Contents
- Cisco Prime Network Services Controller Release Notes
- Prime Network Services Controller Overview
- New Features and Enhancements
- Requirements Overview
- System Requirements
- Hypervisor Requirements
- Web-Based GUI Client Requirements
- Firewall Ports Requiring Access
- Performance and Scalability
- Hypervisor Support
- Prime Network Services Controller Upgrade Matrix
- Important Notes
- Cloned Linux Virtual Machines
- Editing Firewall Interfaces
- Searching with Special Characters
- User Account Password Expiration
- Workflow for Automatically Deploying Network Services
- Importing Service Images
- Configuring Networks for Network Service Deployment
- Adding a Device Profile
- NTP Behavior Post PNSC Upgrade
- Configuring an Org Profile for Automatic Service Deployment
- Creating an Organization and Assigning an Org Profile
- Deploying a Network Service
- Configuring Additional Policies and Profiles for Network Services
- Deleting an Automatically Deployed Compute Firewall Service
- Using the Bug Search Tool
- Open Bugs
- Resolved Bugs
- Related Documentation
- Accessibility Features in Prime Network Services Controller
- Obtaining Documentation and Submitting a Service Request
First Published:
Last Updated:
Text Part Number:
Cisco Prime Network Services Controller Release Notes
This document describes the features, limitations, and bugs for the Prime Network Services Controller, Release 3.4.2c.
Prime Network Services Controller Overview
The dynamic nature of cloud environments requires organizations to apply and enforce frequent changes to networks. These networks can consist of thousands of virtual services elements, such as firewalls, load balancers, routers, and switches. simplifies operations with centralized, automated multi-device and policy management for Cisco network virtual services. For the latest release updates and overview, see the corresponding data sheet.
() is the primary management element for Cisco Nexus 1000V (Nexus 1000V) Switches and Services that can enable a transparent, scalable, and automation-centric network management solution for virtualized data center and hybrid cloud environments. Nexus 1000V switches and services deliver a highly secure multitenant environment by adding virtualization intelligence to the data center network. These virtual switches are built to scale for cloud networks. Support for Virtual Extensible LAN (VXLAN) helps enable a highly scalable LAN segmentation and broader virtual machine (VM) mobility.
enables the centralized management of Cisco virtual services to be performed by an administrator, through its GUI, or programmatically through its XML API. is built on an information-model architecture in which each managed device is represented by its subcomponents (or objects), which are parametrically defined. This model-centric approach enables a flexible and simple mechanism for provisioning and securing virtualized infrastructure using Cisco VSG security services.
Note
Starting with Cisco PNSC Release 3.4.2a, Cisco Adaptive Security Appliance (ASA 1000V), Cisco Cloud Services Router (CSR), Citrix NetScaler VPX, Citrix NetScaler, and KVM Hypervisor, and Microsoft HyperV platforms are not supported.
New Features and Enhancements
Prime Network Services Controller includes the following new features and enhancements:
Support for TACACS+ Authentication.
Support for VMware vSphere 6.5a.
Requirements Overview
The following topics identify the primary requirements for installing and using Prime Network Services Controller.
System Requirements
Hypervisor Requirements
Prime Network Services Controller is a multi-hypervisor virtual appliance that can be deployed on VMware vSphere.
See the VMware Compatibility Guide to confirm that VMware supports your hardware platform.
Requirement Description VMware
VMware vSphere
5.5, 6.0, and 6.5a with VMware ESXi (English only)
VMware vCenter
5.5, 6.0, and 6.5a (English only)
Note
Prime Network Services Controller running as a virtual machine with version 3.4.1b and later can be hosted on VMware vSphere ESXi 6.0 hosts that are managed by VMware vCenter Server 6.0.
Note
Prime Network Services Controller running as a virtual machine with version 3.4.2b or later can be hosted on VMware vSphere ESXi 6.5a hosts that are managed by VMware vCenter Server version 6.5a.Performance and Scalability
Hypervisor Support
The following table identifies features that differ with regard to hypervisor support in Prime Network Services Controller Release 3.4.2c. Features that are not listed are supported by all hypervisors.
Feature and Device Support VMware vSphere ESXi 5.5, 6.0, and 6.5a
Feature Support
Automatic deployment of network services
Supported
VM Attribute support
Supported:
Device Support
For detailed information about device support, see Cisco Prime Network Services Controller Supported Devices.
VSG
Supported
Prime Network Services Controller Upgrade Matrix
The following table lists the supported upgrade paths for Prime Network Services Controller.
Note
Please make sure to have 5GB of space free in bootflash directory before proceeding with upgrade process.
Initial Version
Intermediate State(s)
Final Version
2.0.3
2.1 to 3.0.2g to 3.2.2a to 3.4.1d to 3.4.2b
3.4.2c
2.1
3.0.2 to 3.2.2a to 3.4.1d to 3.4.2b
3.4.2c
3.0.2
3.2.2a to 3.4.1d to 3.4.2b
3.4.2c
3.2.1d
3.4.1d to 3.4.2b
3.4.2c
3.2.2b
3.4.1d to 3.4.2b
3.4.2c
3.4.1b
3.4.1d to 3.4.2b
3.4.2c
3.4.1c
3.4.1d to 3.4.2b
3.4.2c
3.4.1d
3.4.2b
3.4.2c
3.4.2a
N/A
3.4.2c
3.4.2b
N/A
3.4.2c
Important Notes
The following topics provide important information for using Prime Network Services Controller.
Cloned Linux Virtual Machines
When Linux virtual machines are cloned, new MAC addresses are assigned. This causes a MAC address mismatch between the VM settings and the Linux Guest OS. If you encounter this situation, the following message is displayed:
The Guest OS either does not contain interface configuration for the VM NICs or the interfaces are explictly disabled.For information on how to resolve the MAC address mismatch, see the VMware Knowledge Base.
Editing Firewall Interfaces
We recommend that you do not edit the data interfaces of compute or edge firewalls. Changing the data interface via the Prime Network Services Controller GUI stops communication between the Cisco Nexus 1000V VEM link and the firewall, and thereby stops vPath traffic.
If you change the data interfaces of compute or edge firewalls via the Prime Network Services Controller GUI, make the appropriate configuration changes on the Cisco Nexus 1000V.
Searching with Special Characters
Searching for organization names does not work if the organization names include special characters, such as $.
User Account Password Expiration
When adding a user account, the administrator can choose to expire the account password and select the date on which it expires. When the expiration date is reached, the account is disabled and the user cannot log in to Prime Network Services Controller until a user with administrator privileges extends the expiration date.
Workflow for Automatically Deploying Network Services
Prime Network Services Controller enables you to automatically deploy compute firewall and load balancer network services by preparing the required networks, defining organizational profiles by configuring service automation policies, and assigning the organizational profiles to the required organization in the tenant hierarchy.
The following table identifies the tasks required to configure Prime Network Services Controller for automatic network service deployment, the related documentation, and the minimum role required for each task.
Task Related Documentation Role Required 1. Confirm that the following prerequisites are met:
admin
2. Import service images. Supported service devices are VSG compute firewalls .
admin
3. Configure Management, HA, and vPath networks and subnetworks at root.
admin
4. Create the policies and profiles for the network services.
admin
5. Create organizational (Org) profiles and add service automation definitions to each profile.
admin
6. In Tenant Management, create the organization where the network services will be deployed and assign an Org profile.
admin or tenant-admin
7. Add a network to the organization to deploy the network service.
tenant-admin
8. Configure additional policies and profiles as needed.
Configuring Additional Policies and Profiles for Network Services
tenant-admin
9. Removing an automatically deployed compute firewall network service.
tenant-admin
Importing Service Images
Configuring Networks for Network Service Deployment
ProcedureTo automatically deploy network services, you must configure the following networks with subnetworks at the root level:
A management network—This network provides IP addresses for the automatically deployed services.
A vPath service network—This network is required for deploying compute firewall network services.
An HA network—This network is required for deploying compute firewall network services in HA mode.
The following guidelines apply when creating networks for automated network service deployment:
Adding a Device Profile
ProcedureA device profile is a set of custom security attributes and device policies. Adding a device profile enables you to specify the DNS and NTP servers that the service device is to use in addition to SNMP, syslog, and authentication policies.
NTP Behavior Post PNSC Upgrade
NTP service does not come up on the terminal when PNSC is upgraded from the previous releases to Release 3.4.1d or later. To access the NTP service, you need to re-login into the same terminal or start a new terminal.
Configuring an Org Profile for Automatic Service Deployment
ProcedureA network service automation policy specifies the profiles, image, and credentials to be used when deploying a network service. Depending on the type of service, different options are available. For each Org profile, you can create a definition for each network service type: compute firewall and load balancer.
Creating an Organization and Assigning an Org Profile
After you configure the service automation policies for an Org profile, create the tenant or other organization on which you want to deploy the network service. Creating the organization includes assigning the Org profile that will be used to automatically deploy network services.
Before You BeginProcedure
Determine the level in the hierarchy where the organization that will be configured to automatically deploy network services will reside.
Step 1 Choose Tenant Management > root and navigate to the level where you want to add the organization that will deploy network services using the Org profile. For example, to assign an Org profile to a tenant, click Create Tenant at the root level. Similarly, to assign an Org profile at the Application level, navigate to the VDC and click Create Application. Step 2 In the Create dialog box, enter a name for the organization and, from the Profile drop-down list, choose the Org profile to assign to the organization. Step 3 Click OK.
Deploying a Network Service
ProcedureAfter you create the organization where network services will be deployed and assign an Org profile, you can deploy the network service. To deploy the network service, create a network on the organization.
The following guidelines apply when deploying a network service:
Step 1 Choose Resource Management > Managed Resources > root > tenant or tenant > org. Step 2 In the Networks tab, create the network for the service to be deployed, being sure to choose the correct role for the service. The network service is then automatically deployed. To monitor progress, choose Resource Management > Managed Resources > root > tenant or tenant > org and click the Network Services tab.
Configuring Additional Policies and Profiles for Network Services
After deploying a network service, you might need to apply new policies and profiles to the network service. To apply new policies and profiles to a specific, deployed network service, create the policies and profiles at the same organizational level as the deployed service. For example, if a compute firewall network service has been deployed for a VDC, create the new policies and profiles at the VDC level.
Deleting an Automatically Deployed Compute Firewall Service
ProcedureYou cannot delete an automatically deployed compute firewall by deleting the network of a specific client. However, you can delete an automatically deployed compute firewall service from the Managed Resources Network Services tab in Prime Network Services Controller.
Note
If you delete the vPath network from root, it will remove all compute firewalls from all tenants and subordinate organizations.
Using the Bug Search Tool
ProcedureThis topic explains how to use the Bug Search Tool to search for a specific bug or to search for all bugs in a release.
Step 1 Go to http://tools.cisco.com/bugsearch. Step 2 In the Log In screen, enter your registered Cisco.com username and password, and then click Log In. The Bug Search page opens.
Note If you do not have a Cisco.com username and password, you can register for them at http://tools.cisco.com/RPF/register/register.do. Step 3 To search for a specific bug, enter the bug ID in the Search For field and press Enter. Step 4 To search for bugs in the current release:
Open Bugs
The following table lists the open bugs in Prime Network Services Controller, Release 3.4.2c.
Bug ID Description PNSC: VSM role shows as standalone mode even when VSM is in primary HA mode.
VSM goes to Failed to Apply state in PNSC on upgrade.
Cleanup or modification of authorization methods on PNSC are not updated on VSG.
VSM going to Failed to Apply state on changing the service path from PNSC.
PNSC fails to reboot after upgrading from release 3.4.2b to 3.4.2c.
Resolved Bugs
Related Documentation
Prime Network Services Controller
The Prime Network Services Controller documentation is available on Cisco.com at the following URL:
Cisco Nexus 1000V Series Switch Documentation
The Cisco Nexus 1000V Series switch documentation is available on Cisco.com at the following URL:
Cisco Prime Data Center Network Manager Documentation
The Cisco Prime Data Center Network Manager (DCNM) documentation is available on Cisco.com at the following URL:
Cisco Virtual Security Gateway Documentation
The Cisco Virtual Security Gateway (VSG) documentation is available on Cisco.com at the following URL:
Accessibility Features in Prime Network Services Controller
All product documents are accessible except for images, graphics, and some charts. If you would like to receive the product documentation in audio format, braille, or large print, contact accessibility@cisco.com.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation.
To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's New in Cisco Product Documentation RSS feed. RSS feeds are a free service.
Copyright © 2017, Cisco Systems, Inc. All rights reserved.