1. Virtual Network Management Center 2
Virtual Network Management Center 2.0 Firewall and Policy Configuration
Ranga Maddipudi
Technical Marketing Engineer
Cisco Cloud and System Management Technology Group

2. Agenda Tenant Management Device Profiles Compute Firewall (VSG)
Edge Firewall (ASA1000V)
Controller

3. Tenant Management

4. Defining Tenant Structure in VNMC - Tenant
Creating Tenant

5. Defining Tenant Structure in VNMC – Virtual Data Center
Creating Tenant Virtual Data Center

6. Defining Tenant Structure in VNMC – Application
Creating Application in a Virtual Data Center

7. Defining Tenant Structure in VNMC – Tier
Creating Application Tier

8. Tenant Management - Summary

9. Device Profiles

10. Device Profiles
Defines global parameters for a device (VSG, ASA1000V) – SNMP, SYSLOG, DNS, NTP etc.

11. Device Profiles - Syslog

12. Compute Firewall (VSG)

13. Compute Firewall Creation

14. Assign VSG

15. Assign VSG (contd.)

16. Security Profile Structure
Policy Set
Policy 1
Policy 2
Policy N
Rule 1
Rule 1
Rule 1
Rule 2
Rule 2
Rule 2
Rule N
Rule N
Rule N

17. Policy Helpers – Object Groups

18. Policy Helpers – Object Groups (contd.)

19. Policy Helpers – vZones

20. Policy Helpers – vZones (contd.)

21. ACL Policies

22. ACL Policy Sets

23. Compute Security Profile

24. Compute Security Profile (contd.)

25. Bind Compute Security Profile to a Port-Profile
Define the service node in Nexus 1000V
Define the Service Chain
Enable the Service Chain on Port-Profile

26. Assign Port-Profile to VM Network Adapter

27. Policy Enforcement Verification
Syslog Message
Policy engine statistics in VSG

28. Edge Firewall (ASA1000V)

29. Edge Device Profiles
Allows to setup DHCP, VPN, IP Audit and Routing policies of Edge Firewall (ASA 1000V)

30. Edge Firewall 192.168.200.10 Win 8 Client 192.168.200.15 outside
ASA1000V
inside
Win 7 Client
Web Server
Db Server
VSG

31. Edge Firewall Creation

32. Edge Firewall Creation

33. Assign ASA1000V

34. Assign ASA1000V (contd.)

35. Edge Security Profile - NAT Use Case
Win 8
Client
Tenant
ASA
Static NAT
Win 7 Client
Web Server
Db Server
VSG

36. Edge Security Profile Creation

37. Edge Security Profile Creation – Name & Ingress

38. Edge Security Profile Creation - Egress

39. Edge Security Profile Creation – Static NAT

40. Edge Security Profile Creation – Static NAT (2)

41. Edge Security Profile Creation – Static NAT (3)

42. Edge Security Profile Creation – Static NAT (4)

43. Edge Security Profile Creation – Static NAT (5)

44. Bind Edge Security Profile to Port-Profile
Define the service node in Nexus 1000V for ASA1000V
Define the Service Chain (Order is inside to outside)
Enable the Service Chain on Port-Profile

45. Policy Enforcement Verification
Syslog Messages
Verify NAT on ASA