docs/guides/onap-user/vfwcl-deployment-tutorial/index.rst

   1 .. This work is licensed under a Creative Commons Attribution 4.0
   2 .. International License. http://creativecommons.org/licenses/by/4.0
   3 .. Copyright © 2017-2021 Aarna Networks, Inc.
   4
   5 vFWCL deployment Tutorial
   6 #########################
   7
   8 Introduction
   9 ============
  10
  11 This tutorial describes the step by step instructions on how to achieve the control loop for vFW use case. Instructions in this tutorial will enable you to deploy the vfw control loop specific usecase.
  12
  13 vFW service components
  14 ~~~~~~~~~~~~~~~~~~~~~~
  15
  16 The vFW service is composed of the following components
  17
  18 vPKG VNF
  19
  20 - It is a packet generator which sends periodically different volumes of traffic to the sink through the firewall (vFw)
  21
  22 vFWSNK VNF
  23
  24 - Firewall: Reports the volume of traffic passing through to the DCAE collector (VES collector). The vFW has no real firewalling functionality.
  25 - Traffic sink: Provides a graphical representation (bar charts) showing the volume of incoming traffic.
  26
  27 The below block diagram shows about the components part of vFW usecase
  28
  29 |image25|
  30
  31 vFWCL service overview
  32 ~~~~~~~~~~~~~~~~~~~~~~
  33
  34 The vFW contol loop use case consists in applying policy rules that aim to re-adjust the traffic volume
  35 when high threshold (700 packets/10s) or low threshold (300 packets/10s) are crossed. In fact, the DCAE collects
  36 events from the vFW, applies analytics (Threshold Crossing Analytics: TCA microservice) and publishes events to DMaap.
  37 When detecting the triggering event, the policy engine executes the operational policy via the APP-C that modifies
  38 vPKG application configurations in order to adjust the traffic volume to 500 packet per 10 seconds.
  39
  40 The vFW control loop is based on VES (VNF Event Stream) reported measurements that TCA analyses and publishes
  41 related alams to DMaap. The policy has the responsibility for triggering ModifyConfig action that APPC executes
  42 on the target vnf (vPKG). All closed loop interactions are relying on the Message router (DMaap) by publishing
  43 topics and subscribing to them.
  44
  45 The ladder diagram below describes the components and their interactions that take place while running the vFWCL
  46
  47 |image53|
  48
  49 Prerequisite:
  50 vFW service design and deployment should be completed before following the steps of this tutorial
  51
  52 Refer the below tutorials for doing vFW service design and deployment
  53
  54 .. toctree::
  55    :maxdepth: 1
  56
  57    vFW Design Tutorial <../vfw-design-tutorial/index.rst>
  58    vFW Deployment Tutorial <../vfw-deployment-tutorial/index.rst>
  59
  60 Adding DCAE artifacts and policies
  61 ==================================
  62
  63 Follow the below steps to upload the blueprint for the TCA (Threshold Checking Application) DCAE microservice
  64 and Distribute the service to the CLAMP
  65
  66 1. Login as DESIGNER (cs0008) and create the service, checkin and certify
  67
  68 |image16|
  69
  70 2. Add any VNF (ex: vfw_pg) that was already created during the SDC design phase
  71
  72 In the composition canvas drag and drop a resource of type VF from the abstract section in the Elements section (left hand side panel)
  73
  74 |image15|
  75
  76 3. Download the required DCAE MS blueprint to be attached to the service
  77
  78 Use the sample TCA blueprint located here:
  79 https://git.onap.org/dcaegen2/platform/blueprints/tree/blueprints/k8s-tcagen2-clampnode.yaml
  80
  81 .. note::
  82   * Check if the version of the plugin used in the blueprint is different from existing, then update the blueprint import to match
  83   * To check the version run this: `cfy plugins list | grep k8splugin`
  84
  85 4. Now upload the Control Loop Artifact. The procedure to upload the artifact is
  86
  87  * Click on the VF, as in the picture above the ‘vsp_pg 0’ is selected
  88  * Click on ‘DEPLOYMENT ARTIFACTS’  and then click on “Add Artifact”
  89
  90  |image5|
  91
  92  * Fill the details and in the type select DCAE_INVENTORY_BLUEPRINT, then click on Done as in the picture shown below
  93
  94  |image13|
  95
  96 5. After uploading the DCAE artifact to the SDC Service, attach the policy model to the Service. From the left drop down,
  97 select TCA policy under Policies, and click on the Add policy
  98
  99 |image1|
 100
 101 6. Click on Checkin on top right corner then click OK
 102
 103 |image12|
 104
 105 7. Search and select the same service from CATALOG and click on Certify on top right corner
 106
 107 |image14|
 108
 109 8. Click Distribute to distribute the service, then click on Distribution in the left hand side panel and monitor until
 110 the distribution is complete. We should see artifacts deployed in CLAMP and Policy engine, as can be seen in the picture below
 111
 112 |image19|
 113
 114 At this point we can open the CLAMP GUI and verify that the DCAE microservice design template is in place
 115
 116 Deploy DCAE and Policy through CLAMP
 117 ====================================
 118
 119 CLAMP is a GUI tool which enables the users to design the policies, distribute them to the DROOLS engine and eventually deploy
 120 the DCAE microservices.
 121
 122 1. Add the necessary certificates in the browser to login to the CLAMP GUI
 123
 124 The default certificate can be found here: https://gerrit.onap.org/r/gitweb?p=clamp.git;a=blob;f=src/main/resources/clds/aaf/org.onap.clamp.p12;h=268aa1a3ce56e01448f8043cc0b05b5fceb5a47d;hb=HEAD
 125
 126 The password is:  "China in the Spring"
 127 The certificate must be loaded into your favorite browser before trying to load the CLAMP UI.
 128
 129 2. After the certificate is added, the CLAMP GUI can be accessed at:
 130 `https://<host_IP>:30258` (host_IP is the node IP where CLAMP is running)
 131
 132 3. Before designing the policy we need to undeploy the default tca policy.
 133 To undeploy default policy execute the below commands on control node
 134
 135 .. code-block::
 136
 137   > kubectl get deployments -n onap | grep "dep-dcae-tca-analytics\|dcaegen2-analytics-tca" | awk '{print $1}' |
 138     xargs kubectl delete deployments -n onap
 139   > kubectl get svc -n onap | grep "dcae-tca-analytics\|dcaegen2-analytics-tca" | awk '{print $1}' |
 140     xargs kubectl delete svc -n onap
 141     To Verify there are no dcae-analytics POD, run the below command
 142   > kubectl get pods -n onap | grep 'analytics'
 143
 144 4. If the service has been distributed correctly, following is how the service design templates
 145 listed in the Loop Templates as below
 146
 147 |image7|
 148
 149 Available Policy Models
 150
 151 |image10|
 152
 153 5. Create the loop from the templates distributed by SDC
 154
 155 |image4|
 156
 157 |image20|
 158
 159 6. Add the Operational Policy
 160 Click on Loop Instance drop down and select Modify then click, select the policy model type then click Add
 161
 162 |image9|
 163
 164 |image3|
 165
 166 7. Click on the MS application box and configure
 167 Fill the details in the pop up window and click on the save changes button.
 168
 169  A. Click on app and Edit the Policy details, fill the below details
 170
 171   * eventName: vFirewallBroadcastPackets
 172   * policyScope: DCAE
 173   * policyVersion: v0.0.1
 174   * Select controlLoopSchemaType as VM
 175   * policyName: DCAE.Config_tca-hi-lo
 176   * Select Pdp Group Info from the drop down as defaultGroup & xacm
 177
 178  |image17|
 179
 180  B. Click on the Add monitoring threshold1 button and fill the below details
 181
 182   * version : 1.0.2
 183   * closedLoopControlName : name of the CL (ex: LOOP_TEMPLATE_mytest_srv_v1_0_vsp_pg0_k8s-tca)
 184   * select the direction from dropdown (ex: LESS)
 185
 186  |image11|
 187
 188  C. Click on the Add monitoring threshold2 button and fill the details same as above then click on Save Changes button
 189
 190  |image24|
 191
 192 8. Click on the Operational policy box and configure
 193 Fill the details in the pop window then click on save changes
 194
 195 |image22|
 196
 197 |image18|
 198
 199 9. Submit the control loop to the policy
 200 From Loop Operations drop down select SUBMIT and click
 201
 202 |image23|
 203
 204 10. Deploy the control loop to DCAE
 205 From Loop Operations drop down select DEPLOY and click, verify the details and click Deploy
 206
 207 |image2|
 208
 209 |image8|
 210
 211 Status Logs
 212
 213 |image21|
 214
 215 A successful deployment will make the service as DEPLOYED
 216
 217 11. You can login into the control node and verify whether your new analytics application got deployed using below command
 218
 219 .. code-block::
 220
 221   > kubectl get pods -n onap | grep analytics
 222   Sample output
 223   dep-dcae-tca-analytics-7fccbf459-xkxlq             2/2     Running      0          6m15s
 224
 225   > cfy deployment  list | grep CLAMP
 226   Sample output
 227   | CLAMP_615bb47a-ea3e-4a02-8928-0564df900826 | CLAMP_615bb47a-ea3e-4a02-8928-0564df900826 | 2020-11-10 19:23:22.286  |
 228   2020-11-10 19:23:22.286  |   tenant   |   default_tenant |   admin    |
 229
 230 Robot heatbridge
 231 ================
 232
 233 Run the Robot heatbridge script to populate the vserver (OAM IP, VM flavor name, ID etc.) related information in AAI.
 234 This is required by APPC/SDNC for performing LCM operations.
 235
 236 Following is the command usage along with the example
 237
 238 ./demo-k8s.sh <namespace> heatbridge <stack_name> <service_instance_id> <service> <oam-ip-address>
 239
 240 .. note::
 241   The stack_name & oam-ip-address of the VNF VM can be obtained from OpenStack Horizon and service_instance_id from the VID screen
 242
 243 .. code-block::
 244
 245   ./demo-k8s.sh onap heatbridge vfw_sinc_vf e039b3d4-7ee5-4ad2-8108-ae31086ac7c0 vFW 172.29.249.157
 246   Number of parameters:
 247   6
 248   KEY:
 249   heatbridge
 250   ++ kubectl --namespace onap get pods
 251   ++ sed 's/ .*//'
 252   ++ grep robot
 253   + POD=dev-robot-58f85bb64d-zz5bh
 254   ++ dirname ./demo-k8s.sh
 255   + DIR=.
 256   + SCRIPTDIR=scripts/demoscript
 257   + ETEHOME=/var/opt/ONAP
 258   + '[' ']'
 259   ++ kubectl --namespace onap exec dev-robot-58f85bb64d-zz5bh -- bash -c 'ls -1q /share/logs/ | wc -l'
 260   + export GLOBAL_BUILD_NUMBER=13
 261   + GLOBAL_BUILD_NUMBER=13
 262   ++ printf %04d 13
 263   + OUTPUT_FOLDER=0013_demo_heatbridge
 264   + DISPLAY_NUM=103
 265   + VARIABLEFILES='-V /share/config/robot_properties.py'
 266   + kubectl --namespace onap exec dev-robot-58f85bb64d-zz5bh -- /var/opt/ONAP/runTags.sh -V /share/config/robot_properties.py -v HB_STACK:vfw_sinc_vf
 267   -v HB_VNF:e039b3d4-7ee5-4ad2-8108-ae31086ac7c0 -v HB_VNF:vFW -v HB_SERVICE:vFW -v HB_IPV4_OAM_ADDRESS:172.29.249.157 -d /share/logs/0013_demo_heatbridge
 268   -i heatbridge --display 103
 269   Starting Xvfb on display :103 with res 1280x1024x24
 270   Executing robot tests at log level TRACE
 271   ==============================================================================
 272   Testsuites
 273   ==============================================================================
 274   Testsuites.Demo :: Executes the VNF Orchestration Test cases including setu...
 275   ==============================================================================
 276   Run Heatbridge :: Try to run heatbridge                               | PASS |
 277   ------------------------------------------------------------------------------
 278   Testsuites.Demo :: Executes the VNF Orchestration Test cases inclu... | PASS |
 279   1 critical test, 1 passed, 0 failed
 280   1 test total, 1 passed, 0 failed
 281   ==============================================================================
 282   Testsuites                                                            | PASS |
 283   1 critical test, 1 passed, 0 failed
 284   1 test total, 1 passed, 0 failed
 285   ==============================================================================
 286   Output:  /share/logs/0013_demo_heatbridge/output.xml
 287   Log:     /share/logs/0013_demo_heatbridge/log.html
 288   Report:  /share/logs/0013_demo_heatbridge/report.html
 289
 290 Update the operational policy
 291 =============================
 292
 293 1. GET the modelInvariantID of vPG
 294
 295 Following is the command usage along with the sample output
 296
 297 .. code-block::
 298
 299   curl -k -X GET https://<kubernetes-host>:30233/aai/v11/network/generic-vnfs/ -H 'Accept: application/json' -H 'Authorization: Basic QUFJOkFBSQ==' -H ' Content-Type: application/json' -H 'X-FromAppId: Postman' -H 'X-TransactionId: get_generic_vnf' | jq
 300
 301   {
 302   "generic-vnf": [
 303     {
 304       "vnf-id": "edc085e8-5088-4b73-bcdc-b8b0bf5e528b",
 305       "vnf-name": "vfw_vpg_vnf",
 306       "vnf-type": "vFWCL_service/vsp_vpg 0",
 307       "service-id": "929190d1-fed1-4dff-883f-f0ede779065e",
 308       "prov-status": "PREPROV",
 309       "orchestration-status": "Created",
 310       "in-maint": false,
 311       "is-closed-loop-disabled": false,
 312       "resource-version": "1609783281808",
 313       "model-invariant-id": "7d4fef5e-f9b0-4e03-a653-712d6630f389",
 314       "model-version-id": "a248f68e-c1f2-4b25-8120-c4f7310b0d1e",
 315       "model-customization-id": "cf0019db-f51f-472a-996d-9da19d41f7b4",
 316       "relationship-list": {
 317         "relationship": [
 318           {
 319             "related-to": "service-instance",
 320             "related-link": "/aai/v11/business/customers/customer/Demonstration/service-subscriptions/service-subscription/vFWCL/service-instances/service-  instance/e039b3d4-7ee5-4ad2-8108-ae31086ac7c0",
 321             "relationship-data": [
 322               {
 323                 "relationship-key": "customer.global-customer-id",
 324                 "relationship-value": "Demonstration"
 325               },
 326               {
 327                 "relationship-key": "service-subscription.service-type",
 328                 "relationship-value": "vFWCL"
 329               },
 330               {
 331                 "relationship-key": "service-instance.service-instance-id",
 332                 "relationship-value": "e039b3d4-7ee5-4ad2-8108-ae31086ac7c0"
 333               }
 334             ],
 335             "related-to-property": [
 336               {
 337                 "property-key": "service-instance.service-instance-name",
 338                 "property-value": "vFWCL_srv_00"
 339               }
 340             ]
 341           },
 342           {
 343             "related-to": "platform",
 344             "related-link": "/aai/v11/business/platforms/platform/Platform-Demonstration",
 345             "relationship-data": [
 346               {
 347                 "relationship-key": "platform.platform-name",
 348                 "relationship-value": "Platform-Demonstration"
 349               }
 350             ]
 351           },
 352           {
 353             "related-to": "line-of-business",
 354             "related-link": "/aai/v11/business/lines-of-business/line-of-business/LOB-Demonstration",
 355             "relationship-data": [
 356               {
 357                 "relationship-key": "line-of-business.line-of-business-name",
 358                 "relationship-value": "LOB-Demonstration"
 359               }
 360             ]
 361           }
 362         ]
 363       }
 364     },
 365     {
 366       "vnf-id": "816040b6-d9bf-43ba-b852-e31e21a0a5f4",
 367       "vnf-name": "vfw_sinc_vnf",
 368       "vnf-type": "vFWCL_service/vsp_sinc 0",
 369       "service-id": "929190d1-fed1-4dff-883f-f0ede779065e",
 370       "prov-status": "ACTIVE",
 371       "orchestration-status": "Active",
 372       "in-maint": false,
 373       "is-closed-loop-disabled": false,
 374       "resource-version": "1609788164862",
 375       "model-invariant-id": "4d432903-4338-48ae-a105-47c0c8d19193",
 376       "model-version-id": "86b98636-150b-4f1c-a768-61e6c43a3199",
 377       "model-customization-id": "d3671119-5b65-40ed-abea-d1fe0d09c3ba",
 378       "relationship-list": {
 379         "relationship": [
 380           {
 381             "related-to": "vserver",
 382             "related-link": "/aai/v11/cloud-infrastructure/cloud-regions/cloud-  region/CloudOwner/RegionOne/tenants/tenant/747a01548b494670892413c496c1c250/vservers/vserver/3353a853-87cc-47cc-9e6a-4f45b6dc580f",
 383             "relationship-data": [
 384               {
 385                 "relationship-key": "cloud-region.cloud-owner",
 386                 "relationship-value": "CloudOwner"
 387               },
 388               {
 389                 "relationship-key": "cloud-region.cloud-region-id",
 390                 "relationship-value": "RegionOne"
 391               },
 392               {
 393                 "relationship-key": "tenant.tenant-id",
 394                 "relationship-value": "747a01548b494670892413c496c1c250"
 395               },
 396               {
 397                 "relationship-key": "vserver.vserver-id",
 398                 "relationship-value": "3353a853-87cc-47cc-9e6a-4f45b6dc580f"
 399               }
 400             ],
 401             "related-to-property": [
 402               {
 403                 "property-key": "vserver.vserver-name",
 404                 "property-value": "zdfw1fwl01snk01"
 405               }
 406             ]
 407           },
 408           {
 409             "related-to": "vserver",
 410             "related-link": "/aai/v11/cloud-infrastructure/cloud-regions/cloud-  region/CloudOwner/RegionOne/tenants/tenant/747a01548b494670892413c496c1c250/vservers/vserver/642b5709-4f3d-405b-bcb2-dc82884cb8de",
 411             "relationship-data": [
 412               {
 413                 "relationship-key": "cloud-region.cloud-owner",
 414                 "relationship-value": "CloudOwner"
 415               },
 416               {
 417                 "relationship-key": "cloud-region.cloud-region-id",
 418                 "relationship-value": "RegionOne"
 419               },
 420               {
 421                 "relationship-key": "tenant.tenant-id",
 422                 "relationship-value": "747a01548b494670892413c496c1c250"
 423               },
 424               {
 425                 "relationship-key": "vserver.vserver-id",
 426                 "relationship-value": "642b5709-4f3d-405b-bcb2-dc82884cb8de"
 427               }
 428             ],
 429             "related-to-property": [
 430               {
 431                 "property-key": "vserver.vserver-name",
 432                 "property-value": "zdfw1fwl01fwl01"
 433               }
 434             ]
 435           },
 436           {
 437             "related-to": "service-instance",
 438             "related-link": "/aai/v11/business/customers/customer/Demonstration/service-subscriptions/service-subscription/vFWCL/service-instances/service-  instance/e039b3d4-7ee5-4ad2-8108-ae31086ac7c0",
 439             "relationship-data": [
 440               {
 441                 "relationship-key": "customer.global-customer-id",
 442                 "relationship-value": "Demonstration"
 443               },
 444               {
 445                 "relationship-key": "service-subscription.service-type",
 446                 "relationship-value": "vFWCL"
 447               },
 448               {
 449                 "relationship-key": "service-instance.service-instance-id",
 450                 "relationship-value": "e039b3d4-7ee5-4ad2-8108-ae31086ac7c0"
 451               }
 452             ],
 453             "related-to-property": [
 454               {
 455                 "property-key": "service-instance.service-instance-name",
 456                 "property-value": "vFWCL_srv_00"
 457               }
 458             ]
 459           },
 460           {
 461             "related-to": "platform",
 462             "related-link": "/aai/v11/business/platforms/platform/Platform-Demonstration",
 463             "relationship-data": [
 464               {
 465                 "relationship-key": "platform.platform-name",
 466                 "relationship-value": "Platform-Demonstration"
 467               }
 468             ]
 469           },
 470           {
 471             "related-to": "line-of-business",
 472             "related-link": "/aai/v11/business/lines-of-business/line-of-business/LOB-Demonstration",
 473             "relationship-data": [
 474               {
 475                 "relationship-key": "line-of-business.line-of-business-name",
 476                 "relationship-value": "LOB-Demonstration"
 477               }
 478             ]
 479           }
 480         ]
 481       }
 482     }
 483   ]
 484   }
 485
 486 2. Get the Operational policy name and version
 487
 488 Following is the command usage and the sample output
 489
 490 .. code-block::
 491
 492   curl -k -u 'healthcheck:zb!XztG34' -X GET -H 'Accept:application/json' https://<kubernetes-host>:6969/policy/pap/v1/pdps
 493
 494   #sample command and output
 495   curl  -k -u 'healthcheck:zb!XztG34' -X GET -H 'Accept:application/json' https://10.43.244.213:6969/policy/pap/v1/pdps | jq
 496   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
 497                                  Dload  Upload   Total   Spent    Left  Speed
 498   100  2678  100  2678    0     0   7695      0 --:--:-- --:--:-- --:--:--  7695
 499   {
 500   "groups": [
 501     {
 502       "name": "defaultGroup",
 503       "description": "The default group that registers all supported policy types and pdps.",
 504       "pdpGroupState": "ACTIVE",
 505       "properties": {},
 506       "pdpSubgroups": [
 507         {
 508           "pdpType": "apex",
 509           "supportedPolicyTypes": [
 510             {
 511               "name": "onap.policies.controlloop.operational.Apex",
 512               "version": "1.0.0"
 513             },
 514             {
 515               "name": "onap.policies.controlloop.operational.common.Apex",
 516               "version": "1.0.0"
 517             },
 518             {
 519               "name": "onap.policies.native.Apex",
 520               "version": "1.0.0"
 521             }
 522           ],
 523           "policies": [],
 524           "currentInstanceCount": 1,
 525           "desiredInstanceCount": 1,
 526           "properties": {},
 527           "pdpInstances": [
 528             {
 529               "instanceId": "dev-policy-apex-pdp-0",
 530               "pdpState": "ACTIVE",
 531               "healthy": "HEALTHY",
 532               "message": "Pdp Heartbeat"
 533             }
 534           ]
 535         },
 536         {
 537           "pdpType": "drools",
 538           "supportedPolicyTypes": [
 539             {
 540               "name": "onap.policies.controlloop.Operational",
 541               "version": "1.0.0"
 542             },
 543             {
 544               "name": "onap.policies.controlloop.operational.common.Drools",
 545               "version": "1.0.0"
 546             },
 547             {
 548               "name": "onap.policies.native.drools.Controller",
 549               "version": "1.0.0"
 550             },
 551             {
 552               "name": "onap.policies.native.drools.Artifact",
 553               "version": "1.0.0"
 554             }
 555           ],
 556           "policies": [],
 557           "currentInstanceCount": 1,
 558           "desiredInstanceCount": 1,
 559           "properties": {},
 560           "pdpInstances": [
 561             {
 562               "instanceId": "dev-drools-0",
 563               "pdpState": "ACTIVE",
 564               "healthy": "HEALTHY"
 565             }
 566           ]
 567         },
 568         {
 569           "pdpType": "xacml",
 570           "supportedPolicyTypes": [
 571             {
 572               "name": "onap.policies.controlloop.guard.common.FrequencyLimiter",
 573               "version": "1.0.0"
 574             },
 575             {
 576               "name": "onap.policies.controlloop.guard.common.MinMax",
 577               "version": "1.0.0"
 578             },
 579             {
 580               "name": "onap.policies.controlloop.guard.common.Blacklist",
 581               "version": "1.0.0"
 582             },
 583             {
 584               "name": "onap.policies.controlloop.guard.coordination.FirstBlocksSecond",
 585               "version": "1.0.0"
 586             },
 587             {
 588               "name": "onap.policies.monitoring.*",
 589               "version": "1.0.0"
 590             },
 591             {
 592               "name": "onap.policies.optimization.*",
 593               "version": "1.0.0"
 594             },
 595             {
 596               "name": "onap.policies.optimization.resource.AffinityPolicy",
 597               "version": "1.0.0"
 598             },
 599             {
 600               "name": "onap.policies.optimization.resource.DistancePolicy",
 601               "version": "1.0.0"
 602             },
 603             {
 604               "name": "onap.policies.optimization.resource.HpaPolicy",
 605               "version": "1.0.0"
 606             },
 607             {
 608               "name": "onap.policies.optimization.resource.OptimizationPolicy",
 609               "version": "1.0.0"
 610             },
 611             {
 612               "name": "onap.policies.optimization.resource.PciPolicy",
 613               "version": "1.0.0"
 614             },
 615             {
 616               "name": "onap.policies.optimization.service.QueryPolicy",
 617               "version": "1.0.0"
 618             },
 619             {
 620               "name": "onap.policies.optimization.service.SubscriberPolicy",
 621               "version": "1.0.0"
 622             },
 623             {
 624               "name": "onap.policies.optimization.resource.Vim_fit",
 625               "version": "1.0.0"
 626             },
 627             {
 628               "name": "onap.policies.optimization.resource.VnfPolicy",
 629               "version": "1.0.0"
 630             },
 631             {
 632               "name": "onap.policies.native.Xacml",
 633               "version": "1.0.0"
 634             },
 635             {
 636               "name": "onap.policies.Naming",
 637               "version": "1.0.0"
 638             }
 639           ],
 640           "policies": [
 641             {
 642               "name": "SDNC_Policy.ONAP_NF_NAMING_TIMESTAMP",
 643               "version": "1.0.0"
 644             }
 645           ],
 646           "currentInstanceCount": 1,
 647           "desiredInstanceCount": 1,
 648           "properties": {},
 649           "pdpInstances": [
 650             {
 651               "instanceId": "dev-policy-xacml-pdp-6c5f6db887-zkh6h",
 652               "pdpState": "ACTIVE",
 653               "healthy": "HEALTHY"
 654             }
 655           ]
 656         }
 657       ]
 658     }
 659   ]
 660   }
 661
 662 3. Remove the vFW Policy from PDP
 663
 664 Following is the command usage
 665
 666 .. code-block::
 667
 668   POLICY_ID = "OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6"
 669   POLICY_VERSION = "1.0.0"
 670
 671   curl -k -u 'healthcheck:zb!XztG34' -X DELETE -H 'Content-Type:application/json' https://<kubernetes-host>:6969/policy/pap/v1/pdps/policies/$POLICY_ID/versions/$POLICY_VERSION
 672
 673 4. Get latest policy
 674
 675 Following is the command usage and sample output
 676
 677 .. code-block::
 678
 679   POLICY_TYPEID="onap.policies.controlloop.operational.common.Drools"
 680   VERSIONID='1.0.0'
 681   POLICY_ID="OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6"
 682
 683   curl -k -u 'healthcheck:zb!XztG34' -X GET -H 'Accept:application/json' https://<kubernetes-host>:6969/policy/api/v1/policytypes/$POLICY_TYPEID/versions/$VERSIONID/policies/$POLICY_ID/versions/latest > operational_policy_template.json
 684
 685 5. Update this policy in the policy DB
 686
 687 Following is the command usage and sample output
 688
 689 .. code-block::
 690
 691   POLICY_TYPEID="onap.policies.controlloop.operational.common.Drools"
 692   VERSIONID='1.0.0'
 693
 694   curl -k -u 'healthcheck:zb!XztG34' -X POST -H 'Content-Type:application/json' --data @./operational_policy_template.json https://<kubernetes-host>:6969/policy/api/v1/policytypes/$POLICY_TYPEID/versions/$VERSIONID/policies
 695
 696   {
 697         "tosca_definitions_version": "tosca_simple_yaml_1_1_0",
 698         "topology_template": {
 699                 "policies": [{
 700                         "OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6": {
 701                                 "type": "onap.policies.controlloop.operational.common.Drools",
 702                                 "type_version": "1.0.0",
 703                                 "properties": {
 704                                         "abatement": true,
 705                                         "operations": [{
 706                                                 "failure_retries": "final_failure_retries",
 707                                                 "id": "ModifyConfig",
 708                                                 "failure_timeout": "final_failure_timeout",
 709                                                 "failure": "final_failure",
 710                                                 "operation": {
 711                                                         "payload": {
 712                                                                 "active-streams": 5
 713                                                         },
 714                                                         "target": {
 715                                                                 "entityIds": {
 716                                                                         "resourceID": "7d4fef5e-f9b0-4e03-a653-712d6630f389"
 717                                                                 },
 718                                                                 "targetType": "VNF"
 719                                                         },
 720                                                         "actor": "APPC",
 721                                                         "operation": "ModifyConfig"
 722                                                 },
 723                                                 "failure_guard": "final_failure_guard",
 724                                                 "retries": 3,
 725                                                 "timeout": 3600,
 726                                                 "failure_exception": "final_failure_exception",
 727                                                 "description": "ModifyConfig",
 728                                                 "success": "final_success"
 729                                         }],
 730                                         "trigger": "ModifyConfig",
 731                                         "timeout": 3600,
 732                                         "id": "LOOP_tca"
 733                                 },
 734                                 "name": "OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6",
 735                                 "version": "1.0.0",
 736                                 "metadata": {
 737                                         "policy-id": "OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6",
 738                                         "policy-version": "1.0.0"
 739                                 }
 740                         }
 741                 }]
 742         },
 743         "name": "ToscaServiceTemplateSimple",
 744         "version": "1.0.0",
 745         "metadata": {}
 746   }
 747
 748 6. Deploy this version of the policy using PAP API
 749
 750 Prepare the payload for the deployment API by naming the file as pap_template.json. The contents are policy name, version and command usage as below
 751
 752 .. code-block::
 753
 754   cat pap_template.json
 755   {
 756     "policies" : [
 757      {
 758        "policy-id": "OPERATIONAL_dcae_service_v1_0_Drools_1_0_0_of6",
 759        "policy-version": "3"
 760      }
 761      ]
 762   }
 763
 764   curl -k -u 'healthcheck:zb!XztG34' -X POST --data @./pap_template.json -H 'Content-Type:application/json' https://<kubernetes-host>:6969/policy/pap/v1/pdps/policies
 765
 766 Set network topology for vPG in APPC
 767 ====================================
 768
 769 1. Enable direct access to vFW PG VNF instance from control node
 770
 771 .. note::
 772    These steps are applicable only when your openstack instance is running on the GCP
 773
 774    You can refer to `Google Cloud Docs <https://cloud.google.com/vpc/docs/configure-alias-ip-ranges>`_ to find
 775    more details about how to add IP alias to a running GCP instance
 776
 777 Execute the below commands from your laptop using gcloud CLI
 778
 779 a. Find the Default interface name and primary internal IP for the GCP instance
 780
 781 .. code-block::
 782
 783   gcloud compute instances describe openstack-01 | grep 'nic\|networkIP'
 784
 785   #sample command output
 786   name: nic0
 787   networkIP: 10.128.0.43
 788
 789 b. For the Default interface nic0 add an IP alias from the default subnet
 790
 791 .. code-block::
 792
 793   gcloud compute instances network-interfaces update openstack-01 \
 794     --zone us-central1-f \
 795     --network-interface nic0 \
 796     --aliases "/30"
 797
 798   # sample output
 799   Updating network interface [nic0] of instance [openstack-01]...done
 800
 801 c. Verify if the instance has got a new IP alias
 802
 803 .. code-block::
 804
 805   gcloud compute instances describe openstack-01 | grep 'nic\|networkIP\|aliasIpRanges\|ipCidrRange'
 806
 807   # from the output note down the IP alias ipCidrRange attribute that you will need it inplace
 808   aliasIpRanges:
 809   ipCidrRange: 10.128.0.124/30
 810   name: nic0
 811   networkIP: 10.128.0.22
 812
 813 2. Map openstack-01 GCP IP alias to vFW PG VNF openstack instance public IP
 814
 815 a. SSH into GCP openstack-01  VM instance and verify if you can see the new IP alias in the routing table
 816
 817 .. code-block::
 818
 819   ip route show table local | grep '/30'
 820
 821   # sample output
 822   local 10.128.0.112/30 dev eth0 proto 66 scope host
 823
 824 b. Find the vFW packet generator public / external network IP address
 825
 826 Run the below command on the openstack instance
 827
 828 .. code-block::
 829
 830   openstack server list
 831   # sample output
 832   | ID | Name | Status | Networks | Image  | Flavor  |
 833   | 1faa6593-7e9e-452d-a5dc-1536e18e4b94 | zdfw1fwl01pgn01 | ACTIVE | OAM_NETWORK=10.10.10.12; public=172.29.249.200;
 834   zdfw1fwl01_unprotected=192.168.10.200| trusty | m1.medium |
 835
 836 c. Now update openstack-01 GCP instance iptables to forward the traffic to vFW PG VNF VM
 837
 838 Below are the commands to forward all traffic reaching to IP alias (ex: 10.128.0.112/30)
 839 to vFW PG VNF VM (ex:zdfw1fwl01pgn01) instance public IP (ex:172.29.249.200)
 840
 841 .. code-block::
 842
 843   # DNAT rule update
 844   sudo iptables -t nat -I PREROUTING -d 10.128.0.112 -j DNAT --to-destination 172.29.249.200
 845   sudo iptables -t nat -I POSTROUTING -s 172.29.249.200 -j MASQUERADE
 846
 847   # Update INPUT, FORWARD AND OUTPUT chain to allow traffic for all ports
 848   sudo iptables -I INPUT 1 -p udp -j ACCEPT
 849   sudo iptables -I FORWARD 1 -p tcp -j ACCEPT
 850   sudo iptables -I OUTPUT 1 -p tcp -j ACCEPT
 851   sudo iptables -I OUTPUT 1 -p udp -j ACCEPT
 852
 853 d. Verify if you can access vFW PG instance from the control node
 854
 855 SSH into vFW PG VNF instance using the openstack-01 GCP IP alias, it should connect to the vFW PG VNF instance
 856
 857 3. Mount APPC
 858
 859 a. Get the VNF instance ID, either through VID or through AAI. Below the AAI request
 860
 861 Search for the vnf-name as vfw_pg_vsp_002-1 from the output of the below command and find the corresponding vnf-id,
 862 the value is: a1ca05b4-3231-4e4a-a09c-74f2292fe577
 863
 864 .. code-block::
 865
 866   curl -X GET   https://<kubernetes-host>:30233/aai/v8/network/generic-vnfs/   -H 'Accept: application/json'   -H 'Authorization: Basic QUFJOkFBSQ=='   -H 'Content-Type:application/json' -H 'X-FromAppId: Postman' -H 'X-TransactionId: get_generic_vnf' -k
 867
 868   {
 869         "generic-vnf": [{
 870                 "vnf-id": "a1ca05b4-3231-4e4a-a09c-74f2292fe577",
 871                 "vnf-name": "vfw_pg_vsp_002-1",
 872                 "vnf-type": "vfw-service-002/vfw_pg_vsp_002 0",
 873                 "service-id": "f18af052-6dfb-40e8-ad25-f060eb898f53",
 874                 "prov-status": "ACTIVE",
 875                 "orchestration-status": "Active",
 876                 "in-maint": false,
 877                 "is-closed-loop-disabled": false,
 878                 "resource-version": "1617776160138",
 879                 "model-invariant-id": "7a347a5a-8f3f-416c-81f3-13b30631c1e6",
 880                 "model-version-id": "f988048a-b4f4-4f5e-aa7c-fdaa0d7ea017",
 881                 "model-customization-id": "601d5d68-fbbe-4c1f-a624-08a3445ae8fe",
 882                 "relationship-list": {
 883                         "relationship": [{
 884                                 "related-to": "service-instance",
 885                                 "relationship-label": "org.onap.relationships.inventory.ComposedOf",
 886                                 "related-link": "/aai/v16/business/customers/customer/Demonstration/service-subscriptions/service-subscription/vFW/service-instances/service-instance/6f294c8f-ac67-4b33-9e56-014fb63791a5",
 887                                 "relationship-data": [{
 888                                         "relationship-key": "customer.global-customer-id",
 889                                         "relationship-value": "Demonstration"
 890                                 }, {
 891                                         "relationship-key": "service-subscription.service-type",
 892                                         "relationship-value": "vFW"
 893                                 }, {
 894                                         "relationship-key": "service-instance.service-instance-id",
 895                                         "relationship-value": "6f294c8f-ac67-4b33-9e56-014fb63791a5"
 896                                 }],
 897                                 "related-to-property": [{
 898                                         "property-key": "service-instance.service-instance-name",
 899                                         "property-value": "vfw-service-002-1"
 900                                 }]
 901                         }, {
 902                                 "related-to": "platform",
 903                                 "relationship-label": "org.onap.relationships.inventory.Uses",
 904                                 "related-link": "/aai/v16/business/platforms/platform/Platform-Demonstration",
 905                                 "relationship-data": [{
 906                                         "relationship-key": "platform.platform-name",
 907                                         "relationship-value": "Platform-Demonstration"
 908                                 }]
 909                         }, {
 910                                 "related-to": "line-of-business",
 911                                 "relationship-label": "org.onap.relationships.inventory.Uses",
 912                                 "related-link": "/aai/v16/business/lines-of-business/line-of-business/LOB-Demonstration",
 913                                 "relationship-data": [{
 914                                         "relationship-key": "line-of-business.line-of-business-name",
 915                                         "relationship-value": "LOB-Demonstration"
 916                                 }]
 917                         }, {
 918                                 "related-to": "vserver",
 919                                 "relationship-label": "tosca.relationships.HostedOn",
 920                                 "related-link": "/aai/v16/cloud-infrastructure/cloud-regions/cloud-region/CloudOwner/RegionOne/tenants/tenant/759425709b7a4b3ca257d3f93ef4e91e/vservers/vserver/856aed6e-cc25-4819-a03d-5549f5fe8662",
 921                                 "relationship-data": [{
 922                                         "relationship-key": "cloud-region.cloud-owner",
 923                                         "relationship-value": "CloudOwner"
 924                                 }, {
 925                                         "relationship-key": "cloud-region.cloud-region-id",
 926                                         "relationship-value": "RegionOne"
 927                                 }, {
 928                                         "relationship-key": "tenant.tenant-id",
 929                                         "relationship-value": "759425709b7a4b3ca257d3f93ef4e91e"
 930                                 }, {
 931                                         "relationship-key": "vserver.vserver-id",
 932                                         "relationship-value": "856aed6e-cc25-4819-a03d-5549f5fe8662"
 933                                 }],
 934                                 "related-to-property": [{
 935                                         "property-key": "vserver.vserver-name",
 936                                         "property-value": "zdfw1fwl01pgn01"
 937                                 }]
 938                         }]
 939                 }
 940         }, {
 941                 "vnf-id": "be9e190e-a20c-4900-8074-cffec77131f1",
 942                 "vnf-name": "vfw_sinc_vsp_002-1",
 943                 "vnf-type": "vfw-service-002/vfw_sinc_vsp_002 0",
 944                 "service-id": "f18af052-6dfb-40e8-ad25-f060eb898f53",
 945                 "prov-status": "ACTIVE",
 946                 "orchestration-status": "Active",
 947                 "in-maint": false,
 948                 "is-closed-loop-disabled": false,
 949                 "resource-version": "1617776104234",
 950                 "model-invariant-id": "9b25321d-9260-4739-97f8-7c85fba4e755",
 951                 "model-version-id": "c785c203-9c39-4b6a-9c2e-f24bb8d4d92d",
 952                 "model-customization-id": "a1e0ddf7-5d50-43a4-a6f1-0bfde3c1de78",
 953                 "relationship-list": {
 954                         "relationship": [{
 955                                 "related-to": "service-instance",
 956                                 "relationship-label": "org.onap.relationships.inventory.ComposedOf",
 957                                 "related-link": "/aai/v16/business/customers/customer/Demonstration/service-subscriptions/service-subscription/vFW/service-instances/service-instance/6f294c8f-ac67-4b33-9e56-014fb63791a5",
 958                                 "relationship-data": [{
 959                                         "relationship-key": "customer.global-customer-id",
 960                                         "relationship-value": "Demonstration"
 961                                 }, {
 962                                         "relationship-key": "service-subscription.service-type",
 963                                         "relationship-value": "vFW"
 964                                 }, {
 965                                         "relationship-key": "service-instance.service-instance-id",
 966                                         "relationship-value": "6f294c8f-ac67-4b33-9e56-014fb63791a5"
 967                                 }],
 968                                 "related-to-property": [{
 969                                         "property-key": "service-instance.service-instance-name",
 970                                         "property-value": "vfw-service-002-1"
 971                                 }]
 972                         }, {
 973                                 "related-to": "platform",
 974                                 "relationship-label": "org.onap.relationships.inventory.Uses",
 975                                 "related-link": "/aai/v16/business/platforms/platform/Platform-Demonstration",
 976                                 "relationship-data": [{
 977                                         "relationship-key": "platform.platform-name",
 978                                         "relationship-value": "Platform-Demonstration"
 979                                 }]
 980                         }, {
 981                                 "related-to": "line-of-business",
 982                                 "relationship-label": "org.onap.relationships.inventory.Uses",
 983                                 "related-link": "/aai/v16/business/lines-of-business/line-of-business/LOB-Demonstration",
 984                                 "relationship-data": [{
 985                                         "relationship-key": "line-of-business.line-of-business-name",
 986                                         "relationship-value": "LOB-Demonstration"
 987                                 }]
 988                         }, {
 989                                 "related-to": "vserver",
 990                                 "relationship-label": "tosca.relationships.HostedOn",
 991                                 "related-link": "/aai/v16/cloud-infrastructure/cloud-regions/cloud-region/CloudOwner/RegionOne/tenants/tenant/759425709b7a4b3ca257d3f93ef4e91e/vservers/vserver/30dd6250-8a74-4ed7-9729-6ce7190c6661",
 992                                 "relationship-data": [{
 993                                         "relationship-key": "cloud-region.cloud-owner",
 994                                         "relationship-value": "CloudOwner"
 995                                 }, {
 996                                         "relationship-key": "cloud-region.cloud-region-id",
 997                                         "relationship-value": "RegionOne"
 998                                 }, {
 999                                         "relationship-key": "tenant.tenant-id",
1000                                         "relationship-value": "759425709b7a4b3ca257d3f93ef4e91e"
1001                                 }, {
1002                                         "relationship-key": "vserver.vserver-id",
1003                                         "relationship-value": "30dd6250-8a74-4ed7-9729-6ce7190c6661"
1004                                 }],
1005                                 "related-to-property": [{
1006                                         "property-key": "vserver.vserver-name",
1007                                         "property-value": "vfw_sinc_vsp_002-1"
1008                                 }]
1009                         }, {
1010                                 "related-to": "vserver",
1011                                 "relationship-label": "tosca.relationships.HostedOn",
1012                                 "related-link": "/aai/v16/cloud-infrastructure/cloud-regions/cloud-region/CloudOwner/RegionOne/tenants/tenant/759425709b7a4b3ca257d3f93ef4e91e/vservers/vserver/9ab8d517-2b1c-4d31-a04c-0fe2f8396815",
1013                                 "relationship-data": [{
1014                                         "relationship-key": "cloud-region.cloud-owner",
1015                                         "relationship-value": "CloudOwner"
1016                                 }, {
1017                                         "relationship-key": "cloud-region.cloud-region-id",
1018                                         "relationship-value": "RegionOne"
1019                                 }, {
1020                                         "relationship-key": "tenant.tenant-id",
1021                                         "relationship-value": "759425709b7a4b3ca257d3f93ef4e91e"
1022                                 }, {
1023                                         "relationship-key": "vserver.vserver-id",
1024                                         "relationship-value": "9ab8d517-2b1c-4d31-a04c-0fe2f8396815"
1025                                 }],
1026                                 "related-to-property": [{
1027                                         "property-key": "vserver.vserver-name",
1028                                         "property-value": "zdfw1fwl01snk01"
1029                                 }]
1030                         }]
1031                 }
1032         }]
1033   }
1034
1035 b. Get the public IP address of the Packet Generator VM from your deployment
1036
1037 c. To mount APPC, run the below command by replacing <vnf-id> and <vnf-ip> with the values obtained from the above steps (a) & (b) respectively
1038
1039 .. code-block::
1040
1041   curl -X PUT \
1042    http://<kubernetes-host>:30230/restconf/config/network-topology:network-topology/topology/topology-netconf/node/<vnf-id> \
1043   -H 'Accept: application/xml' \
1044   -H 'Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ==' \
1045   -H 'Content-Type: text/xml' \
1046   -d '<node xmlns="urn:TBD:params:xml:ns:yang:network-topology">
1047    <node-id><vnf-id></node-id>
1048    <host xmlns="urn:opendaylight:netconf-node-topology"><vnf-ip></host>
1049    <port xmlns="urn:opendaylight:netconf-node-topology">830</port>
1050    <username xmlns="urn:opendaylight:netconf-node-topology">netconf</username>
1051    <password xmlns="urn:opendaylight:netconf-node-topology">netconf</password>
1052    <tcp-only xmlns="urn:opendaylight:netconf-node-topology">false</tcp-only>
1053    </node>'
1054
1055   #smaple command and output:
1056   curl -vvv -X PUT   http://192.168.122.99:30230/restconf/config/network-topology:network-topology/topology/topology-netconf/node/a1ca05b4-3231-4e4a-a09c-74f2292fe577   -H 'Accept: application/xml'   -H 'Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ=='   -H 'Content-Type: text/xml'   -d '<node xmlns="urn:TBD:params:xml:ns:yang:network-topology"> <node-id>a1ca05b4-3231-4e4a-a09c-74f2292fe577</node-id> <host xmlns="urn:opendaylight:netconf-node-topology">192.168.122.238</host> <port xmlns="urn:opendaylight:netconf-node-topology">830</port> <username xmlns="urn:opendaylight:netconf-node-topology">netconf</username> <password xmlns="urn:opendaylight:netconf-node-topology">netconf</password> <tcp-only xmlns="urn:opendaylight:netconf-node-topology">false</tcp-only> </node>'
1057   *   Trying 192.168.122.99...
1058   * TCP_NODELAY set
1059   * Connected to 192.168.122.99 (192.168.122.99) port 30230 (#0)
1060   > PUT /restconf/config/network-topology:network-topology/topology/topology-netconf/node/a1ca05b4-3231-4e4a-a09c-74f2292fe577 HTTP/1.1
1061   > Host: 192.168.122.99:30230
1062   > User-Agent: curl/7.58.0
1063   > Accept: application/xml
1064   > Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ==
1065   > Content-Type: text/xml
1066   > Content-Length: 488
1067   >
1068   * upload completely sent off: 488 out of 488 bytes
1069   < HTTP/1.1 200 OK
1070   < Content-Length: 0
1071   <
1072   * Connection #0 to host 192.168.122.99 left intact
1073
1074 d. To verify the NETCONF connection has successfully being established, run the following request (replace <vnd-id> with yours)
1075
1076 .. code-block::
1077
1078   curl -X GET \
1079   http://<kubernetes-host>:30230/restconf/operational/network-topology:network-topology/topology/topology-netconf/node/<vnf-id> \
1080   -H 'Accept: application/json' \
1081   -H 'Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ=='
1082
1083   #smaple command and output:
1084   curl -X GET   http://192.168.122.99:30230/restconf/operational/network-topology:network-topology/topology/topology-netconf/node/a1ca05b4-3231-4e4a-a09c-74f2292fe577    -H 'Accept: application/json'   -H 'Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ==' | jq
1085   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
1086                                  Dload  Upload   Total   Spent    Left  Speed
1087   100  5368  100  5368    0     0   374k      0 --:--:-- --:--:-- --:--:--  374k
1088   {
1089   "node": [
1090     {
1091       "node-id": "a1ca05b4-3231-4e4a-a09c-74f2292fe577",
1092       "netconf-node-topology:unavailable-capabilities": {},
1093       "netconf-node-topology:available-capabilities": {
1094         "available-capability": [
1095           {
1096             "capability-origin": "device-advertised",
1097             "capability": "urn:ietf:params:netconf:capability:yang-library:1.0?revision=2018-01-17&module-set-id=29"
1098           },
1099           {
1100             "capability-origin": "device-advertised",
1101             "capability": "urn:ietf:params:netconf:base:1.1"
1102           },
1103           {
1104             "capability-origin": "device-advertised",
1105             "capability": "urn:ietf:params:netconf:base:1.0"
1106           },
1107           {
1108             "capability-origin": "device-advertised",
1109             "capability": "urn:ietf:params:netconf:capability:writable-running:1.0"
1110           },
1111           {
1112             "capability-origin": "device-advertised",
1113             "capability": "urn:ietf:params:netconf:capability:validate:1.1"
1114           },
1115           {
1116             "capability-origin": "device-advertised",
1117             "capability": "urn:ietf:params:netconf:capability:with-defaults:1.0?basic-mode=explicit&also-supported=report-all,report-all-tagged,trim,explicit"
1118           },
1119           {
1120             "capability-origin": "device-advertised",
1121             "capability": "urn:ietf:params:netconf:capability:interleave:1.0"
1122           },
1123           {
1124             "capability-origin": "device-advertised",
1125             "capability": "urn:ietf:params:netconf:capability:rollback-on-error:1.0"
1126           },
1127           {
1128             "capability-origin": "device-advertised",
1129             "capability": "urn:ietf:params:netconf:capability:xpath:1.0"
1130           },
1131           {
1132             "capability-origin": "device-advertised",
1133             "capability": "urn:ietf:params:netconf:capability:startup:1.0"
1134           },
1135           {
1136             "capability-origin": "device-advertised",
1137             "capability": "urn:ietf:params:netconf:capability:candidate:1.0"
1138           },
1139           {
1140             "capability-origin": "device-advertised",
1141             "capability": "urn:ietf:params:netconf:capability:notification:1.0"
1142           },
1143           {
1144             "capability-origin": "device-advertised",
1145             "capability": "(urn:ietf:params:xml:ns:netconf:notification:1.0?revision=2008-07-14)notifications"
1146           },
1147           {
1148             "capability-origin": "device-advertised",
1149             "capability": "(urn:ietf:params:xml:ns:yang:iana-crypt-hash?revision=2014-08-06)iana-crypt-hash"
1150           },
1151           {
1152             "capability-origin": "device-advertised",
1153             "capability": "(urn:ietf:params:xml:ns:yang:ietf-x509-cert-to-name?revision=2014-12-10)ietf-x509-cert-to-name"
1154           },
1155           {
1156             "capability-origin": "device-advertised",
1157             "capability": "(urn:ietf:params:xml:ns:yang:ietf-system?revision=2014-08-06)ietf-system"
1158           },
1159           {
1160             "capability-origin": "device-advertised",
1161             "capability": "(urn:ietf:params:xml:ns:yang:ietf-netconf-monitoring?revision=2010-10-04)ietf-netconf-monitoring"
1162           },
1163           {
1164             "capability": "(urn:ietf:params:xml:ns:yang:ietf-datastores?revision=2017-08-17)ietf-datastores"
1165           },
1166           {
1167             "capability-origin": "device-advertised",
1168             "capability": "(urn:ietf:params:xml:ns:yang:1?revision=2017-02-20)yang"
1169           },
1170           {
1171             "capability-origin": "device-advertised",
1172             "capability": "(urn:ietf:params:xml:ns:yang:ietf-interfaces?revision=2014-05-08)ietf-interfaces"
1173           },
1174           {
1175             "capability-origin": "device-advertised",
1176             "capability": "(urn:ietf:params:xml:ns:yang:iana-if-type?revision=2014-05-08)iana-if-type"
1177           },
1178           {
1179             "capability": "(urn:ietf:params:xml:ns:yang:ietf-netconf-server?revision=2016-11-02)ietf-netconf-server"
1180           },
1181           {
1182             "capability-origin": "device-advertised",
1183             "capability": "(urn:opendaylight:params:xml:ns:yang:sample-plugin?revision=2016-09-18)sample-plugin"
1184           },
1185           {
1186             "capability-origin": "device-advertised",
1187             "capability": "(http://nokia.com/pnf-simulator)pnf-simulator"
1188           },
1189           {
1190             "capability": "(urn:ietf:params:xml:ns:yang:ietf-ssh-server?revision=2016-11-02)ietf-ssh-server"
1191           },
1192           {
1193             "capability-origin": "device-advertised",
1194             "capability": "(urn:ietf:params:xml:ns:yang:ietf-netconf-notifications?revision=2012-02-06)ietf-netconf-notifications"
1195           },
1196           {
1197             "capability-origin": "device-advertised",
1198             "capability": "(urn:ietf:params:xml:ns:netconf:base:1.0?revision=2011-06-01)ietf-netconf"
1199           },
1200           {
1201             "capability-origin": "device-advertised",
1202             "capability": "(urn:ietf:params:xml:ns:yang:ietf-yang-types?revision=2013-07-15)ietf-yang-types"
1203           },
1204           {
1205             "capability": "(urn:mynetconf:test?revision=2019-03-01)mynetconf"
1206           },
1207           {
1208             "capability": "(urn:ietf:params:xml:ns:yang:ietf-keystore?revision=2016-10-31)ietf-keystore"
1209           },
1210           {
1211             "capability-origin": "device-advertised",
1212             "capability": "(urn:ietf:params:xml:ns:netmod:notification?revision=2008-07-14)nc-notifications"
1213           },
1214           {
1215             "capability-origin": "device-advertised",
1216             "capability": "(urn:ietf:params:xml:ns:yang:ietf-yang-metadata?revision=2016-08-05)ietf-yang-metadata"
1217           },
1218           {
1219             "capability-origin": "device-advertised",
1220             "capability": "(urn:ietf:params:xml:ns:yang:ietf-inet-types?revision=2013-07-15)ietf-inet-types"
1221           },
1222           {
1223             "capability-origin": "device-advertised",
1224             "capability": "(http://example.net/turing-machine?revision=2013-12-27)turing-machine"
1225           },
1226           {
1227             "capability": "(urn:ietf:params:xml:ns:yang:ietf-tls-server?revision=2016-11-02)ietf-tls-server"
1228           },
1229           {
1230             "capability-origin": "device-advertised",
1231             "capability": "(urn:ietf:params:xml:ns:yang:ietf-netconf-with-defaults?revision=2011-06-01)ietf-netconf-with-defaults"
1232           },
1233           {
1234             "capability": "(urn:ietf:params:xml:ns:yang:ietf-yang-library?revision=2018-01-17)ietf-yang-library"
1235           },
1236           {
1237             "capability-origin": "device-advertised",
1238             "capability": "(urn:ietf:params:xml:ns:yang:ietf-ip?revision=2014-06-16)ietf-ip"
1239           },
1240           {
1241             "capability-origin": "device-advertised",
1242             "capability": "(urn:ietf:params:xml:ns:yang:ietf-netconf-acm?revision=2018-02-14)ietf-netconf-acm"
1243           },
1244           {
1245             "capability-origin": "device-advertised",
1246             "capability": "(urn:opendaylight:params:xml:ns:yang:stream-count?revision=2016-09-18)stream-count"
1247           }
1248         ]
1249       },
1250       "netconf-node-topology:host": "192.168.122.238",
1251       "netconf-node-topology:clustered-connection-status": {
1252         "netconf-master-node": "akka.tcp://opendaylight-cluster-data@127.0.0.1:2550"
1253       },
1254       "netconf-node-topology:connection-status": "connected",
1255       "netconf-node-topology:port": 830
1256     }
1257   ]
1258   }
1259
1260 VPP setup
1261 =========
1262
1263 1. The information that we need to configure the VPP reporter (which is the VES agent application
1264 that generates events destined for the ONAP VES collector) is the VES IP and port.
1265 The below instructions can be used for this configuration
1266
1267 .. code-block::
1268
1269   kubectl get svc -n onap -o wide | grep ves
1270   dcae-hv-ves-collector                                       ClusterIP      10.43.130.145   <none>                                 6061/TCP                                                      12d   app=dcae-hv-ves-collector
1271   dcae-ves-collector                                          ClusterIP      10.43.83.158    <none>                                 8080/TCP,8443/TCP                                             12d   app=dcae-ves-collector
1272   xdcae-hv-ves-collector                                      NodePort       10.43.32.76     <none>                                 6061:30222/TCP                                                12d   app=dcae-hv-ves-collector
1273   xdcae-ves-collector                                         NodePort       10.43.97.42     <none>                                 8080:30235/TCP,8443:30417/TCP                                 12d   app=dcae-ves-collector
1274
1275 2. Use the port of xdcae-ves (30235 in this case) and the kubernetes-host IP
1276
1277 - Log in to the vfw sinc VNF as user ubuntu
1278 - Modify /opt/config/dcae_collector_ip.txt and /opt/config/dcae_collector_port.txt
1279 - Kill the vpp reporter if running already
1280 - Start the vpp reporter by executing the script
1281
1282   - cd /opt/VES/evel/evel-library/code/VESreporting
1283   - ./go-client.sh &
1284 - Add the following route for the metadata service if not present already
1285
1286   .. code-block::
1287
1288       sudo ip route add 169.254.169.254 via <vfw_sinc OAM_NETWORK IP> dev <interface name>
1289       sample command:
1290       # sudo ip route add 169.254.169.254 via 10.10.10.11 dev eth3
1291 - Verify that the metadata service is accessible by issuing the following command
1292
1293   - curl http://169.254.169.254
1294
1295 3. The events generated from this program will trigger the vFW CL flow.
1296 In a successful deployment of the vFW CL, the graphs look as in the screenshot below.
1297 We can see that the bars are shorter and more uniform as compared to vFW deployment without the CL
1298
1299 Browse to the zdfw1fwl01snk01 on port 667 to see a graph representing the traffic being received
1300
1301 .. code-block::
1302
1303   http://<zdfw1fwl01snk01>:667/
1304
1305 |image54|
1306
1307 4. Check the events sent by TCA on unauthenticated.DCAE_CL_OUTPUT
1308
1309 These events are the resulting of the TCA application, e.g. TCA has noticed an event was crossing
1310 a given threshold, hence is sending a message of that particular topic. Then Policy will grab this event
1311 and perform the appropriate action, as defined in the Policy. In the case of vFWCL, Policy will send
1312 an event on the APPC_CL topic, that APPC will consume. This will trigger a NETCONF request to the
1313 packet generator to adjust the traffic.
1314
1315 .. code-block::
1316
1317   curl -X GET \
1318   http://<kubernetes-host>:3904/events/unauthenticated.DCAE_CL_OUTPUT/group1/C1 \
1319   -H 'Accept: application/json' \
1320   -H 'Content-Type: application/cambria'
1321
1322   #smaple command and output:
1323   curl -X GET   http://10.43.214.215:3904/events/unauthenticated.DCAE_CL_OUTPUT/group1/C1   -H 'Accept: application/json'   -H 'Content-Type: application/cambria' | jq
1324   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
1325                                  Dload  Upload   Total   Spent    Left  Speed
1326   100   909  100   909    0     0    677      0  0:00:01  0:00:01 --:--:--   677
1327   [
1328   "{\"closedLoopEventClient\":\"DCAE_INSTANCE_ID.dcae-tca\",\"policyVersion\":\"v0.0.1\",\"policyName\":\"DCAE.Config_tca-hi-lo\",\"policyScope\":\"DCAE\",\"target_type\":\"VM\",\"AAI\":{\"vserver.prov-status\":\"ACTIVE\",\"vserver.resource-version\":\"1617776112073\",\"vserver.is-closed-loop-disabled\":false,\"vserver.vserver-name2\":\"vfw_sinc_vsp_002-1\",\"vserver.vserver-id\":\"30dd6250-8a74-4ed7-9729-6ce7190c6661\",\"vserver.vserver-selflink\":\"http://10.200.142.157:8774/v2.1/servers/30dd6250-8a74-4ed7-9729-6ce7190c6661\",\"vserver.in-maint\":false,\"vserver.vserver-name\":\"vfw_sinc_vsp_002-1\"},\"closedLoopAlarmStart\":1500584201765465,\"closedLoopEventStatus\":\"ONSET\",\"closedLoopControlName\":\"ControlLoop-vFirewall-d0a1dfc6-94f5-4fd4-a5b5-4630b438850a\",\"version\":\"1.0.2\",\"target\":\"vserver.vserver-name\",\"requestID\":\"2f546551-f304-4e76-9e8e-45c601790823\",\"from\":\"DCAE\"}"
1329   ]
1330
1331 5. Check the active streams value in vPG over restconf
1332
1333 The number of streams will change along the time, this is the result of close-loop policy.
1334 When the traffic goes over a certain threshold, DCAE will publish an event on the unauthenticated.DCAE_CL_OUTPUT
1335 topic that will be picked up by APPC, that will send a NETCONF request to the packet generator to adjust the traffic it's sending.
1336
1337 Run the below command to check the stream count, you should see the value as 5
1338
1339 .. code-block::
1340
1341   curl -v --noproxy '*' --user "admin":"Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U"  -H "Accept: application/xml" -H "Content-type: application/xml" -X GET   http:/<kubernetes-host>:30230/restconf/config/network-topology:network-topology/topology/topology-netconf/node/<VPG VNFID>/yang-ext:mount/stream-count:stream-count/streams/
1342
1343   #sample command and output
1344   curl -v --noproxy '*' --user "admin":"Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U"  -H "Accept: application/xml" -H "Content-type: application/xml" -X GET http:/192.168.122.99:30230/restconf/config/network-topology:network-topology/topology/topology-netconf/node/a1ca05b4-3231-4e4a-a09c-74f2292fe577/yang-ext:mount/stream-count:stream-count/streams/
1345   Note: Unnecessary use of -X or --request, GET is already inferred.
1346   * Unwillingly accepted illegal URL using 1 slash!
1347   *   Trying 192.168.122.99...
1348   * TCP_NODELAY set
1349   * Connected to 192.168.122.99 (192.168.122.99) port 30230 (#0)
1350   * Server auth using Basic with user 'admin'
1351   > GET /restconf/config/network-topology:network-topology/topology/topology-netconf/node/a1ca05b4-3231-4e4a-a09c-74f2292fe577/yang-ext:mount/stream-count:stream-  count/streams/ HTTP/1.1
1352   > Host: 192.168.122.99:30230
1353   > Authorization: Basic YWRtaW46S3A4Yko0U1hzek0wV1hsaGFrM2VIbGNzZTJnQXc4NHZhb0dHbUp2VXkyVQ==
1354   > User-Agent: curl/7.58.0
1355   > Accept: application/xml
1356   > Content-type: application/xml
1357   >
1358   < HTTP/1.1 200 OK
1359   < Content-Type: application/xml
1360   < Content-Length: 110
1361   <
1362   * Connection #0 to host 192.168.122.99 left intact
1363   <streams xmlns="urn:opendaylight:params:xml:ns:yang:stream-count"><active-streams>5</active-streams></streams>
1364
1365
1366 .. |image16| image:: media/image16.png
1367 .. |image15| image:: media/image15.png
1368 .. |image5| image:: media/image5.png
1369 .. |image13| image:: media/image13.png
1370 .. |image1| image:: media/image1.png
1371 .. |image12| image:: media/image12.png
1372 .. |image14| image:: media/image14.png
1373 .. |image19| image:: media/image19.png
1374 .. |image7| image:: media/image7.png
1375 .. |image10| image:: media/image10.png
1376 .. |image4| image:: media/image4.png
1377 .. |image20| image:: media/image20.png
1378 .. |image9| image:: media/image9.png
1379 .. |image3| image:: media/image3.png
1380 .. |image17| image:: media/image17.png
1381 .. |image11| image:: media/image11.png
1382 .. |image24| image:: media/image24.png
1383 .. |image22| image:: media/image22.png
1384 .. |image18| image:: media/image18.png
1385 .. |image23| image:: media/image23.png
1386 .. |image2| image:: media/image2.png
1387 .. |image8| image:: media/image8.png
1388 .. |image21| image:: media/image21.png
1389 .. |image25| image:: media/image25.png
1390 .. |image53| image:: media/image53.jpg
1391 .. |image54| image:: media/image54.png