations team can restart vrouter in consultation with customer, if necessary. Section Three: How to get support AT&T Support Resources: Documentation Support URL: Links to Customer Care Support Overview and provides the information to the customer on how to speak to an agent Managing Your Solution documentation 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property. Page 5