The diagram below illustrates the default network configuration of Cisco Enterprise NFVIS with the Cisco ENCS.

• LAN ports—Eight physical Gigabit Ethernet ports for inbound and outbound traffic.

• WAN port—You can use one of the dual media Ethernet ports (wan-br and wan2-br) for DHCP connection.

• Bridges—They form a Layer 2 domain between virtual network interface controllers (vNICs) of VMs. A vNIC is used by a virtual machine to provide virtual network interfaces by defining a range of MAC addresses. The default management IP address (192.168.1.1) for the NFVIS host is configured on the management port. Multiple VMs can use the same LAN port for local connectivity.

• Network—It is a segment Layer 2 bridge domain where only the specific VLAN traffic is allowed.

• Reserved VLANs in the LAN network on the ENCS 5400 platform—The VLAN range 2350-2449 is reserved for internal use and should not be used on the external switch ports and for virtual machines in the LAN ports". Note that this limitation doesn't apply to the WAN ports.

• Internal 192.168.10.00/24 and 192.168.50.0/24 networks—The IP subnet 192.168.10.0/24 and 192.168.50.0/24 are used for the ENCS-5400 internal networks. A user should not use this IP subnet on the NFVIS management network. In the future NFVIS releases, this internal subnet will be isolated so that users can use this for NFVIS management.

Note	The following networks and bridges are automatically configured. You can configure more as required. A LAN network (lan-net) and a LAN bridge (lan-br) A WAN network (wan-net) and a WAN bridge (wan-br) wan2-net and wan2-br are the default configurations for ENCS 5400 and ENCS 5100.

The default networks and bridges cannot be deleted.

Configuring the networks in Cisco Enterprise NFVIS allows inbound and outbound traffic and VMs to be service chained. The following diagram illustrates the default network configuration:

The following networks and bridges are created by default, and cannot be deleted. You can configure more as required.

• A LAN network (lan-net) and a LAN bridge (lan-br)—The default static management IP address (192.168.1.1) for the NFVIS host is configured on the LAN bridge. All other ports for inbound and outbound traffic are associated with the LAN bridge. Any LAN port can be used to access the default static IP address. By default, the hostname is set to "nfvis".

• A WAN network (wan-net) and a WAN bridge (wan-br)—This is created with the "eth0" port, and is configured to enable the DHCP connection.

By default, the first port on the device is associated with the WAN bridge. All the other ports on the device are associated with the LAN bridge.

For more details about the initial setup, see the Installing the Server chapter in the Cisco UCS C220 M4 Server Installation and Service Guide or Cisco Cloud Services Platform 2100 Hardware Installation Guide.

The following networks and bridges are created by default, and cannot be deleted. You can configure more as required.

• A LAN network (lan-net) and a LAN bridge (lan-br)—The default static management IP address (192.168.1.1) for the NFVIS host is configured on the LAN bridge. All other ports for inbound and outbound traffic are associated with the LAN bridge. By default, the hostname is set to "nfvis".
• A WAN network (wan-net) and a WAN bridge (wan-br)— The physical WAN ports are on the Cisco ISR module. They are not externally available on the Cisco UCS E server. The WAN traffic comes from the ISR WAN ports, and goes through the backplane to the Cisco UCS-E server. The backplane has one internal WAN interface (GE0) to establish connection with the Cisco UCS-E server. By default, the "GE0" interface is enabled for the DHCP connection.

For more details on the initial setup, see the Getting Started Guide for Cisco UCS E-Series Servers and the Cisco UCS E-Series Network Compute Engine.

For initial login, use admin as the default user name, and Admin123# as the default password. Immediately after the initial login, the system prompts you to change the default password. You must set a strong password as per the on-screen instructions to proceed with the application. All other operations are blocked until default password is changed. API will return 401 unauthorized error if the default password is not reset.

If wan-br and wan2-br has not obtained IP addresses through DHCP, the zero touch deployment is terminated. To manually apply the IP configurations answer 'y' and the system proceeds with dhclient on wan-br until the configurations are changed. For dhclient to continue to request IP address for PnP flow on both WAN interfaces answer 'n'.

You must follow the rules to create a strong password:

• Must contain at least one upper case and one lower case letter.

• Must contain at least one number and one special character (# _ - * ?).

• Must contain seven characters or greater. Length should be between 7 and 128 characters.

You can change the default password in three ways:

• Using the Cisco Enterprise NFVIS portal.

• Using the CLI—When you first log into Cisco Enterprise NFVIS through SSH, the system will prompt you to change the password.

• Using PnP (for details, see the Cisco Network Plug-n-Play Support).

• Using console - After the initial login using the default password, you are prompted to change the default password.

  
  NFVIS Version: 3.10.0-9
  
  Copyright (c) 2015-2018 by Cisco Systems, Inc.
  Cisco, Cisco Systems, and Cisco Systems logo are registered trademarks of Cisco
  Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
  
  The copyrights to certain works contained in this software are owned by other
  third parties and used and distributed under third party license agreements.
  Certain components of this software are licensed under the GNU GPL 2.0, GPL 3.0,
  LGPL 2.1, LGPL 3.0 and AGPL 3.0.
  
  nfvis login: console (automatic login)
  
  login:
  login:
  login:
  login:
  login: admin
  
  Cisco Network Function Virtualization Infrastructure Software (NFVIS)
  
  NFVIS Version: 3.10.0-9
  
  Copyright (c) 2015-2018 by Cisco Systems, Inc.
  Cisco, Cisco Systems, and Cisco Systems logo are registered trademarks of Cisco
  Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
  
  The copyrights to certain works contained in this software are owned by other
  third parties and used and distributed under third party license agreements.
  Certain components of this software are licensed under the GNU GPL 2.0, GPL 3.0,
  LGPL 2.1, LGPL 3.0 and AGPL 3.0.
  
  admin@localhost's password:
  
  admin connected from ::1 using ssh on nfvis
  nfvis# show version

Note

To commit the target configuration to the active (running) configuration, use the commit command in any configuration mode in Cisco Enterprise NFVIS Release 3.5.1 and later. Changes made during a configuration session are inactive until the commit command is entered. By default, the commit operation is pseudo-atomic, meaning that all changes must succeed for the entire commit operation to succeed.

Performing Static Configuration without DHCP

Note	Starting from NFVIS 3.10.1 release, for ENCS 5400 and ENCS 5100, wan2-br obtains an IP address from DHCP. To configure default gateway, first use no bridges bridge wan2-br dhcp command.

If you want to disable DHCP and use static configuration, initial configuration is done by setting the WAN IP address and/or management IP address, and the default gateway. You can also configure a static IP on a created bridge.

To perform initial configuration on the system without using DHCP:

configure terminal
system settings mgmt ip address 192.168.1.2 255.255.255.0 
bridges bridge wan-br ip address 209.165.201.22 255.255.255.0
system settings default-gw 209.165.201.1
commit

Note	When an interface is configured with a static IP address, DHCP is automatically disabled on that interface.

Now you can either use the management IP or WAN IP to access the portal.

To configure static IPv6 on the WAN interface:

configure terminal
system settings mgmt ipv6 address 2001:DB8:1:1::72/64 
bridges bridge wan-br ipv6 address 2001:DB8:1:1::75/64
system settings default-gw-ipv6 2001:DB8:1:1::76
commit

Note	When an interface is configured with a static IPv6 address, DHCP IPv6 is automatically disabled on that interface. There are three options for IPv6 - static, DHCP and SLAAC, out of which only one can be enabled at a time.

Configuring DHCP on the WAN or Management Interface

Note	Starting from NFVIS 3.10.1, you can configure DHCP on any bridge. You can only have one DHCP bridge or management interface active at a time, and cannot have DHCP and default gateway configured at the same time.

You can configure DHCP either on the WAN interface or the management interface; you cannot configure DHCP on both the interfaces simultaneously.

To configure DHCP on any one of the interfaces (WAN or management), delete the default gateway.

To configure DHCP on the management interface:

configure terminal
no system settings default-gw
system settings mgmt dhcp
commit
exit
hostaction mgmt-dhcp-renew

To configure DHCP IPv6 on the management interface:

configure terminal
no system settings default-gw-ipv6
system settings mgmt dhcp-ipv6
commit
exit
hostaction mgmt-dhcp-renew

To configure DHCP on the WAN interface:

configure terminal
no system settings default-gw
system settings wan dhcp
commit
exit
hostaction wan-dhcp-renew

Note	Starting from NFVIS 3.10.1, you can configure DHCP IPv6 on any bridge. You can only have one DHCP IPv6 bridge or management interface active at a time, and cannot have DHCP IPv6 and default gateway IPv6 or SLAAC IPv6 configured at the same time.

To configure DHCP IPv6 on the WAN interface:

configure terminal
no system settings default-gw-ipv6
system settings wan dhcp-ipv6
commit
exit
hostaction wan-dhcp-renew

Configuring SLAAC on the WAN or Management Interface

Note	Starting from NFVIS 3.10.1, you can configure SLAAC IPv6 on any bridge. You can only have one SLAAC IPv6 bridge or management interface active at a time, and cannot have SLAAC IPv6 and default gateway IPv6 or DHCP IPv6 configured at the same time.

To configure SLAAC IPv6 on the WAN interface:

configure terminal
system settings wan slaac-ipv6
commit

To configure SLAAC IPv6 on the management interface:

configure terminal
system settings mgmt slaac-ipv6
commit

system settings-native mgmt ip-info interface lan-br
system settings-native mgmt ip-info ipv4_address 192.168.1.2
system settings-native mgmt ip-info netmask 255.255.255.0
!
!
!
system settings-native mgmt dhcp disabled
system settings-native wan ip-info interface wan-br
system settings-native wan ip-info ipv4_address 209.165.201.22 
system settings-native wan ip-info netmask 255.255.255.0
!
!
!
system settings-native wan dhcp disabled
!
!
system settings-native gateway ipv4_address 209.165.201.1
system settings-native gateway interface wan-br

system settings-native mgmt ip-info interface MGMT
system settings-native mgmt ip-info ipv4_address 192.168.1.2
system settings-native mgmt ip-info netmask 255.255.255.0
!
!
!
system settings-native mgmt dhcp enabled
system settings-native wan ip-info interface wan-br
system settings-native wan ip-info ipv4_address 209.165.201.22
system settings-native wan ip-info netmask 255.255.255.0
!
!
!
system settings-native wan dhcp disabled

system settings-native mgmt ip-info interface lan-br
system settings-native mgmt ip-info ipv4_address 209.165.201.2 
system settings-native mgmt ip-info netmask 255.255.255.0
!
!
!
system settings-native mgmt dhcp disabled
system settings-native wan ip-info interface wan-br
system settings-native wan ip-info ipv4_address 209.165.201.22
system settings-native wan ip-info netmask 255.255.255.0
!
!
!
system settings-native wan dhcp enabled

Role based access enables the administrator to manage different levles of access to the system's compute, storage, database, and application services. It uses the access control concepts such as users, groups, and rules, which you can apply to individual API calls. You can also keep a log of all user activities.

To filter out unwanted traffic, you can configure ip-receive-acl to block or allow certain traffic based on the IP address and service ports.

To configure the source network for Access Control List (ACL) access to the management interface:

configure terminal
system setting ip-receive-acl 198.0.2.0/24
commit

nfvis# show running-config system settings ip-receive-ac 
system settings ip-receive-acl 198.51.100.11/24
service
[ ssh https scpd]
action accept
priority 100

Cisco Enterprise NFVIS supports two types of banners: system-defined and user-defined banners. You cannot edit or delete the system-defined banner, which provides copyright information about the application. Banners are displayed on the login page of the portal.

You can post messages using the Message of the Day option. The message is displayed on the portal's home page when you log into the portal.

To configure your banner and message:

configure terminal
banner-motd banner "This is a banner" motd "This is the message of the day"
commit

Note	Currently, you can create banners and messages in English only. You can view the system-defined banner using the show banner-motd command. This command does not display the user-defined banner or message.

You can configure the Cisco Enterprise NFVIS system time manually or synchronise with an external time server using Network Time Protocol (NTP).

To set the system time manually:

configure terminal
system set-manual-time 2017-01-01T00:00:00
commit

Note	NTP is automatically disabled when the time clock is set manually.

To set the system time using NTP IPv4:

configure terminal
system time  ntp preferred_server 209.165.201.20 backup_server 1.ntp.esl.cisco.com
commit

To set the system time using NTP IPv6:

configure terminal
system time  ntp-ipv6 2001:420:30d:201:ffff:ffff:fff4:35
commit

nfvis# show system time

system time current-time 2017-01-01T17:35:39+00:00

system time current-timezone "UTC (UTC, +0000)"

REMOTE               REFID  	ST   	T         WHEN       POLL       REACH         DELAY         OFFSET        JITTER    

=================================================================================================================================================

*calo-timeserver     .GPS.   	1          u           4  	64           1         69.423         2749736        0.000     

* sys.peer and synced, o pps.peer, # selected, + candidate,

- outlyer, . excess, x falseticker, space reject

The Cisco Enterprise NFVIS portal access is enabled by default. You can disable the access if required.

To disable the portal access:

configure terminal
system portal access disabled 
commit

Note	You can enable the portal access using the enable keyword with the system portal access command.

nfvis# show system portal status
system portal status "access disabled"

You can view system logs for troubleshooting purpose. There are two log types and five log levels. The two log types are configuration and operational.

The INFO and WARNING log levels are set by default respectively for the configuration and operational log types. You can change them as required. However, the change to the log level is not persisted across a reboot. After a reboot, the default log levels are used.

The following table explains the log levels:

You can configure system logs using the system set-log command in global configuration or privileged EXEC mode:

system set-log level error logtype configuration

nfvis# show system logging-level
system logging-level configuration error
system logging-level operational warning

The Network File System (NFS) is an application where the user can view, store and update the files on a remote device. NFS allows the user to mount all or a part of a file system on a server. NFS uses Remote Procedure Calls (RPC) to route requests between the users and servers.

configure terminal
system storage nfs_storage
nfs
100
10.29.173.131
/export/vm/amol
commit

configure terminal
vm_lifecycle images image myas10 src file:///data/mount/nfs_storage/repository/asav961.tar.gz
properties property placement value nfs_storage
commit

Note	This feature is supported only on ENCS 5400. Upgrade BIOS to version 2.6 for this feature. The secure boot feature is only available for release 3.9.1 fresh install.

The secure boot feature prevents malicious software applications and unauthorized operating systems from loading into the system during the system start up process. If secure boot feature is enabled, only the authorized software applications boots up from the device. Each device has keys that allow software with the correct signature to boot up on the device.

This feature ensures that the software applications that boot up on the device are certified by Cisco. The NFVIS 3.9.1 image is signed with Cisco key. If secure boot is enabled the signature is verified during the device boot up. If the verification fails, the image does not boot up.

Secure boot is disabled by default and to enable it you must change firmware configurations from CIMC. Secure boot needs to boot from a separate UEFI partition.

To enable secure boot:

1. Get into CIMC and use show bios detail command to view the BIOS version.

   
   ENCS# scope bios
   ENCS/bios # show detail
   BIOS:
       BIOS Version: " ENCS54_2.6 (Build Date: 07/12/2018)"
       Boot Order: EFI
       FW Update/Recovery Status: Done, OK
       Active BIOS on next reboot: main
       UEFI Secure Boot: disabled
   ENCS/bios # 
   

2. enable secure boot.

   
   ENCS/bios # set secure-boot enable
   Setting Value : enable
   Commit Pending.
   ENCS/bios *# commit
   ENCS/bios # show detail
   BIOS:
       BIOS Version: "ENCS54_2.6 (Build Date: 07/12/2018)"
       Boot Order: EFI
       FW Update/Recovery Status: None, OK
       Active BIOS on next reboot: main
       UEFI Secure Boot: enabled
   ENCS/bios #

Legacy boot, UEFI boot and UEFI secure boot are the three boot modes. Secure boot can only be used on a disk that has UEFI partition.

You can configure boot order from CIMC command or portal or from BIOS setup menu. With CIMC you can only configure legacy boot order. BootOrderRules are by default set to Strict and so boot order follows the CIMC configuration. Since CIMC cannot be used to configure UEFI boot order, the BootOrderRules setting must be changed to Loose when secure boot is enabled.

If BootOrderRules is set to Loose, the boot order will follow the BIOS setup menu. When an operating system is installed in secure boot mode, the new UEFI boot option for the OS automatically appears at the top of the BIOS menu boot order list, to boot the installed operating system.

To set BootOrderRule to Loose:

ENCS/bios # scope advanced 
ENCS/bios/advanced # set BootOrderRules Loose
ENCS/bios/advanced *# commit
Changes to BIOS set-up parameters will require a reboot.
Do you want to reboot the system?[y|N]y

On ENCS 5400, NFVIS administrators have authoritative control of the device. This includes capability to change the IP address used to reach the CIMC and modifying the CIMC and BIOS passwords

The Data Plane Development Kit (DPDK) is a set of data plane libraries and network interface controller drivers for fast packet processing.

Starting from NFVIS 3.10.1 release, you can backup or export (vmExportAction) and restore or import (vmImportAction) VMs. To backup or restore the whole NFVIS system, refer Backup and Restore NFVIS and VM Configurations.

VM Export and Import Limitations

• The imported VM cannot change datastore.

• The original registered image must exist.

• The OVS network name must be identical to the one used by original deployment.

• NFVIS does not check the disk space before exporting or importing a VM.

• The VM has larger disk footprint compared to original deployment after exporting or importing.

To export a VM ensure that:

• VM is in powered off state.

• Backup file is saved in any NFVIS datastores or USB.

• Provide a backup name for NFVIS to append .vmbkp extension to the backup name.

nfvis# show system file-list disk local | display xpath | include backup

/system/file-list/disk/local[si-no='84']/name tiny_backup.vmbkp
nfvis# show system file-list disk local 84
SI NO  NAME               PATH                SIZE  TYPE               DATE MODIFIED
--------------------------------------------------------------------------------------------
84     tiny_backup.vmbkp  /mnt/extdatastore1  17M   VM Backup Package  2019-01-31 19:31:32

To import a VM ensure that:

• The Backup file is placed under NFVIS datastores or USB.

• The registered image used by the original deployed VM is in the same datastore, with same properties.

• The Original deployed VM does not exist on the system.

• OVS network used by the original deployment should exist.

• Restored VM is created with the same datastore with same deployment properties.

• The full path name to backup file is used (for example, /mnt/extdatastore1/backup.vmbkp, not extdatastore1:backup)

nfvis# vmImportAction importPath /mnt/extdatastore1/tiny_backup.vmbkp
System message at 2019-01-31 19:53:32...
Commit performed by admin via ssh using maapi.

The following examples show export failures:

• Original deployment is not deleted

  
  nfvis# vmImportAction importPath /mnt/extdatastore1/tiny_backup.vmbkp
  Error: Exception from action callback: Deployment Configuration : 'SystemAdminTenantIdtiny' already exists , can not be imported/restored due to conflict!
  
  

• 2. OVS network used by original deployment is deleted.

  
  nfvis# vmImportAction importPath /mnt/extdatastore1/tiny_backup.vmbkp
  Error: Exception from action callback: Restoration Request rejected, see logs for root cause
  
  

Starting from NFVIS 3.10.1 release, you can backup and restore NFVIS configurations and VMs. You can also restore a backup from one NFVIS device to another if they are running on the same version of NFVIS and have the same platform.

Note	To backup or restore a single VM, use vmImportAction and vmBackupAction APIs.

To backup and save NFVIS and all VM configurations use configuration-only option. To backup and save VM disks, NFVIS and VM configurations use configuration-and-vms option.

You can only create a backup to datastore or uploads directory. The backup file has .bkup extension.

The following examples shows the backup options:

nfvis# hostaction backup configuration-and-vms file-path intdatastore:sample.bkup

nfvis# hostaction backup configuration-only file-path extdatastore2:sample-dir/sample.bkup

The following example shows the backup stored on a USB:

nfvis# hostaction backup configuration-only file-path usb:usb1/sample.bkup

Use hostaction backup force-stop command to stop the running backup.

To restore a previous backup on same NFVIS setup or on a new NFVIS setup use except-connectivity option which preserves connectivity of the NFVIS and restores everything else from backup.

nfvis# hostaction restore file-path intdatastore:sample.bkup

The following example shows how to restore a backup on a different NFVIS device:

nfvis# hostaction restore except-connectivity file-path extdatastore2:sample-dir/sample.bkup

Dynamic SR-IOV allows you to enable or disable SR-IOV on a Physical Network Interface Controller (PNIC). You can disable SR-IOV on any PNIC to 0 and enable SR-IOV by setting a value between 1 to maximum virtual functions (maxvfs) supported on PNICs. You can also create and delete SR-IOV networks based on the number of virtual functions (numvfs) set on that PNIC while enabling SR-IOV. Existing fresh installation behavior has not changed. Each PNIC has default number of VFs created and Default SRIOV networks are created. User can use CLI, API or GUI to Enable/Disable SR-IOV on a PNIC or to Create/Delete SR-IOV networks

configure terminal
no pnic eth0-1 sriov
commit

configure terminal
pnic eth0-1 sriov numvfs 20
commit

configure terminal
networks network eth0-1-SRIOV-1 sriov true
commit

configure terminal
networks network eth0-1-SRIOV-1 sriov true trunk false vlan 30
commit

configure terminal
no networks network eth0-1-SRIOV-1 
commit