Adding a Single Tenant

Name

Enter a unique name for the tenant. You can use alphanumeric characters and hyphen (-); the maximum length is 15 characters.

Example: test-tenant

First Name

Enter the first name of the user.

Username (Email)

Enter the e-mail ID of the user. The e-mail ID is also the username for the user. This field is automatically populated after you enter the tenant name.

Example: test-tenant_admin@test-tenant.com

Password Policy

Deployment Info

SD-WAN Mode

Note: This field appears only if you selected the SD-WAN sites check box in the Deployment Type field.

Select the SD-WAN mode:

• Bandwidth-optimized—CSO uses link-level probes to switch traffic from links that do not meet SLA criteria to links that meet SLA. This is selected by default.

  If you select the bandwidth-optimized option, all sites in the tenant are connected to the hub (hub-and-spoke topology).

• Real time-optimized—CSO monitors application-level traffic and delegates the application-level probes and link switching to CPE. Select this mode if you want to implement AppQoE.

  If you select the real time-optimized option, all sites in the tenant are connected in full mesh or hub-and-spoke topology.

  Note: The Dynamic VPN page and Mesh Tags page appears in the Customer Portal only if you have selected the Real time-optimized option.

SSL Settings

Note: This setting is applicable only to the SD-WAN deployment scenario.

Root Certificate

You can add a root certificate (X.509 ASCII format) by importing the certificate content from a file or by pasting the certificate content:

• To import the certificate content directly from a file:

  Procedure

  1. Click Browse.

     The File Upload dialog box appears.

  2. Select a file and click Open.

     The content of the certificate file is displayed in the Root Certificate field.

• Copy the certificate content from a file and paste it in the text box.

After the tenant is successfully added, a default root certificate, a default SSL proxy profile, and a default SSL proxy profile intent are created.

Note:

• The root certificate must contain both the certificate content and the private key.

• For full-fledged certificate operations, such as certificates that need a passphrase, or that have RSA private keys, you must use the Certificates page (Administration > Certificates) to import the certificates and install on one or more sites.

Authentication Type

Select the VPN authentication method to establish a secure IPsec tunnel:

• Preshared Key—Select this option if you want CSO to establish IPsec tunnels using keys.

  Note: Preshared Key is the default VPN authentication method.

• PKI Certificate—Select this option if you want CSO to establish IPsec tunnels using public key infrastructure (PKI) certificates. Specify the following:

  • CA Server URL—Specify the Certificate Authority (CA) Server URL. For example, http://CA-Server-IP-Address/certsrv/mscep/
    mscep.dll/pkiclient.exe.

    The CA server manages the life cycle of a certificate. The CA server also publishes revoked certificates to the certification revocation list (CRL) server. To obtain trusted CA certificates, CSO communicates with the CA server using the Simple Certificate Enrollment Protocol (SCEP).

  • Password—Specify the password for the CA server. This field is optional.

  • Revocation List Server URL—Specify the CRL server URL. For example, http://Revocation-List-Server-IP-Address/certservices/abc.crl. CSO retrieves the list of revoked certificates from the CRL server.

  • Auto Renew—Click the toggle button to enable automatic renewal of certificates.

    If you enable the Auto Renew toggle button, certificates are automatically renewed for all sites in the tenant.

    By default, the Auto Renew toggle button is disabled. If you disable the Auto Renew toggle button, certificates must be manually renewed.

    Note: If the certificate is expired before the renewal, CSO might not be able to reach the device.

  • Renew before expiry—This field appears only if you have enabled the Auto Renew toggle button.

    Select the number of days, weeks, or months before the expiration date when the certificates get automatically renewed.

    Select one of the following:

    • 3 Days

    • 1 Week

    • 2 Weeks

    • 1 Month

    Note: The default value is 2 weeks. You can also change the duration value in the Customer Portal > Administration > Certificate Management > VPN Authentication page.

Encryption Type

For security reasons, all data that passes through the VPN tunnel must be encrypted. Select the encryption type:

• 3DES-CBC—Triple Data Encryption Standard with Cipher-Block Chaining (CBC) algorithm.

• AES-128-CBC—128-bit Advanced Encryption Standard with CBC algorithm.

• AES-128-GCM—128-bit Advanced Encryption Standard with Galois/Counter Mode (GCM) algorithm.

• AES-256-CBC— 256-bit Advanced Encryption Standard with CBC algorithm.

• AES-256-GCM—256-bit Advanced Encryption Standard with GCM algorithm.

The default encryption type is AES-256-GCM.

Note: The MX Series routers do not support encryption types, AES-128-GCM and AES-256-GCM. The default encryption type for MX Series routers is, AES-256-CBC.

Network Segmentation

Enable network segmentation on the tenant.

Threshold for Creating a Tunnel

Set a threshold value, above which a tunnel is created between two sites.

Threshold for Deleting a Tunnel

Set a threshold value, below which a tunnel is deleted between two sites.

Maximum DVPN Tunnels

Max tunnels allowed per tenant

Specify the maximum number of DVPN tunnels that the tenant can create.

Range: 0 through 50000.

A major alarm is raised if the number of DVPN tunnels created by all sites in a tenant reaches seventy percent of the maximum value.

A critical alarm is raised if the number of DVPN tunnels created by all sites in a tenant reaches ninety percent of the maximum value.

To view alarms, see Monitor > Alerts & Alarms > Alarms in the Customer Portal.

For more information about alarms, see About the Alarms Page.

VIM Name

If you use a dedicated OpenStack Keystone for Contrail Service Orchestration in a centralized deployment, then select the virtualized infrastructure manager (VIM) for the tenant. A tenant can be associated with multiple VIMs.

Example: test-vim

Tenant-specific Attributes

If you have set up a third-party provider edge (PE) device by using software other than Contrail Service Orchestration, then configure settings on that router by specifying custom parameters and its corresponding values.

Value

Specify a value for the information about the site that you want to pass to a third-party device.

Example: Boston