Contrail Sandbox Tutorial Script

Transcription

1 Contrail Sandbox Tutorial Script

2 Tutorial Flow Login to lab setup Add security rules Add IP address manager Add two networks Add network policy Add two VMs (can t ping) Add network policy to networks (VMs can ping) Configure DNS resolution in IPAM Add service template Add service instance Put service instance into policy Add sql and wiki VMs Configure floating IP Test wiki available Delete everything Port mirror, network analyzer

3 Accessing the Environment Use RDP client to connect to RDP server address sent in Open Firefox from desktop in RDP window Use bookmarks to open tabs for OpenStack and Contrail

4 OpenStack Change Zoom in Firefox Change zoom to 80% (Ensures dialogs are more visible)

5 OpenStack Security Groups and Contrail Network Policies Security groups control traffic flowing between networks Contrail implements security groups in addition to its own network policies The default security group only allows traffic to flow into a network from another one that is defined in OpenStack, so traffic can t flow in from outside Additional rules need to be added to allow this we will use this when we add floating IP addresses that are accessible via a gateway

6 OpenStack Check Project Project "demo" needs to be selected

7 OpenStack Security Groups Click Access & Security Tab Click Manage Rules Button

8 OpenStack Add Rule Click Add Rule Button

9 OpenStack Add ICMP, TCP, UDP Rules Add Ingress Rules for: ALL ICMP ALL TCP ALL UDP

10 OpenStack Rules Added New Rules Added

11 Take a Look at BGP Router Configuration Setting up a gateway router requires entering the router IP address, the AS number and the supported address families to enable peering

12 Contrail Look at BGP Routers Monitor Button Click Configure Button Click BGP Routers Button Click Expand Button for Router

13 Contrail Gateway Router Details DC-dependent setting DC-independent setting: BGP Peering Information

14 Add an IP Address Manager Each IPAM can have separate DNS, NTP and domain name It s a good idea for each project to have it s own IPAM So let s add one

15 Contrail Add IP Address Manager (IPAM) Make sure you are in the demo project 1. Click IP Address Management Tab 2. Click + Button 3. Enter Name for IPAM 4. Click Save Button

16 Contrail Add Network 1. Click Networks Tab 2. Click + Button

17 Adding Networks Basic properties of a network are its address pool with subnet mask and its default gateway Networks can be added in both OpenStack and Contrail Networks in Contrail have extra parameters to enable connectivity with gateway routers, port mirroring and service chaining

18 Contrail Configure Front End Network 1. Enter Name for Network 2. Open "Subnets" Section 3. Click + Button 3. Select IPAM 4. Add Address 5. (Gateway Address is Automatic) 6. Click Save Button

19 Contrail Configure Back End Network 1. Enter Name for Network 2. Click + Button 3. Select IPAM 4. Add Address 5. (Gateway Address is Automatic) 6. Click Save Button

20 Contrail - Configure Management Network 1. Enter Name for Network 2. Click + Button 3. Select IPAM 4. Add Address 5. (Gateway Address is Automatic) 6. Click Save Button

21 Floating IPs Floating IP pools are addresses that can be allocated to VM interfaces in addition to their normal virtual IP address Vrouter does NAT between the floating IP address and the normal address Floating IPs are usually used to enable external access Each sandbox is configured with a floating IP subnet which are part of a larger prefix that is configured on the gateway router Route target is set to match that on router

22 Contrail Configure Public Network - Subnets DC-dependent setting:10.1.dc_number.0/24 (dc_number is in sandbox )

23 Contrail Configure Public Network - Subnets 1. Select "Advanced Options" 2. Click "External"

24 Contrail Configure Public Network Route Targets

25 Contrail Configure Public Network Floating IP Pools 1. Select Floating IP Pool(s) drop down menu 2. Click + Button 3. Add Pool Name 4. Add Project

26 Contrail Check Subnets Network Subnets

27 Network Policies Contrail network policies control traffic flow between networks Policies must be applied to networks to become effective (even when networks are named inside a policy)

28 Contrail Add Policy 1. Click Policies Tab 2. Click + Button

29 Contrail Configure Policy 1. Configure Name 2. Add Rule 3. Configure Source/Destination 4. Click Save

30 Launch VMs in OpenStack VMs are instantiated by specifying an image to boot from, a flavor (size) and a network for each interface

31 OpenStack Launch VM Instance 1. Click Instances Tab 2. Click Launch Instance Button

32 OpenStack Configure and Launch VM1 and VM2 VMs in wizard Instance name: VM1 Instance name: VM2 Source: Image Source: Image Image: cirros Image: cirros Flavor: tiny Flavor: tiny Network web-front Network sql-backend

33 Accessing a VM console OpenStack provides console access for each VM The console is preserved even if its tab is closed and reopened We will use the console of on VM to test that VMs in different networks can t ping each other when there is no network policy applied

34 OpenStack Open VM1 Console 1. Click Instances Tab 2. Select Console on Menu

35 OpenStack Login to VM1 and Ping VM2 1. Click on gray bar to put keyboard focus into the console 2. Login as cirros/cubswin:) 3. Ping VM (Fails)

36 Apply Policy Apply policy to both networks

37 Contrail Edit web-front Network 1. Click Networks Tab 2. Select Edit on Menu

38 Contrail Add Policy to Networks 1. Select web-to-backend Policy 2. Click Save Button Do Same for sql-backend Network

39 Contrail Policies Are Applied

40 Contrail Check Network Policy Diagram

41 OpenStack Check Ping Is Working Ctrl-c to stop the ping Try ssh l cirros Ctrl-d to terminate session

42 Configure DNS resolution Contrail can run a virtual DNS server DNS has a separate view for each IPAM associated with it Can set a forwarder to use if local DNS does not contain a record

43 Check ping to VM2 does not work

44 Add DNS server 1. Click Server Tab 2. Click on + button 1. Name the DNS server 2. Give the DNS server a dummy domain name 3. Configure DNS Forwarder 4. Select the IPAM 5. Click on the save button

45 Configure DNS in IPAM 1. Click IP Address Mgmt Tab 2. Select Edit on Menu 3. Select Virtual DNS 4. Select DNS-hands-on 5. Click Save button

46 View DNS Records 1. Click Servers Tab 2. Select Active DNS on Menu 3. View VM1, VM2 DNS entries

47 Check DNS resolution working with ping/nslookup

48 Service Chains A service chain is when network policy specifies that traffic between two networks must pass through a service (like a firewall) A service template describes which image should be used and the order of its interfaces A service instance is one or more instantiated VMs with its interfaces associated with interfaces in a template Traffic only flows through a service instance when it is included in a network policy

49 Contrail Add Service Template 1. Click Service Templates Tab 2. Click + Button

50 Contrail - Configure Service Template 1. Name Firewall-Template-X 2. Version v2 3. Virtualization Type Virtual Machine 4. Service Mode In-Network 5. Service Type Firewall 6. Click + Button to Add 1st Interface 7. Click + Button on lowest Interface 8. Click + Button on new lowest Interface 9. Click Save Button

51 OpenStack- Launch VM that will become service Instance name: Source: Image: Flavor: Networks FW-inst Image SDN-NoNAT medium svc-mgt web-front sql-backend

52 OpenStack - Open Service Instance Console

53 OpenStack Login Prompt Means Instance is Ready 1. Login with root/c0ntrail Type cli at prompt 3. Type show config to take a look at the

54 Contrail - Configure Service Instance Interfaces FW-inst 1. Name firewall-inst 2. Service Template FW-Template 3. Choose networks 4. Open Tuple

55 Contrail - Configure Service Instance Interfaces 1. Select management interface 2. Select left interface 3. Select right interface (hidden)

56 Contrail - Complete Screen 1. Click Save

57 Contrail Edit Policy

58 Contrail Add Service To Policy 1. Check Services Box 2. Select firewall-inst Service 3. Click Save Button

59 Contrail Check Service Inserted

60 OpenStack Check Ping Still Working

61 Building a Two-Tier Application Deploy an SQL backend and LAMP front end into the two networks Allocate a floating IP address Access a wiki from your PC via the internet First - delete VM1, VM2 using OpenStack GUI

62 OpenStack Configure and Launch front-end and sql-server VMs Instance name: Source: Image: Flavor: Network front-end Image demo-wiki small web-front Instance name: Source: Image: Flavor: Network sql-server Image demo-sql small sql-backend

63 OpenStack Open SQL-server Console

64 OpenStack Check SQL Running

65 OpenStack Check front-end Console

66 Contrail Configure Specific Network Policy

67 Contrail Associate Floating IP 1. Select Manage Floating IPs Tab 2. Click + Button

68 Contrail Pull IP from Pool 1. Select dc-net:publicpool 2. Click Save Button

69 Contrail Associate Floating IP to Port Select Associate Port Menu Item

70 Contrail Associate Floating IP to Front End 1. In OpenStack find the IP address of front-end 2. Select Port with front-end address

71 New Browser Tab Check Access to Wiki Enter Your Floating IP Address

72 Deletion Exercise Delete all the objects created in the tutorial so far Try to do this without getting any popups complaining about dependencies

73 Analyzer Exercise Find Contrail 3.1 Documentation Locate section dealing with Traffic Mirroring Use Configure > Networking > Services method to put mirroring between VMs in two new networks with new VMs in them

74 End