Example: Creating an In-Network-NAT Service Chain

Step-by-Step Procedure

Use the Contrail user interface to create a left virtual network, right virtual network, and management virtual network.

To create a virtual network:

1. Click Configure>Networking>Networks.

   The Networks page is displayed.

   Figure 1: Networks Page

2. Click the add (+) icon to create a network.

   The Create page is displayed.

   Figure 2: Create Page

3. Enter a name for the network in the Name field.

4. Click Subnets and click add (+) to add subnets.

   Step-by-Step Procedure

   In the row that is displayed,

   1. Click the arrow in the IPAM field and select left-ipam for the left virtual network, or select right-ipam for the right virtual network, or select mgmt-ipam for the management network.

      Management network is not used to route packets. This network is used to help debug issues with the virtual machine.

      Note:

      Step-by-Step Procedure

      You can also create a new IPAM by following these steps:

      1. Click Configure>Networking>IP Address Management and click the add (+) icon.

         The IPAM tab of the Create page is displayed.

      2. In the Name field, enter a name for the IPAM.

      3. Click Save.

         The IP Address Management page is displayed.

   2. In the CIDR field, enter valid IPv4 or IPv6 subnet or mask.

5. Click Save.

   The Networks page is displayed. All virtual networks that you created are displayed in the Networks page.

Step-by-Step Procedure

You use OpenStack to create virtual machines with left, right, and management interfaces.

Follow these steps to create virtual machines for left, right, and management networks.

1. Click Project>Compute>Instances.

   The Instances page is displayed.

   Figure 3: Instances Page

2. Click Launch Instance to create an instance.

   The Details tab of the Launch Instance page is displayed.

   Figure 4: Launch Instance

3. Enter a name for the virtual machine in the Instance Name field and click the Source tab.

   The Source tab of the Launch Instance page is displayed.

4. Select an image file from the Available list by clicking the add (+) icon next to the image file.

5. Click the Flavor tab.

   The Flavor tab of the Launch Instance page is displayed.

   Note:

   vSRX image with M1.large flavor is recommended for in-network-nat virtual machine.

6. Select a flavor from the Available list by clicking the add (+) icon next to the flavor name.

7. Click the Networks tab.

   The Network tab of the Launch Instance page is displayed.

8. Select a network you want to associate with the virtual machine instance by clicking the add (+) icon next to the network name.

9. Click Launch Instance to launch the virtual machine instance.

   The Instances page is displayed.

   All virtual machine instances that you created are displayed on the Instances page.

Step-by-Step Procedure

Follow these steps to configure a service template:

1. Click Configure>Services>Service Templates.

   The Service Templates page is displayed.

2. Click the add (+) icon to create a service template. See Figure 5.

   The Service Template tab of the Create page is displayed.

   Enter the following information as given in Table 1:

   Table 1: Add Service Template Fields

   Field	Action
   Name	Enter a name for the service template.
   Version	Select v2 as the version type. Note: Starting with Release 3.2, Contrail supports only Service Chain Version 2 (v2).
   Virtualization Type	Select Virtual Machine as the virtualization type.
   Service Mode	Select In-Network Nat as the service mode.
   Service Type	Select Firewall as the service type.
   Interface(s)	Click the add (+) icon and add the following interfaces: management left right Note: The interfaces created on the virtual machine must follow the same sequence as that of the interfaces in the service template.

   Figure 5: Create Service Template

3. Click Save to save the service template.

   The Service Templates page is displayed. All service templates that you created are displayed in the Service Templates page.

Step-by-Step Procedure

Follow these steps to add a service instance:

1. Click Configure>Services>Service Instances.

   The Service Instances page is displayed.

2. Click the add (+) icon to add a service instance. See Figure 6.

   The Service Instance tab of the Create page is displayed.

   Enter the following information as given in Table 2:

   Table 2: Add Service Instance Fields

   Field	Action
   Name	Enter a name for the service instance.
   Service Template	Select in-network-nat - [in-network-nat (management, left, right)] - v2 as the service template
   Virtual Network	Select the virtual network for each interface type as given below: management—Select the management virtual network that you created. left—Select the left virtual network that you created. right—Select the right virtual network that you created.
   Port Tuples	Click Port Tuples and click the add (+) icon to add new port tuples. See Figure 7. Click the arrow next to the newly added port tuple to select the virtual machine intstance for each interface type as given below: management—Select the management virtual machine instance that you created. left—Select the left virtual machine instance that you created. right—Select the right virtual machine instance that you created.

   Figure 6: Create Service Instance
   Figure 7: Create Port Tuples

3. Click Save to save the service instance.

   The Service Instances page is displayed. All service instances that you created are displayed in the Service Instances page.

Step-by-Step Procedure

Follow these steps to create a service policy:

1. Click Configure>Networking>Policies.

   The Policies page is displayed.

   Figure 8: Policies Page

2. Click the add (+) icon to add a service policy. See Figure 8.

   The Policy tab of the Create page is displayed.

   Figure 9: Create Policy Page

3. Enter a name for the service policy in the Policy Name field.

4. Click add (+) in the Policy Rule(s) table to add a policy rule.

   A row is added to the Policy Rule(s) table. See Figure 9.

5. In the row that is added:

   1. Click the Source column and select Network from the source list.

      From the networks list, select the left virtual network that you created.

   2. Click the Destination column and select Network from the destination list.

      From the networks list, select the right virtual network that you created.

   3. Select the Services check box to enable services.

      The Service Instance field is enabled.

   4. Click the Service Instance field and select in-network-nat from the service instance list.

6. Click Save to add the service policy.

   The Policies page is displayed. All policies that you created are displayed in the Policies page.

Step-by-Step Procedure

Follow these steps to attach a service policy to a network:

1. Click Configure>Networking>Networks.

   The Networks page is displayed.

2. Add service policy to the left and right virtual networks.

   Step-by-Step Procedure

   To add a service policy to a virtual network:

   1. Click the settings icon given at the end of the row of the virtual network.

   2. In the list that is displayed, click Edit. See Figure 10.

      The Edit page is displayed. See Figure 11.

      Figure 10: Networks Page
      Figure 11: Edit Network Page

   3. Click Network Policy(s) and select the network policy you want to add to the virtual network. See Figure 11.

   4. Click Save.

      The policy is assigned to the network.

      Repeat steps a through d to assign policies to other virtual networks.

Step-by-Step Procedure

You can launch virtual machines from OpenStack and test the traffic through the service chain by doing the following:

1. Launch the left virtual machine in left virtual network. For more information, see Create Virtual Machine.

2. Launch the right virtual machine in right virtual network. For more information, see Create Virtual Machine.

3. Ping the right virtual machine IP address from the left virtual machine.

   Follow these steps to ping a virtual machine:

   1. Click Project > Compute > Instances.

      All virtual machine instances that you created are displayed on the Instances page.

   2. From the list of virtual machines, click the left virtual machine.

      The Instances / Left Instance page is displayed.

   3. Click the Console tab.

      The Instance Console is displayed.

   4. Ping the right virtual machine IP address from the Instance Console.