Cisco Blogs


Cisco Blog > Data Center and Cloud

Meaningful IT Automation Is The Goal

Automation was a major theme at VMWorld 2014 in Barcelona this month and it was clear that IT professionals are discovering that they can’t keep pace with business using manual provisioning and de-provisioning processes. The problem is that with the physical boundaries of time and space, there simply isn’t enough staff to meet the need. As a result, there is a renewed interest in automation at all levels of the organization, to utilize automation allowing IT to scale beyond their current capabilities.

There are a lot of solutions on the market today aimed at this problem, but you have to be careful. Many of them are point solutions, have limited coverage or functional scope.

Cisco has been talking about automation for years and their approach is to deliver heterogeneous management – because your data center is heterogeneous. These tools allows your subject matter experts to transfer their knowledge into automated workflows allowing your business to respond to market changes faster than ever before. Meaningful automation that spans your enterprise with unified management allows you to manage your data center as an interrelated whole. Read More »

Nexus 9000/7000 Series Switches No Longer Vulnerable to Shellshock Bug

What is Shellshock?

Recently a bug called Shellshock was discovered that could potentially allow remote attackers access to Linux, Unix, and Mac OS X operating systems. This bug, also called Bash Bug because it exploits vulnerabilities in the bash shell of *nix based systems, is rated a 7.5 on the Common Vulnerability Scoring System, the highest score a bug may get. It also has a low difficulty rating making it a very serious vulnerability.

How Does it Affect Nexus 9000 Series Switches?

Cisco Nexus 9000 switches are not vulnerable out of the box. The NX-OS image includes a version of bash that is affected by the Shellshock bug. In order for this vulnerability to be exploited a user must successfully SSH into a switch and successfully log in. The Common Vulnerability and Exposure IDs for these vulnerabilities are:

  • CVE-2014-6271
  • CVE-2014-7169
  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2014-7186
  • CVE-2014-7187

Shellshock could potentially allow attackers to log in to the switch and send remote commands to attack the network or possibly set up attacks for later exploitation. However, as long TACACS or local authentication has been used to secure the login, the vulnerability is not exploitable. Nexus 9000 Series switches can run in NX-OS mode or ACI mode. The bug affects all current releases of the NX-OS mode image for the Nexus 9000 Series. The ACI image for the Nexus 9000 Series has been analyzed and is not vulnerable to Shellshock. Even though the ACI image is not affected, it does now contain a patched version of the bash shell as well.

Shellshock Fixed in Recent Patches

The Nexus 9000 NX-OS team was one of the first, if not the first, in the networking industry to fix these issues with hot patches. Hot patches that fix all six of the above listed CVEs have been released by Cisco for the existing NX-OS software and Guest Bash Shell. These patches are currently available for download from http://software.cisco.com/download/navigator.html

There’s a very helpful configuration guide posted on our website on how to perform NX-OS software maintenance upgrades (SMU) as well as using the downloadable RPM to patch the Guest Bash Shell.

Shellshock Fixes for Nexus 3000, 5000, 6000 and 7000.

A Shellshock fix has already been released for the Nexus 7000 Series in NX-OS release 6.2. For the remaining platforms, we will be providing fixes through upcoming NX-OS software releases by the end of this month.

Tags: ,

Cisco and OpenStack: Juno Release – Part 2

The tenth OpenStack release codenamed Juno was released on October 16, 2014. This press release provides a good summary of what to expect in Juno. It also discusses important new capabilities included in the 342 new enhancements built in to Juno and highlights different usecases that showcase the diversity of workloads supported on OpenStack.

In the first part of the Cisco and Openstack Juno Release blog, I covered Cisco’s OpenStack team contributions to the Neutron project. Here I’ll provide details of our contributions to other OpenStack projects as well highlight our development efforts on StackForge. Cisco was the sixth top code reviewer for the Juno release across all projects in Juno release and is Foundation’s fifth largest company in terms of OpenStack membership.

This Nova blueprint was completed in Juno and provides support for configuration and provisioning of instances with SR-IOV port connectivity.  The implementation generates SR-IOV specific libvirt domain and network configuration XML for the instances as well as includes the capability to schedule instances based on the compute nodes SR-IOV capabilities.  One of the key use-cases for SR-IOV is Network Function Virtualization (NFV) that requires high performance traffic throughput in and out of a virtual machine providing network services (Virtual Network Function or VNF).

We proposed and implemented support for metering Network Services in Neutron using Ceilometer. This included new pollsters and notification handlers for Load Balancer as a Service (LBaaS), Firewall as a Service (FWaaS) and VPN as a Service (VPNaaS). The metrics are categorized into Provider or Service Level, providing different level of details. Provider level metrics help determine the type of implementation and its feature, whereas the Service level metrics provide more granular metric details on the service health and consumption. Separately, instance metrics were enhanced as part of this blueprint to support read and write metrics per instance disk device.

In the Cinder project, Fibre Channel Zone Manager allows FC SAN Zone/Access control management in conjunction with Fibre Channel block storage.  It has a pluggable architecture and we contributed the Cisco FC Zoning plugin that automates creation, deletion and modification of zones in zonesets.  Zones are configured automatically as part of the active zone set for the specified VSAN in the FC SAN to provide a more flexible and secure way of controlling access.

Enhancements to Horizon to enable configuration of  IPv6 subnet modes is also part of the Juno release. This allows tenants to configure address and Route Advertisement (ra) mode for their subnets through the user dashboard. Neutron supports multiple IPv6 address configuration modes including SLAAC and DHCPv6 (both Stateful and Stateless modes).

StackForge

The Cisco OpenStack team has been actively developing across different projects on StackForge as well. This provides an excellent platform for OpenStack related projects to make use of OpenStack project infrastructure and also continue to collaborate in the open.

OpenStack Services Puppet Modules -- One of challenges that we hear about from our OpenStack customers is how to make OpenStack more manageable and deployable.  There are several different deployment options for OpenStack and we have tremendous experience with automating the underlying system and service configuration via Puppet. We work with customers, partners and the community to enhance Puppet modules for OpenStack services and integrate with Cisco infrastructure as well.  We also recently announced, in collaboration with RedHat, Cisco UCS Integrated Infrastructure that combines Cisco’s server, switching and management technologies with Red Hat’s enterprise-grade OpenStack platform.

Group Based Policy (GBP)– Currently staged on StackForge, this project aims to provide policy abstractions that extend the current Neutron API resources and introduces a declarative policy driven connectivity model that presents application-oriented interfaces to the user. The Group Based Policy framework implementation provides the flexibility for new API resources – End Points, End Point Groups, Contracts and Classifiers – that can be mapped to existing Neutron resources or passed directly to a third party controller.  In addition to a mapping driver that supports all existing Neutron plugins, Cisco will also be releasing a driver to directly integrate GBP with its Application Policy Infrastructure Controller.

Nova Solver Scheduler – For resolving complex constraints based on policies and business rules, we have been collaborating with the community to develop a smart Nova Scheduler driver that models compute placement as a supply and demand problem.  The intent is for the Solver Scheduler to integrate with the Gantt project that is aiming to separate out the Nova scheduler as a standalone project.

Summary

Cisco’s OpenStack team contributions are across numerous projects in OpenStack. Our aim is to work with the community, with our customers and partners to enable more successful OpenStack User Stories, resulting in a win-win situation. We are going to be presenting several general sessions that were selected as part of the community voting process at the upcoming Kilo Summit in Paris. You can find more details in this blog post and we look forward to seeing you there!

You can also download OpenStack Cisco Validated Designs, White papers, and more at www.cisco.com/go/openstack

 

Tags: , , , , , , , ,

The Benefits of an Application Policy Language in Cisco ACI: Part 4 – Application Policies for DevOps

October 21, 2014 at 5:00 am PST

[Note: This is the last installment of a four-part series on the OpFlex protocol in Cisco ACI, how it enables an application-centric policy model, and why other SDN protocols do not.  Part 1 | Part 2 | Part 3]

As noted earlier in this series, modern DevOps applications such as Puppet, Chef, and CFEngine have already moved toward the declarative model of IT automation, so there is already some obvious synergy between DevOps and the Cisco ACI policy model. DevOps automation products are also optimizing application delivery processes and are designed to automate critical IT tasks to make the organization more agile and efficient.

In an early 2014 blog post, Andi Mann, vice president of strategic solutions at CA Technologies, wrote about the evolution to DevOps and the synergy with the Cisco ACI policy model:

Though the DevOps approach of today—with its notable improvements to culture, process, and tools—certainly delivers many efficiencies, automation and orchestration of hardware infrastructure has still been limited by traditional data center devices, such as servers, network switches and storage devices. Adding a virtualization layer to server, network, and storage, IT was able to divide some of these infrastructure devices, and enable a bit more fluidity in compute resourcing, but this still comes with manual steps or custom scripting to prepare the end-to-end application infrastructure and its networking needs used in a DevOps approach.

The drag created by these traditional application infrastructures has been somewhat reduced by giving that problem to cloud providers, but in reality this drag never really went away until Cisco innovated application-centric programmability with Cisco ACI. This innovative new solution is now poised to greatly benefit the whole application economy, especially management of the DevOps application environment…

Read More »

Tags: , , , , , , , , ,

SQL de Dissabte (SQLSaturday Barcelona)

SQL Saturday Gary and Renee

Of the more than 300 SQLSaturdays around the world, I am lucky enough to represent Cisco at the one in Barcelona on October 25th. If you’re attending TechEd Europe we encourage you to also join us at this one-day free event for IT professionals to learn more about SQL Server and the Cisco Unified Computing System (UCS).

If my experience at a recent SQL event in San Diego is any indication, it is going to be a great event. I was amazed that even after UCS being recognized as the #1 x86 blade server in Americas, many database administrators still came to our table and asked, “What is Cisco doing here at a SQL Saturday event?” The good news is that these same people left with an understanding of how UCS is different from our competitors and can help simplify, standardize and optimize SQL Server deployments.

In San Diego, 80 people showed up to Cisco consulting systems engineer, Aaron Rigney’s presentation, “Optimize Your SQL Server 2014 Workloads with Cisco UCS” which covered the following key benefits.

  • Quickly and easily deploy new SQL Servers in minutes
  • Proactively manage and automate your  SQL Server workloads with Microsoft System Center 2012 R2 and PowerShell integrations with UCS Manager
  • Achieve the highest levels of consolidation and performance for both virtual and bare metal implementations.

Read More »

Tags: , , , , , , , ,