heat/vIPsec/vIPsec/base_vipsec.yaml

   1 ##########################################################################
   2 #
   3 #==================LICENSE_START==========================================
   4 #
   5 # Copyright © Intel Corporation 2019
   6 #
   7 # Licensed under the Apache License, Version 2.0 (the "License");
   8 # you may not use this file except in compliance with the License.
   9 # You may obtain a copy of the License at
  10 #
  11 #     http://www.apache.org/licenses/LICENSE-2.0
  12 #
  13 # Unless required by applicable law or agreed to in writing, software
  14 # distributed under the License is distributed on an "AS IS" BASIS,
  15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 # See the License for the specific language governing permissions and
  17 # limitations under the License.
  18 #
  19 #==================LICENSE_END============================================
  20 #
  21 ##########################################################################
  22
  23 heat_template_version: 2013-05-23
  24
  25 description: Heat template that deploys vIPsec demo app for ONAP
  26
  27 ##############
  28 #            #
  29 # PARAMETERS #
  30 #            #
  31 ##############
  32
  33 parameters:
  34   basic_image_name:
  35     type: string
  36     label: Image name or ID
  37     description: Image to be used for IPsec compute instance
  38   ipsec_flavor_name:
  39     type: string
  40     label: IPsec Flavor
  41     description: Type of instance (flavor) to be used for IPsec VM
  42   sink_flavor_name:
  43     type: string
  44     label: Flavor
  45     description: Type of instance (flavor) to be used for vSink VM
  46   packetgen_flavor_name:
  47     type: string
  48     label: Flavor
  49     description: Type of instance (flavor) to be used for packet generator
  50   public_net_id:
  51     type: string
  52     label: Public network name or ID
  53     description: Public network that enables remote connection to VNF
  54   protected_clientA_private_net_id:
  55     type: string
  56     label: protected private network name or ID
  57     description: Private network that connects vPacketGenerator with vIPsec gateway A
  58   protected_clientB_private_net_id:
  59     type: string
  60     label: Protected private network name or ID
  61     description: Private network that connects vIPsec gateway B with vSink
  62   protected_clientA_provider_net_id:
  63     type: string
  64     label: Provider network name or ID for client A
  65     description: Private network that connects vPacketGenerator with vIPsec gateway A
  66   protected_clientB_provider_net_id:
  67     type: string
  68     label: Provider network name or ID for client B
  69     description: Private network that connects vIPsec gateway B with vSink
  70   ipsec_provider_net_id:
  71     type: string
  72     label: Provider network name or ID between IPsec gateways
  73     description: Private network that connects vIPsec gateway B with vIPsec gateway A
  74   onap_private_net_id:
  75     type: string
  76     label: ONAP management network name or ID
  77     description: Private network that connects ONAP components and the VNF
  78   onap_private_subnet_id:
  79     type: string
  80     label: ONAP management sub-network name or ID
  81     description: Private sub-network that connects ONAP components and the VNF
  82   ipsec_private_net_id:
  83     type: string
  84     label: IPsec private network name or ID
  85     description: Private network that connects the two IPsec VNFs
  86   protected_clientA_private_net_cidr:
  87     type: string
  88     label: Unprotected private network CIDR
  89     description: The CIDR of the protected private network for clientA
  90   protected_clientB_private_net_cidr:
  91     type: string
  92     label: Protected private network CIDR
  93     description: The CIDR of the protected private network for clientB
  94   onap_private_net_cidr:
  95     type: string
  96     label: ONAP private network CIDR
  97     description: The CIDR of the protected private network
  98   ipsec_private_net_cidr:
  99     type: string
 100     label: IPsec private network CIDR
 101     description: The CIDR of the protected IPsec private network
 102   vipsec_A_private_ip_0:
 103     type: string
 104     label: vIPsec private IP address towards the protected network A
 105     description: Private IP address that is assigned to the vIPsec gateway A to communicate with the vPacketGenerator
 106   vipsec_A_private_ip_1:
 107     type: string
 108     label: vIPsec private IP address towards the ONAP management network
 109     description: Private IP address that is assigned to the vIPsec A to communicate with ONAP components
 110   vipsec_A_private_ip_2:
 111     type: string
 112     label: vIPsec private IP address towards the IPsec external network
 113     description: Private IP address that is assigned to the vIPsec A to communicate with vIPsec B
 114   vipsec_B_private_ip_0:
 115     type: string
 116     label: vIPsec private IP address towards the protected network B
 117     description: Private IP address that is assigned to the vIPsec gateway B to communicate with the vSink
 118   vipsec_B_private_ip_1:
 119     type: string
 120     label: vIPsec private IP address towards the ONAP management network
 121     description: Private IP address that is assigned to the vIPsec B to communicate with ONAP components
 122   vipsec_B_private_ip_2:
 123     type: string
 124     label: vIPsec private IP address towards the IPsec external network
 125     description: Private IP address that is assigned to the vIPsec B to communicate with vIPsec A
 126   vpg_private_ip_0:
 127     type: string
 128     label: vPacketGenerator private IP address towards the protected network A
 129     description: Private IP address that is assigned to the vPacketGenerator to communicate with the vIPsec gateway A
 130   vpg_private_ip_1:
 131     type: string
 132     label: vPacketGenerator private IP address towards the ONAP management network
 133     description: Private IP address that is assigned to the vPacketGenerator to communicate with ONAP components
 134   vsn_private_ip_0:
 135     type: string
 136     label: vSink private IP address towards the protected network
 137     description: Private IP address that is assigned to the vSink to communicate with the vIPsec gateway B
 138   vsn_private_ip_1:
 139     type: string
 140     label: vSink private IP address towards the ONAP management network
 141     description: Private IP address that is assigned to the vSink to communicate with ONAP components
 142   vipsec_A_private_0_port_vnic_type:
 143     type: string
 144     description: vipsec port 0 vnic type (normal, direct)
 145     default: normal
 146   vipsec_private_1_port_vnic_type:
 147     type: string
 148     description: vipsec port 1 vnic type (normal, direct)
 149     default: normal
 150   vipsec_B_private_0_port_vnic_type:
 151     type: string
 152     description: vipsec port 0 vnic type (normal, direct)
 153     default: normal
 154   vipsec_private_2_port_vnic_type:
 155     type: string
 156     description: vipsec port 2 vnic type (normal, direct)
 157     default: normal
 158   vsn_private_0_port_vnic_type:
 159     type: string
 160     description: vsn port 0 vnic type (normal, direct)
 161     default: normal
 162   vsn_private_1_port_vnic_type:
 163     type: string
 164     description: vsn port 1 vnic type (normal, direct)
 165     default: normal
 166   vpg_private_0_port_vnic_type:
 167     type: string
 168     description: vpg port 0 vnic type (normal, direct)
 169     default: normal
 170   vpg_private_1_port_vnic_type:
 171     type: string
 172     description: vpg port 1 vnic type (normal, direct)
 173     default: normal
 174   vipsec_name_0:
 175     type: string
 176     label: vIPsec name
 177     description: Name of the vIPsec gateway A
 178   vipsec_name_1:
 179     type: string
 180     label: vIPsec name
 181     description: Name of the vIPsec gateway B
 182   vpg_name_0:
 183     type: string
 184     label: vPacketGenerator name
 185     description: Name of the vPacketGenerator
 186   vsn_name_0:
 187     type: string
 188     label: vSink name
 189     description: Name of the vSink
 190   vnf_id:
 191     type: string
 192     label: VNF ID
 193     description: The VNF ID is provided by ONAP
 194   vf_module_id:
 195     type: string
 196     label: vIPsec module ID
 197     description: The vIPsec Module ID is provided by ONAP
 198   dcae_collector_ip:
 199     type: string
 200     label: DCAE collector IP address
 201     description: IP address of the DCAE collector
 202   dcae_collector_port:
 203     type: string
 204     label: DCAE collector port
 205     description: Port of the DCAE collector
 206   key_name:
 207     type: string
 208     label: Key pair name
 209     description: Public/Private key pair name
 210   pub_key:
 211     type: string
 212     label: Public key
 213     description: Public key to be installed on the compute instance
 214   install_script_version:
 215     type: string
 216     label: Installation script version number
 217     description: Version number of the scripts that install the vIPsec demo app
 218   demo_artifacts_version:
 219     type: string
 220     label: Artifacts version used in demo vnfs
 221     description: Artifacts (jar, tar.gz) version used in demo vnfs
 222   nexus_artifact_repo:
 223     type: string
 224     description: Root URL for the Nexus repository for Maven artifacts.
 225     default: "https://nexus.onap.org"
 226   cloud_env:
 227     type: string
 228     label: Cloud environment
 229     description: Cloud environment (e.g., openstack, rackspace)
 230   input_device_interface_A:
 231     type: string
 232     description: Device BDF name for the interface
 233   input_device_interface_B:
 234     type: string
 235     description: Device BDF name for the interface
 236   output_device_interface_A:
 237     type: string
 238     description: Device BDF name for the interface
 239   output_device_interface_B:
 240     type: string
 241     description: Device BDF name for the interface
 242   input_interface_A:
 243     type: string
 244     description: Device BDF num for the interface
 245   input_interface_B:
 246     type: string
 247     description: Device BDF num for the interface
 248   output_interface_A:
 249     type: string
 250     description: Device BDF num for the interface
 251   output_interface_B:
 252     type: string
 253     description: Device BDF num for the interface
 254   vpp_config:
 255     type: string
 256     description: Name of the vpp config
 257   ipsec_config:
 258     type: string
 259     description: Name of the ipsec config
 260   ipsec_A_MAC_address:
 261     type: string
 262     description: MAC address of ipsec gateway A
 263   ipsec_B_MAC_address:
 264     type: string
 265     description: MAC address of ipsec gateway B
 266
 267 #############
 268 #           #
 269 # RESOURCES #
 270 #           #
 271 #############
 272
 273 resources:
 274   random-str:
 275     type: OS::Heat::RandomString
 276     properties:
 277       length: 4
 278
 279   my_keypair:
 280     type: OS::Nova::KeyPair
 281     properties:
 282       name:
 283         str_replace:
 284           template: base_rand
 285           params:
 286             base: { get_param: key_name }
 287             rand: { get_resource: random-str }
 288       public_key: { get_param: pub_key }
 289       save_private_key: false
 290
 291   security_group_ipsec:
 292     type: OS::Neutron::SecurityGroup
 293     properties:
 294       name: "ipsec_sg"
 295       rules:
 296       - {direction: ingress, remote_ip_prefix: 0.0.0.0/0, protocol: icmp }
 297       - {direction: ingress, remote_ip_prefix: 0.0.0.0/0, protocol: tcp, port_range_min: 22, port_range_max: 22}
 298
 299   onap_private_net:
 300     type: OS::Neutron::Net
 301     properties:
 302       name: { get_param: onap_private_net_id }
 303
 304   onap_private_subnet:
 305     type: OS::Neutron::Subnet
 306     properties:
 307       name: { get_param: onap_private_subnet_id }
 308       network_id: { get_resource: onap_private_net }
 309       cidr: { get_param: onap_private_net_cidr }
 310       dns_nameservers: [ "8.8.8.8" ]
 311
 312   router:
 313     type: OS::Neutron::Router
 314     properties:
 315       name:
 316         list_join: ['-', [{ get_param: 'OS::stack_name' }, 'router']]
 317       external_gateway_info:
 318         network: { get_param: public_net_id }
 319
 320   oam_router_interface:
 321     type: OS::Neutron::RouterInterface
 322     properties:
 323       router_id: { get_resource: router }
 324       subnet_id: { get_resource: onap_private_subnet }
 325
 326   ipsec_0_floating_ip:
 327     type: OS::Neutron::FloatingIP
 328     properties:
 329       floating_network_id: { get_param: public_net_id }
 330       port_id: { get_resource: vipsec_A_private_1_port }
 331
 332   ipsec_1_floating_ip:
 333     type: OS::Neutron::FloatingIP
 334     properties:
 335       floating_network_id: { get_param: public_net_id }
 336       port_id: { get_resource: vipsec_B_private_1_port }
 337
 338   protected_clientA_private_network:
 339     type: OS::Neutron::ProviderNet
 340     properties:
 341       name: { get_param: protected_clientA_private_net_id }
 342       physical_network: { get_param: protected_clientA_provider_net_id }
 343       network_type: vlan
 344
 345   protected_clientB_private_network:
 346     type: OS::Neutron::ProviderNet
 347     properties:
 348       name: { get_param: protected_clientB_private_net_id }
 349       physical_network: { get_param: protected_clientB_provider_net_id }
 350       network_type: vlan
 351
 352   protected_ipsec_network:
 353     type: OS::Neutron::ProviderNet
 354     properties:
 355       name: { get_param: ipsec_private_net_id }
 356       physical_network: { get_param: ipsec_provider_net_id }
 357       network_type: vlan
 358
 359   protected_clientA_private_subnet:
 360     type: OS::Neutron::Subnet
 361     properties:
 362       network_id: { get_resource: protected_clientA_private_network }
 363       cidr: { get_param: protected_clientA_private_net_cidr }
 364
 365   protected_clientB_private_subnet:
 366     type: OS::Neutron::Subnet
 367     properties:
 368       network_id: { get_resource: protected_clientB_private_network }
 369       cidr: { get_param: protected_clientB_private_net_cidr }
 370
 371   ipsec_private_subnet:
 372     type: OS::Neutron::Subnet
 373     properties:
 374       network_id: { get_resource: protected_ipsec_network }
 375       cidr: { get_param: ipsec_private_net_cidr }
 376
 377   # Virtual IPsec instantiation
 378   vipsec_A_private_0_port:
 379     type: OS::Neutron::Port
 380     properties:
 381       network: { get_resource: protected_clientA_private_network }
 382       binding:vnic_type: { get_param: vipsec_A_private_0_port_vnic_type}
 383       fixed_ips: [{"subnet": { get_resource: protected_clientA_private_subnet}, "ip_address": { get_param: vipsec_A_private_ip_0 }}]
 384       security_groups:
 385       - { get_resource: security_group_ipsec }
 386
 387   vipsec_A_private_1_port:
 388     type: OS::Neutron::Port
 389     properties:
 390       network: { get_resource: onap_private_net }
 391       binding:vnic_type: { get_param: vipsec_private_1_port_vnic_type}
 392       fixed_ips: [{"subnet": { get_resource: onap_private_subnet }, "ip_address": { get_param: vipsec_A_private_ip_1 }}]
 393       security_groups:
 394       - { get_resource: security_group_ipsec }
 395
 396   vipsec_A_private_2_port:
 397     type: OS::Neutron::Port
 398     properties:
 399       allowed_address_pairs: [{ "ip_address": { get_param: vpg_private_ip_0 }}]
 400       network: { get_resource: protected_ipsec_network }
 401       binding:vnic_type: { get_param: vipsec_private_2_port_vnic_type}
 402       fixed_ips: [{"subnet": { get_resource: ipsec_private_subnet }, "ip_address": { get_param: vipsec_A_private_ip_2 }}]
 403       security_groups:
 404       - { get_resource: security_group_ipsec }
 405
 406   vipsec_B_private_0_port:
 407     type: OS::Neutron::Port
 408     properties:
 409       network: { get_resource: protected_clientB_private_network }
 410       binding:vnic_type: { get_param: vipsec_B_private_0_port_vnic_type}
 411       fixed_ips: [{"subnet": { get_resource: protected_clientB_private_subnet}, "ip_address": { get_param: vipsec_B_private_ip_0 }}]
 412       security_groups:
 413       - { get_resource: security_group_ipsec }
 414
 415   vipsec_B_private_1_port:
 416     type: OS::Neutron::Port
 417     properties:
 418       network: { get_resource: onap_private_net }
 419       binding:vnic_type: { get_param: vipsec_private_1_port_vnic_type}
 420       fixed_ips: [{"subnet": { get_resource: onap_private_subnet }, "ip_address": { get_param: vipsec_B_private_ip_1 }}]
 421       security_groups:
 422       - { get_resource: security_group_ipsec }
 423
 424   vipsec_B_private_2_port:
 425     type: OS::Neutron::Port
 426     properties:
 427       network: { get_resource: protected_ipsec_network }
 428       binding:vnic_type: { get_param: vipsec_private_2_port_vnic_type}
 429       fixed_ips: [{"subnet": { get_resource: ipsec_private_subnet }, "ip_address": { get_param: vipsec_B_private_ip_2 }}]
 430       security_groups:
 431       - { get_resource: security_group_ipsec }
 432
 433   vipsec_0:
 434     type: OS::Nova::Server
 435     properties:
 436       image: { get_param: basic_image_name }
 437       flavor: { get_param: ipsec_flavor_name }
 438       name: { get_param: vipsec_name_0 }
 439       key_name: { get_resource: my_keypair }
 440       networks:
 441         - port: { get_resource: vipsec_A_private_0_port }
 442         - port: { get_resource: vipsec_A_private_1_port }
 443         - port: { get_resource: vipsec_A_private_2_port }
 444       metadata: { vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 445       user_data_format: RAW
 446       user_data:
 447         str_replace:
 448           params:
 449             __dcae_collector_ip__ : { get_param: dcae_collector_ip }
 450             __dcae_collector_port__ : { get_param: dcae_collector_port }
 451             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 452             __install_script_version__ : { get_param: install_script_version }
 453             __vipsec_A_private_ip_0__ : { get_param: vipsec_A_private_ip_0 }
 454             __vipsec_A_private_ip_1__ : { get_param: vipsec_A_private_ip_1 }
 455             __protected_clientA_private_net_cidr__ : { get_param: protected_clientA_private_net_cidr }
 456             __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
 457             __cloud_env__ : { get_param: cloud_env }
 458             __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
 459             __vpp_config__: { get_param: vpp_config }
 460             __ipsec_config__: { get_param: ipsec_config }
 461             __input_interface_num__: { get_param: input_interface_A }
 462             __output_interface_num__: { get_param: output_interface_A }
 463             __input_interface__: { get_param: input_device_interface_A }
 464             __output_interface__: { get_param: output_device_interface_A }
 465             __ipsec_B_MAC_address__: { get_param: ipsec_B_MAC_address }
 466           template: |
 467             #!/bin/bash
 468
 469             # Create configuration files
 470             mkdir /opt/config
 471             echo "__dcae_collector_ip__" > /opt/config/dcae_collector_ip.txt
 472             echo "__dcae_collector_port__" > /opt/config/dcae_collector_port.txt
 473             echo "__demo_artifacts_version__" > /opt/config/demo_artifacts_version.txt
 474             echo "__install_script_version__" > /opt/config/install_script_version.txt
 475             echo "__vipsec_A_private_ip_0__" > /opt/config/vipsec_A_private_ip_0.txt
 476             echo "__vipsec_A_private_ip_1__" > /opt/config/vipsec_A_private_ip_1.txt
 477             echo "__protected_clientA_private_net_cidr__" > /opt/config/protected_clientA_private_net_cidr.txt
 478             echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
 479             echo "__cloud_env__" > /opt/config/cloud_env.txt
 480             echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 481             echo "__input_interface_num__" > /opt/config/input_interface_A_BDF_num.txt
 482             echo "__output_interface_num__" > /opt/config/output_interface_A_BDF_num.txt
 483             echo "__input_interface__" > /opt/config/input_interface_A.txt
 484             echo "__output_interface__" > /opt/config/output_interface_A.txt
 485             echo "__ipsec_B_MAC_address__" > /opt/config/ipsec_B_mac_address.txt
 486             echo "__vpp_config__" > /opt/config/vpp_config.txt
 487             echo "__ipsec_config__" > /opt/config/ipsec_config.txt
 488
 489             # Download and run install script
 490             apt-get update
 491             wget https://packagecloud.io/install/repositories/fdio/release/script.deb.sh
 492             bash ./script.deb.sh
 493             apt install -y vpp
 494             apt install -y vpp-plugin-dpdk
 495             apt install -y make gcc libnuma-dev python
 496             cd /opt
 497             git clone http://dpdk.org/git/dpdk
 498             cd dpdk
 499             export RTE_TARGET=x86_64-native-linuxapp-gcc/
 500             export DESTDIR=/opt/dpdk
 501             export RTE_SDK=/opt/dpdk
 502             make install T=x86_64-native-linux-gcc
 503             modprobe uio
 504             insmod x86_64-native-linux-gcc/kmod/igb_uio.ko
 505             python ./usertools/dpdk-devbind.py -b igb_uio 00:06.0
 506             python ./usertools/dpdk-devbind.py -b igb_uio 00:05.0
 507             cd /opt/config
 508             cat > __vpp_config__<< NEWFILE
 509
 510             unix {
 511                     exec __ipsec_config__
 512                     nodaemon
 513                     cli-listen /run/vpp/cli.sock
 514                     log /tmp/vpp.log
 515                  }
 516
 517             cpu {
 518                    main-core 0
 519                    corelist-workers 1
 520                 }
 521
 522             dpdk {
 523                     socket-mem 512
 524                     log-level debug
 525                     no-tx-checksum-offload
 526                     dev default{
 527                             num-tx-desc 512
 528                             num-rx-desc 512
 529                     }
 530                     dev __input_interface_num__
 531                     {
 532                             workers 0
 533                     }
 534                     dev __output_interface_num__
 535                     {
 536                             workers 0
 537                     }
 538                     vdev crypto_aesni_gcm0
 539
 540                     no-multi-seg
 541                  }
 542
 543             NEWFILE
 544
 545             cat > __ipsec_config__<< NEWFILE
 546
 547             set interface state __input_interface__ up
 548             set interface state __output_interface__ up
 549
 550             set interface ip address __input_interface__ 1.0.0.1/8
 551             set interface ip address __output_interface__ 255.0.0.128/8
 552
 553             set int promiscuous on __input_interface__
 554             set int promiscuous on __output_interface__
 555
 556             set ip arp __output_interface__ 255.0.0.129 __ipsec_B_MAC_address
 557             set ip arp __input_interface__ 1.0.0.2 11:11:11:11:00:11
 558
 559             ip route add count 1 104.0.0.0/32 via 255.0.0.129 __output_interface__
 560             ip route add count 1 004.0.0.0/32 via 1.0.0.2 __input_interface__
 561
 562             ipsec spd add 1
 563             set interface ipsec spd __output_interface__ 1
 564             ipsec sa add 1 spi 25500128 esp tunnel-src 255.0.0.128 tunnel-dst 255.0.0.129 crypto-key 2b7e151628aed2a6abf7158809cf4f3d crypto-alg aes-cbc-128 integ-key 6867666568676665686766656867666568676669 integ-alg sha1-96
 565             ipsec sa add 2 spi 25500129 esp tunnel-src 255.0.0.129 tunnel-dst 255.0.0.128 crypto-key 2b7e151628aed2a6abf7158809cf4f3d crypto-alg aes-cbc-128 integ-key 6867666568676665686766656867666568676669 integ-alg sha1-96
 566             ipsec policy add spd 1 outbound priority 100 action protect sa 1 remote-ip-range 104.0.0.0-104.0.0.0
 567             ipsec policy add spd 1 inbound priority 100 action protect sa 2 remote-ip-range 004.0.0.0-004.0.0.0
 568             ipsec policy add spd 1 inbound priority 90 protocol 50 action bypass
 569             ipsec policy add spd 1 outbound priority 90 protocol 50 action bypass
 570
 571             NEWFILE
 572
 573             vpp -c __vpp_config__
 574
 575   vipsec_1:
 576     type: OS::Nova::Server
 577     properties:
 578       image: { get_param: basic_image_name }
 579       flavor: { get_param: ipsec_flavor_name }
 580       name: { get_param: vipsec_name_1 }
 581       key_name: { get_resource: my_keypair }
 582       networks:
 583         - port: { get_resource: vipsec_B_private_0_port }
 584         - port: { get_resource: vipsec_B_private_1_port }
 585         - port: { get_resource: vipsec_B_private_2_port }
 586       metadata: { vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 587       user_data_format: RAW
 588       user_data:
 589         str_replace:
 590           params:
 591             __dcae_collector_ip__ : { get_param: dcae_collector_ip }
 592             __dcae_collector_port__ : { get_param: dcae_collector_port }
 593             __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 594             __install_script_version__ : { get_param: install_script_version }
 595             __vipsec_A_private_ip_0__ : { get_param: vipsec_B_private_ip_0 }
 596             __vipsec_A_private_ip_1__ : { get_param: vipsec_B_private_ip_1 }
 597             __protected_clientA_private_net_cidr__ : { get_param: protected_clientB_private_net_cidr }
 598             __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
 599             __cloud_env__ : { get_param: cloud_env }
 600             __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
 601             __vpp_config__: { get_param: vpp_config }
 602             __ipsec_config__: { get_param: ipsec_config }
 603             __input_interface_num__: { get_param: input_interface_B }
 604             __output_interface_num__: { get_param: output_interface_B }
 605             __input_interface__: { get_param: input_device_interface_B }
 606             __output_interface__: { get_param: output_device_interface_B }
 607             __ipsec_A_MAC_address__: { get_param: ipsec_A_MAC_address }
 608           template: |
 609             #!/bin/bash
 610
 611             # Create configuration files
 612             mkdir /opt/config
 613             echo "__dcae_collector_ip__" > /opt/config/dcae_collector_ip.txt
 614             echo "__dcae_collector_port__" > /opt/config/dcae_collector_port.txt
 615             echo "__demo_artifacts_version__" > /opt/config/demo_artifacts_version.txt
 616             echo "__install_script_version__" > /opt/config/install_script_version.txt
 617             echo "__vipsec_B_private_ip_0__" > /opt/config/vipsec_B_private_ip_0.txt
 618             echo "__vipsec_B_private_ip_1__" > /opt/config/vipsec_B_private_ip_1.txt
 619             echo "__protected_clientA_private_net_cidr__" > /opt/config/protected_clientB_private_net_cidr.txt
 620             echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
 621             echo "__cloud_env__" > /opt/config/cloud_env.txt
 622             echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 623             echo "__input_interface_num__" > /opt/config/input_interface_B_BDF_num.txt
 624             echo "__output_interface_num__" > /opt/config/output_interface_B_BDF_num.txt
 625             echo "__input_interface__" > /opt/config/input_interface_B.txt
 626             echo "__output_interface__" > /opt/config/output_interface_B.txt
 627             echo "__ipsec_A_MAC_address__" > /opt/config/ipsec_A_mac_address.txt
 628             echo "__vpp_config__" > /opt/config/vpp_config.txt
 629             echo "__ipsec_config__" > /opt/config/ipsec_config.txt
 630
 631             # Download and run install script
 632             apt-get update
 633             wget https://packagecloud.io/install/repositories/fdio/release/script.deb.sh
 634             bash ./script.deb.sh
 635             apt install -y vpp
 636             apt install -y vpp-plugin-dpdk
 637             apt install -y make gcc libnuma-dev python
 638             cd /opt
 639             git clone http://dpdk.org/git/dpdk
 640             cd /opt/dpdk
 641             export RTE_TARGET=x86_64-native-linuxapp-gcc/
 642             export DESTDIR=/opt/dpdk
 643             export RTE_SDK=/opt/dpdk
 644             make install T=x86_64-native-linux-gcc
 645             modprobe uio
 646             insmod x86_64-native-linux-gcc/kmod/igb_uio.ko
 647             python ./usertools/dpdk-devbind.py -b igb_uio 00:05.0
 648             python ./usertools/dpdk-devbind.py -b igb_uio 00:06.0
 649             cd /opt/config
 650             cat > __vpp_config__<< NEWFILE
 651
 652             unix {
 653                     exec __ipsec_config__
 654                     nodaemon
 655                     cli-listen /run/vpp/cli.sock
 656                     log /tmp/vpp.log
 657                  }
 658
 659             cpu {
 660                    main-core 0
 661                    corelist-workers 1
 662                 }
 663
 664             dpdk {
 665                     socket-mem 512
 666                     log-level debug
 667                     no-tx-checksum-offload
 668                     dev default{
 669                             num-tx-desc 512
 670                             num-rx-desc 512
 671                     }
 672                     dev __input_interface_num__
 673                     {
 674                             workers 0
 675                     }
 676                     dev __output_interface_num__
 677                     {
 678                             workers 0
 679                     }
 680                     vdev crypto_aesni_gcm0
 681
 682                     no-multi-seg
 683                  }
 684
 685             NEWFILE
 686
 687             cat > __ipsec_config__<< NEWFILE
 688
 689             set interface state __input_interface__ up
 690             set interface state __output_interface__ up
 691
 692             set interface ip address __input_interface__ 1.0.0.1/8
 693             set interface ip address __output_interface__ 255.0.0.128/8
 694
 695             set int promiscuous on __input_interface__
 696             set int promiscuous on __output_interface__
 697
 698             set ip arp __output_interface__ 255.0.0.129 __ipsec_A_MAC_address
 699             set ip arp __input_interface__ 1.0.0.2 11:11:11:11:00:11
 700
 701             ip route add count 1 104.0.0.0/32 via 255.0.0.129 __output_interface__
 702             ip route add count 1 004.0.0.0/32 via 1.0.0.2 __input_interface__
 703
 704             ipsec spd add 1
 705             set interface ipsec spd __output_interface__ 1
 706             ipsec sa add 1 spi 25500128 esp tunnel-src 255.0.0.128 tunnel-dst 255.0.0.129 crypto-key 2b7e151628aed2a6abf7158809cf4f3d crypto-alg aes-cbc-128 integ-key 6867666568676665686766656867666568676669 integ-alg sha1-96
 707             ipsec sa add 2 spi 25500129 esp tunnel-src 255.0.0.129 tunnel-dst 255.0.0.128 crypto-key 2b7e151628aed2a6abf7158809cf4f3d crypto-alg aes-cbc-128 integ-key 6867666568676665686766656867666568676669 integ-alg sha1-96
 708             ipsec policy add spd 1 outbound priority 100 action protect sa 1 remote-ip-range 104.0.0.0-104.0.0.0
 709             ipsec policy add spd 1 inbound priority 100 action protect sa 2 remote-ip-range 004.0.0.0-004.0.0.0
 710             ipsec policy add spd 1 inbound priority 90 protocol 50 action bypass
 711             ipsec policy add spd 1 outbound priority 90 protocol 50 action bypass
 712
 713             NEWFILE
 714
 715             vpp -c __vpp_config__
 716
 717
 718   # Virtual Packet Generator instantiation
 719   vpg_private_0_port:
 720     type: OS::Neutron::Port
 721     properties:
 722       network: { get_resource: protected_clientA_private_network}
 723       binding:vnic_type: { get_param: vpg_private_0_port_vnic_type}
 724       fixed_ips: [{"subnet": { get_resource: protected_clientA_private_subnet }, "ip_address": { get_param: vpg_private_ip_0 }}]
 725       security_groups:
 726       - { get_resource: security_group_ipsec }
 727
 728   vpg_private_1_port:
 729     type: OS::Neutron::Port
 730     properties:
 731       network: { get_resource: onap_private_net }
 732       binding:vnic_type: { get_param: vpg_private_1_port_vnic_type}
 733       fixed_ips: [{"subnet": { get_resource: onap_private_subnet }, "ip_address": { get_param: vpg_private_ip_1 }}]
 734       security_groups:
 735       - { get_resource: security_group_ipsec }
 736
 737
 738   vpg_0_floating_ip:
 739     type: OS::Neutron::FloatingIP
 740     properties:
 741       floating_network_id: { get_param: public_net_id }
 742       port_id: { get_resource: vpg_private_1_port }
 743
 744    vpg_0:
 745      type: OS::Nova::Server
 746      properties:
 747        image: { get_param: basic_image_name }
 748        flavor: { get_param: packetgen_flavor_name }
 749        name: { get_param: vpg_name_0 }
 750        key_name: { get_resource: my_keypair }
 751        networks:
 752          - port: { get_resource: vpg_private_0_port }
 753          - port: { get_resource: vpg_private_1_port }
 754        metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 755        user_data_format: RAW
 756        user_data:
 757          str_replace:
 758            params:
 759              __ipsec_ipaddr__: { get_param: vipsec_A_private_ip_0 }
 760              __protected_clientB_net_cidr__: { get_param: protected_clientB_private_net_cidr }
 761              __sink_ipaddr__: { get_param: vsn_private_ip_0 }
 762              __demo_artifacts_version__ : { get_param: demo_artifacts_version }
 763              __install_script_version__ : { get_param: install_script_version }
 764              __vpg_private_ip_0__ : { get_param: vpg_private_ip_0 }
 765              __vpg_private_ip_1__ : { get_param: vpg_private_ip_1 }
 766              __protected_clientA_net_cidr__ : { get_param: protected_clientA_private_net_cidr }
 767              __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
 768              __cloud_env__ : { get_param: cloud_env }
 769              __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
 770            template: |
 771              #!/bin/bash
 772
 773              # Create configuration files
 774              mkdir /opt/config
 775              echo "__ipsec_ipaddr__" > /opt/config/vipsec_ipaddr.txt
 776              echo "__protected_clientB_net_cidr__" > /opt/config/protected_clientB_net_cidr.txt
 777              echo "__sink_ipaddr__" > /opt/config/sink_ipaddr.txt
 778              echo "__demo_artifacts_version__" > /opt/config/demo_artifacts_version.txt
 779              echo "__install_script_version__" > /opt/config/install_script_version.txt
 780              echo "__vpg_private_ip_0__" > /opt/config/vpg_private_ip_0.txt
 781              echo "__vpg_private_ip_1__" > /opt/config/vpg_private_ip_1.txt
 782              echo "__protected_clientA__net_cidr__" > /opt/config/protected_clientA_net_cidr.txt
 783              echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
 784              echo "__cloud_env__" > /opt/config/cloud_env.txt
 785              echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 786
 787              # Download and run install script
 788              apt-get update
 789              apt-get -y install unzip
 790              if [[ "__install_script_version__" =~ "SNAPSHOT" ]]; then REPO=snapshots; else REPO=releases; fi
 791              curl -k -L "__nexus_artifact_repo__/service/local/artifact/maven/redirect?r=${REPO}&g=org.onap.demo.vnf.vipsec&a=vipsec-scripts&e=zip&v=__install_script_version__" -o /opt/vipsec-scripts-__install_script_version__.zip
 792              unzip -j /opt/vipsec-scripts-__install_script_version__.zip -d /opt v_packetgen_install.sh
 793              cd /opt
 794              chmod +x v_packetgen_install.sh
 795              ./v_packetgen_install.sh
 796
 797
 798   # Virtual Sink instantiation
 799   vsn_private_0_port:
 800     type: OS::Neutron::Port
 801     properties:
 802       network: { get_resource: protected_clientB_private_network }
 803       binding:vnic_type: { get_param: vsn_private_0_port_vnic_type}
 804       fixed_ips: [{"subnet": { get_resource: protected_clientB_private_subnet }, "ip_address": { get_param: vsn_private_ip_0 }}]
 805       security_groups:
 806       - { get_resource: security_group_ipsec }
 807
 808   vsn_private_1_port:
 809     type: OS::Neutron::Port
 810     properties:
 811       network: { get_resource: onap_private_net }
 812       binding:vnic_type: { get_param: vsn_private_1_port_vnic_type}
 813       fixed_ips: [{"subnet": { get_resource: onap_private_subnet }, "ip_address": { get_param: vsn_private_ip_1 }}]
 814       security_groups:
 815       - { get_resource: security_group_ipsec }
 816
 817   vsn_floating_ip:
 818     type: OS::Neutron::FloatingIP
 819     properties:
 820       floating_network_id: { get_param: public_net_id }
 821       port_id: { get_resource: vsn_private_1_port }
 822
 823    vsn_0:
 824      type: OS::Nova::Server
 825      properties:
 826        image: { get_param: basic_image_name }
 827        flavor: { get_param: sink_flavor_name }
 828        name: { get_param: vsn_name_0 }
 829        key_name: { get_resource: my_keypair }
 830        networks:
 831          - port: { get_resource: vsn_private_0_port }
 832          - port: { get_resource: vsn_private_1_port }
 833        metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
 834        user_data_format: RAW
 835        user_data:
 836          str_replace:
 837            params:
 838              __protected_net_gw__: { get_param: vipsec_B_private_ip_0 }
 839              __protected_net_A__: { get_param: protected_clientA_private_net_cidr }
 840              __install_script_version__ : { get_param: install_script_version }
 841              __vsn_private_ip_0__ : { get_param: vsn_private_ip_0 }
 842              __vsn_private_ip_1__ : { get_param: vsn_private_ip_1 }
 843              __protected_clientB_private_net_cidr__ : { get_param: protected_clientB_private_net_cidr }
 844              __onap_private_net_cidr__ : { get_param: onap_private_net_cidr }
 845              __cloud_env__ : { get_param: cloud_env }
 846              __nexus_artifact_repo__: { get_param: nexus_artifact_repo }
 847            template: |
 848              #!/bin/bash
 849
 850              # Create configuration files
 851              mkdir /opt/config
 852              echo "__protected_net_gw__" > /opt/config/protected_net_gw.txt
 853              echo "__protected_net_A__" > /opt/config/protected_net_A.txt
 854              echo "__install_script_version__" > /opt/config/install_script_version.txt
 855              echo "__vsn_private_ip_0__" > /opt/config/vsn_private_ip_0.txt
 856              echo "__vsn_private_ip_1__" > /opt/config/vsn_private_ip_1.txt
 857              echo "__protected_clientB_private_net_cidr__" > /opt/config/protected_clientB_private_net_cidr.txt
 858              echo "__onap_private_net_cidr__" > /opt/config/onap_private_net_cidr.txt
 859              echo "__cloud_env__" > /opt/config/cloud_env.txt
 860              echo "__nexus_artifact_repo__" > /opt/config/nexus_artifact_repo.txt
 861
 862              # Download and run install script
 863              apt-get update
 864              apt-get -y install unzip
 865              if [[ "__install_script_version__" =~ "SNAPSHOT" ]]; then REPO=snapshots; else REPO=releases; fi
 866              curl -k -L "__nexus_artifact_repo__/service/local/artifact/maven/redirect?r=${REPO}&g=org.onap.demo.vnf.vipsec&a=vipsec-scripts&e=zip&v=__install_script_version__" -o /opt/vipsec-scripts-__install_script_version__.zip
 867              unzip -j /opt/vipsec-scripts-__install_script_version__.zip -d /opt v_sink_install.sh
 868              cd /opt
 869              chmod +x v_sink_install.sh
 870              ./v_sink_install.sh