Open MSA Introduction Kuala Lumpur, I. S. on IOT & SDN/NFV, Day 2
â˘
0 likesâ˘272 views
Presentation about the Open MSA given at the International Symposium on IOT & SDN/NFV in Kuala Lumpur on Aug 1, 2018.
Recommended
Recommended
More Related Content
Similar to Open MSA Introduction Kuala Lumpur, I. S. on IOT & SDN/NFV, Day 2
Similar to Open MSA Introduction Kuala Lumpur, I. S. on IOT & SDN/NFV, Day 2 (20)
Recently uploaded
Recently uploaded (20)
Open MSA Introduction Kuala Lumpur, I. S. on IOT & SDN/NFV, Day 2
- 1. OPEN MSA Network & Security Automation Made Easy THE INTERNATIONAL SYMPOSIUM ON IOT & SDN/NFV Kuala Lumpur, Jul.31st â Aug. 1st 2018
- 2. Welcomeďź ObjecNves: â⯠Learn how to use Microservices and WorkďŹows on the OpenMSA through real-world examples â⯠Empower aZendees to use the OpenMSA to perform Networking and Security automaNon and orchestraNon â⯠Connect with other people who work through similar issues and processes 2
- 3. Who are we? Chang Kyu Kim, Head of Sales & Partnerships, Asia & Far East, Ubiqube â˘âŻ Chang-Kyu Kim leads UBiqubeâs APAC business development and sales, focusing on developing an ecosystem where cross industry alliances and partnerships are necessary to build mulF-domain, mulF-vendor service automaFons in the connected world â˘âŻ Chang-Kyu has 25 years of track record of building businesses from scratch to global presence as a key member of startups in many areas including Neural Networks, Cybersecurity, and Process opFmizaFon. Naveen Kumar, Senior SoluFons Architect, Ubiqube â˘âŻ Naveen Kumar is passionate about solving challenges in the networking and security domains in reducing Nme to market for new services, designing fully automated orchestraNon soluNons for legacy/virtualized/hybrid infrastructures/domains using DevOps. â˘âŻ As a Senior SoluNon Architect at UBiqube, Naveen is engaging customers, training developers using MSAcNvator, UBiqube's dev-ops orchestrator, and acNvely involved in the OpenMSA community to help contributors. Prior to joining UBiqube, Naveen was a STB socware stack developer at Cisco India. 3
- 4. The Agenda 13:00 OpenMSA Overview & PosiNoning Advanced Product Demo 14:00 Hands-on Session #1: Microservices How to do element management by designing microservices Typical use case: Provision security and networking rules to control traďŹc ďŹow Followed by QA 15:30 Break 16:00 Hands-on Session #2: WorkďŹows Automate network conďŹguraNons and orchestrate security services Typical use case: Automate the security policy conďŹguraNon on mulNple devices Followed by QA 17:30 Summary The beneďŹts of joining the OpenMSA Community and where it is headed 18:00 BuďŹet Dinner 4
- 6. â˘âŻ Global presence â˘âŻ Ireland â Headquarters & Engineering â˘âŻ France â Engineering â˘âŻ India â Engineering, Sales & Support â˘âŻ US - Global Marketing & Sales & Support â˘âŻ Japan - Sales & Support â˘âŻ UAE - Sales & Support â˘âŻ Strategic investment from â˘âŻ Technology and channel partner ecosystem include UBiqube Corporate Overview
- 8. OpenMSA â˘âŻ OpenMSA is a DevOps ready programmable orchestrator designed to ease the use and integraNon of network and security systems â˘âŻ OpenMSA enables easy design of process automaNon across the infrastructure conNnuum â˘âŻ OpenMSA is used by service provider engineers, IT and security managers and IT soluNon developers 8 Seamless integra1on of virtual and physical Scalability Modular, evergreen building blocks Flexibility and depth in workďŹow design Compliant, yet not constrained by any orchestra1on standard
- 9. Services Architecture EvoluNon We are here Integration (with Network and Apps) Time First wave of virtualization: SDN, NFV, SDx Public Cloud, self management trends, IoT â˘âŻ Best-of-breed add-on security appliances â˘âŻ Mono-vendor scenarios â˘âŻ Dominate/add-on/pure-play services with premium pricing â˘âŻ Software focus â˘âŻ Agility â˘âŻ Integration matters â˘âŻ Volume acceleration â˘âŻ Still skills intensive â driving OPEX up â˘âŻ Easy management becomes a paramount focus â˘âŻ Automation and process streamlining promotes price erosion
- 10. OpenMSA Architecture: Modular Framework with the Orchestration Designer and the Ops User in Mind
- 11. Reality Check: IntegraNon Remains TheoreNcal Network Security Telco/CSP Enterprise OSS/BSS* Vendor EMS/NMS** SIEM Vendor EMS/NMS** Vendor EMS/NMS** SIEM ** = Locked solution that canât integrate in a larger automation architecture * = Costly and cumbersome platforms to integrate Lack of Orchestration Continuum
- 12. OpenMSA the âAgileâ E2EO in an Ever Evolving Landscape Architectural PosiNoning: MulNVendor & MulNDomain Multitude of Vendors E2E Orchestration DCI Management Element/Domain Management SDN NFV Legacy (Hardware) VNF Hosting (DC) Core Edge Securi ty NSX Contrail ACI Nu age Juniper SDDC Cisco Nokia Viptela Velocloud Tracker Neutron Vrealize Vsphere OpenStackVMware Cloudify, Ansible, etc. AWS MS Azure Google
- 15. The OpenMSA Community 15 â˘âŻ Open forum for networking and security automaNon â˘âŻ Knowledge-based tools and applicaNons to empower developers and network engineers â˘âŻ Vendor-agnosNc, mulN-domain soluNons â˘âŻ The OpenMSA is available at no charge for community members â˘âŻ Available at hZp://www.openmsa.co/. â˘âŻ Open source development modules available on GitHub PollEv.com/ubiqube850
- 18. On GitHub 18 â˘âŻ Open Source Core engine â˘âŻ Open Source Adaptors (developed by the Community) â˘âŻ WorkďŹow examples â˘âŻ Microservice examples PollEv.com/ubiqube733
- 19. Does the OpenMSA allow for automated provisioning and policy conďŹguraNon? PollEv.com/ubiqube733
- 24. ConďŹguring the OpenMSA 24 â˘âŻ Use the public IP of the instance and access â˘âŻ hZp://<PUBLIC_IP>:3577/conďŹg.xml (socconďŹg/b5ty9uvh4) â˘âŻ ConďŹgure the following: â˘âŻ System name â˘âŻ Company informaNon â˘âŻ Management interface: Enable NAT and use the public IP assigned to the AWS instance â˘âŻ Disable: Backup, maintenance interface, etc. More details available online: hZps://www.openmsa.co/documentaNon/getng-started-with-the-openmsa-freeware/ PollEv.com/ubiqube850
- 26. OpenMSA: The DevOps Way GitHub.com/openmsa/ openmsa/WorkďŹows-Microservices # git clone https://github.com/openmsa/Workflows-Microservices.git OpenMSA [root@DEV-OPENMSA]# ll /opt/fmc_repository/CommandDefinition/ total 60 drwxr----- 4 ncuser ncuser 4096 Nov 15 11:22 LINUX lrwxrwxrwx 1 ncuser ncuser 25 Feb 23 10:37 OpenMSA -> ../OpenMSA/ MICROSERVICES/ drwxr----- 16 ncuser ncuser 4096 Apr 12 14:28 Reference clone symlink to OpenMSA repository
- 30. AutomaNon and OrchestraNon via WorkďŹows â⯠Provide automation of operations â⯠Open work-flow builder Automated operation (simplified standardized interfaces) Reduced time to setup and less error prone Workflow Manager Task1 Get floating IP Task2 Create VNF Task3 Create device in DB Task4 Push initial configuration Openstack Device A Device B Device Xăťăťăť Define services by combination of processes and tasks The work-flow consisting of tasks Reusable definition of the business-logic written in simple PHP â Service ⥠Process ⢠TaskCustomer Order System VM Management Create VNF Update VNF Delete VNF
- 42. Part 2: coding
- 45. High-Level Requirements â˘âŻ The operator should have the opNon to protect IT resources (e.g. public or corporate servers, like NckeNng systems, web servers, etc.) with a ďŹrewall â˘âŻ The ďŹrewalls should not be limited to a single vendor â˘âŻ The operator should beneďŹt from a single management pane for all operaNons, from policy provisioning, to monitoring and reporNng â˘âŻ ConďŹguring the ďŹrewall should be as simple as possible PollEv.com/ubiqube733
- 47. SpeciďŹcaNons for a Simple Firewall â˘âŻ The user (operator or end-customer) must be able to specify an IP address and a service (network port number) on the OpenMSA console â˘âŻ The user must be able to select a group of ďŹrewalls to conďŹgure â˘âŻ The OpenMSA will use the two parameters IP + port to automaNcally conďŹgure the ďŹrewalls selected by the user PollEv.com/ubiqube733
- 49. Firewall ImplementaNon on Linux PollEv.com/ubiqube733 â˘âŻ Based on Linux IPtables â˘âŻ Takes an IP and a port as parameters Create a rule sudo iptables -A INPUT -p tcp --dport <PORT TO BLOCK> -s <IP TO BLOCK> -j DROP sudo iptables -A FORWARD -p tcp --dport <PORT TO BLOCK> -s <IP TO BLOCK> -j DROP Get the list of rules iptables -L INPUT -n | grep -v Chain | grep -v target Returns DROP tcp -- 92.103.182.20 0.0.0.0/0 tcp dpt: DROP tcp -- 92.103.182.20 0.0.0.0/0 tcp dpt:80
- 50. Firewall ImplementaNon on Linux PollEv.com/ubiqube733 config firewall address edit â123â set subnet <IP TO BLOCK> 255.255.255.255 next end config firewall service custom edit â<PORT TO BLOCK>" set tcp-portrange <PORT TO BLOCK>:<PORT TO BLOCK> next End config firewall policy edit {$params.object_id} set name "<IP TO BLOCK> :<PORT TO BLOCK>" set srcintf "port1" set dstintf "port2" set srcaddr "<IP TO BLOCK>" set dstaddr "VIP-PUB-WEB-SERVER" set service "<PORT TO BLOCK>â next end â˘âŻ Based on FGT ďŹrewall policy, address and service â˘âŻ Takes an IP and a port as parameters
- 58. ImplementaNon of Microservices on ForNgate I Step 1: create a new Microservice in the repository
- 65. Simple Firewall WorkďŹow â˘âŻ The user selects one or several ďŹrewalls to manage â˘âŻ The user enters a new security rule (IP and port) to block â˘âŻ The user selects an exisNng security rule and deletes it from the ďŹrewall conďŹguraNon PollEv.com/ubiqube733
- 66. ImplementaNon of WorkďŹows â˘âŻ Step 1: DeďŹne the parameters: â˘âŻ List of ďŹrewall devices â˘âŻ Rule ID / Rule IP / Rule Port â˘âŻ Array of (Rule ID / Rule IP / Rule Port) â˘âŻ Step 2: Implement the process to instanNate a new service â˘âŻ Step 3: Implement the process to delete the service â˘âŻ Step 4: Implement the process to conďŹgure a new security policy â˘âŻ Step 5: Implement the process to remove exisNng security policies PollEv.com/ubiqube733