NaaS ToCP Integration Inbound PAT презентация

UTM: anti-virus, URL filtering, IDS/IPS
QoE
Application Discovery, Grouping
Application Group QoE levels
Resiliency
Dual CPE
Application-based Path Selection (Active/Active), dynamic
Reporting
Service-Level analytics

Proactively Managed Services
NaaS Managed Internet
Port Forwarding
IPSec L3VPN
Hub and Spoke
Multi-VRF VPN
SD-WAN
NaaS for Internet Offload for MPLS customers
Security
Stateful TCP firewall
QoE
Flow based QoE
Resiliency
LTE Backup (Active/Standby)
Dual Wireline uplinks with Flow-Based Path Selection (Active/Active), based on customer policy
Reporting
Service-Level analytics

MVP – Oct 2016

CPE Offering
100M VPN throughput
Proactively Managed Services
NaaS Managed Internet
Static IP (provided by underlay)
NAT
IPSec L3VPN
Mesh
L3 VPN with Internet Offload
SD-WAN
NaaS as backup link on 3rd party MPLS
Security
Basic ACL firewall
Resiliency
Dual Wireline uplinks (active/standby)
On Premise Capabilities
6 port CPE (2 WAN, 4 LAN)
Public WiFi (Swift)
Reporting
Uptime Reporting

Pilot – Jul 2016

Commercial Rel 1 – Jan 2017

offer inbound service
WAN IP must be Public IP
Customer use 3rd Party DDNS
for WAN failover
Customer must know WAN IP
to configure PAT Pool
Customer need to change pool
when WAN IP changes.

platform level.
Name must be unique. Suugested format can be --port
Assign First/Last and default IP.
PATNAT address maps
Map outside to inside IP and port.
Port map for both TCP/UDP.
Can map public IP to multiple internal IPs

"addressRange": null,
"defaultPATIP": "10.1.9.104",
"associatedGatewayType": null,
"associatedGatewayId": null,
"associatedVlanId": null,
"dynamicSourceEnabled": false,
"startSourceAddress": null,
"endSourceAddress": null,
"associatedSubnetId": null,
"name": "Cust-1-nsg1-port1",
"description": "PAT Pool Cust-1-nsg1-port1",
"startAddressRange": "10.1.9.104",
"endAddressRange": "10.1.9.104",
"permittedAction": "ALL",
"IPType": "IPV4"
}

Create PATNAT address map
v4_0/patnatpools/{ID}/addressmaps # POST {ID} is the ID return from PATNAT Pool creation.
{
"privateIP": "192.168.1.101",
"publicIP": "10.1.9.104",
"privatePort": 8080,
"publicPort": 8080,
"type": "MANY_TO_ONE_PAT" # possible Types ONE_TO_ONE_NAT, ONE_TO_MANY_PAT, MANY_TO_ONE_PAT, UNKNOWN,
}

{ID} is the ID return from PATNAT Pool creation.
{
"permittedEntityID": "{ID}", # {ID} of the organization “NaaS”
"permittedAction": "USE"
}
Associate PATNAT Pool to NSG WAN port vlan 0
Vlan ID 0 = {ID}
API to update the patnat pool to associate with NSG.
v4_0/v4_0/patnatpools/{id} ! Put {ID} is the ID of patnat pool created in step 1.
{
"associatedGatewayType": "NSGATEWAY",
"associatedGatewayId": "{ID}", ! {ID} is NSGateway ID.
"associatedVlanId": "{ID}"
}
Repeat for patnat pool 2.

association
API to update the patnat pool to associate with NSG.
v4_0/v4_0/patnatpools/{id}?responseChoice=1 ! Put {ID} is the ID of patnat pool associated with uplink port 1.
{
"associatedGatewayType": null,
"associatedGatewayId": null,
"associatedVlanId": null
}

Delete PATNAT Pool
v4_0/v4_0/patnatpools/{id} ! Delete
{
}
Recreate PATNAT Pool and address map
Associate with port+vlan 0 again

IP match the WAN port IP address. Hence the customer may attach wrong PATNAT Pool to the NSG port.