In this session, Wei presents how CloudStack 4.19 adds the capability to easily and quickly perform a light-touch integration of networking appliances with ACS, allowing for operators to offer a broader range of networking services while empowering end-users to effortlessly deploy their own virtualized network functions. ----------------------------------------- The CloudStack Collaboration Conference 2023 took place on 23-24th November. The conference, arranged by a group of volunteers from the Apache CloudStack Community, took place in the voco hotel, in Porte de Clichy, Paris. It hosted over 350 attendees, with 47 speakers holding technical talks, user stories, new features and integrations presentations and more.

1. VNF Integration and Support in
CloudStack 4.19
CloudStack Collaboration Conference, 23 - 24 November 2023

2. Who am I ?
Wei Zhou
Software Architect @ Shapeblue
2012.12 Joined Apache CloudStack community
2013.05 Became an Apache CloudStack committer
2017.03 Became an Apache CloudStack PMC member
Email: weizhou@apache.org
Github: @weizhouapache

3. 01
Introduction
02
Use cases
03
Build your own VNF images
04
Work with VNF templates
05
Deploy VNF appliances
06
Summary and Future work
Contents

4. 01
Introduction
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

5. What are VNF
Virtualized network functions (VNF):
• Software applications which implement network functions
• Run as virtual machines on top of hypervisors
• Replace physical network devices and reduce the costs
Network function virtualization (NFV)
• An architecture to manage VNF images and instances
Network Function Virtualization with Apache Cloudstack (Presented by Alex in CCC 2021 )
https://events.hubilo.com/cloudstack-collaboration-conference/session/95229

6. What network functions can be virtualized ?
Including but not limited to
• Gateways (Storage, VOIP, etc)
• NAT (SNAT, DNAT)
• Firewall
• Load balancing
• DHCP/DNS
• VPN
• Tunneling (VXLAN, NVGRE, MPLSoUDP, etc)
• Security (IDS, IPS)
• WAN Acceleration/Optimization
• Transparent proxy
• ...

7. Where/How to get VNF images
Get from vendors
• service providers (Cisco, etc)
• hypervisor marketplace (VMware, etc)
• cloud providers (Google cloud, Microsoft Azure, etc)
• others (ESTI OSM, etc)
Build your own VNF images

8. Get VNF images from vendors
Cisco virtual routers

9. Get VNF images from vendors
VMware

10. Get VNF images from vendors
Google Cloud

11. Get VNF images from vendors

12. VNF appliance: CloudStack VR
Provided features
• SourceNat, StaticNat,
• Firewall, PortForwarding, LB (Load balancing)
• DHCP, DNS, VPN, etc
Tightly coupled with Apache CloudStack
• No CLI
• No WebUI
• No API
• Lack of some features (OpenVPN, Dynamic routing, Security, etc)
• Limited performance
Next-Gen Virtual Router (Presented by Rohit in CCC 2021 )
https://events.hubilo.com/cloudstack-collaboration-conference/session/95287

13. VNF integration in CloudStack 4.19
Requirements (Stage 1)
• Support CRUD operations of VNF images/templates
• Configurable nics and details for VNF templates
• Support deployment and management for VNF appliances
• Automatically program network rules for management interfaces of VNF
appliances
• Display access information for VNF appliances

14. 02
Use cases of VNF
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

15. Use case 1: Silverpeak (HPE Aruba) SD-WAN
Connect some small~medium sites/branches

16. Use case 2: Riverbed WAN Optimization
Connect 2 VPCs in separated zones
• Each with a full stack 3-tiers application

17. Use case 3: PFSense Firewall
Connect VMs in MGMT, LAN and DMZ

18. 03
Build your own VNF images
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

19. Build your own VNF images
Step 0: Choose a Router OS
Options:
• pfSense
• OpnSense
• Vyos
• MikroTik
• Linux distributions (Alpine Linux, Debian, etc)
• ...

20. Build your own VNF images
Steps
• Register ISO
• Deploy VM from ISO
• Configure services via VM
Console
• Create template from VM

21. Build your own VNF images
Step 2: Deploy VM from ISO

22. Build your own VNF images
Step 3: Configure services via VM Console

23. Build your own VNF images
Step 3: Configure services via VM Console

24. Build our own VNF images
Step 3: Configure services via VM Console

25. Build your own VNF images
Step 4: Create template from VM
VNF Template is ready for use !

26. 04
Work with VNF templates
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

27. Register VNF templates

28. Update a regular template to VNF template

29. Configure VNF templates

30. Configure VNF template: Add VNF Nic
Device ID:
• The device ID of the VNF nic.
• The device id must be consecutive
and start from 0.
• The NIC with deviceId=0 will be
the default NIC
Name
Required
Management NIC
Description

31. Configure VNF template: Add VNF Detail
Options for access methods

32. Configure VNF templates: example

33. 05
Deploy VNF appliances
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

37. Network rules to be applied
Network type Network rules
Isolated network - Acquire a public IP
- Enable static nat
- Create firewall rules for ssh/http/https ports
shared network with security groups - Create a new security group
- Add rules to allow traffic to ssh/http/https ports
L2 network, VPC tier, or
Shared network without security
groups
- No rules

38. Cluster/Pod/Host
Boot type and boot mode
Userdata
SSH key pairs
Affinity groups (HA cluster with primary/secondary nodes)
NIC multiqueue number and packed virtqueues enabled (KVM only)
IO Thread and driver policy (KVM only)

43. VM on L2-001 VM on L2-002

44. Comparison
VPC-based solution pfSense-based solution
Networks All VPC tiers are in same parent CIDR All network CIDRs are configurable
Existing network cannot be added to a
VPC
Existing network can be attached to VNF
appliance
Features Source NAT/Static NAT Source NAT / 1:1
Load balancing haproxy (installed by Package Manager)
Port forwarding Port forward
L2TP VPN / Site-to-Site VPN IPsec / L2TP / OpenVPN
Network ACL Firewall rules (ingress/egress)
Private gateways (Attach extra NICs to VNF appliance)
Static Routes Static Routes (NOT rely on private gateways)
DHCP/DNS DHCP/DNS
Userdata (Use ConfigDrive)
Others: Virtual IP, DNS Forwarder, Dynamic DNS,
Dymamic Routing/BGP/OSPF (via FRR), etc

45. 06
Summary and Future work
Contents
CloudStack Collaboration Conference, 23 - 24 November 2023

46. Summary
Support VNF templates
• CRUD operations
• configurations
Support VNF applicances
• CRUD operations
• Automatically program network rules for access

47. Future work
Still in the early stage of VNF integration and support
Goal: Allow users to use VNF appliances with little manual
intervention.
• Ideally VNF applicances are configured automatically.
• Like auto-configuration on CloudStack Virtual Routers.
Challenges
• Access layer: SSH, REST api, unix sockets, etc. (TCP proxy or tunnel may be
required)
• Data model: json, xml, arguments of shell commands, API parameters, etc
• Upgrade

48. Idea: New network offering

49. Idea: New network

50. Idea: new framework and plugins
plugin framework for VNF
plugins
• CloudStack Virtual Router
• pfSense
• VyOS
• ......

51. Acknowledgement
Alex Mattioli
Jithin Raju
Lucian Burlacu
Daan Hoogland
Thanks for the design, reviews and testing !

52. Q & A
Email: weizhou@apache.org
CloudStack Collaboration Conference, 23 - 24 November 2023

53. Thank you !
Email: weizhou@apache.org
CloudStack Collaboration Conference, 23 - 24 November 2023

54. References
Design document on cwiki
• https://cwiki.apache.org/confluence/display/CLOUDSTACK/VNF+Appliance+Integration
Cisco VNF images
• https://www.cisco.com/c/en/us/solutions/service-provider/network-functions-
virtualization-nfv/index.html#~virtual-routers
• https://www.cisco.com/c/en/us/solutions/service-provider/network-functions-
virtualization-nfv/index.html#~featured-vnfs
OpenStack tacker
• https://docs.openstack.org/tacker/latest/admin/index.html
VNF Templates and Appliances
• https://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_a
ppliances.html