Virtual Device Context

[ryanmerolle]

NetBox version

v3.0.10

Feature type

New functionality

Proposed functionality

For lack of a better term, it would be ideal to support the common model of virtual device context. This should NOT model a specific vendor, but the common functionality of virtual device context in that interfaces can be assigned to them (in addition to VRFs if implemented #7852)

Use case

Platform specific implementations to look at to understand the commonly shared functionality:

• Fortinet Virtual Domains (vDOMs)
• Juniper Virtual Router Instances
• Cisco Virtual Device Context
• Palo Alto Virtual Systems

Database changes

No response

External dependencies

No response

[jeremystretch]

Picking a concise, descriptive, and vendor-neutral name for this may be tricky. I think I like "device context" best because it clearly references a device, though this would probably get confused with config contexts.

At any rate, this would probably entail adding a new model (we'll use DeviceContext for the purpose of discussion) which can be assigned to a device. Interfaces (and other components?) belonging to the device can optionally be assigned to a DeviceContext to indicate their membership. Deleting the DeviceContext instance would also remove these relationships, but the interfaces would remain on the parent device as before.

I'm not clear what other data we would need to track for the DeviceContext itself: Presumably a name, but what else goes into its configuration?

[DanSheps]

Couple thoughts on data to track:

• Primary IP
• Serial number
• Tenant
• Resources (not sure the best way to track this one as most likely every vendor is going to be different)

I am sure there are more

[snowie-swe]

These type of "device context" are normally hosted on cluster based either physical hardware or VM.
So keeping track of the cluster they belong to would be nice.

[DanSheps]

Which product hosts the device context on a cluster? Granted my experience is with Nexus but the relationship is a One-to-Many Chassis-to-VDC

[snowie-swe]

Most firewall vendors, such as listed above.
Cisco, Palo Alto, Check Point, Juniper etc.

Cisco you can run Cisco ASA in context mode.
Context are run on 2 physical cisco asa firewalls in a cluster.
Then each Context has its own interfaces / routing table etc.

Check Point uses a product called VSX.
VSX is based on appliances or openservers (HPE, IBM etc)
These clusters can be up to 12 physical nodes.

Running on these you can have virtual routers / virtual systems / virtual switches.
All of this virtual devices has independent routing tables / interfaces

Palo Alto and juniper dose it in a similar way.

[DanSheps]

So, for ASA, that is not how contexts work at all. I think you are confusing how HA works.

With a ASA, if you are using clustering with contexts, on each ASA you will have a context, not one context shared between ASAs. For Active/Active HA, or Active/Standby HA it is the same. If you have a "users" context, you will have a users context on both ASA's.

I am sure many of the other vendors are the same. You want a way to track the HA relationship and that is a separate FR (although virtual chassis works well in most.instances for that)

[jeremystretch]

I think there are two distinct layers of abstraction here:

1. Emulating a single logical device from two physical devices (i.e. clustering/HA)
2. Emulating multiple virtual environments within a single device

This FR addresses the later. The former is probably best conveyed using NetBox's virtual chassis model.

[snowie-swe]

So, for ASA, that is not how contexts work at all. I think you are confusing how HA works.

With a ASA, if you are using clustering with contexts, on each ASA you will have a context, not one context shared between ASAs. For Active/Active HA, or Active/Standby HA it is the same.

I am sure many of the other vendors are the same. You want a way to track the HA relationship and that is a separate FR (although virtual chassis works well in most.instances for that)

Sure i understand that we want to have multiple virtual things running on the same device.

In Cisco ASA, yes you can enable context mode in single device or in a cluster. and yes for cisco its HA.
"You can partition a single ASA into multiple virtual devices, known as security contexts. Each context acts as an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices. For unsupported features in multiple context mode, see Guidelines for Multiple Context Mode."
https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/ha-contexts.html

Check Point use VSX with VSLS meaning one context is active on one node within the cluster at the time

"Each Virtual System works as a Security Gateway, typically protecting a specified network. When packets arrive at the VSX Gateway, it sends traffic to the Virtual System protecting the destination network. The Virtual System inspects all traffic and allows or rejects it according to rules defined in the security policy.

In order to better understand how virtual networks work, it is important to compare physical network environments with their virtual (VSX) counterparts. While physical networks consist of many hardware components, VSX virtual networks reside on a single configurable VSX Gateway or cluster that defines and protects multiple independent networks, together with their virtual components."

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_VSX_AdminGuide/Content/Topics-VSXG/How-VSX-Works.htm?tocpath=_____5

Regarding virtual chassi, if am not misstaken this for things like Cisco VSS.

[DanSheps]

snowie-swe,

With ASA, when you have contexts enabled in a cluster or HA, you will have n contexts, 1 for each device. There is no need to track the "cluster", except in the case you want to track the HA state, which as I said is a separate FR.

Checkpoint VSX is the same way: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_VSX_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_VSX_AdminGuide/161797

If you look at the image, you will see there is a virtual "context" associated with each physical device. There is no need to track this similar to the virtual machine model where you have a VM that can be on multiple separate devices. It is different, each device will hold a context.

[snowie-swe]

snowie-swe,

With ASA, when you have contexts enabled in a cluster or HA, you will have n contexts, 1 for each device. There is no need to track the "cluster", except in the case you want to track the HA state, which as I said is a separate FR.

Checkpoint VSX is the same way: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_VSX_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_VSX_AdminGuide/161797

If you look at the image, you will see there is a virtual "context" associated with each physical device. There is no need to track this similar to the virtual machine model where you have a VM that can be on multiple separate devices. It is different, each device will hold a context.

actually its not.

[snowie-swe]

Just to clarify, this FR is about wanting to have virtualization similar to VM but for network equipment, correct?

"Emulating multiple virtual environments within a single device"
All am saying is that there are cases where the thing will be a cluster that's its hosted on.