• Controller database (Controllerdb): Port 9979.
• Client-server out-of-band connection: Port 50003.
• CVX cluster peer out-of-band connection: Port 50004.

   

  Note: All of these connections are TCP.

   

• Enabling CVX on the CVX Client

  CVX client parameters are configured in Management-CVX configuration mode. Management-CVX configuration mode is not a group-change mode; running-config is changed when commands are entered, and exiting the mode does not modify running-config. The management cvx command places the switch in Management-CVX configuration mode.

  CVX client is disabled by default. The no shutdown (Management-CVX) command enables CVX client on the switch.

  For the CVX network topology service to create an inventory of all CVX clients, ensure that LLDP is enabled on each client switch using the lldp run command.

   

  Example

  These commands enter Management-CVX-configuration mode and enable the CVX client.

  switch(config)# lldp run
  switch(config)# management cvx
  switch(config-mgmt-cvx)# no shutdown
  switch(config-mgmt-cvx)#

   

• CVX Client Heartbeat Configuration

  A CVX client synchronizes and maintains contact with CVX by exchanging heartbeat signals. The heartbeat transmission frequency and timeout period define when communication with CVX will be considered down.

  The interval between heartbeat messages that the CVX client transmits is configured by the heartbeat-interval (Management-CVX) command.

  The CVX client timeout period is specified by the heartbeat-timeout (Management-CVX) command. When a CVX client does not receive a subsequent heartbeat message from CVX within this timeout period, the client assumes that services provided by CVX are no longer available.

  Best practices dictate that a CVX client's heartbeat interval and heartbeat timeout values are identical to those of the CVX server to which it connects.

  Example

   

  This command configures a CVX client heartbeat interval of 30 seconds and client timeout period of 90 seconds.

  switch(config-mgmt-cvx)# heartbeat-interval 30
  switch(config-mgmt-cvx)# heartbeat-timeout 90
  switch(config-mgmt-cvx)#

   

• Connecting the CVX Client to a Server

  The server host (Management-CVX) command identifies the location of the CVX server that the client accesses. The source-interface (Management-CVX) command specifies the interface from which the client derives the IP address it uses as the source in CVX packets that it transmits. And the no shutdown (Management-CVX) command enables CVX on the client switch.

   

  Example

  These commands configure the switch as a CVX client, connecting to a CVX server at IP address 10.1.1.14 and using IP address 10.24.24.1 as the source address for its outbound packets.

  switch(config)# interface loopback 5
  switch(config-if-Lo5)# ip address 10.24.24.1/24
  switch(config-if-Lo5)# management cvx
  switch(config-mgmt-cvx)# server host 10.1.1.14
  switch(config-mgmt-cvx)# source-interface loopback 5
  switch(config-mgmt-cvx)# no shutdown
  switch(config-mgmt-cvx)#

• Configuring OpenStack Service.
• Configuring VXLAN Control Service.
• Configuring Hardware Switch Controller Service (HSC).
• Configuring Network Topology Service.
• Configuring Static Topology Service.

   

1. On CVX server, copy the server certificate and key and also the CA certificate to verify CVX clients.

   switch(config)# !Copy the PEM encoded certificate and RSA key files for CVX server
   switch(config)# !Lets call them server.crt and server.key
   switch(config)# copy <url> certificate:server.crt
   switch(config)# copy <url> sslkey:server.key
   switch(config)# !Copy the PEM encoded CA certificate to verify the certificate of CVX clients.Lets call it ca.crt
   switch(config)# copy <url> certificate:ca.crt

    

2. On CVX server, configure SSL profile with the certificates and key as below. Lets call the SSL profile as serverssl.

   switch(config)# management security
   switch(config-mgmt-security)# ssl profile serverssl
   switch(config-mgmt-sec-ssl-profile-serverssl)# certificate server.crt key server.key
   switch(config-mgmt-sec-ssl-profile-serverssl)# !You can trust multiple CA certificates
   switch(config-mgmt-sec-ssl-profile-serverssl)# trust certificate ca.crt

    

    

   Note: If you are using intermediate certificates to build a 'Chain of Trust' (such as server.crt -> intermediate1.crt -> intermediate2.crt -> ca.crt), then you need to configure the intermediate certificates as part of the SSL profile using the following commands:

   switch(config-mgmt-sec-ssl-profile-serverssl)# chain certificate intermediate1.crt
   switch(config-mgmt-sec-ssl-profile-serverssl)# chain certificate intermediate2.crt

    

3. On CVX server, configure to use the serverssl SSL profile. With this configuration, the CVX server starts listening on a secure port. The CVX server will continue to listen on the default port. i.e., the CVX server will accept connections from CVX clients over both SSL and default non-SSL transports. During a SSL negotiation, the CVX server will authenticate itself to the CVX clients by presenting server.crt and it verifies the authenticity of the CVX client by checking if the CVX client certificate is signed by the trusted certificate ca.crt.

   switch(config)# cvx
   switch(config-cvx)# ssl profile serverssl

    

4. On CVX client, copy the client certificate and key and also the CA certificate to verify CVX server.

   switch(config)# !Copy PEM encoded certificate and RSA key files for CVX client
   switch(config)# !Lets call them client.crt and client.key
   switch(config)# copy <url> certificate:client.crt
   switch(config)# copy <url> sslkey:client.key
   switch(config)# !Copy PEM encoded CA certificate used to verify the
   switch(config)# !certificate of CVX server. Lets call it ca.crt
   switch(config)# copy <url> certificate:ca.crt

    

    

   Note: If you are using intermediate certificates to build a 'Chain of Trust' (such as client.crt -> intermediate1.crt -> intermediate2.crt -> ca.crt), then you need to configure the intermediate certificates as part of the SSL profile using the following commands:

   switch(config-mgmt-sec-ssl-profile-clientssl)# chain certificate intermediate1.crt
   switch(config-mgmt-sec-ssl-profile-clientssl)# chain certificate intermediate2.crt

    

5. On CVX client, configure SSL profile with the certificates and key as below. Lets call the SSL profile as clientssl.

   switch(config)# management security
   switch(config-mgmt-security)# ssl profile clientssl
   switch(config-mgmt-sec-ssl-profile-clientssl)# certificate client.crt key client.key
   switch(config-mgmt-sec-ssl-profile-clientssl)# !You can trust multiple CA certificates
   switch(config-mgmt-sec-ssl-profile-clientssl)# trust certificate ca.crt

    

6. On CVX client, configure to use the SSL profile clientssl. With this configuration, the CVX client will connect to the secure port of the CVX server over SSL transport. During SSL negotiation, the CVX client will authenticate itself to the CVX server by presenting client.crt and it verifies the authenticity of the CVX server by checking if the CVX server certificate is signed by the trusted certificate ca.crt.

   switch(config)# management cvx
   switch(config-mgmt-cvx)# ssl profile clientssl

    

switch# show cvx

CVX Server
 Status: Enabled
 UUID: beb19142-dfaa-11e4-b996-001c73105347
 Heartbeat interval: 20.0
 Heartbeat timeout: 60.0
 SSL profile: serverssl
  Status: Enabled

switch# show cvx connections 

Switch 00:1c:73:10:53:48
 Hostname: sq302
 Status: up
Last heartbeat sent: 0:00:04 ago
Last heartbeat received: 0:00:10 ago
Clock offset: -0.00201620385865
Out-of-band connection: SSL secured
In-band connection: Not secured (SSL not supported)

switch# show management cvx

CVX Client
 Status: Enabled
 Last connected time: 2015-04-14 11:16:19
 Connection status: Connected
  Out-of-band connection: SSL secured
  In-band connection: Not secured (SSL not supported)
 Negotiated version: 2
 Controller UUID: 0e7dee2e-e2cf-11e4-880f-001c73105347
 Controller: 127.0.0.1
  Last heartbeat sent: 0:00:00 ago
  Last heartbeat received: never
  Clock offset: 0.0
 SSL profile: clientssl
  Status: Enabled

• SSL profile does not exist: If the SSL profile configured under CVX server/client is not configured under management security, you will see this message. Configure the SSL profile with required certificates and key under management security.

   

• Invalid SSL profile: If the SSL profile configured under CVX server/client is in invalid state, you will see this message. Check show management security ssl profile <name> command to see the errors on the SSL profile and fix them.

   

• Trusted certificates not configured in SSL profile: If the SSL profile configured under CVX server/client does not have trusted certificates configured, you will see this message. Configure trusted CA certificates in the SSL profile.

   

• Certificate not configured in SSL profile: If the SSL profile configured under CVX server/client does not have certificate key pair configured, you will see this message. Please configure certificate and key pair in the SSL profile.

   

• Diffie-Hellman parameters not yet ready: When EOS is booted, a Diffie-Hellman parameters file is auto generated by the system if one does not exist. This Diffie-Hellman parameters file is used for symmetric key exchange during SSL negotiation. Only the CVX server uses this file and hence this message can be seen only on show cvx command output. If the file is not yet generated, you will see this message. When the file is ready, this message automatically goes away and the SSL profile will become enabled.

   

• Required Number of Controllers to Support High Availability
• Cluster Configuration Options

• Fail-stop
• Fail-recover

   

• A crash of the agent or machine running CVX.
• The CVX controller or dedicated machine it runs on is removed (partitioned) from the cluster.

   

• The number of CVX Controllers in a cluster is 3.
• An odd number of CVX instances (CVX Controllers) are required to form a cluster.

   

  Note: If an even number of CVX Controllers are configured in a cluster, a CVX instance will automatically refuse to participate in the cluster.

   

• All cluster members must point to each other. This is essential for clusters to operate normally. (The steps required to complete this task are included in the following procedure.)

1. Using the peer host command, configure one of the cluster members to point to every other cluster member. This example shows the configuration of cluster member cvs1 to point to the other cluster members (cvs2 and cvs3).

   cvs1(config-cvx)# peer host 10.0.0.2 (connects cvs1 to cvs2)
   cvs1(config-cvx)# peer host 10.0.0.3 (connects cvs1 to cvs3)

    

2. Use the show cvx command to check the Mode and Peer registration state status values for cluster member cvs1. The status values should be:
   • Mode = Cluster
   • Peer registration state = Connecting

      

     Note: Mode automatically changes from Standalone to Cluster when configuring a CVX cluster. This is because the presence of multiple CVX peers causes the Mode to change to Cluster. Peer registration state remains in Connecting status after you configure the first cluster member. This is because the two peers must register with each other for the registration of the two members to be successful.

      

3. Using the peer host command, configure peer cluster member cvs2 to point to every other cluster member. This example shows the configuration of cluster member cvs2 to point to the other cluster members (cvs1 and cvs3).

   cvs2(config-cvx)# peer host 10.0.0.1 (connects cvs2 to cvs1)
   cvs2(config-cvx)# peer host 10.0.0.3 (connects cvs2 to cvs3)

    

4. Use the show cvx command to check the Peer registration state settings for cvs1. This is done to verify that peers cvs1 and cvs2 are successfully registered with each other.

   cvs1(config-cvx)# show cvx

    

   Example

   This example shows the output of the show cvx command for cvs1. The Peer registration state setting of Registration Complete for peer cvs2 indicates a successful registration between cvs1 and cvs2.

   cvs1(config-cvx)# show cvx
   
   CVX Server
    Status: Enabled
    UUID: 6c208fba-7324-11e5-8fef-1d98cdd3b27a
    Mode: Cluster
    Heartbeat interval: 20.0
    Heartbeat timeout: 60.0
    Cluster Status
     Name: default
     Role: Standby
     Leader: 10.0.0.2
     Peer timeout: 10.0
     Last leader switchover timestamp: 0:00:03 ago
     Peer Status for 10.0.0.3
      Peer registration state: Connecting
      Peer service version compatibility : Version mismatch
     Peer Status for 10.0.0.2
      Peer Id : 02-01-63-02-00-00
      Peer registration state: Registration complete
      Peer service version compatibility : Version ok

    

5. Using the peer host command, configure peer cluster member cvs3 to point to every other cluster member. This example shows the configuration of cluster member cvs3 to point to the other cluster members (cvs1 and cvs2).

   cvs3(config-cvx)# peer host 10.0.0.1 (connects cvs3 to cvs1)
   cvs3(config-cvx)# peer host 10.0.0.2 (connects cvs3 to cvs2)

    

6. Use the show cvx command to check the Peer registration state settings for cvs1. This is done to verify that peers cvs1 and cvs3 are successfully registered with each other.

   cvs1(config-cvx)# show cvx

    

   Example

   This example shows the output of the show cvx command for cvs1. The Peer registration state setting of Registration Complete for peer cvs3 indicates a successful registration between cvs1 and cvs3.

   cvs1(config-cvx)# show cvx
   
   CVX Server
    Status: Enabled
    UUID: 6c208fba-7324-11e5-8fef-1d98cdd3b27a
    Mode: Cluster
    Heartbeat interval: 20.0
    Heartbeat timeout: 60.0
    Cluster Status
     Name: default
     Role: Standby
     Leader: 10.0.0.2
     Peer timeout: 10.0
     Last leader switchover timestamp: 0:05:37 ago
     Peer Status for 10.0.0.3
      Peer Id : 02-01-63-03-00-00
      Peer registration state: Registration complete
      Peer service version compatibility : Version ok
     Peer Status for 10.0.0.2
      Peer Id : 02-01-63-02-00-00
      Peer registration state: Registration complete
      Peer service version compatibility : Version ok

1. Using the server host command, configure each of the CVX clients to point to every cluster member. This example shows the configuration of client cvc1 to point to all of the cluster members (the addresses of the cluster members are 10.0.0.1, 10.0.0.2, and 10.0.0.3).

   cvc1(config-mgmt-cvx)# server host 10.0.0.1 (connects cvc1 to cluster member 10.0.0.1)
   cvc1(config-mgmt-cvx)# server host 10.0.0.2 (connects cvc1 to cluster member 10.0.0.2)
   cvc1(config-mgmt-cvx)# server host 10.0.0.3 (connects cvc1 to cluster member 10.0.0.3)

    

2. Use the show man cvx command to check the status of client cvc1. The Connection status for each cluster member should be Established. In addition, the client is also aware that cluster member 10.0.0.3 is the current Master.

   cvc1(config-mgmt-cvx)# show man cvx
   
   CVX Client
    Status: Enabled
    Source interface: Inactive (Not configured)
    Controller cluster name: default
     Controller status for 10.0.0.1
      Connection status: established
       Out-of-band connection: Not secured
       In-band connection: Not secured (SSL not supported)
      Negotiated version: 2
      Controller UUID: 6c208fba-7324-11e5-8fef-1d98cdd3b27a
      Last heartbeat sent: 0:00:07 ago
      Last heartbeat received: 0:00:07 ago
    Controller status for 10.0.0.3
     Master since 0:03:34 ago
     Connection status: established
      Out-of-band connection: Not secured
      In-band connection: Not secured (SSL not supported)
    Negotiated version: 2
    Controller UUID: c64954b8-7324-11e5-9f33-51f8b016cae8
    Last heartbeat sent: 0:00:14 ago
    Last heartbeat received: 0:00:14 ago
   Controller status for 10.0.0.2
    Connection status: established
     Out-of-band connection: Not secured
     In-band connection: Not secured (SSL not supported)
    Negotiated version: 2
    Controller UUID: 6a0dbf2c-7324-11e5-94f3-ff17a8a1cdc8
    Last heartbeat sent: 0:00:05 ago
    Last heartbeat received: 0:00:05 ago  

CVX(config)# interface management 0
CVX(config-if-Ma0)# mac-address 00:1C:72:00:00:FF
CVX(config-if-Ma0)# ip address 10.0.0.2

switch(config)# cvx
switch(config-cvx)# service openstack
switch(config-cvx-openstack)# name-resolution interval 18000
switch(config-cvx-openstack)#