Skip to content

Commit 106730c

Browse files
Radhika PCpranavs
Radhika PC
authored and
pranavs
committed
SRX and f5 inline mode documentation: Reviewed-By: Jessica Tomechak
1 parent bb59c1e commit 106730c

9 files changed

Lines changed: 240 additions & 48 deletions

‎docs/en-US/external-guest-firewall-integration.xml‎

Lines changed: 21 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -21,23 +21,16 @@
2121
<section id="external-guest-firewall-integration">
2222
<title>External Guest Firewall Integration for Juniper SRX (Optional)</title>
2323
<note>
24-
<para>Available only for guests using advanced networking.</para>
24+
<para>Available only for guests using advanced networking, both shared and isolated.</para>
2525
</note>
2626
<para>&PRODUCT; provides for direct management of the Juniper SRX series of firewalls. This
27-
enables &PRODUCT; to establish static NAT mappings from public IPs to guest VMs, and to use
28-
the Juniper device in place of the virtual router for firewall services. You can have one or
29-
more Juniper SRX per zone. This feature is optional. If Juniper integration is not provisioned,
30-
&PRODUCT; will use the virtual router for these services.</para>
27+
enables &PRODUCT; to establish staticNAT mappings from public IPs to guest VMs, and to use the
28+
Juniper device in place of the virtual router for firewall services. You can have only one
29+
Juniper SRX device per zone. This feature is optional. If Juniper integration is not
30+
provisioned, &PRODUCT; will use the virtual router for these services.</para>
3131
<para>The Juniper SRX can optionally be used in conjunction with an external load balancer.
32-
External Network elements can be deployed in a side-by-side or inline configuration.</para>
33-
<mediaobject>
34-
<imageobject>
35-
<imagedata fileref="./images/parallel-mode.png"/>
36-
</imageobject>
37-
<textobject>
38-
<phrase>parallel-mode.png: adding a firewall and load balancer in parallel mode.</phrase>
39-
</textobject>
40-
</mediaobject>
32+
External Network elements can be deployed in a side-by-side or inline configuration. For more
33+
information, see <xref linkend="inline-config-lb-fw"/>.</para>
4134
<para>&PRODUCT; requires the Juniper to be configured as follows:</para>
4235
<note>
4336
<para>Supported SRX software version is 10.3 or higher.</para>
@@ -58,22 +51,22 @@
5851
<para>Record the public and private interface names. If you used a VLAN for the public
5952
interface, add a ".[VLAN TAG]" after the interface name. For example, if you are using
6053
ge-0/0/3 for your public interface and VLAN tag 301, your public interface name would be
61-
"ge-0/0/3.301". Your private interface name should always be untagged because the
62-
&PRODUCT; software automatically creates tagged logical interfaces.</para>
54+
"ge-0/0/3.301". Your private interface name should always be untagged because the &PRODUCT;
55+
software automatically creates tagged logical interfaces.</para>
6356
</listitem>
6457
<listitem>
65-
<para>Create a public security zone and a private security zone. By default, these will
66-
already exist and will be called "untrust" and "trust". Add the public interface to the
67-
public zone and the private interface to the private zone. Note down the security zone
68-
names.</para>
58+
<para>Create a public security zone and a private security zone. By default, these already
59+
exist and are called "untrust" and "trust" zones. Add the public interface to the public
60+
zone. &PRODUCT;automatically adds the private interface to private zone (trusted zone). Note
61+
down the security zone names.</para>
6962
</listitem>
7063
<listitem>
7164
<para>Make sure there is a security policy from the private zone to the public zone that
7265
allows all traffic.</para>
7366
</listitem>
7467
<listitem>
75-
<para>Note the username and password of the account you want the &PRODUCT; software to log
76-
in to when it is programming rules.</para>
68+
<para>Note the username and password of the account you want the &PRODUCT; software to log in
69+
to when it is programming rules.</para>
7770
</listitem>
7871
<listitem>
7972
<para>Make sure the "ssh" and "xnm-clear-text" system services are enabled.</para>
@@ -124,13 +117,13 @@ filter untrust {
124117
<para>In the left navigation bar, click Infrastructure.</para>
125118
</listitem>
126119
<listitem>
127-
<para>In Zones, click View More.</para>
120+
<para>In Zones, click View All.</para>
128121
</listitem>
129122
<listitem>
130123
<para>Choose the zone you want to work with.</para>
131124
</listitem>
132125
<listitem>
133-
<para>Click the Network tab.</para>
126+
<para>Click the Physical Network tab.</para>
134127
</listitem>
135128
<listitem>
136129
<para>In the Network Service Providers node of the diagram, click Configure. (You might have
@@ -159,10 +152,6 @@ filter untrust {
159152
<para>Private Interface: The name of the private interface on the SRX. For example,
160153
ge-0/0/1. </para>
161154
</listitem>
162-
<listitem>
163-
<para>Usage Interface: (Optional) Typically, the public interface is used to meter
164-
traffic. If you want to use a different interface, specify its name here</para>
165-
</listitem>
166155
<listitem>
167156
<para>Number of Retries: The number of times to attempt a command on the SRX before
168157
failing. The default value is 2.</para>
@@ -180,12 +169,12 @@ filter untrust {
180169
untrust.</para>
181170
</listitem>
182171
<listitem>
183-
<para>Capacity: The number of networks the device can handle</para>
172+
<para>Capacity: The number of networks the device can handle.</para>
184173
</listitem>
185174
<listitem>
186175
<para>Dedicated: When marked as dedicated, this device will be dedicated to a single
187176
account. When Dedicated is checked, the value in the Capacity field has no significance
188-
implicitly, its value is 1</para>
177+
implicitly, its value is 1.</para>
189178
</listitem>
190179
</itemizedlist>
191180
</listitem>
@@ -194,8 +183,8 @@ filter untrust {
194183
</listitem>
195184
<listitem>
196185
<para>Click Global Settings. Set the parameter external.network.stats.interval to indicate how
197-
often you want &PRODUCT; to fetch network usage statistics from the Juniper SRX. If you
198-
are not using the SRX to gather network usage statistics, set to 0.</para>
186+
often you want &PRODUCT; to fetch network usage statistics from the Juniper SRX. If you are
187+
not using the SRX to gather network usage statistics, set to 0.</para>
199188
</listitem>
200189
</orderedlist>
201190
</section>

‎docs/en-US/external-guest-lb-integration.xml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,12 @@
2020
-->
2121
<section id="external-guest-lb-integration">
2222
<title>External Guest Load Balancer Integration (Optional)</title>
23+
<note>
24+
<para>External load balancer devices are not supported in shared networks.</para>
25+
</note>
2326
<para>&PRODUCT; can optionally use a Citrix NetScaler or BigIP F5 load balancer to provide load
2427
balancing services to guests. If this is not enabled, &PRODUCT; will use the software load
2528
balancer in the virtual router.</para>
26-
<para>To install and enable an external load balancer for &PRODUCT; management:</para>
2729
<orderedlist>
2830
<listitem>
2931
<para>Set up the appliance according to the vendor's directions.</para>

‎docs/en-US/hardware-firewall.xml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,11 @@
2222
<title>Hardware Firewall</title>
2323
<para>All deployments should have a firewall protecting the management server; see Generic
2424
Firewall Provisions. Optionally, some deployments may also have a Juniper SRX firewall that will
25-
be the default gateway for the guest networks; see <xref linkend="external-guest-firewall-integration"/>.</para>
25+
be the default gateway for the guest networks; see <xref
26+
linkend="external-guest-firewall-integration"/>.</para>
2627
<xi:include href="generic-firewall-provisions.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
27-
<xi:include href="external-guest-firewall-integration.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
28-
<xi:include href="external-guest-lb-integration.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
28+
<xi:include href="external-guest-firewall-integration.xml"
29+
xmlns:xi="http://www.w3.org/2001/XInclude"/>
30+
<xi:include href="lb-services.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
31+
<xi:include href="inline-config-lb-fw.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
2932
</section>

‎docs/en-US/images/add-netscaler.png‎

22.2 KB
Loading

‎docs/en-US/images/parallel-inline-mode.png‎

142 KB
Loading

‎docs/en-US/inline-config-lb-fw.xml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
<?xml version='1.0' encoding='utf-8' ?>
2+
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
3+
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
4+
%BOOK_ENTITIES;
5+
]>
6+
<!-- Licensed to the Apache Software Foundation (ASF) under one
7+
or more contributor license agreements. See the NOTICE file
8+
distributed with this work for additional information
9+
regarding copyright ownership. The ASF licenses this file
10+
to you under the Apache License, Version 2.0 (the
11+
"License"); you may not use this file except in compliance
12+
with the License. You may obtain a copy of the License at
13+
http://www.apache.org/licenses/LICENSE-2.0
14+
Unless required by applicable law or agreed to in writing,
15+
software distributed under the License is distributed on an
16+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17+
KIND, either express or implied. See the License for the
18+
specific language governing permissions and limitations
19+
under the License.
20+
-->
21+
<section id="inline-config-lb-fw">
22+
<title>Configuring Network Devices in Inline and Side by Side Modes</title>
23+
<para>The external network elements, such as load balancer and firewall devices, supported in
24+
&PRODUCT; can be deployed in either of the following modes: Side by Side and Inline. Inline mode
25+
was originally supported in &PRODUCT; 2.2.x versions, and is now added back in the 3.0.6
26+
release.</para>
27+
<para>In Inline mode, one firewall device is placed in front of a load balancing device. The
28+
firewall acts as the gateway for all incoming traffic, then redirect the load balancing traffic
29+
to the load balancer behind it. The load balancer in this case will not have the direct access
30+
to the public network. Deploying network devices in Inline mode ensures that the resources are
31+
protected.</para>
32+
<mediaobject>
33+
<imageobject>
34+
<imagedata fileref="./images/parallel-inline-mode.png"/>
35+
</imageobject>
36+
<textobject>
37+
<phrase>parallel-inline-mode.png: external networks in different deployment modes</phrase>
38+
</textobject>
39+
</mediaobject>
40+
<para>In Side by Side mode, a firewall device is deployed in parallel with the load balancer
41+
device. So the traffic to the load balancer public IP is not routed through the firewall, and
42+
therefore, is exposed to the public network. </para>
43+
<mediaobject>
44+
<imageobject>
45+
<imagedata fileref="./images/parallel-mode.png"/>
46+
</imageobject>
47+
<textobject>
48+
<phrase>parallel-mode.png: adding a firewall and load balancer in side by side mode</phrase>
49+
</textobject>
50+
</mediaobject>
51+
<para>The following table gives you an overview of the supported services and devices for inline
52+
and side by side mode.</para>
53+
<informaltable>
54+
<tgroup cols="4" align="left" colsep="1" rowsep="1">
55+
<colspec colwidth="1.08*" colname="c1" colnum="1"/>
56+
<colspec colwidth="1.2*" colname="c2" colnum="2"/>
57+
<colspec colnum="3" colname="c3" colwidth="1.0*"/>
58+
<colspec colnum="4" colname="c4" colwidth="5.15*"/>
59+
<thead>
60+
<row>
61+
<entry><para>Mode</para></entry>
62+
<entry><para>Firewall</para></entry>
63+
<entry><para>Load Balancer</para></entry>
64+
<entry><para>Supported</para></entry>
65+
</row>
66+
</thead>
67+
<tbody>
68+
<row>
69+
<entry><para>Side by Side</para></entry>
70+
<entry><para>Virtual Router</para></entry>
71+
<entry><para>F5</para></entry>
72+
<entry><para>Yes</para></entry>
73+
</row>
74+
<row>
75+
<entry><para>Side by Side</para></entry>
76+
<entry><para>Virtual Router</para></entry>
77+
<entry><para>Virtual Router</para></entry>
78+
<entry><para>Yes</para></entry>
79+
</row>
80+
<row>
81+
<entry><para>Side by Side</para></entry>
82+
<entry><para>Virtual Router</para></entry>
83+
<entry><para>NetScaler</para></entry>
84+
<entry><para>Yes</para></entry>
85+
</row>
86+
<row>
87+
<entry><para>Side by Side</para></entry>
88+
<entry><para>Juniper SRX</para></entry>
89+
<entry><para>F5</para></entry>
90+
<entry><para>Yes</para></entry>
91+
</row>
92+
<row>
93+
<entry><para>Side by Side</para></entry>
94+
<entry><para>Juniper SRX</para></entry>
95+
<entry><para>NetScaler</para></entry>
96+
<entry><para>Yes</para></entry>
97+
</row>
98+
<row>
99+
<entry><para>Inline</para></entry>
100+
<entry><para>Virtual Router</para></entry>
101+
<entry><para>F5</para></entry>
102+
<entry><para>No</para></entry>
103+
</row>
104+
<row>
105+
<entry><para>Inline</para></entry>
106+
<entry><para>Virtual Router</para></entry>
107+
<entry><para>NetScaler</para></entry>
108+
<entry><para>No</para></entry>
109+
</row>
110+
<row>
111+
<entry><para>Inline</para></entry>
112+
<entry><para>Juniper SRX</para></entry>
113+
<entry><para>F5</para></entry>
114+
<entry><para>Yes</para></entry>
115+
</row>
116+
<row>
117+
<entry><para>Inline</para></entry>
118+
<entry><para>Juniper SRX</para></entry>
119+
<entry><para>NetScaler</para></entry>
120+
<entry><para>No</para></entry>
121+
</row>
122+
<row>
123+
<entry><para>Inline</para></entry>
124+
<entry><para>Juniper SRX</para></entry>
125+
<entry><para>Virtual Router</para></entry>
126+
<entry><para>No</para></entry>
127+
</row>
128+
</tbody>
129+
</tgroup>
130+
</informaltable>
131+
<para>To configure SRX and F5 in Inline mode:</para>
132+
<orderedlist>
133+
<listitem>
134+
<para>Configure F5 Big IP and Juniper SRX.</para>
135+
<para>See the respective product documentation for more information.</para>
136+
</listitem>
137+
<listitem>
138+
<para>Add SRX and F5 to the same zone in &PRODUCT;.</para>
139+
<note>
140+
<para>Ensure that you select per zone sourceNAT when creating the network offering. When
141+
adding F5 BigIP, do not make it a dedicated device.</para>
142+
</note>
143+
</listitem>
144+
<listitem>
145+
<para>Enable both the devices.</para>
146+
</listitem>
147+
<listitem>
148+
<para>Create a network offering:</para>
149+
<para>Use SRX as provider for Firewall, Port Forwarding, SourceNAT, and StaticNat. Select F5
150+
BigIP as the service provider for Load Balancing. Use Virtual Router as the service provider
151+
for DNS, DHCP, user data.</para>
152+
</listitem>
153+
<listitem>
154+
<para>Select Inline mode.</para>
155+
<para>For more information, see <phrase condition="admin"><xref
156+
linkend="creating-network-offerings"/>.</phrase>
157+
<phrase condition="install">Creating Network Offerings in the Administration Guide.</phrase>
158+
</para>
159+
</listitem>
160+
<listitem>
161+
<para>Start a new VM with this new network offering.</para>
162+
</listitem>
163+
<listitem>
164+
<para>Add firewall and load balancing rules. For more information, see <phrase
165+
condition="admin"><xref linkend="add-load-balancer-rule"/></phrase>
166+
<phrase condition="install">Adding a Load Balancer Rule</phrase> and <phrase
167+
condition="admin"><xref linkend="firewall-rules"/>.</phrase>
168+
<phrase condition="install">IP Forwarding and Firewalling in the Administration
169+
Guide.</phrase>
170+
</para>
171+
</listitem>
172+
</orderedlist>
173+
</section>

‎docs/en-US/lb-services.xml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version='1.0' encoding='utf-8' ?>
2+
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
3+
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
4+
%BOOK_ENTITIES;
5+
]>
6+
<!-- Licensed to the Apache Software Foundation (ASF) under one
7+
or more contributor license agreements. See the NOTICE file
8+
distributed with this work for additional information
9+
regarding copyright ownership. The ASF licenses this file
10+
to you under the Apache License, Version 2.0 (the
11+
"License"); you may not use this file except in compliance
12+
with the License. You may obtain a copy of the License at
13+
http://www.apache.org/licenses/LICENSE-2.0
14+
Unless required by applicable law or agreed to in writing,
15+
software distributed under the License is distributed on an
16+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17+
KIND, either express or implied. See the License for the
18+
specific language governing permissions and limitations
19+
under the License.
20+
-->
21+
<section id="lb-services">
22+
<title>Load Balancing Services</title>
23+
<xi:include href="external-guest-lb-integration.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
24+
<xi:include href="management-server-lb.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
25+
</section>

‎docs/en-US/management-server-lb.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@
1919
under the License.
2020
-->
2121
<section id="management-server-lb">
22-
<title>Setting Zone VLAN and Running VM Maximums</title>
23-
<para>&PRODUCT; can use a load balancer to provide a virtual IP for multiple Management
24-
Servers. The administrator is responsible for creating the load balancer rules for the
25-
Management Servers. The application requires persistence or stickiness across multiple sessions.
26-
The following chart lists the ports that should be load balanced and whether or not persistence
27-
is required.</para>
22+
<title>Management Server Load Balancing</title>
23+
<para>&PRODUCT; can use a load balancer to provide a virtual IP for multiple Management Servers.
24+
The administrator is responsible for creating the load balancer rules for the Management
25+
Servers. The application requires persistence or stickiness across multiple sessions. The
26+
following chart lists the ports that should be load balanced and whether or not persistence is
27+
required.</para>
2828
<para>Even if persistence is not required, enabling it is permitted.</para>
2929
<informaltable>
3030
<tgroup cols="4" align="left" colsep="1" rowsep="1">

‎docs/en-US/network-setup.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,16 @@
2020
-->
2121
<chapter id="network-setup">
2222
<title>Network Setup</title>
23-
<para>Achieving the correct networking setup is crucial to a successful &PRODUCT;
24-
installation. This section contains information to help you make decisions and follow the right
25-
procedures to get your network set up correctly.</para>
23+
<para>Achieving the correct networking setup is crucial to a successful &PRODUCT; installation.
24+
This section contains information to help you make decisions and follow the right procedures to
25+
get your network set up correctly.</para>
2626
<xi:include href="basic-adv-networking.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
2727
<xi:include href="vlan-allocation-eg.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
2828
<xi:include href="hardware-config-eg.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
2929
<xi:include href="layer2-switch.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
3030
<xi:include href="hardware-firewall.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
31-
<xi:include href="management-server-lb.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
3231
<xi:include href="topology-req.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
33-
<xi:include href="guest-nw-usage-with-traffic-sentinel.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
32+
<xi:include href="guest-nw-usage-with-traffic-sentinel.xml"
33+
xmlns:xi="http://www.w3.org/2001/XInclude"/>
3434
<xi:include href="set-zone-vlan-run-vm-max.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
35-
</chapter>
35+
</chapter>

0 commit comments

Comments
 (0)