Introducing Cisco Cloud Community Controller on Google Cloud Platform – Half 2

[ad_1]

Half 1 of this weblog sequence demonstrated how Cisco CNC can automate cloud networking inside GCP independently of safety insurance policies. Half 2 goes over further capabilities pertaining to contract-based routing and firewall guidelines automation by extending the identical coverage mannequin.

One of many causes for decoupling routing and safety is to present prospects extra flexibility. Typically, organizations could have completely different groups answerable for cloud networking and safety insurance policies definitions within the cloud. Nonetheless, for these use circumstances the place coverage consistency is a prime precedence adopted by extra governance of cloud assets, a standard coverage mannequin is a should.

Coverage Mannequin Translation

Under is a high-level one-to-one mapping of the Cisco CNC coverage mannequin to native GCP cloud constructs.

Policy Model Translation

Primarily, a tenant maps to a challenge and is the top-level logical container holding all the opposite insurance policies. For cloud networking, Cisco CNC interprets the mixture of VRF and Cloud Context Profile into international VPC networks and regional subnets. Within the state of affairs under, Cisco CNC will even translate safety insurance policies by combining cloud EPGs (Endpoint Teams) with contracts and filters into firewall guidelines and community tags in GCP.

By definition, a cloud EPG is a set of endpoints sharing the identical safety coverage, can have endpoints in a number of subnets and is tied to a VRF.

Situation

This state of affairs has two VRFs: network-a and network-b. Moreover, cloud EPGs Internet & App might be created and related to contracts with particular safety insurance policies outlined by filters. A Cloud Exterior EPG will even be created as Web EPG to permit web entry on network-a.

Scenario

On GCP, these insurance policies are translated into correct VPC networks, subnets, routing tables, peering, firewall guidelines, and community tags. Observe that for this state of affairs, VPCs and subnets have been already pre-provisioned.

High Level Architecture

Contract-based Routing

On Half 1 of this weblog sequence, a route leak coverage was created to permit inter-VRF routing between network-a and network-b. For this state of affairs, solely contract-based routing might be enabled, which implies contracts will drive routing the place wanted. Subsequently, the leak route coverage created beforehand was eliminated and peering between VPCs disconnected.

Contract-based Routing is a world mode configuration accessible within the Cloud Community Controller Setup. Observe that when contract-based routing is enabled, the routes between a pair of inner VRFs may be leaked utilizing contracts solely within the absence of a route leak coverage.

Contract-based Routing

Observe: a short overview of the Cisco CNC GUI was supplied on Half 1.

Firewall Guidelines Automation

The configuration under illustrates the creation of Internet and Web EPGs tied to network-a, together with their related endpoint selectors. These are used to assign endpoints to a Cloud EPG, and may be based mostly on IP tackle, Subnet, Area, or Customized tags (utilizing a mixture of key worth pairs and match expressions).

For the Internet EPG, a key worth pair is used with particular tags to be matched (customized: epg equals net). For the Web EPG, a subnet selector is used permitting all visitors. Moreover, Web EPG must be kind Exterior as web entry might be allowed on network-a.

Create EPG
Internet EPG
Create EPG
Web EPG

The Cloud EPG App configuration just isn’t depicted for brevity however is much like that of cloud EPG Internet. Nonetheless, it’s tied to network-b and set with its distinctive endpoint selector (customized: epg equals app).

On GCP, these insurance policies get translated to devoted ingress firewall guidelines and community tags for Internet and App as highlighted utilizing the next format: capic-<app-profile-name>-<epg-name>.

GCP Console

Observe: Rebranding from Cloud APIC to Cloud Community Controller is roofed on Half 1.

Within the instance under, cloud endpoints instantiated in GCP with labels matching the endpoint selectors are assigned to community tags and firewall guidelines automated by Cisco CNC.

GCP Console

Associating Contracts to EPGs

Now, let’s affiliate the web-to-app contract between Internet and App EPGs utilizing the idea of client and supplier to outline guidelines path.

Associating Contracts to EPGs

Upon associating the contract, further ingress and egress firewall guidelines are programmed relying on the patron and supplier relationship specified. Particularly, these firewall guidelines are up to date based mostly on safety insurance policies outlined via contracts and filters. For brevity, all visitors is allowed however granular filters may be added per necessities. On one other observe, these guidelines are solely programmed as soon as cloud endpoints matching the foundations are instantiated.

GCP VPC Firewall rules

Wait, what about peering between these VPCs? Since contract-based routing is enabled, it additionally drives routing by enabling peering and auto producing routes to one another accordingly.

GCP VPC network peering

Lastly, let’s permit web entry to net companies residing on network-a by including the internet-access contract between Web and Internet EPGs.

EPG Communication

As quickly because the contract is related, Cisco CNC provides an ingress firewall rule with community tags representing the Internet EPG which permits web entry to endpoints behind it.

GCP VPC firewall rules

From this level on, web entry to web-server is allowed in addition to connectivity from the web-server to the app-server.

[email protected]:/dwelling/marinfer# ifconfig ens4
ens4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet 172.16.1.2  netmask 255.255.255.255  broadcast 172.16.1.2
        inet6 fe80::4001:acff:fe10:102  prefixlen 64  scopeid 0x20<hyperlink>
        ether 42:01:ac:10:01:02  txqueuelen 1000  (Ethernet)
        RX packets 19988  bytes 3583929 (3.4 MiB)
        RX errors 0  dropped 0  overruns 0  body 0
        TX packets 17707  bytes 1721956 (1.6 MiB)
        TX errors 0  dropped 0 overruns 0  provider 0  collisions 0
[email protected]:/dwelling/marinfer# ping 172.16.128.2
PING 172.16.128.2 (172.16.128.2) 56(84) bytes of knowledge.
64 bytes from 172.16.128.2: icmp_seq=1 ttl=64 time=58.3 ms
64 bytes from 172.16.128.2: icmp_seq=2 ttl=64 time=56.0 ms
64 bytes from 172.16.128.2: icmp_seq=3 ttl=64 time=56.0 ms
64 bytes from 172.16.128.2: icmp_seq=4 ttl=64 time=56.0 ms

Cloud Assets Visibility

Utilizing a cloud-like coverage mannequin, Cisco CNC gives a topology and hierarchical view of cloud assets on a per tenant foundation with drill down choices. Furthermore, software profile containers group collectively cloud EPGs and related contracts for straightforward visibility of insurance policies and dependencies.

Cloud Resources Visibility

Extra granular visibility is supplied all the way in which to cloud endpoints. Firewall guidelines are additionally seen by way of Cisco CNC GUI beneath Ingress and Egress Guidelines.

Cloud Endpoint Visibility

Abstract

Defining and managing safety insurance policies may be difficult, which can lead to elevated operational overhead and coverage inconsistency. Moreover automating and giving extra visibility into firewall guidelines in GCP, Cisco CNC can also be offering an extra layer of governance from a centralized administration airplane.

Half 3 completes this weblog sequence by exhibiting how Cisco Cloud Community Controller builds and automates exterior cloud connectivity from and to GCP.

 


Assets

Cisco Cloud Community Controller for Google Cloud Set up Guides

Cisco Cloud Community Controller for Google Cloud Person Guides

Weblog Collection: Introducing Cisco Cloud Community Controller on Google Cloud Platform

Half 1: Native Cloud Networking Automation

Half 3: Exterior Cloud Connectivity Automation – Coming Quickly

 

 

Share:

[ad_2]

Leave a Reply