Release Notes for NorthStar Controller

Transcription

1 Release Notes for NorthStar Controller Release January 2017 These release notes accompany Juniper Networks NorthStar Controller Release Contents Introduction Contents of this Release New Features Support for Multiple Network-Facing Interfaces for High Availability Deployments Support MapQuest Plugins v2.2 for Leaflet External LDAP Improvements Clean Up of Stale User Sessions by Admin Changes in Behavior Known Behavior Known Issues Resolved Issues Requesting Technical Support Revision History

2 Release Notes: Juniper Networks NorthStar Controller Introduction The Juniper Networks NorthStar Controller is an SDN controller that enables granular visibility and control of IP/MPLS flows in large service provider and enterprise networks. Network operators can use the NorthStar Controller to optimize their network infrastructure through proactive monitoring, planning, and explicit routing of large traffic loads dynamically based on user-defined constraints. The NorthStar Controller release is fully supported with Junos OS Releases 15.1F6 and 16.1R1. NorthStar Controller can also be deployed with Junos OS Releases 14.2R6, 15.1F4, and 15.1R4, but the following features would not be available: MD5 authentication for PCEP P2MP support Administrative group support NOTE: The Path Computation Element Protocol (PCEP) configuration on the PCC routers does not persist across upgrades when the SDN package is not part of the installation binary. Before upgrading the Junos OS image to this release, save the existing configuration to a file by using the save command. After you upgrade the Junos OS image on each PCC router, use the load override command to restore the PCEP configuration. Contents of this Release Junos OS supports Internet draft draft-crabbe-pce-pce-initiated-lsp-03 for the stateful PCE-initiated LSP implementation (M Series, MX Series, PTX Series, T Series, QFX Series, and ACX Series). Table 1 on page 2 describes the downloadable files. Table 1: NorthStar Controller Downloadable Files File NorthStar Application NOTE: E-signature also available. Northstar_Bundle_2_2_0.tar.gz which includes: NorthStar-Bundle-2.2.0/NorthStar-Bundle _171815_69024_21.x86_64.rpm installation file for use with: Bare metal server installation in which the JunosVM will be running as a virtual machine using qemu hypervisor via CLI. Installation onto a CentOS 6 VM running on the OpenStack virtualization platform. Readme file. 2

3 New Features Table 1: NorthStar Controller Downloadable Files (continued) File NorthStar JunosVM NOTE: E-signature also available. northstar_junosvm.tar.gz which includes: northstar_junosvm.img, a Qcow2 formatted file to be run as a virtual machine on OpenStack. NOTE: The junos_vm file has no configuration. Sample junos_vm configuration file. Sample HEAT templates for use when installing the NorthStar Controller in an OpenStack virtual environment: northstar220.heat.official for launching the NorthStar Controller in standalone mode without a floating IP address. northstar220.floating.heat.official for launching the NorthStar Controller in standalone mode with a floating IP address. northstar220.3instances.heat.official for launching the NorthStar Controller in cluster mode without a floating IP address. northstar220.3instances.floating.heat.official for launching the NorthStar Controller in cluster mode with a floating IP address. Readme file. New Features This section lists new features in the NorthStar Controller Release Support for Multiple Network-Facing Interfaces for High Availability Deployments Prior to this release, the NorthStar Controller supported only one interface monitored by Zookeeper. Zookeeper was never aware when an unmonitored interface went down, so the information could not be propagated across the network or taken into consideration in the election of an active node for high availability (HA) clusters. In NorthStar Controller Release 2.2.0, a total of five monitored interfaces are now supported, one of which is designated by the user as the cluster communication (Zookeeper) interface. The following changes were made to enable this new feature: The net_setup.py script allows configuration of the additional monitored interfaces in both the host configuration (Host interfaces 1 through 5), and JunosVM configuration (JunosVM interfaces 1 through 5). See NorthStar Controller 2.2 RPM Bundle Installation in the NorthStar Controller Getting Started Guide for the steps to configure these interfaces. The ha_agent sends probes using ICMP packets (ping) to remote cluster endpoints (including the Zookeeper interface) to monitor the connectivity of the interfaces. If the packet is not received within the timeout period, the neighbor is declared unreachable. The ha_agent updates Zookeeper on any interface status changes and propagates that information across the cluster. Interval and timeout values for the cluster are user-configurable in the HA setup script. Default values are 10 seconds and 30 seconds, respectively. Also in the HA setup script is an option to configure whether switchover 3

4 Release Notes: Juniper Networks NorthStar Controller is to be allowed for each interface. See Configuring a Cluster for High Availability in the NorthStar Controller Feature Guide for HA setup instructions. For nested VM configurations, you can modify supervisord-junosvm.sh to add the bridges needed for the additional monitored interfaces. Support MapQuest Plugins v2.2 for Leaflet The slippy map panel used in the NorthStar topology map supports MapQuest Maps if you have a MapQuest API key. Without a MapQuest API key, the slippy map uses Open Street Maps, for which there is no cost or registration requirement. To obtain a MapQuest API key: 1. Register with MapQuest and obtain a MapQuest API key from There is a cost for some plans, which you can see at 2. Close all NorthStar web clients. 3. Log in to the NorthStar application server. 4. Edit the config.json file located at /opt/pcs/nodejs/config.json. 5. Enter the MapQuest API key for the entry mapquestkey (include the key inside the quotes). 6. Launch the NorthStar Controller web client and verify that the slippy map panel loads properly. A sample configuration (config.json) follows: { } "usessl" : true, "useoauth" : true, "limitfullcontroluser" : true, "resttimeout": 30000, "dbcapacity": 35, "nodejsport": 48091, "nodejssslport": 48443, "mapquestkey": "api-key***** External LDAP Improvements The following external LDAP improvements have been added: Active Directory is supported. A Test Connectivity feature has been added so the NorthStar Controller application server can verify connection to the LDAP server. In the Web UI, navigate to Administration > Authentication (Admin user only). Clean Up of Stale User Sessions by Admin The Admin can use a web URL to manually terminate all sessions. 4

5 Changes in Behavior Use the following procedure: 1. Obtain an access token for the Admin user from api-ref-northstar-auth.html. 2. Use the following web URL and action, inserting the appropriate server IP address to replace server-ip: POST Changes in Behavior This section lists changes in NorthStar Controller behavior since the previous release. The NorthStar setup scripts and menu options have changed to support new features. See NorthStar Controller 2.2 RPM Bundle Installation in the NorthStar Controller Getting Started Guide and Configuring a Cluster for High Availability in the NorthStar Controller Feature Guide for complete information. Known Behavior The following behaviors are known to occur in NorthStar Controller Release 2.2.0: The NorthStar application uses default classification for control packets. To support a different packet classification, you can use Linux firewall iptables to reclassify packets to a different priority. See Changing Control Packet Classification Using the Mangle Table in the NorthStar Controller Getting Started Guide for sample configuration snippets that show how to modify the ToS bits using the mangle table, changing DSCP values to cs6. When upgrading the NorthStar Controller from an earlier 2.x release, you should regenerate your Cassandra keystore password and certificate files, because if the certificate has expired, your NTAD session will not come up. To confirm certificate expiration, review the Toposerver log (/opt/northstar/logs/toposerver.log) for the following error message: DB Error: initialize - Error verifying peer certificate: certificate has expired You can also check the certificate expiration date using the following command: # openssl x509 -enddate -noout -in /opt/northstar/data/apache-cassandra/conf/client.pem If the certificate has expired, use the following procedure to correct the problem: 1. Source the environment variable:. /opt/northstar/northstar.env 2. Obtain the current certificate and keystore password. cat /opt/northstar/data/apache-cassandra/conf/cassandra.yaml grep keystore_password 5

6 Release Notes: Juniper Networks NorthStar Controller Verify the existing certificate. keytool -list -v -keystore /opt/northstar/data/apache-cassandra/conf/server.keystore -storepass ${password} 4. Stop all processes. supervisorctl stop northstar:* infra:* 5. Delete existing keys. rm -f /opt/northstar/data/apache-cassandra/conf/server.keystore rm -f /opt/northstar/data/apache-cassandra/conf/server.publickey rm -f /opt/northstar/data/apache-cassandra/conf/client.pem rm -f /opt/northstar/data/apache-cassandra/conf/client.keystore 6. Regenerate the new certificate and key, replacing ${password} in the example with your existing password from the previous command. source /opt/northstar/northstar.env keytool -genkey -alias cassandra -keyalg RSA -validity dname "CN=NorthStar, OU=NorthStar, O=Juniper, L=Sunnyvale, S=CA, C=US" -keypass ${password} -storepass ${password} -keystore /opt/northstar/data/apache-cassandra/conf/server.keystore keytool -export -alias cassandra -keypass ${password} -storepass ${password} -keystore /opt/northstar/data/apache-cassandra/conf/server.keystore -file /opt/northstar/data/apache-cassandra/conf/server.publickey keytool -import -alias cassandra -keypass ${password} -storepass ${password} -file /opt/northstar/data/apache-cassandra/conf/server.publickey -keystore /opt/northstar/data/apache-cassandra/conf/client.keystore -noprompt keytool -exportcert -rfc -noprompt -alias cassandra -keystore /opt/northstar/data/apache-cassandra/conf/server.keystore -storepass ${password} -file /opt/northstar/data/apache-cassandra/conf/client.pem NOTE: For a cluster setup, these files should only be generated on one server and then copied to the rest of the servers in the cluster. 7. Set the access permissions and ownership. cd /opt/northstar/data/apache-cassandra/conf/ chmod 700 * chown pcs:pcs * 8. Restart the Infra process. supervisorctl start infra:* The NorthStar Controller uses a private certificate, which some browsers might automatically flag. You can still proceed to the NorthStar URL. User administration must be done through the Web UI; it cannot be done through the Java client UI. 6

7 Known Issues By default, the topology map layout is not saved, so it is lost during a switchover. In order to retain a layout, you must specifically save it. Navigate to Layout>Manage Layouts, click Save, complete the requested information, and select the Default check box if you want the layout to be your default layout. When scheduled LSPs reach their configured end time, they are automatically deleted from the database. In the Web UI, expired LSPs are automatically removed from the Network Information pane (Tunnel tab) display upon expiration. After installing the NorthStar Controller or performing an upgrade, you should wait for all processes to be up and running before attempting to log in to the Web client. Not doing so can cause the UI to display incomplete information. Refer to the NorthStar Controller Getting Started Guide for information about checking the status of processes. The NorthStar Controller allows you to create PCE-initiated LSPs that serve as secondary or standby LSPs to a primary PCE-initiated LSP. You can also modify a PCC-delegated LSP that serves as secondary or standby LSP to a primary PCC-delegated LSP. You cannot configure PCE-initiated LSPs to serve as secondary or standby LSPs to a primary PCC-delegated LSP. For some delegated LSPs configured with strict path, the actual signaled path uses a different set of transit routers than would be expected according to the RSVP-TE RFC. For optimal performance, we recommend that the total number of PCE-delegated and PCE-initiated LSPs per ingress node be less than or equal to The NorthStar Controller HA module does not trigger a switchover when the NorthStar client is disconnected from the NorthStar server (loss of connectivity). It is the user s responsibility to make sure the connectivity between the client and the server is up and running. PCC-delegated LSP settings data can be lost when de-activating and re-activating PCEP on a PCC. Failover can sometimes happen when shutting down a standby node if the active node is not assigned the highest priority. User-facing interface failure is not covered by HA. Because link flapping parameters (timers and frequency) are not persistent during failover, they have to be manually copied on each node of a cluster. When LSP names collide, a PCC-controlled LSP overrides the PCE-initiated LSP. OSPF should be configured on donor interfaces in unnumbered interface cases, for the donor IP address to be reachable in OSPF. Known Issues Table 2 on page 8 lists known issues in NorthStar Controller Release The identifier associated with each entry is the tracking number in the Juniper Networks Problem Report (PR) tracking system. 7

8 Release Notes: Juniper Networks NorthStar Controller Table 2: Known Issues in NorthStar Controller Identifier For delegated LSPs, if the LSP metric is not part of the initial configuration, a change or addition of the LSP metric through PCEP will result in a make-before-break operation When processing P flags and I flags in PCEP objects, the PCE and PCC do not honor the P flags and I flags that are carried in the PCEP object The bandwidth specified in a PCE-initiated LSP must be greater than or equal to the minimum bandwidth that is specified in an auto-bandwidth template, or the template should not contain a minimum-bandwidth clause. In addition, the bandwidth specified in a PCE-initiated LSP should not exceed the maximum bandwidth that is specified in the template If you configure unnumbered interfaces on parallel links between two routers, the NorthStar Controller is not able to display accurate connections Locally-provisioned filtering does not work as intended in PCCs. Use the command show mpls lsp ingress locally-provisioned to obtain a list of externally provisioned LSPs The show path-computation-client active-pce detail command does not provide the running count of the LSP cleanup timer When you modify the attributes of an LSP, the LSP goes down while the controller remains active. When the configuration of a packet LSP is changed to a non-packet LSP configuration, we recommend that you delete the LSP and re-provision it The /opt/pcs/db/config/pce_md5.config file does not add nodes dynamically, so new PCEP-enabled nodes cannot be brought up. Reset Topology does not clear the MD5 configuration file on the controller (/opt/pcs/db/config/pce_md5.config). When you change topologies, you must manually delete this configuration file Output of the show path-computation-client status command incorrectly includes the count of externally provisioned LSPs The set protocols pcep max-provisioned-lsps command does not prohibit creation of new PCE-initiated LSPs beyond the configured limit. When changing the value of max-provisioned-lsps, the new value must be greater than the number of LSPs currently provisioned on the router. Resolved Issues Table 3 on page 8 lists resolved issues in NorthStar Controller Release Where an identifier is listed, it is the tracking number in the Juniper Networks Problem Report (PR) tracking system. Table 3: Resolved Issues in NorthStar Controller Identifier Operation status of Tunnel does not update properly on PCEP connection down/up event Web UI shows the nodes shifted from the desired location. 8

9 Requesting Technical Support Table 3: Resolved Issues in NorthStar Controller (continued) Identifier Slippy map panel does not display MapQuest tiles properly with API key Topology server becomes out of sync with NTAD Setting Lat/Lon from the map in the Planner client fails. (No ID) REST API is not able to delete links marked as failed (F). (No ID) The controller status of scheduled diverse LSPs displays NoRoute_Rescheduled when an LSP cannot be placed due to insufficient bandwidth. (No ID) Optimization does not work for LSP with required path and a loose route. (No ID) Cannot provision LSP with preferred loose path. Requesting Technical Support Revision History Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. 31 January 2017 NorthStar Controller Release All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 9