Cisco Virtual Security Gateway for VMware vSphere Release Notes, Release 5.2(1)VSG2(1.4)

Cisco Virtual Security Gateway for VMware vSphere Release Notes, Release 5.2(1)VSG2(1.4)

---

First Published: 2015-12-10

This document describes the features, limitations, and bugs for the Cisco Virtual Security Gateway (Cisco VSG) software. Use this document in combination with documents listed in Related Documentation. The following is the change history for this document.

Contents

This document includes the following sections:

• Introduction
• Software Compatibility
• Cisco VSG License
• Features
• New and Changed Information
• Limitations and Restrictions
• Cisco VSG Scalability Matrix
• Bugs
• Related Documentation
• Obtaining Documentation and Submitting a Service Request

Introduction

Cisco VSG for the Cisco Nexus 1000V series switch is a virtual firewall appliance that provides trusted access to virtual data center and cloud environments with dynamic policy-driven operation, mobility-transparent enforcement, and scale-out deployment for dense multitenancy. Cisco VSG enables a broad set of multitenant workloads that have varied security profiles to share a common compute infrastructure. By associating one or more virtual machines (VMs) into distinct trust zones, Cisco VSG ensures that access to trust zones is controlled and monitored through established security policies.

Together, Cisco VSG and the Cisco Nexus 1000V Virtual Ethernet Module (VEM) provide the following benefits:

• Efficient deployment—Each Cisco VSG can protect VMs across multiple physical servers, which eliminates the need to deploy one virtual appliance per physical server.
• Performance optimization—By offloading Fast-Path to one or more Cisco Nexus 1000V VEM vPath modules, Cisco VSG boosts its performance through distributed Cisco vPath-based enforcement.
• Operational simplicity—You can insert Cisco VSG in one-arm mode without creating multiple switches or temporarily migrating VMs to different switches or servers. Zone scaling is based on security profile, not on vNICs that are limited for virtual appliances.
• High availability—For each tenant, you can deploy Cisco VSG in an active-standby mode to ensure a highly available operating environment, with Cisco vPath redirecting packets to the standby Cisco VSG when the primary Cisco VSG is unavailable.
• Independent capacity planning—You can place Cisco VSG on a dedicated server, controlled by the security operations team so that maximum compute capacity can be allocated to application workloads. Capacity planning can occur independently across server and security teams, and operational segregation across security, network, and server teams can be maintained.

Software Compatibility

The servers that run the Cisco Nexus 1000V Virtual Supervisor Module (VSM) and VEM must be in the VMware Hardware Compatibility list, which is a requirement for running the ESX/ESXi 5.0, 5.1, 5.5, and 6.0 software. See the Cisco Nexus 1000V and VMware Compatibility Information .

Cisco VSG is installed on the Cisco Nexus 1000V switch and is managed using Cisco PNSC. For compatibility among the various releases of Cisco VSG, Cisco PNSC, and Cisco Nexus 1000V, see the Cisco VSG Environment Upgrade Matrix and Path.

Cisco VSG License

The Cisco VSG license is integrated with the Cisco Nexus 1000V Multi-Hypervisor License (Universal License). You must install the Cisco Nexus 1000V Multi-Hypervisor License for Cisco VSG for VMware vSphere. When the Cisco Nexus 1000V Multi-Hypervisor License is installed, the license for Cisco VSG is included automatically.

Two licenses are available for use with the Cisco Nexus 1000V switch: Essentials Edition and Advanced Edition. Cisco VSG functionality is available only with the Advanced Edition. You must install the Advanced Edition license and then configure the VSM mode to advanced mode to use the Advanced Edition license.

The Cisco Nexus 1000V VSM is available in two modes: essential and advanced. Cisco VSG functionality is available only in the advanced mode. You must install the Cisco Nexus 1000V Multi-Hypervisor License and change the VSM mode to advanced mode.

Note If you try to access Cisco VSG services on the Cisco Nexus 1000V switch with the Essentials Edition license enabled, an error message is generated on the VSM console indicating that the Cisco Nexus 1000V Multi-Hypervisor License is required for Cisco VSG.

For more information about the Cisco Nexus 1000V for VMware vSphere licenses, see the Cisco Nexus 1000V Multi-Hypervisor License Configuration Guide .

Features

This section describes the key features in this release.

Trusted Multitenant Access

You can transparently insert Cisco VSG into the VMware vSphere environment where the Cisco Nexus 1000V distributed virtual switch is deployed. Upon insertion, one or more Cisco VSG instances are deployed on a per-tenant basis, which allows a highly scaled-out deployment across many tenants. Because tenants are isolated from each other, no traffic can cross tenant boundaries. Depending on the use case, you can deploy Cisco VSG at the tenant level, at the virtual data center (vDC) level, or at the virtual Application (vApp) level.

---

Note Cisco VSG is not inherently multitenant; you must configure it within each tenant.

---

Because the VMs are instantiated for a given tenant, association to security profiles and zone membership occurs immediately through binding with the Cisco Nexus 1000V port profile. Upon instantation, each VM is placed in a logical trust zone. Security profiles contain context-aware rule sets that specify access policies for traffic that enters and exits each zone. With the VM and network contexts, you can leverage custom attributes to define zones directly through security profiles. The profiles are applied to zone-to-zone traffic and external-to-zone/zone-to-external traffic. This enforcement occurs within a VLAN because a VLAN often identifies a tenant boundary.

Cisco VSG evaluates access control rules and then offloads enforcement to the Cisco Nexus 1000V VEM vPath module for performance optimization. Access is permitted or denied based on policies. Cisco VSG provides policy-based traffic monitoring capability and generates access logs.

New and Changed Information

No new features are introduced for Cisco VSG for VMware vSphere Release 5.2(1)VSG2(1.4).

Limitations and Restrictions

Cisco VSG for VMware vSphere has the following limitations and restrictions:

• If Cisco VSG Release 5.2(1)VSG2(1.3) or later is used with the Cisco Nexus 1000V Release 5.2.(1)SV3(1.3), the maximum limits for Cisco Nexus 1000V are reduced to the following:

– 250 hosts per DVS.

– 10,000 vEth ports with up to 6000 vEth ports protected by Cisco VSG.

– 512 ports per host.

• Cisco VSG does not support multiple user accounts. It supports only the default admin user account.
• Jumbo frames cannot be configured for the Cisco VSG management interface.
• vMotion of the Cisco VSG is validated only for host upgrades and not for DRS purposes.
• Enabling firewall protection on a router virtual machine might cause problems for policies based on VM attributes. Firewall protection should be enabled only for endpoint virtual machines.
• During OVA installation, the following error message might occur:

Workaround: Ensure that all three network interfaces in the Cisco VSG port profile are set to VM Network (port profile from vSwitch) during OVA installation. After the VM is created, the port profile for these three interfaces should be changed according to the Cisco VSG for VMware vSphere, Release 5.2(1)VSG2(1.4) and Cisco PNSC, Release 3.4.1d Installation and Upgrade Guide.

• If the VSM is down when Cisco VSG is powered on, Cisco VSG continuously tries to reboot.

Workaround: To prevent this situation, configure the service VLAN and the HA VLAN used by Cisco VSG as system vlan vlan_number in the uplink port profile.

• Layer 2 Mode

When the VEM communicates with the Cisco VSG in the Layer 2 mode, an additional header with 62 bytes is added to the original packet. The VEM fragments the packet if it exceeds the uplink MTU.

For better performance, increase the MTU of all links between the VEM and the Cisco VSG by 62 bytes to account for packet encapsulation which occurs for communication between Cisco vPath and the Cisco VSG. For example, if the MTU values of the client and server VMs and uplink are all 1500 bytes, set the uplink MTU to 1562 bytes.

• Layer 3 Mode

– If jumbo frames are enabled in the network, make sure the MTU of the client and server VMs is 82 bytes smaller than the uplink. For example, if the uplink MTU is 9000 bytes, set the MTU of the client and server VMs to 8918 bytes.

– When encapsulated traffic that is destined to a Cisco VSG is connected to a different subnet other than the vmknic subnet, the VEM does not use the VMware host routing table. Instead, the vmknic initiates an ARP for the remote Cisco VSG IP addresses. You must configure the upstream router to respond by using the proxy ARP feature.

– The VEM does not support a routing functionality and it is assumed that the upstream switch/router is configured with the proxy-ARP configuration.

• Configuring a Rule with a Reset Action

Configuring a rule with a reset action for the non-TCP/UDP protocol results in dropped traffic. However, the syslog generated for this traffic shows that the action performed for the traffic is reset as shown in the following example:

• Cisco VSG CLI Session Timeout

The CLI session for the Cisco VSG Release 1.3x that is newly deployed times out after 5 minutes of inactivity. The CLI session timeout does not work on Cisco VSG that has been upgraded from Release 1.0x.

• On Cisco VSG that is upgraded from Release 1.0x, the show running-config consists only of the following lines:

As a workaround, when you are done upgrading from Cisco VSG Release 5.2(1)VSG2(1.x) to 5.2(1)VSG2(1.3) or later, you can enable a 5-minute CLI session inactivity timeout by configuring the exec-timeout 5 command in the line console and line vty command modes.

• VM Name Display Length Limitation

VM names for VMs on ESX 4.1 hosts that exceed 21 characters are not displayed correctly on the VSM. When you use a show vservice command that displays the port profile name (for example, the show vservice port brief port-profile port-profile-name command), only VMs with names that are 21 characters or fewer display correctly. Longer VM names might truncate or append extra characters. Depending on the network adapter, the name length limitation varies. For example:

– The E1000 or VMXNET 2 network adapters allow 26-character names. At 27 characters, the word ‘.eth’ is appended to the VM name. With each addition to the VM name, a character is truncated from the word ‘.eth’. After 31 characters, the VM name is truncated.

– The VMXNET 3 network adapters allow 21-character names. At 22 characters, the word ‘ethernet’ is appended to the VM name. With each addition to the VM name, a character is truncated from the word ‘ethernet’. After 30 characters, the VM name is truncated.

Workaround: This is a display issue with ESX Release 4.1 only. Use VM names of 21 characters or fewer to avoid this issue.

Cisco VSG Scalability Matrix

The following table compares two Cisco VSGs with a different number of virtual CPUs and Cisco PNSC.

If Cisco VSG Release 5.2(1)VSG2(1.4) is used with Cisco Nexus 1000V Release 5.2.(1)SV3(1.5b), the maximum limits for Cisco Nexus 1000V are reduced to the following:

• 250 hosts per DVS.
• 10,000 vEth ports with up to 6000 vEth ports protected by Cisco VSG.
• 512 protected ports per host.

Bugs

The bugs are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.

For more information about the Cisco Bug Search Tool, see the Bug Search Tool Help & FAQ.

Using the Bug Search Tool

Use the Bug Search Tool to search for a specific bug or to search for all bugs in a release.

---

Step 1 Go to Cisco Bug Search Tool.

Step 2 In the Log In screen, enter your registered Cisco.com username and password, and then click Log In. The Bug Search page opens.

---

Note If you do not have a Cisco.com username and password, you can register for them at http://tools.cisco.com/RPF/register/register.do.

---

Step 3 To search for a specific bug, enter the bug ID in the Search For field and press Enter.

Step 4 To search for bugs in the current release:

a. In the Search For field, enter appropriate release name and press Enter. (Leave the other fields empty.)

b. When the search results are displayed, use the filter tools to find the types of bugs you are looking for. You can search for bugs by status, severity, modified date, and so forth.

---

Tip To export the results to a spreadsheet, click the Export Results to Excel link.

---

---

 

Related Documentation

This section contains information about the documentation available for Cisco VSG and related products.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a reader application. The RSS feeds are a free service.