Virtual Network Management Center 2 Virtual Network Management Center 2.0 Firewall and Policy Configuration Ranga Maddipudi Technical Marketing Engineer Cisco Cloud and System Management Technology Group

Agenda Tenant Management Device Profiles Compute Firewall (VSG) Edge Firewall (ASA1000V) Controller

Tenant Management

Defining Tenant Structure in VNMC - Tenant Creating Tenant

Defining Tenant Structure in VNMC – Virtual Data Center Creating Tenant Virtual Data Center

Defining Tenant Structure in VNMC – Application Creating Application in a Virtual Data Center

Defining Tenant Structure in VNMC – Tier Creating Application Tier

Tenant Management - Summary

Device Profiles

Device Profiles Defines global parameters for a device (VSG, ASA1000V) – SNMP, SYSLOG, DNS, NTP etc.

Device Profiles - Syslog

Compute Firewall (VSG)

Compute Firewall Creation

Assign VSG

Assign VSG (contd.)

Security Profile Structure Policy Set Policy 1 Policy 2 Policy N Rule 1 Rule 1 Rule 1 Rule 2 Rule 2 Rule 2 Rule N Rule N Rule N

Policy Helpers – Object Groups

Policy Helpers – Object Groups (contd.)

Policy Helpers – vZones

Policy Helpers – vZones (contd.)

ACL Policies

ACL Policy Sets

Compute Security Profile

Compute Security Profile (contd.)

Bind Compute Security Profile to a Port-Profile Define the service node in Nexus 1000V Define the Service Chain Enable the Service Chain on Port-Profile

Assign Port-Profile to VM Network Adapter

Policy Enforcement Verification Syslog Message Policy engine statistics in VSG

Edge Firewall (ASA1000V)

Edge Device Profiles Allows to setup DHCP, VPN, IP Audit and Routing policies of Edge Firewall (ASA 1000V)

Edge Firewall 192.168.200.10 Win 8 Client 192.168.200.15 outside ASA1000V 192.168.100.15 inside Win 7 Client Web Server Db Server VSG 192.168.100.20 192.168.100.10 192.168.100.11 192.168.100.12

Edge Firewall Creation

Edge Firewall Creation

Assign ASA1000V

Assign ASA1000V (contd.)

Edge Security Profile - NAT Use Case 192.168.200.10 Win 8 Client Tenant 192.168.200.11 192.168.200.15 ASA Static NAT 192.168.100.15 Win 7 Client Web Server Db Server VSG 192.168.100.20 192.168.100.10 192.168.100.11 192.168.100.12

Edge Security Profile Creation

Edge Security Profile Creation – Name & Ingress

Edge Security Profile Creation - Egress

Edge Security Profile Creation – Static NAT

Edge Security Profile Creation – Static NAT (2)

Edge Security Profile Creation – Static NAT (3)

Edge Security Profile Creation – Static NAT (4)

Edge Security Profile Creation – Static NAT (5)

Bind Edge Security Profile to Port-Profile Define the service node in Nexus 1000V for ASA1000V Define the Service Chain (Order is inside to outside) Enable the Service Chain on Port-Profile

Policy Enforcement Verification Syslog Messages Verify NAT on ASA