nexus 1000v

• ASA 1000V has four main interfaces
  • Outside
  • Inside
  • Management
  • Failover
• ASA 1000V may have additional logical security profile interfaces 

The video walks you through an installation process of redundant VSG in L3 mode from .ova file. Manual install option will be selected for the primary VSG, while the secondary will be installed with the installer. We will create port-profiles on Cisco Nexus 1000V for interfaces on VSG. At the end of the lab, we will have VSG registered with VNMC and be ready for configuration.

The video walks you through an installation process of Cisco VNMC. To build foundation of our system, we will register VNMC to vCenter and register VSM to VNMC. We will also create a simple organization hierarchy for our virtual datacenter in preparation for our future labs. This video is applicable to both Cisco VSG and ASA 1000V.

• VNMC Installation
• VSM
• vCenter

Recommeded Videos:

The video introduces you to the concepts behind Cisco VSG and VNMC. We will help you understand how VSG works with other components such as VNMC, VSM and VEM to provide policy-based security within an IP subnet. This video serves as a prerequisite to our future VSG labs. Since this is an introduction-to-technology video, there will be no lab.

• VSG
• VNMC
• VSM
• VEM
• vPath

The video looks into Virtual Extension LAN (VXLAN) support on Cisco Nexus 1000V. VXLAN allows VLAN ID to be extended to 24 bits, or in other words, essentially increases number of available VLAN from 4096 to more than 16 million VLAN. We will configure VXLAN on port-profile. In this lab, we intentionally have VEM control interfaces separated by layer 3 to demonstrate MAC-in-IP encapsulation provided by VXLAN to extend an isolated layer 2 domain across a routable and multicast-enabled network.

The video looks into Cisco TrustSec feature on Cisco Nexus 1000V. We will configure port-profiles to assign SGT to hosts, and have SGT-to-IP mapping sent to an ASA firewall over a SXP connection for policy enforcement. We will see how we can construct an ACL on the ASA to permit or deny traffic based on SGT value using a object-group-security. 

The video looks at how we can achieve network separation at layer 2 with private vlan on Cisco Nexus 1000V. We will go through the concept of Primary, Secondary, Isolated and Community VLANs, and experiment with server communication by placing the servers on different vlan. At the end of the video, we will also go through a scenario where we have two sets of private vlan. Private VLAN allows hosts to remain segregated on the same IP subnet. 

The video presents three main QoS building blocks on Cisco Nexus 1000V: Marking, Policing, and Queuing. We will be applying QoS to Port-Profile to mark RDP traffic, and enforcing policing based on matching DSCP value. Any traffic exceeding allowable rate will be either drop or marked down. We will attempt to provide guaranteed bandwidth to both Nexus and VMware control traffic. DSCP values will be analyzed using Wireshark packet capture.

The video looks into three advanced security features on Cisco Nexus 1000V: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard. We will be testing each of the features with security audit tools, and we will be able to see how these features protect us from DHCP, ARP and source IP spoofing attacks.