Data Sheet Cisco Virtual Network Management Center Introduction The dynamic nature of the cloud paradigm introduces new needs for automation, but it also facilitates new types of automation due to the infrastructure standardization that cloud enables. In fact, two primary characteristics of the cloud paradigm that advance IT efficiency are data center standardization and broad-reaching advanced automation. Organizations that are transitioning to cloud computing know that the principles of standardization and automation apply across the IT disciplines and affect all areas of the data center, including networking. The dynamic nature of today s data centers require IT organizations to apply and enforce frequent changes to networking infrastructures that consist of virtual service instances such as firewalls, load balancers, routers, and switches. Executing and enforcing such infrastructure changes properly and consistently requires networking solutions with advanced automation capabilities that give IT the ability to rapidly automate common infrastructure solutions from pre-defined or golden templates. These templates need to be applied through the network consistently and to IT s meticulous standards. The Cisco Virtual Network Management Center (VNMC) addresses those issues by automating processes, freeing staff to focus on optimizing the network environment. Cisco VNMC supports greater scalability along with standardization and consistent execution of policies. Ultimately Cisco VNMC supports the current shifts in IT, leading to more standardized, automated dynamic infrastructure and networks. As part of the larger Cisco Nexus 1000V Switch solution, this Unified Management solution complements the Cisco ASA 1000V Cloud Firewall and Cisco Virtual Security Gateway (VSG) for Nexus 1000V Series Switch. Product Overview Cisco VNMC is the primary element of Cisco Nexus 1000V Series Switches that can enable the switches to deliver transparent, scalable, and automation-centric network management for virtualized data center and cloud environments. Cisco Nexus 1000V Series Switches deliver highly secure multitenant services by adding virtualization intelligence to the data center network. These soft switches are built to scale for cloud networks. Support for Virtual Extensible LAN (VXLAN) helps enable scalable LAN segmentation and broader virtual machine (VM) mobility. Cisco VNMC can enable centralized management of Cisco virtual services to be performed by an administrator or programmatically through its GUI and XML API. Cisco VNMC is built on an information-model architecture in which each managed device is represented by its subcomponents (or objects), which are parametrically defined. This model-centric approach enables a flexible and simple mechanism for securing virtualized infrastructure using Cisco VSG and Cisco ASA 1000V Cloud Firewall virtual security services (Figure 1). 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 6
Cisco VNMC provides several important benefits that advance efficiency for administration teams and the network: Rapid and scalable deployment through dynamic, template-based policy management based on security profiles Transparent operation management through an XML API that can enable programmatic integration with third-party management and orchestration tools Collaboration across security and server teams while maintaining administrative separation and reducing errors through a consistent and repeatable deployment model Figure 1. Cisco VNMC Provides Centralized Device and Policy Management of Cisco VSG and the Cisco ASA 1000V Cloud Firewall in Virtual Data Centers and Multi-Tenant Private and Public Clouds As shown in Figure 1, VSG and ASA1000V address different aspects of securing the virtualized data center environments. VSG offers a zone-based firewalling solution for inter-vm traffic, while ASA1000V offers edgecentric security services (firewall, Network Address Translation [NAT], VPN, Dynamic Host Configuration Protocol [DHCP], et al.). Both have tight integration with Cisco Nexus 1000V and both have a single management platform (VNMC). Features and Benefits Consistent, Efficient Execution of Security Policies Cisco VNMC uses security profiles for template-based configuration of security policies. A security profile is a collection of security policies that can be predefined and applied on demand at the time of virtual machine instantiation. This profile-based approach significantly simplifies authoring, deployment, and management of security policies, including in a dense multi-tenant environment, while enhancing deployment agility and scaling. Security profiles also help reduce administrative errors and simplify audits. 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 2 of 6
The XML API for Cisco VNMC facilitates integration with northbound network provisioning tools for programmatic network provisioning and management of Cisco VSG and Cisco ASA 1000V. The option of programmatic control of Cisco VSG and Cisco ASA1000V can greatly simplify operation processes and reduce infrastructure management costs. Non-Disruptive Administration Model By providing visual and programmatic controls, Cisco VNMC can enable the security operations team to author and manage security policies for virtualized infrastructure and enhance collaboration with the server and network operations teams. This non-disruptive administration model helps ensure administrative segregation of duties to reduce administrative errors and simplify regulatory compliance and auditing. Cisco VNMC operates in conjunction with the Cisco Nexus 1000V Series Virtual Supervisor Module (VSM) to achieve the following workflow: Security administrators can author and manage security profiles and manage VSG and ASA 1000V instances. Security profiles are referenced in Cisco Nexus 1000V Series port profiles. Network administrators can author and manage port profiles, as well as manage Cisco Nexus 1000V Series distributed virtual switches. Port profiles with referenced security profiles are available in VMware vcenter through the Cisco Nexus 1000V Series VSM s programmatic interface with VMware vcenter. Server administrators can select an appropriate port profile in VMware vcenter when instantiating a virtual machine. Figure 2 displays how to manage security policies in a multi-tenant data center. Figure 2. GUI Screen Illustrating Security Policy Management in a Multi-Tenant Data Center 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 3 of 6
Efficient Management for Easier Scalability Cisco VNMC implements an information-model architecture in which each managed device, such as Cisco VSG or Cisco ASA 1000V, is represented by the device s object-information model. This model-based architecture helps enable the use of: Stateless managed devices - Security policies (security templates) and object configurations are abstracted into a centralized repository. Dynamic device allocation - A centralized resource management function manages pools of devices that are commissioned (deployed) in service and a pool of devices that are available for commissioning. This approach simplifies large-scale deployments because managed devices can be pre-instantiated and then configured on demand, and devices can be allocated and de-allocated dynamically across commissioned and noncommissioned pools. Scalable management - A distributed management-plane function is implemented using an embedded agent on each managed device that helps enable greater scalability. Table 1 details the primary features of Cisco VNMC and the benefits they promote. Table 1. Features and Benefits Feature Description Benefits Multiple-Device Management Cisco VNMC provides central management of Cisco VSG and ASA 1000V for Cisco Nexus 1000V Series Switches. Simplifies provisioning and troubleshooting in a scaledout data center. Security Profiles Stateless Device Provisioning Security Policy Management Context-Aware Security Policies A security profile represents the Cisco VSG or ASA1000V security policy configuration in a profile (template). The management agents in Cisco VSG and ASA 1000V are stateless, receiving information from Cisco VNMC. Security policies are authored, edited, and provisioned centrally. Cisco VNMC obtains virtual machine contexts from VMware vcenter. Simplifies provisioning, reduces administrative errors during security policy changes, reduces audit complexities, and helps enable a highly scaled-out data center environment. Enhances scalability Provides robust endpoint failure recovery without loss of configuration state Simplifies operation and management of security policies Helps ensure that security intent is accurately represented in the associated security policies Allows a security administrator to institute highly specific policy controls across the entire virtual infrastructure. Dynamic Security Policy and Zone Provisioning Cisco VNMC interacts with the Cisco Nexus 1000V Series VSM to bind the security profile to the corresponding Cisco Nexus 1000V Series port profile. When virtual machines are dynamically instantiated by server administrators and appropriate port profiles applied, their association with trust zones is also established. Helps enable security profiles to stay aligned with rapid changes in the virtual data center. Multi-Tenant (Scale-Out) Management Role-Based Access Control (RBAC) XML-Based API Cisco VNMC is designed to manage Cisco VSG and ASA 1000V security policies in a dense multi-tenant environment so that administrators can rapidly add and delete tenants and update tenant-specific configurations and security policies. RBAC simplifies operation tasks across different types of administrators, while allowing subject-matter experts to continue with their normal procedures. Cisco VNMC XML API allows external system management and orchestration tools to programmatically provision Cisco VSG and ASA 1000V. Reduces administrative errors, helps ensure segregation of duties in administrative teams, and simplifies audit procedures. Reduces administrative errors Enables detailed control of user privileges Simplifies auditing requirements Allows use of best-in-class management software Offers transparent and scalable operation management 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 4 of 6
Software Packaging and Installation Tables 2 and 3 describe how to obtain the software for Cisco VNMC. Table 2. Package Packages and Descriptions Description Open Virtualization Format (OVF) ISO Format Downloadable OVF virtual appliance in the form of a single file with the.ova extension Deployed with OVF templates and packages Downloadable ISO file that can be mounted on a virtual machine System Requirements Table 3. Component Components and Specifications Specification Cisco VNMC Virtual Appliance Hypervisor and Hypervisor Manager Web Browser (Client) Interfaces and Protocols 1 virtual CPU at 1.5 GHz RAM: 3 GB Hard disk (vdisk): 25 GB Network interfaces: 1 (management) VMware vsphere 4.1.0, and 5.0 with VMware ESX or ESXi VMware vcenter 4.1.0, and 5.0 Internet Explorer 9.0 or higher; Mozilla Firefox 11.0 or higher; and Chrome 18.0 or higher Adobe Flash Player plug-in 11.2 or higher XML API, HTTP/HTTPS, Lightweight Directory Access Protocol (LDAP), and syslog Licensing and Ordering VNMC is the management platform for VSG and ASA1000V, and is mandatory for those offerings. Although, VNMC is installed like a stand-alone product, it is offered as part of a bundle of either VSG or ASA1000V, and it is added automatically when ordering those products. Please contact your Cisco representative to help you determine and place the appropriate order for your particular environment. Service and Support Cisco Software Application Support plus Upgrades (SASU) is a comprehensive support service that helps you maintain and enhance the availability, security, and performance of your business-critical applications. Cisco SASU includes the following resources: Software updates and upgrades - The Cisco SASU service provides timely, uninterrupted access to software updates and upgrades to help you keep existing systems stable and network release levels current. Updated releases, including major upgrade releases that may include significant architectural changes and new capabilities for your licensed feature set, are available by software download from Cisco.com or by CD-ROM shipment. Cisco Technical Assistance Center (TAC) - Cisco TAC engineers provide accurate rapid diagnosis and resolution of software application problems to help you reduce outages and performance degradation. These specialized software application experts are trained to support Cisco VNMC. Their expertise is available to you 24 hours a day, 365 days a year, by telephone, fax, email, or the Internet. 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 5 of 6
Online support - Cisco SASU provides access to a wide range of online tools and communities to help you resolve problems quickly, support business continuity, and improve competitiveness. For More Information For additional information about Cisco VNMC and related products, please visit the following links: Intelligent Automation Software: http://www.cisco.com/go/ia Cisco Virtual Network Management Center: http://www.cisco.com/go/vnmc Cisco Virtual Security Gateway: http://www.cisco.com/go/vsg Cisco ASA 1000V Cloud Firewall: http://www.cisco.com/go/asa1000v Cisco Nexus 1000V Series Switches: http://www.cisco.com/go/nexus1000v Cisco NX-OS Software: http://www.cisco.com/go/nxos VMware vsphere: http://www.vmware.com/go/vsphere Printed in USA C78-618245-04 08/12 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 6 of 6