1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
|
heat_template_version: 2015-04-30
description: >
HOT template to create a vIPR-ATM firwall service instance.
This template creates the following
- Contrail Port Tuple for this firwall service instance
- Virtual machine interfaces and IP addresses attached to the two
service virtual networks. These virtual machine interfaces will be used
by the vIPR firewall service instance
- Neutron ports for OAM, HA0, and HA1 networks
- OS::Nova::Server with the created virtual machine interface and ports. This
is the firewall service instance virtual machine.
parameters:
oam_net_id:
type: string
constraints:
- custom_constraint: neutron.network
description: This network must currently exist.
description: Neutron UUID for the managemnet network name of the vIPR-ATM firewall
vipr_atm_oam_net_security_groups:
type: comma_delimited_list
description: List of the security group to apply to the vIPR-ATM firewall management port
vipr_atm_service_left_fqdn:
type: string
constraints:
- allowed_pattern: ^(?:[^:]{1,64}:){2}(?:[^:]{1,255})$
description: |
A valid Contrail FQDN that contains three parts seperated by ':'.
The first two part are 1 to 64 characters long and must not contain ':'.
The third part is 1 to 255 characters long and must not contain ':'.
description: FQDN of the Left service network for the vIPR-ATM firewall
vipr_atm_service_right_fqdn:
type: string
constraints:
- allowed_pattern: ^(?:[^:]{1,64}:){2}(?:[^:]{1,255})$
description: |
A valid Contrail FQDN that contains three parts seperated by ':'.
The first two part are 1 to 64 characters long and must not contain ':'.
The third part is 1 to 255 characters long and must not contain ':'.
description: FQDN of the Right service network for the vIPR-ATM firewall
vipr_atm_ha_one_id:
type: string
constraints:
- custom_constraint: neutron.network
description: This network must currently exist.
description: Neutron UUID of the first high availability network for the vIPR-ATM firewall
vipr_atm_ha_one_ip_0:
type: string
constraints:
- allowed_pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
description: A valid IPv4 dot quad IP address.
description: Fixed IP to apply to the vIPR-ATM firewall ha0 port
vipr_atm_ha_one_security_groups:
type: comma_delimited_list
description: List of the security group to apply to the vIPR-ATM firewall ha0 port
vipr_atm_ha_two_id:
type: string
constraints:
- custom_constraint: neutron.network
description: This network must currently exist.
description: Neutron UUID of the second high availability network for the vIPR-ATM firewal
vipr_atm_ha_two_ip_0:
type: string
constraints:
- allowed_pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
description: A valid IPv4 dot quad IP address.
description: Fixed IP to apply to the vIPR-ATM firewall ha1 port
vipr_atm_ha_two_security_groups:
type: comma_delimited_list
description: List of the security group to apply to the vIPR-ATM firewall ha1 port
vipr_atm_contrail_service_instance_fqdn:
type: string
constraints:
- allowed_pattern: ^(?:[^:]{1,64}:){2}(?:[^:]{1,255})$
description: |
A valid Contrail FQDN that contains three parts seperated by ':'.
The first two part are 1 to 64 characters long and must not contain ':'.
The third part is 1 to 255 characters long and must not contain ':'.
description: FQDN of the vIPR-ATM firewall Contrail service instance for the port tuple
vipr_atm_name_0:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Name of the vIPR-ATM firewall virtual machine
vipr_atm_image_name:
type: string
constraints:
- custom_constraint: glance.image
description: This image must currently exist.
description: Image name of the vIPR-ATM firewall virtual machine
vipr_atm_flavor_name:
type: string
constraints:
- custom_constraint: nova.flavor
description: This flavor must currently exist.
description: Flavor for the vIPR-ATM firewall virtual machine
vipr_atm_server_group:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Server Group with anti-affinity policy for the vIPR-ATM firewall virtual machine
vipr_atm_valet_eg_0:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: The Valet 1.0 Exclusivity Group for the vIPR-ATM firewall virtual machine
availability_zone_0:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Availability Zone for the vIPR-ATM firewall virtual machine
vnf_id:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Unique ID for this VF instance
vnf_name:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Unique Name for this VF instance
vf_module_id:
type: string
constraints:
- length: { min: 1, max: 255 }
description: A string with length of at least 1 and less than 255.
description: Unique ID for the VF Module instance
resources:
# Create the Port Tuple
vIPR_ATM_RPT:
type: OS::ContrailV2::PortTuple
properties:
name:
str_replace:
template: VM_NAME_PORT_TUPLE
params:
VM_NAME: { get_param: vipr_atm_name_0 }
service_instance: { get_param: vipr_atm_contrail_service_instance_fqdn }
# Left Port (Virtual Machine Interface)
vIPR_ATM_Left_RVMI:
type: OS::ContrailV2::VirtualMachineInterface
depends_on: [ vIPR_ATM_RPT ]
properties:
name:
str_replace:
template: VM_NAME_PORT_3
params:
VM_NAME: { get_param: vipr_atm_name_0 }
virtual_machine_interface_properties:
{
virtual_machine_interface_properties_service_interface_type: 'left'
}
port_tuple_refs: [{ get_resource: vIPR_ATM_RPT }]
virtual_network_refs: [{ get_param: vipr_atm_service_left_fqdn }]
# Right Port (Virtual Machine Interface)
vIPR_ATM_Right_RVMI:
type: OS::ContrailV2::VirtualMachineInterface
depends_on: [ vIPR_ATM_RPT ]
properties:
name:
str_replace:
template: VM_NAME_PORT_4
params:
VM_NAME: { get_param: vipr_atm_name_0 }
virtual_machine_interface_properties:
{
virtual_machine_interface_properties_service_interface_type: 'right'
}
port_tuple_refs: [{ get_resource: vIPR_ATM_RPT }]
virtual_network_refs: [{ get_param: vipr_atm_service_right_fqdn }]
# Left Instance IP
vIPR_ATM_Left_RII:
type: OS::ContrailV2::InstanceIp
depends_on: [ vIPR_ATM_Left_RVMI ]
properties:
name:
str_replace:
template: VM_NAME_INSTANCE_IP_LEFT
params:
VM_NAME: { get_param: vipr_atm_name_0 }
virtual_machine_interface_refs: [{ get_resource: vIPR_ATM_Left_RVMI }]
virtual_network_refs: [{ get_param: vipr_atm_service_left_fqdn }]
# Right Instance IP
vIPR_ATM_Right_RII:
type: OS::ContrailV2::InstanceIp
depends_on: [ vIPR_ATM_Right_RVMI ]
properties:
name:
str_replace:
template: VM_NAME_INSTANCE_IP_RIGHT
params:
VM_NAME: { get_param: vipr_atm_name_0 }
virtual_machine_interface_refs: [{ get_resource: vIPR_ATM_Right_RVMI }]
virtual_network_refs: [{ get_param: vipr_atm_service_right_fqdn }]
# OAM Network Port (not part of Port Tuple)
vIPR_ATM_OAM_0_Port:
type: OS::Neutron::Port
properties:
name:
str_replace:
template: VM_NAME_PORT_0
params:
VM_NAME: { get_param: vipr_atm_name_0 }
network: { get_param: oam_net_id }
security_groups: { get_param: vipr_atm_oam_net_security_groups }
# HA One Port (not part of Port Tuple)
vIPR_ATM_Ha_One_0_Port:
type: OS::Neutron::Port
properties:
name:
str_replace:
template: VM_NAME_PORT_1
params:
VM_NAME: { get_param: vipr_atm_name_0 }
network: { get_param: vipr_atm_ha_one_id }
fixed_ips: [ { "ip_address": { get_param: vipr_atm_ha_one_ip_0 } } ]
security_groups: { get_param: vipr_atm_ha_one_security_groups }
# HA Two Port (not part of Port Tuple)
vIPR_ATM_Ha_Two_0_Port:
type: OS::Neutron::Port
properties:
name:
str_replace:
template: VM_NAME_PORT_2
params:
VM_NAME: { get_param: vipr_atm_name_0 }
network: { get_param: vipr_atm_ha_two_id }
fixed_ips: [ { "ip_address": { get_param: vipr_atm_ha_two_ip_0 } } ]
security_groups: { get_param: vipr_atm_ha_two_security_groups }
# Valet Exclusivity Group
vIPR_ATM_Valet_EG_0:
type: ATT::Valet::GroupAssignment
properties:
group_name: { get_param: vipr_atm_valet_eg_0 }
group_type: exclusivity
level: host
resources:
- { get_resource: vIPR_ATM_Firewall }
# Create the VM and bind the five ports to it
# vIPR_ATM_Firewall_Cloud_Config:
# type: OS::Heat::CloudConfig
# properties:
# cloud_config:
# password: ubuntu
# chpasswd: { expire: False }
# ssh_pwauth: True
# manage_etc_hosts: true
vIPR_ATM_Firewall:
type: OS::Nova::Server
depends_on:
- vIPR_ATM_Left_RII
- vIPR_ATM_Right_RII
- vIPR_ATM_OAM_0_Port
- vIPR_ATM_Ha_One_0_Port
- vIPR_ATM_Ha_Two_0_Port
properties:
name: { get_param: vipr_atm_name_0 }
image: { get_param: vipr_atm_image_name }
flavor: { get_param: vipr_atm_flavor_name }
availability_zone: { get_param: availability_zone_0 }
scheduler_hints:
group: { get_param: vipr_atm_server_group }
networks:
- port: { get_resource: vIPR_ATM_OAM_0_Port }
- port: { get_resource: vIPR_ATM_Ha_One_0_Port }
- port: { get_resource: vIPR_ATM_Ha_Two_0_Port }
- port: { get_resource: vIPR_ATM_Left_RVMI }
- port: { get_resource: vIPR_ATM_Right_RVMI }
metadata:
vnf_id: { get_param: vnf_id }
vnf_name: { get_param: vnf_name }
vf_module_id: { get_param: vf_module_id }
# user_data_format: RAW
# user_data: { get_resource: vIPR_ATM_Firewall_Cloud_Config }
|
