Contrail Sandbox

Tutorial Script
Tutorial Flow
• Login to lab setup • Add service template
• Add security rules • Add service instance
• Add IP address manager • Put service instance into policy
• Add two networks • Add sql and wiki VMs
• Add network policy • Configure floating IP
• Add two VMs (can’t ping) • Test wiki available
• Add network policy to networks (VMs can • Delete everything
ping) • Port mirror, network analyzer
• Configure DNS resolution in IPAM
Accessing the Environment
• Use RDP client to connect to RDP server address sent in email
• Open Firefox from desktop in RDP window
• Use bookmarks to open tabs for OpenStack and Contrail
OpenStack – Change Zoom in Firefox

Change zoom to 80%

(Ensures dialogs are more visible)
OpenStack Security Groups and Contrail Network
Policies
• Security groups control traffic flowing between networks
• Contrail implements security groups in addition to its own network
policies
• The default security group only allows traffic to flow into a network
from another one that is defined in OpenStack, so traffic can’t flow in
from outside
• Additional rules need to be added to allow this – we will use this
when we add floating IP addresses that are accessible via a gateway
OpenStack – Check Project

Project "demo" needs to be selected

OpenStack – Security Groups

Click “Access & Security” Tab

Click “Manage Rules” Button

OpenStack – Add Rule

Click “Add Rule” Button

OpenStack – Add ICMP, TCP, UDP Rules
Add Ingress Rules for:
ALL ICMP
ALL TCP
ALL UDP
 OpenStack – Rules Added

New Rules Added

Take a Look at BGP Router Configuration

• Setting up a gateway router requires entering the router IP address,

the AS number and the supported address families to enable peering
Contrail – Look at BGP Routers

Monitor Button

Click “Configure” Button

Click “BGP Routers” Button

Click “Expand” Button for Router

Contrail – Gateway Router Details

DC-dependent setting

DC-independent setting: 65250

BGP Peering Information

Add an IP Address Manager

• Each IPAM can have separate DNS, NTP and domain name
• It’s a good idea for each project to have it’s own IPAM
• So let’s add one
 Contrail – Add IP Address Manager (IPAM)
Make sure you are in the demo
project

1. Click “IP Address Management” Tab

2. Click “+” Button

3. Enter Name for IPAM

4. Click “Save” Button
Contrail – Add Network

1. Click “Networks” Tab

2. Click “+” Button
Adding Networks

• Basic properties of a network are its address pool with subnet mask
and its default gateway
• Networks can be added in both OpenStack and Contrail
• Networks in Contrail have extra parameters to enable connectivity
with gateway routers, port mirroring and service chaining
 Contrail – Configure Front End Network

1. Enter Name for Network

2. Open "Subnets" Section
3. Click “+” Button

3. Select IPAM
4. Add Address
5. (Gateway Address is Automatic)
6. Click “Save” Button
 Contrail – Configure Back End Network

1. Enter Name for Network

2. Click “+” Button

3. Select IPAM
4. Add Address
5. (Gateway Address is Automatic)
6. Click “Save” Button
 Contrail - Configure Management Network

1. Enter Name for Network

2. Click “+” Button

3. Select IPAM
4. Add Address
5. (Gateway Address is Automatic)
6. Click “Save” Button
Floating IPs

• Floating IP pools are addresses that can be allocated to VM interfaces

in addition to their normal virtual IP address
• Vrouter does NAT between the floating IP address and the normal
address
• Floating IPs are usually used to enable external access
• Each sandbox is configured with a floating IP subnet which are part of
a larger prefix that is configured on the gateway router
• Route target is set to match that on router
Contrail – Configure Public Network - Subnets

DC-dependent setting:10.1.dc_number.0/24
(dc_number is in sandbox email)
 Contrail – Configure Public Network - Subnets

2. Click "External"
1. Select "Advanced
Options"
Contrail – Configure Public Network – Route
Targets
Contrail – Configure Public Network – Floating
IP Pools
1. Select “Floating IP
Pool(s)” drop down
menu
2. Click “+” Button
3. Add Pool Name
4. Add Project
Contrail – Check Subnets

Network Subnets
Network Policies

• Contrail network policies control traffic flow between networks

• Policies must be applied to networks to become effective (even when
networks are named inside a policy)
Contrail – Add Policy

1. Click “Policies” Tab

2. Click “+” Button
Contrail – Configure Policy
1. Configure Name
2. Add Rule
3. Configure Source/Destination
4. Click “Save”
Launch VMs in OpenStack

• VMs are instantiated by specifying an image to boot from, a flavor

(size) and a network for each interface
OpenStack – Launch VM Instance

1. Click “Instances” Tab

2. Click “Launch Instance” Button
 OpenStack – Configure and Launch
VM1 and VM2 VMs in wizard

Instance name: VM1 Instance name: VM2

Source: Image Source: Image
Image: cirros Image: cirros
Flavor: tiny Flavor: tiny
Network web-front Network sql-backend
Accessing a VM console

• OpenStack provides console access for each VM

• The console is preserved even if its tab is closed and reopened

• We will use the console of on VM to test that VMs in different

networks can’t ping each other when there is no network policy
applied
OpenStack – Open VM1 Console

1. Click “Instances” Tab

2. Select “Console” on Menu
 OpenStack – Login to VM1 and Ping VM2

1. Click on gray bar to put keyboard focus

into the console
2. Login as cirros/cubswin:)
3. Ping VM2 – 192.168.2.3 (Fails)
Apply Policy

• Apply policy to both networks

Contrail – Edit web-front Network

1. Click “Networks” Tab

2. Select “Edit” on Menu
Contrail – Add Policy to Networks

1. Select “web-to-backend” Policy

2. Click “Save” Button

Do Same for sql-backend Network

Contrail – Policies Are Applied
Contrail – Check Network Policy Diagram
OpenStack – Check Ping Is Working

Ctrl-c to stop the ping

Try “ssh –l cirros 192.168.2.3
Ctrl-d to terminate session
Configure DNS resolution
• Contrail can run a virtual DNS server
• DNS has a separate view for each IPAM associated with it
• Can set a forwarder to use if local DNS does not contain a record
Check ping to VM2 does not work
Add DNS server
1. Click “Server” Tab
2. Click on “+” button

1. Name the DNS server

2. Give the DNS server a dummy
domain name
3. Configure DNS Forwarder
4. Select the IPAM
5. Click on the “save” button
Configure DNS in IPAM
1. Click “IP Address Mgmt” Tab
2. Select “Edit” on Menu

3. Select “Virtual DNS”

4. Select “DNS-hands-on”
5. Click “Save” button
View DNS Records
1. Click “Servers” Tab
2. Select “Active DNS …” on Menu
3. View VM1, VM2 DNS entries
Check DNS resolution working with ping/nslookup
Service Chains

• A service chain is when network policy specifies that traffic between

two networks must pass through a service (like a firewall)
• A service template describes which image should be used and the
order of its interfaces
• A service instance is one or more instantiated VMs with its interfaces
associated with interfaces in a template
• Traffic only flows through a service instance when it is included in a
network policy
Contrail – Add Service Template

1. Click “Service Templates” Tab

2. Click “+” Button
 Contrail - Configure Service Template

1. Name “Firewall-Template-X”
2. Version “v2”
3. Virtualization Type “Virtual Machine”
4. Service Mode “In-Network”
5. Service Type “Firewall”
6. Click “+” Button to Add 1st Interface
7. Click “+” Button on lowest Interface
8. Click “+” Button on new lowest
Interface
9. Click “Save” Button
OpenStack- Launch VM that will become service

Instance name: FW-inst

Source: Image
Image: SDN-NoNAT
Flavor: medium
Networks svc-mgt
web-front
sql-backend
OpenStack - Open Service Instance Console
OpenStack – Login Prompt Means Instance is Ready

1. Login with root/c0ntrail123

2. Type cli at prompt
3. Type show config to take a look at the
 Contrail - Configure Service Instance Interfaces

FW-inst

1. Name “firewall-inst”
2. Service Template “FW-Template”
3. Choose networks
4. Open Tuple
 Contrail - Configure Service Instance Interfaces

1. Select management interface

2. Select left interface
3. Select right interface (hidden)
Contrail - Complete Screen

1. Click “Save”
Contrail – Edit Policy
 Contrail – Add Service To Policy
1. Check “Services” Box
2. Select “firewall-inst” Service
3. Click “Save” Button
Contrail – Check Service Inserted
OpenStack – Check Ping Still Working
Building a Two-Tier Application

• Deploy an SQL backend and LAMP front end into the two networks
• Allocate a floating IP address
• Access a wiki from your PC via the internet

• First - delete VM1, VM2 using OpenStack GUI

OpenStack – Configure and Launch front-end and
sql-server VMs

Instance name: front-end Instance name: sql-server

Source: Image Source: Image
Image: demo-wiki Image: demo-sql
Flavor: small Flavor: small
Network web-front Network sql-backend
OpenStack – Open SQL-server Console
OpenStack – Check SQL Running
OpenStack – Check front-end Console
Contrail – Configure Specific Network Policy
Contrail – Associate Floating IP

1. Select “Manage Floating IPs” Tab

2. Click “+” Button
Contrail – Pull IP from Pool

1. Select “dc-net:public-
pool”
2. Click “Save” Button
Contrail – Associate Floating IP to Port

Select “Associate Port” Menu Item

 Contrail – Associate Floating IP to Front End

1. In OpenStack find the IP address of front-end

2. Select Port with front-end address
New Browser Tab – Check Access to Wiki
Enter Your Floating IP Address
Deletion Exercise
• Delete all the objects created in the tutorial so far
• Try to do this without getting any popups complaining about
dependencies
Analyzer Exercise
• Find Contrail 3.1 Documentation
• Locate section dealing with Traffic Mirroring
• Use Configure > Networking > Services method to put mirroring
between VMs in two new networks with new VMs in them
End