Cisco Prime Network Services Controller Release Notes, Release 3.0.2

March 25, 2014

Added CSCum89284 to the list of open bugs.

Open Bugs

November 6, 2013

Updated support information for Amazon Marketplace.

New Features

October 16, 2013

Initial release.

—

Multiple-Device Management

Central management of VSG and ASA 1000V for Nexus 1000V series switches.

Simplifies provisioning and troubleshooting in a scaled-out data center.

Security Profiles

Representation of VSG and ASA 1000V security policy configuration in a profile.

• Simplifies provisioning.
• Reduces administrative errors during security policy changes.
• Reduces audit complexities.
• Helps enable a highly scaled-out data center environment.

Stateless Device Provisioning

The management agents in VSG and ASA 1000V are stateless, receiving information from Prime Network Services Controller.

• Enhances scalability.
• Provides robust endpoint failure recovery without loss of configuration state.

Security Policy Management

Security policies are authored, edited, and provisioned centrally.

• Simplifies the operation and management of security policies.
• Helps ensure that security intent is accurately represented in the associated security policies.

Context-Aware Security Policies

Prime Network Services Controller obtains virtual machine contexts from VMware vCenter.

Allows a security administrator to institute highly specific policy controls across the entire virtual infrastructure.

Dynamic Security Policy and Zone Provisioning

Prime Network Services Controller interacts with the Nexus 1000V Virtual Supervisor Module (VSM) to bind the security profile to the corresponding Nexus 1000V port profile. When virtual machines are dynamically instantiated by server administrators and the appropriate port profiles applied, their association with trust zones is also established.

Helps enable security profiles to stay aligned with rapid changes in the virtual data center.

Multi-Tenant Management

Prime Network Services Controller is designed to manage VSG and ASA 1000V security policies in a dense, multi-tenant environment so that administrators can rapidly add and delete tenants and update tenant-specific configurations and security policies.

• Reduces administrative errors.
• Helps ensure segregation of duties in administrative terms.
• Simplifies audit procedures.

Role-Based Access Control (RBAC)

RBAC simplifies operation tasks across different types of administrators, while allowing subject-matter experts to continue with their normal procedures.

• Reduces administrative errors.
• Enables detailed control of user privileges.
• Simplifies auditing requirements.

XML-Based API

The Prime Network Services Controller XML API allows external system management and orchestration tools to programmatically provision VSG and ASA 1000V devices.

• Allows use of best-in-class management software.
• Offers transparent and scalable operation management.

Four Virtual CPUs

1.5 GHz

Memory

4 GB RAM

Disk Space

One of the following, depending on InterCloud functionality:

• With InterCloud functionality, 220 GB on shared network file storage (NFS) or storage area network (SAN) in the following configuration:

– Disk 1—20 GB

– Disk 2—200 GB

• Without InterCloud functionality, 40 GB on shared NFS or SAN in the following configuration:

– Disk 1—20 GB

– Disk 2—20 GB

Management Interface

One management network interface.

Processor

x86 Intel or AMD server with 64-bit processor listed in the VMware compatibility matrix

HTTP/HTTPS

—

Lightweight Directory Access Protocol

—

Intel Virtualization Technology (VT)

Enabled in the BIOS

VMware vSphere

Release 5.0 or 5.1 with VMware ESXi (English only)

VMware vCenter

Release 5.0 or 5.1 (English Only)

Microsoft Server

Microsoft Windows Server 2012 with Hyper-V (Standard or Data Center)

Microsoft SCVMM

Microsoft SCVMM 2012 SP1 or higher

Operating System

Either of the following:

• Microsoft Windows
• Apple Mac OS

Browser

Any of the following:

• Internet Explorer 9.0 or higher
• Mozilla Firefox 11.0 or higher
• Google Chrome 18.0 or higher ¹

Flash Player

Adobe Flash Player plugin 11.2 or higher

80

HTTP

443

HTTPS

843

Adobe Flash

TCP

22, 443, 3389, 6644, and 6646

UDP

6644 and 6646

ASA 1000Vs and VSGs

255

Hypervisors

600

Locales

128

Object Group

65536

Orgs

2048

Policies

4096

Policy Sets

2048

Rules

16384

Security Profiles

2048

Tenants

256

Managed VMs

5000

Zones

8192

Amazon Marketplace support

Note The Amazon Marketplace feature is not supported in Prime Network Services Controller 3.0.2.

Support for Amazon Marketplace provides the following benefits associated with creating an InterCloud link:

• Access to Amazon Marketplace is provided via the Add InterCloud Link wizard.
• You can view and optionally purchase the number of cloud VM licenses that you need.
• You can easily install an InterCloud Switch template from Amazon Marketplace.
• The time required to create an InterCloud link is significantly reduced.
• Amazon Marketplace manages the purchase and automatically charges the associated Amazon provider account.
• Amazon tracks the available number of cloud VMs as cloud VMs are instantiated.

Bundle import of images

To improve usability and simplify the process of creating an InterCloud link, Prime Network Services Controller enables you to import a single zipped file that contains the following images:

• InterCloud Extender image
• InterCloud Switch image
• Cloud VM driver images

After the zipped file is imported, Prime Network Services Controller automatically places the zipped files in the correct locations and populates the InterCloud Link Wizard with the images.

This feature helps ensure that you always have the compatible images available for creating InterCloud links and instantiating cloud VMs.

GUI changes

• The following GUI items have been removed:

– Sub-Elements tabs

– Events tabs

– VM Managers tab from Administration

• The following items have been changed:

– The InterCloud Agent Images and Infrastructure Images options in InterCloud Management have been replaced by a single Images option.

– The Administration Operations Backups table has been renamed to Administration Operations, and it includes all operation types (backups, import, and export).

– The VM Managers tab has been moved under Resource Management.

• The following new wizards have been added:

– Add a Compute Firewall Wizard

– Adding Edge Firewall

• The following enhancements have been made:

– Options have been consolidated in a single Actions drop-down list in table toolbars.

– A Filter option has been added to tables.

– A new Service Devices category has been added under Resource Management > Resources.

Hyper-V Hypervisor support

Prime Network Services Controller can be installed on the VMware Hypervisor and the Microsoft Hyper-V Hypervisor. The following are some of the Prime Network Services Controller features that are not supported when Prime Network Services Controller is installed on Hyper-V Hypervisor:

• When adding a rule to create an ACL policy:

– The option to match any one rule is disabled. The only available option is to match all the rules.

– The service condition is disabled.

– If you set source or destination conditions, the VM attribute type is not supported.

• When adding an object group:

– If the attribute type is Network, the attribute name Service is not supported.

– The VM attribute type is not supported.

• When working with vZones, the option to match any one rule is disabled. The vZone must match all the conditions.

Multi-tenancy

Prime Network Services Controller adds a new role named tenant-admin. Users with tenant-admin role can see only those objects and resources related to the tenants with which they are associated. They cannot see the policies, resources, or logs of other tenants.

Only users with the admin role can add users with the tenant-admin role, and they must associate the user with the tenant-admin role with a locale and organization.

The tenant-admin role has the following privileges:

• Policy management
• Resource configuration (except tenant addition or deletion)
• Tenant management

Service VM instantiation and life cycle management

• Resources are available from a new Service Devices category and from the Virtual Supervisor Modules (Resources Management > Resources).
• A new Images option enables you to import service images to use for instantiating compute and edge firewalls.
• You now have the option to import new image versions.

InterCloud VPC-based security (IP groups)

Access to cloud VMs is limited to IP addresses identified in one or more IP groups for each Virtual Private Cloud (VPC).

CSCuh42121

Upon rare occasions, after rebooting Prime Network Services Controller, you might see a UCSSH log file that indicates that the UCSSH process has stopped while waiting for user input. Prime Network Services Controller components and processes are not affected by this situation.

CSCuh74272

A port ID is not returned when the creation of a VM fails.

CSCui79010

DNS entries disappear after a Windows VM is migrated to the cloud. This problem occurs when a Windows VM is configured with a static IP address and then migrated to a cloud.

CSCuj03315

Users cannot log into the Prime Network Services Controller GUI after upgrading from a previous release or after rebooting Prime Network Services Controller.

CSCuj43151

After an InterCloud Switch upgrade, no InterCloud Switch undeploy or deploy events are issued and the known_hosts file is not updated. This problem occurs if the attach module command is issued on a cloud VSM and the related keys in the known_hosts file are not removed when the module is detached or deleted.

CSCuj61197

No error is issued if the number of cloud VMs exceeds the number of available licenses from Amazon Marketplace. The cloud VMs that can be licensed are instantiated, but no message is issued to indicate that not all requested cloud VMs were instantiated or that the license limit has been exceeded.

CSCuj65409

After upgrading an InterCloud link in standalone mode, the InterCloud Switch is changed and a static route to the InterCloud Switch is not added as expected.

CSCuj79213

The Prime Network Services Controller GUI intermittently displays the error: Communication with the server has failed. Try again. If it continues to fail, check the server status and log in again.

CSCuj81064

When creating an InterCloud link, if you do not check the Enable HA check box in the Configure InterCloud Link screen and instead continue to the Configure Network Properties screen before returning to the Configure InterCloud Link screen and checking the Enable HA check box, you cannot configure high availability on the link because the Configure Network Interfaces screen does not contain the fields for the secondary InterCloud extender and the Next button is disabled.

CSCum89284

VSG is missing some or all protected virtual machines (VMs) and thus dropping all traffic for those VMs.