zero-touch deployment med imc bims · •hvert steg i prosessen koster penger •skal du sende...

Zero-touch deployment med IMC BIMSGeir Åge Leirvik - [email protected] Community - 2015

Agenda

–Intro til Zero-touch–Oversikt IMC BIMS –ZTD løsningseksempel:

–Svitsjutrulling @hvorsomhelst–Løsningsdemo

EkstramatriellADVPN with X.509 certs konnektivitet til avdelingskontor

Zero Touch DeploymentA Real World Problem

• Hvert steg i prosessen kosterpenger

• Skal du sende kvalifisertmannskap til hver plass blir detdyrt og kapasiteten mindre.

• Jo mer kompleks løsning, desto mer menneskelig factor –desto større risiko for feil

• ZTD kan bootstrappe via USB, TFTP eller SMS

(Wo)Man in a van: Need

minimal install process

No console cable.

Hardware:Auditing, shipment

NetOps: Config,

monitoring

Zero Touch DeploymentA Real World Problem

• Zero touch hjelper i alle delerav prosessen.

• NetOps – minimer manuellcut’n’paste – minimertidsforbruk og risiko vedmanuell fjernkonfigurasjon

• Onsite personell – Trenger ikkekonsollkabel. Fokus påinstallasjon av maskivare –ikke konfigursjon

• Hardware – Ikke lenger behovfor staging – shipper rett fradistribusjon. Senker kost.

(Wo)Man in a van: Need

minimal install process

No console cable.

Hardware:Auditing, shipment

NetOps: Config,

monitoring

Zero Touch DeploymentHvordan det virker med DHCP

• Prosess1. Svitsjen booter og mottar DHCP info: default-

gw, tftpd server og boot file name 2. Ved oppstart – svitsj laster ned boot strap

config med TR-069 – CWMP kommandoer + kommandoer for sikkerhet og andrenødvendige tjenester (autodeploy.cfg)

3. Svitsjen kobler til og melder seg somkandidat til BIMS

4. Config template på BIMs med variabler–deployes og parametrene fylles ut – fra .CSV eller interaktivt

5. Svitsjen (som periodisk) kontakter IMC BIMS server, gjennomfører CWMP samtale, konfigurasjon lasts ned til enhet.

6. Svitsjen er ferdig konfigurert

NOC

BIMS

DHCPd

TFTPd

Customer or transit network

HP 5700Switch

Zero Touch DeploymentHvordan det virker med DHCP Autodeploy.cfg

interface vlan1ip address dhcp-alloc

ip http enabletelnet server enablecwmpcwmp enablecwmp acs url http://192.168.225.128:9090cwmp acs username bimscwmp acs password simple bims cwmp cpe inform interval enablecwmp cpe inform interval 15cwmp cpe username bimscwmp cpe password simple bims cwmp cpe connect interface vlan1

DHCP oppsettdhcp server ip-pool swimming extendednetwork ip range 192.168.225.121 192.168.225.254network mask 255.255.255.0gateway-list 192.168.225.1dns-list 8.8.8.8 8.8.4.4domain-name community.localexpired day 0 hour 8tftp-server ip-address 192.168.225.128option 43 ascii http://10.240.252.12:9090option 67 ascii config.cfg

NOCBIMS

DHCPd

TFTPd


HP 5700Switch


NOC

BIMS

DHCPd

TFTPd


HP 5700Switch

Templatesysname ${sname}int vlan1ip address ${ipmgmt} 24snmp-agentsnmp-agent community read publicsnmp-agent community write privatesnmp-agent sys-info version allsnmp-agent target-host trap address udp-domain 192.168.225.128 params securityname public v2cuser-interface vty 0 15authentication-mode noneuser privilege level 3telnet server enablesave forcereturn


NOCBIMS

DHCPd

TFTPd


HP 5700Switch

Så med ruter

Zero Touch DeploymentSlik virker det

• Ingredienser:• IMC Branch Intelligent Management

Software (BIMS) avdelingskontorenhetskonfig & mgmt.

• En ut-av-boksen TR-069 protokollkapabel enhet, MSR ruter eller ensupporter svitsj

• USB stick med basic config eller tftp-server og DHCP med basic config(option 150, option 67)

• Onsite “tekniker” for fysisk installasjon(og potensiell isetting av USB minnepinne).

Customer DC / NoC

Carrier Network

IMC BIMS

Remote Branch device

USB

• TR-069 aka CPE WAN Mgmt Protocol (CWMP)

• Bi-Dir HTTP for kommunikasjon mellomCPE & config server

Zero Touch DeploymentSlik virker det - USB minnepinne

• Prosess1. BIMS satt opp med enhetsid – device

ID (serienummer & OUI) & konfigurasjonsmal - config template.

2. USB config peker på IMC server.3. Oppstart - ruter laster config fra USB.4. Ruter kontakter IMC server, CWMP

samtale, endelig ruterkonfigurasjonlastes ned til enhet.

5. Ruter online.

Customer DC / NoC

Carrier Network

IMC BIMS

Remote Branch device

USB






5. Ruter online.

Zero Touch DeploymentSlik virker det interface GigabitEthernet0/4

port link-mode routeip address dhcp-alloc

cwmpcwmp enablecwmp acs url http://10.200.1.132:9090cwmp acs username bimscwmp acs password simple bimscwmp cpe username bimscwmp cpe password simple bimscwmp cpe inform interval enablecwmp cpe inform interval 15

Can use DHCP

Can use DNS





5. Ruter online.






5. Ruter online.

Zero Touch DeploymentThe End?

•Auto-deploy kan fungere alene via tftp – men TR-069 sikrer at ikke alt som kobles på kommer på nett.

•Men dette kan også brukes til myemer – se ekstramateriell for VPN mm

Zero Touch Deployment:Tid for demo og lab.

Labguide - oppgaver

Lab oppgaver Lab miljø:VSR 1000 – virtuell ruter – vår CPE i dag Windows 10 – virtuell maskin med IMC-BIMS – DHCP server og tftp serverFysisk PC – med internett-tilgang og tilgang til virtuelt miljø

Adresser – 192.168.225.0 - alle kan bruke det samme siden nettet er internt for hver PC.

Oppgave: Sette opp med egen adresse og eget hostname + andre atributter dere ønsker.

Dokumentasjon:

Flytdiagram USB boot - dette skal vi IKKE bruke nå

Appendix 1 – Ekstramateriell (in English)

ZTD Combo

ZTD

ADVPN

X.509 PKIBGP

ZTD - ADVPNAuto-Discovery Virtual Private Network

• Process1. Uses DYNAMIC public addresses2. Build private VPN network3. Uses VPN Address Mgmt (VAM)

protocol4. Client/server model - client learns

public address of other clients via server

5. Multipoint IPSEC Tunnels built hub/spoke or spoke/spoke

Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke

VAM Server / Hub Hub


• VAM Server config

vam server advpn-domain abc id 1pre-shared-key cipher xxxserver enablehub-group 0hub private-address 10.150.0.1hub private-address 10.150.0.2spoke private-address range 10.150.0.0 10.150.0.255

Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke


Hub Private address configured and address

range for spokes


Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke


VAM client register public address with server which maps to a private address

• VAM Server Address Map

<HP6804-1>dis vam server address-mapADVPN domain name: abcTotal private address mappings: 3Group Private address Public address Type NAT Holding time0 10.150.0.1 172.16.51.1 Hub No 22H 49M 20S0 10.150.0.2 172.16.52.1 Hub No 22H 47M 3S0 10.150.0.5 172.16.50.1 Spoke No 22H 47M 3S


• Client config

interface Tunnel5 mode advpn greip binding vpn-instance xip address 10.150.0.5 255.255.255.0pim dmsource GigabitEthernet0/0.50tunnel protection ipsec profile abcvam client Spoke1#vam client name Spoke1advpn-domain abcserver primary ip-address 172.16.51.1pre-shared-key cipher xxxclient enable

Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke



• Hub config

interface Tunnel5 mode advpn greip binding vpn-instance xip address 10.150.0.1 255.255.255.0pim dmsource GigabitEthernet2/0/3.51tunnel protection ipsec profile abcvam client Hub1#vam client name Hub1advpn-domain abcserver primary ip-address 172.16.51.1pre-shared-key cipher xxxclient enable

Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke


Only 1 tunnel interface needed

Reduces admin overhead

ZTD Combo

ZTD

ADVPN

X.509 PKIBGP

ZTD - BGPBGP tweak for Auto-deploy

• Normally, even with peer groups, peer statements must be configured for each neighbour.

• BGP peer statement subnet allows hub to passively listen for TCP SYN from a source subnet:

bgp 65100peer 10.150.0.0 24 enable

• Reduce admin overhead• Only clients need hub peer statements

Customer DC / NoC

Carrier Network

IMC BIMS

VAM Client / Spoke


eBGP session eBGP session

ZTD Combo

ZTD

ADVPN

X.509 PKIBGP

ZTD - SecurityPKI Infrastructure

• Public Key Infrastructure (PKI) = asymmetric key infrastructure for encryption & authentication of network users and data.

• Distributes X.509 digital certificates as public keys, creates chain of trust rooted at Certificate Authority.

• IPSEC can utilise certs from CA to build Security Associates between Hub & Spokes.

• Improves security over statically configured pre-shared keys.

Carrier Network

Customer DC / NoC

IMC BIMS

VAM Client / Spoke


P2MPIPSEC ADVPN tunnel

Certificate Authority

ZTD - SecurityPKI Infrastructure

• Example Config

interface Tunnel5 mode advpn greip binding vpn-instance xip address 10.150.0.5 255.255.255.0pim dmsource GigabitEthernet0/0.50tunnel protection ipsec profile abcvam client Spoke1#ike profile abccertificate domain hpnemeaexchange-mode aggressivematch remote identity address 0.0.0.0 0.0.0.0proposal 10

Carrier Network

Customer DC / NoC

IMC BIMS

VAM Client / Spoke




Zero Touch Deployment:Flow

Router boot

USB Insert

IMC BIMS

CWMP

Config Router configured

Router certs for IPSEC neededVAM Server

Register

PublicPrivate

Map


Cert Request

Router IPSEC active

Cert

Hub

IPSEC SA

Router L3 connection up

ADVPN tunnel

Hub

BGP TCP Syn

Router upEstablished

ZTD - SecurityPKI Hooks for ZTD

• Example Config

pki domain hpnemeaca identifier JN-FI-CA8certificate request url http://10.200.1.132:80/certsrv/mscep/mscep.dllcertificate request from racertificate request entity hpnemeacertificate request mode autopublic-key rsa general name abc length 2048root-certificate fingerprint md5 8621C06F5E51590C3D7EA89E29EFC044undo crl check enable

Auto mode: router requests X.509 from CA

Public key auto-generated on boot-up

Carrier Network

Customer DC / NoC

IMC BIMS

VAM Client / Spoke




Zero Touch Deployment:Demo time.

zero-touch deployment med imc bims · •hvert steg i prosessen koster penger •skal du sende...

Documents