Elisity Virtual Edge (Switch Hosted) is a docker container-based implementation of Elisity Cognitive Trust software running on a Cisco Catalyst 9000 series switch by leveraging the switch’s integrated application hosting functionality.
Quick Links:
Deploying Elisity Virtual Edge (Switch Hosted)
Enabling Virtual Edge Redundancy with Cisco StackWise™
Upgrading a Virtual Edge (Switch Hosted)
Decommissioning and Deleting a Virtual Edge Node
As of today, all Cisco Catalyst 9300, 9300L and 9400 models support hosting Elisity Virtual Edge container using Cisco Application Hosting. Cisco StackWise© switch stacking technology is also supported. Additional switch models will be supported in future releases. Please see the switch compatibility matrix for more details.
NOTE:
- Switches running Elisity Virtual Edge must be equipped with a supported storage device such as the SSD-120G or C9400-SSD-240GB (M.2) module. Front panel USB and internal flash are not supported. Catalyst 9400 series switches require the installation of an M.2 SSD which requires a switch reboot. See the document here for installation instructions and the document here for verification.
- All Catalyst 9000 series switches require DNA Advantage licensing. This requirement is not unique to the Elisity Virtual Edge container. It is a requirement imposed by Cisco on the application hosting environment within IOS-XE.
- The Elisity Virtual Edge has been developed using IOS-XE version 17.6.1. While it may work with earlier versions of IOS-XE we cannot guarantee that it will operate correctly.
- All switches running Elisity Virtual Edge must have their clocks synchronized with the Active Directory server so that attachment events are displayed accurately. You can use your own NTP server or a public one such as time.google.com
CATALYST 9400 SPECIFIC NOTE:
- Catalyst 9400 series switches must have application hosting verification disabled by issuing the app-hosting verification disable command.
-
Catalyst 9410 series switch. When using slot 4 of the 48-port linecard for application hosting, the port must be in the default shutdown mode. If slot 4 of the 48-port linecard is active, application hosting is rejected. If the linecard port is disabled, slot 4 of the 48-port linecard is marked as inactive. If slot 4 of the 48-port linecard is populated, the port 4/0/48 will not come up. If linecard 4 is empty or if it is a 24-port linecard, no ports are disabled. See this document for more information.
- Catalyst 9410 series switch. To enable the AppGigabitEthernet interface for application hosting, configure the enable command in interface configuration mode. See this document for more information.
The following chart describes the terminology used in this document
|
Cloud Control Center |
Elisity's cloud native and cloud delivered control, policy and management plane. |
|
Virtual Edge |
The Elisity Cognitive Trust software running as a docker container on an access or aggregation switch that supports Application Hosting functionality. |
|
Virtual Edge Node |
An access switch onboarded to a Virtual Edge to be leveraged as an enforcement point in the network. |
Deploying Elisity Virtual Edge (Switch Hosted)
The Elisity Virtual Edge container has a single virtual interface used to communicate with Cloud Control Center as well as with Virtual Edge Nodes. In more detail, the Virtual Edge virtual interface is used to maintain a persistent control plane connection to Cloud Control Center in order to receive identity based policies as well as to send identity metadata and analytics to Cloud Control Center. This same interface is used to glean identity metadata, traffic analytics and other switch information from the Virtual Edge Nodes and to read the Catalyst configuration and configure security policies, traffic filters and other switch functions.
Elisity Virtual Edge supports a 1:1 and a 1:Many model. In other words, you can deploy a Virtual Edge on every access switch that supports application hosting functionality and onboard that same switch as a Virtual Edge Node or you could deploy a Virtual Edge on an aggregation switch that supports application hosting functionality and onboard many access switches as Virtual Edge Nodes. The 1:Many model would be beneficial in the case where the access switches to onboard do not support application hosting, ie. Catalyst 3850 or Catalyst 9200, but you could really onboard any supported switch. Both models are depicted below:
(Click to enlarge)
Step 1: To deploy Elisity Virtual Edge on a Catalyst 9000 series switch first ensure that the switch is running a Network Advantage license with the DNA Advantage add-on. Execute the following commands under global configuration mode
switch# show license summary
! check the license level first
switch(config)# license boot level network-advantage addon dna-advantage
Step 2: If the witch hosting the Virtual Edge container is also going to be onboarded as a Virtual Edge Node you should either have a user account with privilege 15 configured or TACACS/RADIUS login configured to provide privilege 15 level access. This is needed for the Virtual Edge to authenticate with the host switch. Execute the following command under global configuration mode if a local account is being used and is not already configured:
switch(config)# username <username> privilege 15 secret 0 <password>
Step 3: Log into Cloud Control Center and navigate to Policy Fabric > Elisity Edge > Add Edge
(Click to enlarge)
Step 4: Select the Virtual Edge tile.
(Click to enlarge)
Step 5: Fill out the required fields and select Submit & Generate Configuration. Details about each field are provided in the chart below. These details can always be viewed and edited by selecting the more options icon to the right and selecting Edit/Download Virtual Edge Configuration.
(Click to enlarge)
The following chart provides details about each required field
|
Uplink IP Address |
This is the IP assigned to the Virtual Edge container. This IP needs to be routable and must have access to reach Cloud Control Center. This IP also needs reachability to any Virtual Edge Node management interface you plan to onboard. The network for this IP can be configured locally on the application hosting switch or it can be configured on an aggregation switch upstream. This can be a new network or an existing network. This field is mandatory |
|
Uplink Gateway IP |
This is the default gateway IP for the network described above. The default gateway for this IP can be configured locally on the application hosting switch or it can be configured on an aggregation switch upstream. This can be a a default gateway IP from a new network or an existing network. This field is mandatory. |
|
Uplink VLAN |
This is the VLAN assigned to the network described above. This can be a new VLAN or an existing VLAN. This VLAN is assigned to the container's virtual interface so that the container has access to the network it was configured on. This field is mandatory. |
|
Host Name |
This is the host name assigned to the Virtual Edge container. This will be used by Cloud Control Center when automating the generation of the application hosting configuration to be configured on the application hosting switch. This field is optional. |
|
Domain Name Server (DNS) |
This is the DNS server IP to be used by the Virtual Edge container. This can be either a public or private DNS server. This will be used by Cloud Control Center when automating the generation of the application hosting configuration to be configured on the application hosting switch. To specify more than one DNS server use a comma. This field is optional. |
|
Site Label |
You can assign a pre-created site label to your Virtual Edge that is inherited by any attached asset. This allows you to filter and view assets using these site labels. |
|
Virtual Edge Location Address |
The location of the Virtual Edge so that Cloud Control Center reflects the location of the installed container. This field is optional. |
Step 6: After clicking Submit & Generate Configuration, two files will be automatically downloaded to your workstation.
- VE_xxxxxxxxxxxxxxxx.txt
This text file contains the instructions and configurations required to bring up the Virtual Edge container on the application hosting switch as well as the switch configurations required to onboard a Virtual Edge Node. Each Virtual Edge receives a unique identifier which is embedded in the file name. Below is an example of the content in the text file generated by CCC.
NOTE:
Disregard the first section of the file titled "Configuration commands on legacy VE"
# Configuration commands for new generation VE:
# ===============================================
# Step 1: Download the docker tar file provided by your Elisity SE and copy to switch.
# - The docker file should be downloaded to a local customer location to which Catalyst9000 has access.
# - Copy the docker tar file to usbflash: of Catalyst9000.
# Step 2: Apply the below configurations on Catalyst9000
# Replace AppGigabitEthernet1/0/1 with the suitable interface for your system
# AppGigabitEthernet1/0/1 will be the case for 1 RU systems, on a Cat 9400, this
# will usually be the supervisor slot, like AppGigabitEthernet3/0/1
ip routing
iox
ip http server
ip http authentication local
ip http secure-server
restconf
interface AppGigabitEthernet1/0/1
switchport mode trunk
app-hosting appid VE
app-vnic AppGigabitEthernet trunk
vlan 63 guest-interface 1
guest-ipaddress 10.63.0.12 netmask 255.255.255.0
app-default-gateway 10.63.0.1 guest-interface 1
app-resource docker
run-opts 1 "--entrypoint /etc/init.d/cat9k"
run-opts 2 --cap-add=NET_ADMIN
run-opts 3 "--ulimit nofile=90000:90000"
run-opts 4 "--env EDGE_TYPE=VE --env EDGE_REG_KEY=8c36964cde35b6ed --env EDGE_CLOUD_MANAGE_URL=latest-tls.elisity.net --env EDGE_UPLINK_IP=10.63.0.12 --env EDGE_DNS_SERVER=4.2.2.2,8.8.8.8"
run-opts 5 "--hostname VE-9K"
app-resource profile custom
cpu 1024
memory 800
persist-disk 500
vcpu 2
name-server0 8.8.8.8
start
# Step 3: Execute the following exec command on Catalyst9000
app-hosting install appid VE package usbflash1:<tar file name>
# Step 4: Verify Elisity virtualedge is RUNNING using following exec command on Catalyst9000
show app-hosting list
# =================================================
- VE_DOCKER_xxxxxxxxxxxxxxxx.yml
The YAML file is not used when deploying an Elisity Virtual Edge hosted by a switch. This is used when deploying an Elisity Virtual Edge VM hosted by hypervisor such as VMware ESXi. More details on this file are provided in the Elisity Virtual Edge VM (hosted by hypervisor) deployment guide.
Step 7: Copy the Elisity Virtual Edge .tar file provided by your Elisity SE to the application hosting switch's SSD drive usually called usbflash1:. Make sure to confirm your switch's USB flash storage name so that it is copied to the correct storage media. You can use any method you wish to transfer the file such as FTP, SCP, TFTP, HTTPS etc. The file name should look something like this: docker_edge-14.2.13.tar
(Click to enlarge)
Step 8: Log into the application hosting switch, copy and paste the configuration provided by Cloud Control Center into the command line and don't forget to write mem.
(Click to enlarge)
Step 9: Run the provided command to install the Virtual Edge Container on the application hosting switch. Replace <tar file name> with the name of the .tar file name provided by your Elisity SE. For example, docker_edge-14.2.13.tar.
app-hosting install appid VE package usbflash1:<tar file name>
Step 10: Wait a minute or two until the application is finished installing and then run the following command to ensure it was correctly installed and running.
Latest.Elisity.Core.ME#show app-hosting list
App id State
---------------------------------------------------------
VE RUNNING
Step 11: Check Cloud Control Center to ensure that the Virtual Edge registered successfully. If the Virtual Edge status never changes to green then there is an IP connectivity issue between the Virtual Edge and Cloud Control Center.
(Click to enlarge)
Enabling Virtual Edge Redundancy with Cisco StackWise™
If leveraging Cisco Stackwise™ technology to stack switches together, Elisity supports Virtual Edge redundancy. This means that one Virtual Edge instance will be active on the stack primary switch and a second Virtual Edge instance will be cold-standby on the stack secondary switch. If the primary switch goes offline, the stack secondary switch automatically boots up the cold-standby Virtual Edge instance and the now active Virtual Edge instance takes over identity and policy functions for the switch stack.
-png.png?width=444&name=High%20Level%20Design%20Guide%20-%20Virtual%20Edge%20Redundancy%20(2)-png.png)
Enabling Virtual Edge redundancy on a stack of switches is very simple and uses the normal deployment process detailed above. The only additional step is to ensure that the stack secondary switch AppGig interface is configured as a trunk, the same way the primary stack switch AppGig interface is.
The designated switch stack number will determine the full name of the AppGig interface. For example, if switch #4 in the stack is configured as the secondary stack switch, the AppGig interface will be named AppGig4/0/1. Notice the number of the interface is 4/0/1.
interface AppGigabitEthernet4/0/1
switchport mode trunk
NOTE:
- StackWise™ 1:1 Redundancy Mode must be enabled
- Both primary and secondary stack switches must have SSDs inserted.
- Both primary and secondary stack switches must have the Virtual Edge .tar file on their respective SSD.
- Preemption will NOT occur. The secondary stack switch will continue to host the Active Virtual Edge until it goes offline.
Upgrading a Virtual Edge (Switch Hosted)
Step 1: Copy the Elisity Virtual Edge .tar file provided by your Elisity SE to the application hosting switch's SSD drive usually called usbflash1:. Make sure to confirm your switch's USB flash storage name so that it is copied to the correct storage media. You can use any method you wish to transfer the file such as FTP, SCP, TFTP, HTTPS etc. The file name should look something like this: docker_edge-x86_64-14.4.1.tar
Step 2: Log into the switch and run the following commands to remove the old Virtual Edge from the switch application hosting space before installing the new one.
*** Stop the container app ***
switch# app-hosting stop appid VE
VE stopped successfully
Current state is: STOPPED
*** Deactivate the container app ***
switch# app-hosting deactivate appid VE
VE deactivated successfully
Current state is: DEPLOYED
*** Uninstall the container app ***
switch# app-hosting uninstall appid VE
Uninstalling 'VE'. Use 'show app-hosting list' for progress.
Step 3: Run the provided command to install the upgraded Virtual Edge container on the application hosting switch. Replace <tar file name> with the name of the .tar file name provided by your Elisity SE. For example, docker_edge-x86_64-14.4.1.tar.
app-hosting install appid VE package usbflash1:<tar file name>
Step 4: Wait a minute or two until the application is finished installing and then run the following command to ensure it was correctly installed and running.
Latest.Elisity.Core.ME#show app-hosting list
App id State
---------------------------------------------------------
VE RUNNING
Step 5: Check Cloud Control Center to ensure that new code version is displayed.
Decommissioning and Deleting a Virtual Edge
Step 1: Select the more options icon to the right of the Virtual Edge and then select Decommission Virtual Edge.
NOTE:
Before you can decommission a Virtual Edge, all Virtual Edge Nodes onboarded with that Virtual Edge must first be decommissioned and deleted. Follow the guide here to first decommission Virtual Edge Nodes attached to the Virtual Edge you are trying to decommission.
(Click to enlarge)
Step 2: Wait 60 seconds after decommissioning the Virtual Edge. Select the more options icon to the right of the Virtual Edge and then select Delete Virtual Edge. Refer to the previous image.
Step 3: After the Virtual Edge has been decommissioned in Cloud Control Center, log into the switch and run the following commands to remove the Virtual Edge from the switch application hosting space.
*** Stop the container app ***
switch# app-hosting stop appid VE
VE stopped successfully
Current state is: STOPPED
*** Deactivate the container app ***
switch# app-hosting deactivate appid VE
VE deactivated successfully
Current state is: DEPLOYED
*** Uninstall the container app ***
switch# app-hosting uninstall appid VE
Uninstalling 'VE'. Use 'show app-hosting list' for progress.
*** Clean up old configuration ***
switch(config)# no app-hosting appid VE
switch(config)# do wr