DO NOT SHARE THESE DOCS WITH CUSTOMERS!
This is an LA release that will only be provided to a select number of PLM-sanctioned customers (PDFs only). Contact PLM for details.
In this section:
An SBC deployment requires a Virtual Private Cloud (VPC) with one IPv4 subnet for each of the following:
For HFE environments, configure with two more VPCs with one IPv4 subnet, as described below:
Connect this interface on the HFE for PKT1 traffic only using Private IP addresses.
From the GCP Console Navigation menu, navigate to the Networking section and select VPC network > VPC networks.
GCP Console - VPC Network Navigation
VPC Networks
Create a VPC Network
Click Create to return to the Create a VPC Network window. The new VPC network and subnet is displayed when the creation process is completed.
Return to the Create a VPC Network window
To create extra subnets in a VPC, perform the following steps:
Select the VPC for which you want to add a subnet.
VPC Networks
Enter a suitable IP address range. Generally a CIDR of 10.x.x.0/24 is sufficient.
You can only create networks with "10" as the first octet. For example, 20.0.0.0/24 is an invalid subnet, resulting in a failed network creation.
Click ADD in the subnet window.
Subnet window
Firewall rules govern the traffic in and out of the network. At least two separate firewall rules (one for the incoming IP traffic, and another for the outgoing traffic) are required for each subnet. You may create and apply more rules to the same networks.
Before creating the firewall rules, review the recommended firewall rule settings in the Firewall Rules Overview section.
For a comprehensive description of firewall rules, refer to the Google documentation: https://cloud.google.com/vpc/docs/firewalls.
For PKT0 and PKT1 interfaces, configure the SBC firewalls to allow the subnet that brings up the instances.
To create a new firewall rule, complete the following procedure.
From the GCP Console Navigation menu, navigate to Networking > VPC Network > Firewall rules.
Firewall Rules
Click Create Firewall Rule to create an incoming traffic firewall rule for the Management network.
Create Firewall Rule
Enter a Name and Description for the incoming Management Firewall Rule.
Each firewall rule requires a unique name.
Click Create. The system returns you to the Firewall Rules page and the new firewalls rule is listed:
New Firewall Rule
Click Create Firewall Rule to create an outgoing traffic firewall rule for the Management network:
Create Firewall Rule
Enter a Name and Description for the outgoing Management Firewall Rule.
Each firewall rule requires a unique name.
Click Create. The Firewall Rules page opens and the new firewalls rule is listed.
Firewall Rules
Repeat this procedure to create ingress and egress firewall rules for HA0, PKT0 and PKT1 networks.
Ribbon recommends opening the following ports using Inbound/Ingress and Egress firewall rules for management, HA, PKT0 and PKT1 interfaces.
Each firewall rule requires a unique name.
For PKT0 and PKT1 interfaces, configure the SBC firewalls to allow the subnet that brings up the instances.
Refer to Common Public Cloud Security Group Rules for details.
Ingress HA Firewall Rules
Type | Protocol | Port Range | Source | Notes/Purpose |
---|---|---|---|---|
All Traffic | All | All | x.x.x.x/y | x.x.x.x/y is the HA subnet CIDR. |
Ingress Packet (PKT0, PKT1, and HFE ingress interfaces) Firewall Rules
Type | Protocol | Port Range | Source |
---|---|---|---|
Custom UDP rule | UDP | 5060 | x.x.x.x/y |
Custom TCP rule | TCP | 5061 | x.x.x.x/y |
Custom UDP rule | UDP | 1024-65535 | 0.0.0.0/0 |
For more information about Firewall rules for the HFE environment, refer to Configuring the HFE Node.
Ribbon recommends opening all ports using Outbound/Egress rules in the firewalls associated with management, HA and packet interfaces.
Outbound Firewall Rules
Type | Protocol | Port Range | Destination |
---|---|---|---|
All Traffic | All | All | 0.0.0.0/0 |
The HA solution works only if the mgt0 port has internet access. If the routing table (associated with the subnet of mgt0) fails to have all the traffic rules, the HA solution does not work.
If specific ports are opened in outbound security group rules, the remaining ports are blocked.
For the minimum security group rules that allows the SBC to function, refer to the Management Firewall Rules, HA Firewall Rules, and Packet Security Firewall Rules tables.
If the SIP signaling port in the SBC configuration is set to the default port (5060), the port numbers for UDP/TCP are set to 5060 and 5061.
Google Cloud Platform (GCP) routes define the paths network traffic takes from a VM instance to other destinations. These destinations can be inside your VPC network (for example, in another VM), or outside of it.
GCP has four different types of routes in two categories. System-generated routes are automatically created when you create a network, add a subnet, or modify the secondary IP address range of a subnet. Custom routes are those that you create and maintain, either directly, or by using a Cloud Router.
Every route consists of a destination and a next hop. Traffic whose destination IP address is within the destination range is sent to the next hop for delivery.
When you create a VPC network, GCP creates a system-generated default route. This route serves two purposes:
It defines the path out of the VPC network, including the path to the Internet. In addition to having this route, if the instances need Internet access, they must meet additional requirements as described in https://cloud.google.com/vpc/docs/vpc#internet_access_reqs.
It provides the standard path for Private Google Access - https://cloud.google.com/vpc/docs/private-access-options
.
Initial Default System-Generated Routes for MGT0, HA0, PKT0, PKT1
The system-generated default route has a priority of 1000. Because its destination is the broadest possible (0.0.0.0/0), the GCP uses it only if a route with a more specific destination does not apply to a packet. For more information on how the GCP uses destination specificity and route priority to select a route, refer to the "Routing order" topic at https://cloud.google.com/vpc/docs/routes#routeselection.
You can delete the default route in order to completely isolate your network from the Internet or if you need to replace it with a custom route.
For detailed information on the Routing in GCP, refer to https://cloud.google.com/vpc/docs/routes.
To remove the HA0 system-created route, complete the following procedure.
Navigate to Networking > VPC network > Routes. The list of existing Routes for the project is displayed.
Route List
Select the outgoing route for the HA0 network, and click DELETE to remove it.
Deleting Routes
When promted, confirm the deletion.
You cannot delete the default VPC network routes.
To use a bastion server for SBC in GCP to access the management interface using private IP addresses, you must create the server in a subnet separate to the management interface.
To add a route for mgt0 to a Bastion Server or a VPN IP address, perform the following procedure.
Navigate to Networking > VPC network > Routes.
Routes
Click Create Route Table to create a route table for MGT0.
Create Route Table
Enter the IP address of the bastion server under Next hop IP address.
Next Hop IP Address
Repeat the previous steps to add or remove other routes for PKT0 and/or PKT1.
Routes required for the HFE environment are available in the section "Google Network Routes" of the page Configuring the HFE Node.
To access the SBC management IP, associate the static IP address to the MGT0 private primary IP address, and any secondary private IP addresses.
Based on your network requirement, associate Static IP addresses to secondary IP addresses of PKT0 and PKT1 network interfaces also.
To reserve a static IP address for MGT0, complete the following steps:
Navigate to Networking > VPC network > External IP addresses. The External IP addresses list is displayed.
External IP addresses
Click Reserve static address (if no addresses exist), or click the plus ( + ) button. The Reserve a static address page is displayed.
Reserve a static address
To associate a static IP address after creating an instance, perform the following steps:
Navigate to Networking > VPC network > External IP addresses.
The External IP addresses list displays.
External IP addresses
Click Change next to the desired unused external IP address.
The Attached IP address window displays.
Attached IP address
Select the appropriate internal IP address from the Attach to drop-down list.
Click OK.
Repeat as required for PKT0 and PKT1 network interfaces.
You may reserve Static Internal IP Addresses in a VPC, and attach them to a network interface during instance creation.
Select the VPC where the static IP address needs to be created.
VPC network details
Click RESERVE.
Reserve