Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Introducing Cisco Cloud Community Controller on Google Cloud Platform – Half 2
[ad_1]
Half 1 of this weblog collection demonstrated how Cisco CNC can automate cloud networking inside GCP independently of safety insurance policies. Half 2 goes over extra capabilities pertaining to contract-based routing and firewall guidelines automation by extending the identical coverage mannequin.
One of many causes for decoupling routing and safety is to provide clients extra flexibility. Usually, organizations could have totally different groups chargeable for cloud networking and safety insurance policies definitions within the cloud. Nonetheless, for these use instances the place coverage consistency is a high precedence adopted by extra governance of cloud assets, a standard coverage mannequin is a should.
Coverage Mannequin Translation
Beneath is a high-level one-to-one mapping of the Cisco CNC coverage mannequin to native GCP cloud constructs.
Primarily, a tenant maps to a challenge and is the top-level logical container holding all the opposite insurance policies. For cloud networking, Cisco CNC interprets the mix of VRF and Cloud Context Profile into international VPC networks and regional subnets. Within the situation beneath, Cisco CNC may even translate safety insurance policies by combining cloud EPGs (Endpoint Teams) with contracts and filters into firewall guidelines and community tags in GCP.
By definition, a cloud EPG is a group of endpoints sharing the identical safety coverage, can have endpoints in a number of subnets and is tied to a VRF.
Situation
This situation has two VRFs: network-a and network-b. Moreover, cloud EPGs Net & App will likely be created and related to contracts with particular safety insurance policies outlined by filters. A Cloud Exterior EPG may even be created as Web EPG to permit web entry on network-a.
On GCP, these insurance policies are translated into correct VPC networks, subnets, routing tables, peering, firewall guidelines, and community tags. Observe that for this situation, VPCs and subnets had been already pre-provisioned.
Contract-based Routing
On Half 1 of this weblog collection, a route leak coverage was created to permit inter-VRF routing between network-a and network-b. For this situation, solely contract-based routing will likely be enabled, which implies contracts will drive routing the place wanted. Due to this fact, the leak route coverage created beforehand was eliminated and peering between VPCs disconnected.
Contract-based Routing is a world mode configuration out there within the Cloud Community Controller Setup. Observe that when contract-based routing is enabled, the routes between a pair of inner VRFs might be leaked utilizing contracts solely within the absence of a route leak coverage.
Observe: a quick overview of the Cisco CNC GUI was offered on Half 1.
Firewall Guidelines Automation
The configuration beneath illustrates the creation of Net and Web EPGs tied to network-a, together with their related endpoint selectors. These are used to assign endpoints to a Cloud EPG, and might be primarily based on IP tackle, Subnet, Area, or Customized tags (utilizing a mix of key worth pairs and match expressions).
For the Net EPG, a key worth pair is used with particular tags to be matched (customized: epg equals net). For the Web EPG, a subnet selector is used permitting all visitors. Moreover, Web EPG must be kind Exterior as web entry will likely be allowed on network-a.
The Cloud EPG App configuration shouldn’t be depicted for brevity however is just like that of cloud EPG Net. Nonetheless, it’s tied to network-b and set with its distinctive endpoint selector (customized: epg equals app).
On GCP, these insurance policies get translated to devoted ingress firewall guidelines and community tags for Net and App as highlighted utilizing the next format: capic-<app-profile-name>-<epg-name>.
Observe: Rebranding from Cloud APIC to Cloud Community Controller is roofed on Half 1.
Within the instance beneath, cloud endpoints instantiated in GCP with labels matching the endpoint selectors are assigned to community tags and firewall guidelines automated by Cisco CNC.
Associating Contracts to EPGs
Now, let’s affiliate the web-to-app contract between Net and App EPGs utilizing the idea of client and supplier to outline guidelines course.
Upon associating the contract, extra ingress and egress firewall guidelines are programmed relying on the buyer and supplier relationship specified. Particularly, these firewall guidelines are up to date primarily based on safety insurance policies outlined by contracts and filters. For brevity, all visitors is allowed however granular filters might be added per necessities. On one other word, these guidelines are solely programmed as soon as cloud endpoints matching the foundations are instantiated.
Wait, what about peering between these VPCs? Since contract-based routing is enabled, it additionally drives routing by enabling peering and auto producing routes to one another accordingly.
Lastly, let’s permit web entry to net providers residing on network-a by including the internet-access contract between Web and Net EPGs.
As quickly because the contract is related, Cisco CNC provides an ingress firewall rule with community tags representing the Net EPG which permits web entry to endpoints behind it.
From this level on, web entry to web-server is allowed in addition to connectivity from the web-server to the app-server.
root@web-server:/dwelling/marinfer# ifconfig ens4 ens4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1460 inet 172.16.1.2 netmask 255.255.255.255 broadcast 172.16.1.2 inet6 fe80::4001:acff:fe10:102 prefixlen 64 scopeid 0x20<hyperlink> ether 42:01:ac:10:01:02 txqueuelen 1000 (Ethernet) RX packets 19988 bytes 3583929 (3.4 MiB) RX errors 0 dropped 0 overruns 0 body 0 TX packets 17707 bytes 1721956 (1.6 MiB) TX errors 0 dropped 0 overruns 0 service 0 collisions 0 root@web-server:/dwelling/marinfer# ping 172.16.128.2 PING 172.16.128.2 (172.16.128.2) 56(84) bytes of information. 64 bytes from 172.16.128.2: icmp_seq=1 ttl=64 time=58.3 ms 64 bytes from 172.16.128.2: icmp_seq=2 ttl=64 time=56.0 ms 64 bytes from 172.16.128.2: icmp_seq=3 ttl=64 time=56.0 ms 64 bytes from 172.16.128.2: icmp_seq=4 ttl=64 time=56.0 ms
Cloud Assets Visibility
Utilizing a cloud-like coverage mannequin, Cisco CNC offers a topology and hierarchical view of cloud assets on a per tenant foundation with drill down choices. Furthermore, software profile containers group collectively cloud EPGs and related contracts for simple visibility of insurance policies and dependencies.
Extra granular visibility is offered all the best way to cloud endpoints. Firewall guidelines are additionally seen by way of Cisco CNC GUI below Ingress and Egress Guidelines.
Abstract
Defining and managing safety insurance policies might be difficult, which may end up in elevated operational overhead and coverage inconsistency. Apart from automating and giving extra visibility into firewall guidelines in GCP, Cisco CNC can also be offering an extra layer of governance from a centralized administration airplane.
Half 3 completes this weblog collection by displaying how Cisco Cloud Community Controller builds and automates exterior cloud connectivity from and to GCP.
Assets
Cisco Cloud Community Controller for Google Cloud Set up Guides
Cisco Cloud Community Controller for Google Cloud Consumer Guides
Weblog Sequence: Introducing Cisco Cloud Community Controller on Google Cloud Platform
Half 1: Native Cloud Networking Automation
Half 3: Exterior Cloud Connectivity Automation – Coming Quickly
Share:
[ad_2]