Cisco Virtual Security Gateway for Microsoft Hyper-V Release Notes, Release 5.2(1)VSG2(1.3)
Dynamic (Virtualization-Aware) Operation
Setting Up Cisco VSG and VLAN Usages
New Features in Cisco VSG Release 5.2(1)VSG2(1.3)
Cisco VSG Compatibility Matrix
Cisco Prime Network Services Controller Documentation
Cisco Nexus 1000V Series Switch Documentation
Obtaining Documentation and Submitting a Service Request
This document describes the features, limitations, and caveats for the Cisco Virtual Security Gateway and Cisco Virtual Network Management Center software. Use this document in combination with documents listed in the “Related Documentation” section. The following is the change history for this document.
The Cisco Virtual Security Gateway (VSG) for Microsoft Hyper-V platform is a virtual firewall appliance that provides trusted access to virtual data center and cloud environments with dynamic policy-driven operation, mobility-transparent enforcement, and scale-out deployment for dense multitenancy. The Cisco VSG enables a broad set of multitenant workloads that have varied security profiles to share a common compute infrastructure. By associating one or more virtual machines into distinct trust zones, the Cisco VSG ensures that access to trust zones is controlled and monitored through established security policies.
Together, the Cisco VSG and Cisco Nexus 1000V Virtual Ethernet Module (VEM) provide the following benefits:
The servers that run the Cisco Nexus 1000V Virtual Supervisor Module (VSM) and VEM must be in the Microsoft Server Hardware Compatibility list, which is a requirement for running the Microsoft Hyper-V software.
For additional compatibility information, see the Cisco Nexus 1000V Compatibility Information.
The Cisco VSG license is integrated with the Cisco Nexus 1000V Multi-Hypervisor License (Universal License). You need to install the Cisco Nexus 1000V Multi-Hypervisor License for Cisco VSG for Microsoft Hyper-V. When the Cisco Nexus 1000V Multi-Hypervisor License is installed, the license for Cisco VSG is automatically included.
The Cisco Nexus 1000V VSM is available in two modes: essential and advanced. Cisco VSG functionality is available only in the advanced mode. You must install the Cisco Nexus 1000V Multi-Hypervisor License and change the VSM mode to advanced mode.
Note If you try to access Cisco VSG services with VSM in essential mode, an error message indicates that the Cisco Nexus 1000V Multi-Hypervisor License is required for Cisco VSG.
For more information about the Cisco Nexus 1000V for Microsoft Hyper-V license, see the Cisco Nexus 1000V for Microsoft Hyper-V License Configuration Guide.
This section provides the following information about this release:
The Cisco VSG operates with the Cisco Nexus 1000V distributed virtual switch in the Microsoft Hyper-V. The Cisco VSG leverages the virtual network service data path (vPath) that is embedded in the Cisco Nexus 1000V VEM. vPath steers traffic, whether external-to-VM or VM-to-VM, to the Cisco VSG of a tenant. A split-processing model is applied where initial packet processing occurs in the Cisco VSG for policy evaluation and enforcement. After the policy decision is made, the Cisco VSG offloads policy enforcement of remaining packets to vPath.
You can transparently insert a Cisco VSG into the Microsoft Hyper-V environment where the Cisco Nexus 1000V distributed virtual switch is deployed. Upon insertion, one or more instances of the Cisco VSG is deployed on a per-tenant basis, which allows a highly scaled-out deployment across many tenants. Because tenants are isolated from each other, no traffic can cross tenant boundaries. Depending on the use case, you can deploy the Cisco VSG at the tenant level, at the virtual data center (vDC) level, or at the vApp level.
Note The Cisco VSG is not inherently multitenant. It must be explicit within each tenant.
As VMs are instantiated for a given tenant, association to security profiles and zone membership occurs immediately through binding with the Cisco Nexus 1000V port profile. Upon instantation, each VM is placed into a logical trust zone. Security profiles contain context-aware rule sets that specify access policies for traffic that enters and exits each zone. The profiles are applied to zone-to-zone traffic and external-to-zone/zone-to-external traffic. This enforcement occurs within a VLAN because a VLAN often identifies a tenant boundary.
The Cisco VSG evaluates access control rules and then offloads enforcement to the Cisco Nexus 1000V VEM vPath module for performance optimization. Access is permitted or denied based on policies. The Cisco VSG provides policy-based traffic monitoring and generates access logs.
A virtualization environment is dynamic, where frequent additions, deletions, and changes occur across tenants and especially across VMs. Live migration of VMs can occur due to manual or programmatic VM motion events.
A Cisco VSG operates with the Cisco Nexus 1000V (and vPath), which supports a dynamic VM environment. Typically, a tenant is created with the Cisco VSG (standalone or active-standby pair) and on the Cisco Prime Network Services Controller (PNSC). Associated security profiles are defined that include trust zone definitions and access control rules.
Each security profile is bound to a Cisco Nexus 1000V port profile (authored on the Cisco Nexus 1000V VSM and published to the Microsoft SCVMM). When a new VM is instantiated, you can assign appropriate port profiles to the virtual Ethernet port of the VM. Because the port profile uniquely refers to a security profile and VM zone membership, security controls are immediately applied. A VM can be repurposed by assigning a different port profile or security profile.
As VM motion events occur, VMs move across physical servers. The Cisco Nexus 1000V ensures that port profile policies and associated security profiles follow the VMs. Security enforcement and monitoring remain transparent to VM motion events.
A Cisco VSG is set up in an overlay fashion so that VMs can reach a Cisco VSG regardless of its location. The vPath component in the Cisco Nexus 1000V VEM intercepts the packets from the VM and sends them to the Cisco VSG for further processing.
A Cisco VSG is configured with three vNICS that are each connected to one of the VLANs. The VLAN functions are as follows:
You can allocate one or more VM Data VLAN(s) for VM-to-VM communications. In a multitenant environment, the Management VLAN is shared among all tenants. The Service VLAN, HA VLAN, and VM Data VLAN are allocated on a per-tenant basis. When VLAN resources are scarce, you can use a single VLAN for Service and HA functions.
There are no new features introduced in Cisco VSG Release 5.2(1)VSG2(1.3).
The Cisco VSG has the following limitations and restrictions:
Workaround: To prevent this situation, configure the Service VLAN and the HA VLAN used by the Cisco VSG as system vlan vlan_number in the uplink port profile.
– When the VEM communicates with the Cisco VSG in the Layer 3 mode, an additional header with 82 bytes is added to the original packet. The VEM does not support fragmentation in Layer 3 mode and the ports/network elements (which carry vPath encapsulated packets) must be configured in such a way that the vPath overhead is accommodated. For example, if MTU values of client and server VMs and uplink are all 1500 bytes, set the uplink MTU to 1582 bytes.
– When encapsulated traffic that is destined to a Cisco VSG is connected to a different subnet other than the virtual network adapter subnet, the VEM does not use the Hyper-V host routing table. Instead, the virtual network adapter initiates an ARP for the remote Cisco VSG IP addresses. You must configure the upstream router to respond by using the proxy ARP feature.
– The VEM does not support a routing functionality and it is assumed that the upstream switch/router is configured with the proxy-ARP configuration.
Configuring a rule with a reset action for the non-TCP/UDP protocol causes dropped traffic. However, the syslog generated for this traffic shows that the action performed for the traffic is reset as shown below:
The following table lists the Cisco VSG and Cisco Nexus 1000V software compatibility matrix.
The following table lists the Cisco VSG scalability matrix.
If Cisco VSG Release 5.2(1)VSG2(1.3) is used with Cisco Nexus 1000V Release 5.2.(1)SV3(1.5b), the maximum limits for the Cisco Nexus 1000V are reduced to the following:
Bugs are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.
For more information about the Cisco Bug Search Tool, see the Bug Search Tool Help & FAQ.
Use the Bug Search Tool to search for a specific bug or to search for all bugs in a release.
Step 1 Go to the Cisco Bug Search Tool.
Step 2 In the Log In screen, enter your register
ed Cisco.com username and password, and then click Log In. The Bug Search page opens.
Note If you do not have a Cisco.com username and password, you can register for them at http://tools.cisco.com/RPF/register/register.do.
Step 3 To search for a specific bug, enter the bug ID in the Search For field and press Enter.
Step 4 To search for bugs in the current release:
a. In the Search For field, enter the appropriate release name and press Enter. (Leave the other fields empty.)
b. When the search results are displayed, use the filter tools to find the types of bugs you are looking for. You can search for bugs by status, severity, modified date, and so on.
Tip To export the results to a spreadsheet, click the Export Results to Excel link.
This section contains information about the documentation available for Cisco VSG and related products.
Cisco VSG for Microsoft Hyper-V documents are available on Cisco.com at the following URL:
http://www.cisco.com/en/US/products/ps13095/tsd_products_support_series_home.html
Cisco PNSC documents are available on Cisco.com at the following URL:
http://www.cisco.com/en/US/partner/products/ps13213/tsd_products_support_series_home.html
Cisco Nexus 1000V Series Switch documents are available on Cisco.com at the following URL:
http://www.cisco.com/en/US/products/ps13056/tsd_products_support_series_home.html
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a reader application. The RSS feeds are a free service.