Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Adding a Single Tenant

 

You can use the Add Tenant page to add tenant data and other objects associated with a tenant, such as tenant user, network details, deployment scenario, service profiles, and custom properties. A single tenant supports centralized deployment, distributed deployment, SD-WAN deployment, and hybrid (both centralized and distributed) deployment scenarios.

In earlier versions of CSO, when a tenant user logs in to the Customer Portal for the first time, the user is assigned the Tenant Administrator role by default. With the introduction of object-based custom roles, the tenant user that logs in to Customer Portal for the first time might have customized roles and the role is not restricted to Tenant Administrator.

Begin by creating all the resources required for the network point of presence (POP).

The information listed on the Tenants page changes depending on the authentication mode configured:

  • Local Authentication—You can add the administrative user information as the first step from the Tenants page.

  • Authentication and Authorization with SSO Server—The Admin User information is not displayed on the Tenants page because users are not created in CSO and they are managed in the SAML identity provider. In addition, users are dynamically authorized to the CSO role based on the mapping rules configured in the SAML authentication.

  • Authentication with SSO Server—When you create the administrative user, the login page does not require you to configure a password because the user is created in the SSO without the password and you can enter only the username.

To add a tenant:

  1. Select Tenants > All Tenants > +.

    The Add Tenant page appears.

  2. Update the tenant information. Complete the configuration according to the guidelines provided in Table 1.
  3. Click OK. If you want to discard your changes, click Cancel instead.

    If you click OK, the tenant that you configured appears on the Tenants page.

  4. If you use the tenant for a hybrid WAN centralized deployment, access Contrail and add the following rule to the default security group in the Contrail project.

    This rule allows the network to accept traffic from all subnets.

Table 1: Fields on the Add Tenant Page

Field

Description

Tenant Info

Name

Enter the name of the tenant. You can use an unlimited number of alphanumeric characters, including special characters.

Example: test-tenant

Admin user

First Name

Enter the first name of the user.

Last Name

Enter the last name of the user.

Username (Email)

Enter the e-mail ID of the user. The e-mail ID is also the username for the user. This field is automatically populated after you enter the tenant name.

Example: test-tenant_admin@test-tenant.com

Roles

Select one or more roles (both predefined and custom roles) that you want to assign to the tenant user.

Note: In the Available column, all tenant scope roles are listed.

Click the greater-than icon (>) to move the selected role or roles from the Available column to the Selected column. Note that you can use the search icon on the top right of each column to search for role names.

Click the role name to preview the access privileges assigned to the user.

Password Policy

User Password Expires

Select one of the following options:

  • Never—If you select this option, the password never expires.

  • After specified number of days—If you select this option, you must specify a duration in the Password Expiration Days field.

Password Expiration Days

Specify the duration (in days) after which the password expires and must be changed.

The range is from 1 through 365. The default value is 180 days.

Topology Info

Deployment Type

Select at least one site type for the tenant.

  • SD-WAN sites—Select this check box, if you want the tenant to create SD-WAN sites only. SD-WAN sites can have up to 4 WAN links, and the tenant can define intent policies to intelligently route different applications through different WAN links. Select the topology type:

    • Full Mesh—All sites in the tenant are connected to one another in a full mesh topology.

      If you select the full mesh topology, the Hub creation in full mesh toggle button is enabled by default.

    • Hub and Spoke—All hub sites in the tenant are connected to one another and all spoke sites are connected to at least one hub site in a hub and spoke topology. A spoke site can also be connected to multiple hub sites if multihoming is enabled on the spoke site.

  • Hybrid WAN sites—Select this check box, if you want the tenant to create Hybrid WAN sites only. The Hybrid WAN sites can have a maximum of two WAN links. You cannot apply intent policies for Hybrid WAN sites. By default, the topology type is Standalone.

Select both check boxes, if you want the tenant to create both SD-WAN site and Hybrid WAN site.

Note: The options listed in Customer Portal > Sites > Add are filtered based on the site type that you have selected for a tenant. For example, if you have selected Hybrid WAN sites for a tenant, in Customer portal > Sites > Add, only the following options are listed:

  • Spoke Site

  • Local Service Edge

  • Regional Service Edge

Hub creation in full mesh

This toggle button is enabled by default if you selected the full mesh option for SD-WAN sites.

You can create a hub for a full mesh topology. All sites are connected to the hub at least through one WAN link.

Tenant Properties

SSL Settings

Note: This setting is applicable only to the SD-WAN deployment scenario.

Default SSL Forward Proxy Profile

Click the toggle button to enable a default SSL proxy profile for the tenant.

If you enable this option, the following items are created when a tenant is added:

  • A default root certificate with the certificate content specified (in the Root Certificate field)

  • A default SSL proxy profile

  • A default SSL proxy profile intent that references the default profile

This option is disabled by default.

Note: You use this option to create a tenant-wide default profile; enabling or disabling this option does not mean that SSL is enabled or disabled.

If you enable this option, you must add a root certificate.

Root Certificate

You can add a root certificate (X.509 ASCII format) by importing the certificate content from a file or by pasting the certificate content:

  • To import the certificate content directly from a file:

    1. Click Browse.

      The File Upload dialog box appears.

    2. Select a file and click Open.

      The content of the certificate file is displayed in the Root Certificate field.

  • Copy the certificate content from a file and paste it in the text box.

After the tenant is successfully added, a default root certificate, a default SSL proxy profile, and a default SSL proxy profile intent are created.

Note:

  • The root certificate must contain both the certificate content and the private key.

  • For full-fledged certificate operations, such as certificates that need a passphrase, or that have RSA private keys, you must use the Certificates page (Administration > Certificates) to import the certificates and install on one or more sites.

VPN Authentication

Note: This setting is applicable only to the SD-WAN deployment scenario.

Authentication Type

Select the VPN authentication method to establish a secure IPsec tunnel:

  • Preshared Key—Select this option if you want CSO to establish IPsec tunnels using keys.

    Note: Preshared Key is the default VPN authentication method.

  • PKI Certificate—Select this option if you want CSO to establish IPsec tunnels using public key infrastructure (PKI) certificates. Specify the following:

    • Server URL—Specify the Certificate Authority (CA) Server URL. For example, http://CA-Server-IP-Address/certsrv/mscep/mscep.dll/pkiclient.exe.

      To obtain trusted CA certificates, CSO communicates with the CA server using the Simple Certificate Enrollment Protocol (SCEP).

    • Password—Specify the password for the CA server. This field is optional.

Overlay Tunnel Encryption

Note: This is applicable only to the SD-WAN deployment scenario.

Encryption Type

For security reasons, all data that passes through the VPN tunnel must be encrypted. Select the encryption type:

  • 3DES-CBC—Triple Data Encryption Standard with Cipher-Block Chaining (CBC) algorithm.

  • AES-128-CBC—128-bit Advanced Encryption Standard with CBC algorithm.

  • AES-128-GCM—128-bit Advanced Encryption Standard with Galois/Counter Mode (GCM) algorithm.

  • AES-256-CBC— 256-bit Advanced Encryption Standard with CBC algorithm.

  • AES-256-GCM—256-bit Advanced Encryption Standard with GCM algorithm.

The default encryption type is AES-256-GCM.

Note: The MX Series routers do not support encryption types, AES-128-GCM and AES-256-GCM. The default encryption type for MX Series routers is, AES-256-CBC.

Network Segmentation

Network Segmentation

Enable network segmentation on the tenant.

Service Profiles

VIM Name

If you use a dedicated OpenStack Keystone for Contrail Service Orchestration in a centralized deployment, then select the virtualized infrastructure manager (VIM) for the tenant. A tenant can be associated with multiple VIMs.

Example: test-vim

Service Profile Name

If you use a dedicated OpenStack Keystone for Contrail Service Orchestration in a centralized deployment, then select the service profile that specifies the authentication information for the tenant. You configure the service profile when you create the VIM.

Example: service-profile-for-test-vim

Custom Properties

If you have set up a third-party provider edge (PE) device by using software other than Contrail Service Orchestration, then configure settings on that router by specifying custom parameters and its corresponding values.

Name

Specify any information about the site that you want to pass to a third-party router.

Example: Location

Value

Specify a value for the information about the site that you want to pass to a third-party device.

Example: Boston

SD-WAN Mode

Note: This field appears only if you selected the SD-WAN sites check box in Topology Info.

Select the SD-WAN mode:

  • Bandwidth-optimized SD-WAN—CSO uses link-level probes to switch traffic from links that do not meet SLA criteria to links that meet SLA. This is selected by default.

  • Real time-optimized SD-WAN—CSO monitors application-level traffic and delegates the application-level probes and link switching to CPE. Select this mode if you want to implement AppQoE.

Click the Compare link in the UI to view more information about these modes.

Related Documentation