Page 1 of 26 - Avi Networks...Note: Installation of Avi Vantage into DevStack is supported only if...

Page 1 of 26

Avi Networks — Technical Reference (18.1)Installing Avi Vantage for OpenStack

Copyright © 2020 Avi Networks, Inc. Page 2 of 26

view onlineInstalling Avi Vantage for OpenStack

IntroductionAbout OpenStack

OpenStack is a set of software tools for building and managing cloud computing platforms for public and private clouds. OpenStack lets users deploy virtual machines and other instances that handle different tasks for managing a cloud environment on the fly. It makes horizontal scaling easy, which means that tasks that benefit from running concurrently can easily serve more or fewer users on the fly by just spinning up more instances. OpenStack provides Infrastructure as a Service (IaaS).

About Avi Vantage

The Avi Vantage Platform provides enterprise-grade distributed ADC solutions for on-premises as well as public-cloud infrastructure. Avi Vantage also provides built-in analytics to diagnose and improve the end-user application experience, while making operationalizing easier for network administrators.

Avi Vantage is a complete software solution which runs on commodity x86 servers or as a virtual machine and is entirely enabled by its REST API.

OpenStack IntegrationAvi Vantage integrates with OpenStack infrastructure components to provide centralized automation, monitoring, and management of application discovery and delivery. Avi Vantage integrates with the following OpenStack services:

Keystone: The Avi Controller uses Keystone API to authenticate any OpenStack user accessing Avi API. Also, when an OpenStack user logs in, the Avi Controller can also automatically import tenant/project and role information from Keystone to provide appropriate privileges on Avi Controller.Glance: The Avi Controller uses Glance for storing service engine (SE) image.Nova: The Avi Controller uses Nova API to automatically create and destroy application delivery service engines (Avi SEs) as needed to support high availability and performance guarantees.Neutron: The Avi Controller uses Neutron API to plug service engines into right Neutron networks for receiving and sending the application traffic.Neutron LBaaS v2: Users can either use the Avi Controller API (or UI or CLI) to directly configure load balancer instances. Optionally, the OpenStack admins can install Avi LBaaS driver on the Neutron API servers and enable Avi as a provider for Neutron LBaaS API.Horizon: OpenStack admins can optionally install Avi Horizon Dashboard extensions to expose full Avi UI directly embedded in Horizon Dashboard. Users can then not only configure load balancer instances but can also access the full analytics of their applications.Heat: OpenStack admins can optionally install Avi Heat package on the Heat Engine servers to expose all Avi Controller API resource types for users to use in their heat templates. In contrast to LBaaS (v1 or v2) resource types, Avi Heat resource types expose significantly advanced features.

Note: LBaaS v1 is deprecated from Avi Vantage 17.2.x.

Avi Vantage's integration with OpenStack is as shown below.

https://avinetworks.com/docs/18.1/installing-avi-vantage-for-openstack/



Deployment ModesAvi Vantage can be deployed into an OpenStack cloud in one of the following modes. These modes differ depending on whether the Avi Controller and Service Engines (SEs) are placed in the same OpenStack tenant, and whether Neutron LBaaS API or Avi Vantage API is used to create load balancers.

Single-tenant mode: The Avi Controller and the SEs are deployed together in the same single tenant. The Avi Controller has administrator privileges within the tenant. Tenant users with administrator privileges within the tenant can install and manage Avi Vantage. Use this deployment mode if you do not have administrator privileges for the cloud.Avi-managed LBaaS mode: The Avi Controller and SEs are installed in separate tenants. The Controller has administrator privileges for the cloud and can manage SEs that are in different tenants. A tenant administrator can log onto the Avi Controller to manage the infrastructure resources within the administrator's own tenant but cannot access the resources within other tenants. The tenant administrator can configure and manage load balancing services through the Avi Controller web interface or through the Avi REST API.OpenStack-managed LBaaS mode: This mode is similar to the Avi-managed LBaaS mode, except the tenant administrator configures and manages load-balancing services through OpenStack's Neutron service and Horizon dashboard. Neither the Controller web interface nor Avi API are used. This mode also requires installation of an LBaaS driver and SSL extension from Avi Networks.

Note: The Avi-managed LBaaS option is recommended for its ease of use and advanced feature accessibility.

The following table compares each deployment mode:



Single-tenant Mode

Avi-managed LBaaS Mode

OpenStack-managed LBaaS Mode

Require administrator privileges for cloud? No Yes Yes

Managed by tenant user No Yes Yes

Automated tenant creation N/A Yes Yes

Advanced load-balancing features available Yes Yes Limited

Analytics service Yes Yes Yes

Require Avi LBaaS driver installation? No No Yes

Is Avi extension for Horizon dashboard required?

No NoYes (required for SSL offload and analytics)

Deployment PrerequisitesThe physical and software requirements differ depending on the deployment mode.

Virtual Machine Requirements

The following table lists the minimum requirements for the virtual machines (VMs)on which the Avi Controller and SEs are installed.

Component Memory vCPUs HD

Avi Controller 24 GB 864 GB

Service Engine

2 GB 210 GB

Add 3 GB for each additional vCPU in the Controller. Add 1 GB for each additional vCPU in an SE.

If you allocate more than the minimum number of vCPUs required, make sure to also allocate at least the minimum required additional memory. Cloud administrators can create m1.xlarge flavor of controller image.

Note: In KVM/OpenStack, the Service Engines have a limitation of 24 vNICs. To support 24 vNICs, Service Engines should be configured with at least 3GB of memory.

Software Requirements

The following table lists the software requirements.

Software Version

Avi Controller 18.2

OpenStack (and Neutron service)One of the following: Havana, Icehouse, Juno, Kilo, Liberty, Mitaka, Newton, Ocata, Pike

Neutron extension for allowed-address-pair and/or port-security

Avi LBaaS driver 17.2

Avi SSL extension for OpenStack Horizon 17.2

The Avi Vantage image is available in qcow (QEMU Copy ON Write)2 format or raw image of the Controller and SEs. The SE software is embedded in the Controller image and does not require separate installation. In case of OpenStack Generic cloud (



with Avi Cloud Connector), qcow2 image for SE is pushed by the Avi Controller towards OpenStack Glance. In case of a no-access cloud, the qcow2 image for SE has to be downloaded and then manually uploaded to OpenStack Glance.

Note: Installation of Avi Vantage into DevStack is supported only if the DevStack/Nova-launched VMs can run in Kernel-based Virtual Machine (KVM) mode, as opposed to Quick Emulator (QEMU) mode. Refer to the for DevStack KVM Guideinformation.

Protocol Ports Used by Avi Vantage for Management Communication

In an OpenStack deployment, the Avi Controller and Avi Service Engines use the following ports for management. The firewall should allow traffic to these ports.

Traffic SourceTraffic Destination

Ports To Allow

Avi Controller

Avi Controller

TCP 22 (SSH)TCP 443 TCP 8443TCP 5054

Avi Service Engine

TCP 22

Management Net See section below the table.

Avi Service Engine

Avi Controller

TCP 22TCP 8443UDP 123

Management Net

TCP 22TCP 80 (optional)TCP 443TCP 5054 (if using the optional for remote management access)CLI shell

Ports Used by the Controller for Network Services

The Controller may send traffic to the following UDP ports as part of network operation:

TCP 25 (SMTP)UDP 53 (DNS)UDP 123 (NTP)UDP 162 (SNMP traps)UDP 514 (syslog)

The firewall also should allow traffic from the Controller to these ports.

Importing User Accounts from KeystoneUsing the Avi REST API, user roles can be exported from Keystone into the Avi Controller and directly mapped to role names in the Controller. The accounts do not need to be recreated on the Controller. Here is an example:

"openstack_configuration":

{

....

"role_mapping": [

{"os_role": "admin",

"avi_role": "Tenant-Admin"},

http://docs.openstack.org/developer/devstack/guides/devstack-with-nested-kvm.html

https://avinetworks.com/docs/18.1//cli-installing-the-cli-shell/



{"os_role": "_member_",

"avi_role": "Tenant-Admin"},

{"os_role": "*",

"avi_role": "Application-Operator"}

],

....

}

The parameter is an ordered list, where each item specifies how a Keystone role (os_role) maps to a role in role_mapping

the Controller (avi_role). A default mapping can be defined for any Keystone role by specifying the ? /* ? wildcard for the os_role field. In the above example, roles admin and from Keystone are mapped to the role Tenant-Admin in the memberController. Further, any other role from Keystone is mapped to role Application-Operator on the Controller.

In the following example, only users with role lbaas_project_admin are allowed to access the Controller:

"openstack_configuration":

{

....

"role_mapping": [

{"os_role": "lbaas_project_admin",

"avi_role": "Tenant-Admin"}

],

....

}

Metadata Instead of config_drive for Avi SEsIn some OpenStack environments, support is either absent or not installed well. Also, sometimes customers config_drive

prefer that Avi SEs not use , because using it to configure the VM might prevent SE migration under certain config_drive

conditions.

The Avi Vantage OpenStack configuration option uses metadata instead of for SE VMs. To have Avi Vantage config_drive

use metadata, disable .config_drive

CLI to disable Config_drive

: > configure cloud Default-Cloud<br> : cloud> openstack_configuration<br> : cloud:openstack_configuration> no config_drive<br> : cloud:openstack_configuration> save<br> : cloud> save

Deploying Single-tenant ModeThis section provides the steps for deploying Avi Vantage into an OpenStack cloud in single-tenant mode.



In single-tenant mode, the Avi Controller and SEs are installed in the same tenant, and have member privileges for that tenant. The member privilege grants the Avi Controller full access to the tenant so that it can automatically spin-up and spin-down an SE. Each tenant is responsible for installing and operating Avi Vantage.

Deployment Process

Single-tenant installation requires the following procedure. * . Upload the Controller ImageAdd the Avi Controller QCOW2 or raw image into the tenant from Glance. * for the Avi Create a management networkController and SEs. * * * Create a security group Deploy an Avi Controller instance and assign a floating IP address to it

. Use the setup wizard to perform initial configuration of the Controller.Perform Initial Controller Setup

Upload the Controller Image

To upload the Controller image, execute the following steps. 1. Copy the Avi Vantage Controller image onto your hard drive. 2. Log into the OpenStack tenant account on the Horizon dashboard. 3. Navigate to > . 4. Click on Project Images Create

and fill out the form.Image

Create Management Network

A management network is required for communication between the Avi Controller and the SEs. An existing network can be used but a dedicated management network is recommended. 1. On the Horizon Dashboard, navigate to > . Network Networks2. Click on and follow the wizard's instructions. For this example, * Network name: avi-mgmt * DHCP: Create NetworkEnabled 3. Connect the network to your neutron router.a. Navigate to > .Network Routersb. On the in the router list, click on the router to add an interface to the network.Name columnc. Click on the tab, then click on .Interfaces Add Interface

Create Security Group

A security group is required to allow the Controller and SEs to exchange management traffic. The group specifies the protocol ports for which traffic will be allowed.

For ingress traffic, the group must allow ports.theseFor egress traffic, the group can allow all ports.

Note: The Controller automatically creates a security group for the SEs.



1. 2.

To create a security group (in this example, ) to allow management traffic,Avi-mgmt-sg

On the Horizon Dashboard, navigate to > , and click on .Project Access & Security Create Security GroupsAdd rules as shown in the following example, where 192.168.10.0/24 is the management network.

Deploy Controller and Assign It a Floating IP

To deploy an Avi Controller instance, execute the following steps.

Flavor: Deploy the same flavor that was chosen in the previous steps.Network: Use to attach the Controller to the management network.avi-mgmt

Security group: Use to allow management traffic.avi-mgmt-sg

Enable .config-drive

To assign a floating IP address to the Controller, 1. On the Horizon Dashboard, navigate to > > Project Compute Access & . 2. Assign the floating IP address:Security

* If no floating IP address is already available, click on . * Otherwise, if a floating IP address is already Allocate IP to Projectavailable, associate it with the Avi Controller instance.

Perform Initial Controller Setup

This section shows how to perform initial configuration of the Avi Controller using its deployment wizard. You can change or customize settings following initial deployment using the Avi Controller?s web interface.

Note: While the system is booting up, a blank web page or 503 status code may appear. In this case, wait for 5 to 10 minutes; then follow the instructions for the setup wizard.



1.

This section shows how to perform initial configuration of the Avi Controller using its deployment wizard. You can change or customize settings following initial deployment using the Avi Controller?s web interface.

Configure basic system settings.Administrator accountDNS and NTP server informationEmail and SMTP information



1.

2.

3.

Set the to as shown in the image below.Infrastructure Type OpenStack

Enter the OpenStack settings.Provide the tenant user credentials (username, password). If you are using Keystone V3 and want to provide a user in the non-Default domain, then use the notation for the field as shown user@domain-name Usernamebelow.

If a username is created as a Keystone v3 user in a domain named , then explicitly specify test default

when logging into the Avi Controller. If the domain name is not specified, Keystone looks test@testdomain

for a domain with UUID and not the name . Since no domain with a UUID of testdomain testdomain

exists, Keystone fails, returning the error .testdomain invalid user/password

Using the full value in the field. Avi Vantage determines the Keystone API version Keystone Auth URLautomatically. When the auth URL is a secure URL (HTTPS), an option to either allow or disallow self-signed certificates will show up. Disable that checkbox in a production environment, since OpenStack services should use proper, trusted certificates.Enable the option.Keystone Auth



3.

4. In the window, select a . In this deployment, it should be the same tenant into which the Management Network tenantAvi Controller is deployed. Choose the management network created previously.



4.

5.

6.

7.

In the window, select an Avi Vantage user role to use as the default user role.Keystone Role Mapping

If an Avi Vantage user who logs in with valid Keystone credentials, but with a role that does not have the same name as any of the user roles defined on the Controller, the default role is assigned to the user. To instead disallow access by any user who does not have a role that is defined on the Controller, skip this option.In the window, select to import from tenants Keystone and click on Virtual Service Placement Settings Import Tenants

. Then, in the window, click on .Next Support Multiple Tenants No



7. To verify installation, navigate to > , click on , then click on the button. If Infrastructure Clouds Default-Cloud Statusthe status is green, the installation is successful.

Neutron SDN Plugin Integration

Avi Vantage integrates with the following Neutron SDN plugins to provide VIP placement and floating-IP (FIP) association to VIP.

Nuage SDN

During cloud configuration, select the checkbox and provide the VSD host, port and Integration with Nuage VSDauthentication details.



If you are creating a new cloud, the wizard looks as below:



Contrail SDN

Using the Avi UI

During Cloud configuration, select the checkbox and provide the endpoint URL of Contrail VNC api-Integration with Contrailserver. The Keystone credentials from the OpenStack configuration will be used to authenticate with the api-server service.

Note: Contrail-Interface-IP is handled gracefully by Avi Vantage. So, creating and editing the cloud should be left intact while integrating Contrail SDN under Network Settings.

If you are creating a new cloud, the wizard looks as below.



If you are editing an existing cloud, the cloud editor looks as below.

Using the Avi CLI

{%cli%}

configure cloud oscontrail



cloud> vtype cloud_openstackcloud> openstack_configurationcloud:openstack_configuration>cloud:openstack_configuration> privilege write_accesscloud:openstack_configuration> username admincloud:openstack_configuration> password xxxyyyzzzcloud:openstack_configuration> admin_tenant admincloud:openstack_configuration> mgmt_network_name avi-mgmtcloud:openstack_configuration> region RegionOnecloud:openstack_configuration> use_keystone_authcloud:openstack_configuration> import_keystone_tenantscloud:openstack_configuration> no use_admin_urlcloud:openstack_configuration> auth_url http://172.16.11.50:5000/v2.0cloud:openstack_configuration> no neutron_rbaccloud:openstack_configuration> contrail_endpoint http://10.10.10.100:8082cloud:openstack_configuration> role_mapping os_role * avi_role Tenant-Admin New object being createdcloud:openstack_configuration:role_mapping> savecloud:openstack_configuration> savecloud> save {%endcli%}

Deploying Avi-managed LBaaS ModeThis section provides the steps for deploying Avi Vantage into an OpenStack cloud in Avi-managed LBaaS mode.

Avi-managed LBaaS mode provides tenant users with the advantages of Avi Vantage, without the need for them to perform deployment or maintenance of Avi Vantage. Instead, the cloud administrator deploys and manages Avi Vantage. The Avi Controller and SEs in the administrative tenant are shared by other tenants. Users of those tenants are able to secure and optimize their applications using the Avi Vantage resources that reside in the administrative tenant.

Note: Although using an existing tenant instead of creating a new one also is supported, creating a new tenant is recommended for easy maintenance.

Perform OpenStack-managed LBaaS Mode Deployment

To begin, perform all the steps in . These steps also are required for OpenStack-managed Deploying Avi-managed LBaaS ModeLBaaS mode.



Install Avi LBaaS Driver

Installing/Upgrading LBaaS Driver using Script

Avi Networks provides a script for installing or upgrading the LBaaS plugin driver v2). The script makes the necessary OpenStack configuration changes automatically. Download the Avi LBaaS driver installation package (avi_openstack_package.tar.gz) from the Avi Networks portal website ( ).https://portal.avinetworks.com

Notes:

If preferred, the LBaaS driver can be installed alone without the virtual environment files that the script also installs. (For more information and instructions, refer .)LBaaSv2 Driver

An account with root privileges for the Neutron API server is required. This account is different from the account used by the Controller to access the OpenStack infrastructure.

The following are the steps to install Avi LBaas Installation: * Copy the package onto the OpenStack Neutron API host. * Log into the Neutron API server. * On the OpenStack Neutron API server, back up neutron.conf. * Unzip and untar the driver package: . * Run the Avi LBaaS installation script. To install LBaaSv2 driver, tar -xzf avi_openstack_package.tar.gz

specify the option "--v2" to the following install command.

Note: If installing only the driver without the virtual environment files, refer .LBaaSv2 Driver

[root@sivacos openstack_lbplugin(keystone_admin)]# ./install.sh --aname my_lbaas --aip 10.10.22.44 --auser admin --apass avinetworks

12/06/2016 13:58:37 INFO: logging initialized

12/06/2016 13:58:37 WARNING: Using auth_url IP 10.130.128.110 as keystone IP

12/06/2016 13:58:37 INFO: OS distribution: Fedora

12/06/2016 13:58:38 INFO: Neutron process check...OK

12/06/2016 13:58:38 INFO: neutron path '/usr/lib/python2.7/site-packages/neutron'...OK

12/06/2016 13:58:38 INFO: neutron_lbaas path '/usr/lib/python2.7/site-packages/neutron_lbaas'...OK

12/06/2016 13:58:43 INFO: Local: Avi Controller '10.10.22.44' check using provided credentials...OK

12/06/2016 13:58:44 INFO: Local: Avi Controller cloud 'Default-Cloud' check...OK

--> Install SeLinux module 'avi_lbaas'? (y/n)y

12/06/2016 13:58:49 INFO: SeLinux module Install in progress...

12/06/2016 13:59:05 INFO: SeLinux module 'avi_lbaas' install...OK

12/06/2016 13:59:05 INFO: Horizon Load-Balancer tab already enabled

12/06/2016 13:59:37 INFO: Horizon HTTP server restart...OK

--> Configure Neutron Server with Avi LBaaS provider 'my_lbaas' with driver 'avi'? (y/n)y

12/06/2016 13:59:46 INFO: Neutron Avi LBaaS configure provider 'my_lbaas'...OK

12/06/2016 13:59:46 INFO: Neutron Avi LBaaS driver 'avi' setup...OK

12/06/2016 13:59:58 INFO: neutron-server restart...OK

12/06/2016 13:59:58 INFO: Neutron Avi LBaaS configuration setup...OK

12/06/2016 13:59:58 INFO: Refer '/tmp/openstack_lbplugin/avi_os_setup.log' for install log

To upgrade the existing driver, if any, specify the option ?--update" to the above install command.

[root@sivacos openstack_lbplugin(keystone_admin)]# ./install.sh --aname my_lbaas --aip 10.10.22.44 --auser admin --apass avinetworks --update

12/06/2016 14:04:08 INFO: logging initialized

12/06/2016 14:04:08 WARNING: Using auth_url IP 10.130.128.110 as keystone IP

12/06/2016 14:04:08 INFO: OS distribution: Fedora

https://portal.avinetworks.com

https://avinetworks.com/docs/18.1/lbaas-v2-driver/

https://avinetworks.com/docs/18.1/lbaas-v2-driver/



1. 2.

3. 4. 5. 6. 7.

1. 2. 3. 4.

12/06/2016 14:04:08 INFO: Neutron process check...OK

12/06/2016 14:04:09 INFO: neutron path '/usr/lib/python2.7/site-packages/neutron'...OK

12/06/2016 14:04:09 INFO: neutron_lbaas path '/usr/lib/python2.7/site-packages/neutron_lbaas'...OK

12/06/2016 14:04:19 INFO: Local: Avi Controller '10.10.22.44' check using provided credentials...OK

12/06/2016 14:04:20 INFO: Local: Avi Controller cloud 'Default-Cloud' check...OK

12/06/2016 14:04:23 INFO: SeLinux module 'avi_lbaas' already installed

12/06/2016 14:04:23 INFO: Horizon Load-Balancer tab already enabled

12/06/2016 14:04:54 INFO: Horizon HTTP server restart...OK

--> Configure Neutron Server with Avi LBaaS provider 'my_lbaas' with driver 'avi'? (y/n)y

12/06/2016 14:05:03 INFO: Neutron Avi LBaaS configure provider 'my_lbaas'...OK

12/06/2016 14:05:04 INFO: Neutron Avi LBaaS driver 'avi' setup...OK

12/06/2016 14:05:16 INFO: neutron-server restart...OK

12/06/2016 14:05:16 INFO: Neutron Avi LBaaS configuration setup...OK

12/06/2016 14:05:16 INFO: Refer '/tmp/openstack_lbplugin/avi_os_setup.log' for install log

Deployment Process

Create a tenant for the Controller and SECreate multiple flavors of the Avi Vantage image, with different resource allocations to fit different sizes of user tenant, if required.Upload the Controller Image into the tenant from Glance.Create a management networkfor the Avi Controller and SEs.Create a security group to allow Avi management traffic.Deploy an Avi Controller instance and assign a floating IP address to it.Perform Initial Controller Setup.Use the setup wizard to perform initial configuration of the Controller.

Create a Tenant for the Controller and SEs

Log into the OpenStack Horizon dashboard with an account that has cloud administrator privileges.Navigate to > .Identity ProjectsClick on and follow the wizard's instructions.New ProjectFor Avi Vantage deployment, use the following settings:a. Enter a project name (e.g., "avi-tenant?).b. Click on the tab.Project Membersc. Add a user account to Project Members and assign the admin role to the account.d. Click on the tab and modify the maximum resources. These settings allow for three Avi Controllers (for Quotaredundancy), up to 1000 SEs and some other managerial instances, if required as shown below.



1. 2.

3.

1. 2. 3.

1.

Create Multiple Flavors of Controller Image

Use these steps to create multiple flavors of Avi Vantage:

In the Horizon dashboard, navigate to > > and click on .Admin System Flavors Create FlavorCreate an appropriate flavor for Service Engine. Refer to to check minimum and Service Engine Sizing guiderecommended resources required for Service Engine.Create appropriate flavor for Controller. Refer to to check minimum and recommended Controller Sizing guideresources required for Controller.

You can manually configure the flavor if you want to use flavors other than recommended flavor using .CLI

Note: The OpenStack flavour name should be specified and not the flavor ID or UUID.

Upload Controller Image

Copy the Avi Vantage Controller qcow2 image onto your hard drive.In the Horizon dashboard, navigate to > .Project ImagesClick on and fill out the form. Use at least these resource allocations:Create Image

Minimum disk: 64 GBMinimum memory: 24 GB

Create Management Network

A management network is required for communication between the Avi Controller and the SEs. An existing network can be used but a dedicated management network is recommended.



1. 2.

3.

a. b. c.

1.

On the Horizon Dashboard, navigate to > .Network NetworksClick on and follow the wizard's instructions. For this example let's use,Create Network

Network name: avi-mgmtDHCP: Enabled

Connect the network to your Neutron router.

Navigate to > .Network RoutersIn the column in the router list, click on the router to add an interface to the network.NameClick on the tab; then click on .Interfaces Add Interface

Create Security Group

A security group is required to allow the Avi Controller and SEs to exchange management traffic. The group specifies the protocol ports for which traffic will be allowed. For ingress traffic, the group must allow ports.these

For egress traffic, the group can allow all ports.

Note: The Avi Controller automatically creates a security group for the SEs.

To create a security group (in this example, ) to allow management traffic:Avi-mgmt-sg

Navigate to > , and click on .Project Access & Security Create Security GroupsAdd rules as shown in the following example, where is the management network.192.168.10.0/24

Deploy Controller and Assign it a Floating IP

To deploy an Avi Controller instance, execute the following steps.

Flavor: Deploy the same flavor that was chosen in the previous steps.Network: Use to attach the Controller to the management network.avi-mgmt

Security group: Use to allow management traffic.avi-mgmt-sg

Enable .config-drive

To assign a floating IP address to the Controller, 1. On the Horizon Dashboard, navigate to > > Project Compute Access & . 2. Assign the floating IP address:Security

* If no floating IP address is already available, click on . * Otherwise, if a floating IP address is already Allocate IP to Projectavailable, associate it with the Avi Controller instance.

Perform Initial Controller Setup

This section shows how to perform initial configuration of the Avi Controller using its deployment wizard.

You can change or customize settings following initial deployment using the Avi Controller?s web interface.

Configure basic system settings:Administrator accountDNS and NTP server informationEmail and SMTP information



1.



1.

2. 3.

4.

5.

Set the infrastructure type to . OpenStackEnter OpenStack settings,

Tenant user credentials (username, password).IP address of Keystone server.Enable the .Keystone Auth option

In the window, select a tenant. In this deployment, it should be the same tenant into which the Management NetworkAvi Controller is deployed. Choose the management network created previously.

In the window, select an Avi Vantage user role to use as the default user role.Keystone Role Mapping



5.

6.

7.

If an Avi Vantage user logs in with valid Keystone credentials, but with a role that does not have the same name as any of the user roles defined on the Controller, the default role is assigned to the user. To instead disallow access by any user who does not have a role that is defined on the Controller, leave the selection empty (None).

In the window, select to import from tenants Keystone and click on Virtual Service Placement Settings Import Tenants. Then, in the window, click on .Next Support Multiple Tenants Yes

In window, select the following settings.Tenant SettingsPer tenant IP route domainService Engines are managed within the provider context, shared across tenantsTenant has Read Access to Service Engines



7.

8.

9.

10.

Navigate to > > .Infrastructure Service Engine Group Default-Cloud

Click on checkbox and click on the edit icon.Default-Group

: Ensure that compact placement is selected and Max Number of Service Engines is high enough to meet the Noteneeds of all tenants.

To verify installation, navigate to > . Click on , and then click on the button. Infrastructure Clouds Default-Cloud StatusIf the status is green, installation is successful.



1. 2. 3. 4. 5. 6. 7. 8. 9.

Install Valid Certificate on Avi Controller

This section gives steps for replacing the Avi Controller's self-signed certificate with one signed by a Certificate Authority (CA). The Avi Controller requires a CA-signed certificate to access the Avi Controller through the Horizon dashboard.

Log into Avi Controller's web interface.Navigate to > .Templates SecurityClick on .Createclick on to create it.Controller CertificateClick on the button to import the new certificate and key.ImportClick on the button and select the certificate from your system.Upload FileEnter or or upload the file.Key(PEM) PKCS12Enter the .SSL/TLS PassphraseAfter uploading the new certificate and key, configure the Avi Controller to use them. a. Navigate to > > .Administration Settings Access Settingsb. Click the edit icon.c. Select the imported certificate and click on .Save

Related ArticlesUpgrading Avi Vantage SoftwareUpgrades in an Avi GSLB Environment

Date post:	03-Jul-2020
Category:	Documents
Upload:	others
View:	1 times
Download:	0 times

Page 1 of 26 - Avi Networks...Note: Installation of Avi Vantage into DevStack is supported only if...

Documents