GCP SBC Standalone Install (7.2S400)

VPC Creation

1. From the GCP Console Navigation menu, navigate to Networking and select VPC network > VPC networks.

The VPC networks page will appear.

2. Click Create VPC Network to create a VPC network for the deployment.  

The Create a VPC network page will appear.

3. Complete the Name and Description fields.

Subnet Creation

To create a subnet for mgt0, complete the following procedure:

1. For Subnet creation mode, choose Custom. 
2. Give the subnet a name (for example, mtg0).
3. Select the appropriate region (Note that all subnets for an SBC instantiation must be in the same region). 

4. Enter a suitable IP range based on your needs, typically a CIDR of 10.x.x.0/20 will suffice for management.

   Note

   You can only create networks with "10" as the first octet. For example, 20.0.0.0/24 is invalid subnet, and therefore network creation would fail.

5. Enable Private Google access for the Mgt0 subnet (Ha0, Pkt0, and Pkt1 do not need private Google access).
6. Click Done in the subnet window.
7. Select Regional for Dynamic routing mode.
8. DNS server policy is not required. Leave it as No Server Policy. 
9. Click Create. The user is returned to the Create a VPC network screen. The new VPC network and subnet will be displayed once the creation process completes.
   
10. Repeat steps 1-9 to create a subnet for HA0 using an IPv4 CIDR block 10.x.16.0/20
11. Repeat steps 1-9 to create a subnet for HA0 PKT0 using an IPv4 CIDR block 10.x.32.0/20
12. Repeat steps 1-9 to create a subnet for HA0 PKT1 using an IPv4 CIDR block 10.x.48.0/20
13. After creating the VPC networks, continue to the next procedure.

Creating Firewall Rules

Firewall rules govern the traffic in and out of the network. At least two separate firewall rules (one for incoming IP traffic, one for outgoing traffic) are required for each subnet, although more rules may be created and applied to the same networks. Before creating the firewall rules, review the recommended firewall rule settings in the Firewall Rules Overview section.

For a comprehensive description of firewall rules, refer to Firewalls. 

To create a new firewall rule, complete the following procedure:

1. From the GCP Console Navigation menu, navigate to Networking > VPC Network > Firewall rules.
   The following window will open: 
   
2. Click CREATE FIREWALL RULE to create an incoming traffic firewall rule for the Management network.
   The following window will open: 
   

3.  Enter a Name and Description for the incoming Management Firewall Rule.  

   Note

   Each firewall rule requires a unique name.

4. Under Network, select the newly created VPC Network from the drop-down list.
5. Enter a Priority for the rule (keep the default value 1000).
6. Select Ingress for Direction of traffic.
7. Select Allow for Action on match.
8. Select All instances in the network for Targets.
9. Select IP ranges as the Source filter.
10. Enter one or more Source IP ranges to permit using CIDR format
11. Click Specified protocols and ports under the Protocols and ports section.
12. Click tcp and enter the individual or range of ports to open, separated with commas. To enable all ports, enter the keyword "all".
13. Click udp and enter the individual or range of ports to open, separated with commas. To enable all ports, enter the keyword "all".
14. Click Create.
15. The user returns to the Firewall Rules page and the new firewalls rule is listed
    
16. Click CREATE FIREWALL RULE to create an outgoing traffic firewall rule for the Management network
    The following window will open: 
    

17. Enter a Name and Description for the outgoing Management Firewall Rule.  

    Note

    Each firewall rule requires a unique name.

18. Select the Network to apply the rule to from the drop-down list.
19. Enter a Priority for the rule (you can keep the default value 1000).
20. Select Egress for Direction of traffic.
21. Select Allow for Action on match.
22. Select All instances in the network for Targets.
23. Select IP ranges as the Destination filter.
24. Select Allow all under the Protocols and ports section to permit egress traffic to all destinations. 
25. Click Create.
    The user returns to the Firewall Rules page and the new firewalls rule is listed.
    
26. Repeat this procedure to create ingress and egress firewall rules for HA0, PKT0 and PKT1 networks.

Firewall Rules Overview

Ribbon recommends opening the following ports using Inbound/Ingress and Egress firewall rules for management, HA, packet 0 and packet 1 interfaces.

Ingress (Inbound) Management Firewall Rules

Ingress HA Firewall Rules

Ingress Packet (pkt0, pkt1) Firewall Rules

Egress (Outbound) Firewall Rules 

It is recommended to open all ports using Outbound/Egress rules in the firewalls associated with management, HA and packet interfaces.   

Creating Route Rules

Google Cloud Platform (GCP) routes define the paths network traffic takes from a VM instance to other destinations. These destinations can be inside your VPC network (for example, in another VM) or outside of it.

GCP has four different types of routes in two categories. System-generated routes are automatically created when you create a network, add a subnet, or modify the secondary IP range of a subnet. Custom routes are those that you create and maintain, either directly or by using a Cloud Router. 

Every route consists of a destination and a next hop. Traffic whose destination IP is within the destination range is sent to the next hop for delivery.

When you create a VPC network, GCP creates a system-generated default route. This route serves two purposes:

• It defines the path out of the VPC network, including the path to the Internet. In addition to having this route, instances must meet additional requirements if they need Internet access.

• It provides the standard path for Private Google Access.

Initial Default System-Generated Routes for MGT0, HA0, PKT0, PKT1

 

The system-generated default route has a priority of 1000. Because its destination is the broadest possible (0.0.0.0/0), GCP will only use it if a route with a more specific destination does not apply to a packet. Refer to routing order for details about how destination specificity and route priority are used to select a route.

You can delete the default route in order to completely isolate your network from the Internet or if you need to replace it with a custom route.

For detailed information on the Routing in GCP, refer to Routes.

To remove the HA0 system-created route, complete the following procedure:

1. Navigate to Networking > VPC network > Routes.
   The list of existing Routes for the project will be displayed.
   

2. Select the outgoing route for the HA0 network and click DELETE to remove it.
   
   You will be asked to confirm the deletion.

   Note

   You cannot delete the default VPC network routes.

To add a route for mgt0 to a Bastion Server or VPN IP address, complete the following procedure:

1. Navigate to Networking > VPC network > Routes.
   
2. Click CREATE ROUTE.
3. Click Create Route Table to create a route table for MGT0.
   
4. Enter a Name for the route and Description.
5. Select the management network (in this case mtg0) under Network.
6. Enter the Destination IP range as 0.0.0.0/0 to route all outbound traffic to the bastion server.
7. Select Specify IP address under Next hop.
8. Enter the IP address of the bastion server under Next hop IP address.
   
9. Click Create.
   The route will be created and the route list updated.
10. Repeat if required to add or remove other routes for PKT0 and/or PKT1

Reserving Static IP Addresses

In order to be able to access the SBC management IP, you must associate a static IP address to MGT0 private primary IP and any secondary private IP addresses.

Based on your network requirement you can associate Static IP addresses to secondary IP addresses of PKT0 and PKT1 network interfaces also.

To reserve a static IP address for MGT0, complete the following steps:

1. Navigate to Networking > VPC network > External IP addresses.
   The External IP addresses list is displayed.
   
2. Click Reserve static address (if no addresses exist) or click the plus ( + ) button.
   The Reserve a static address page is displayed.
   
3. Enter a Name and a Description for the IP address.
4. Select Premium for Network Service Tier.
5. Select IPv4 for IP Version.
6. Select Regional for Type.
7. Select the appropriate Region for the static IP address to be allocated in.
8. Click Reserve.

Associating Static IP Addresses to MTG0:

To associate a static IP address to MTG0:

1. Navigate to Networking > VPC network > External IP addresses.
   The External IP addresses list is displayed.
   
2. Click on Change next to the desired unused external IP address. 
   The Attached IP address window appears.
   
3. Select the appropriate internal IP address from the Attach to drop-down list.

4. Click OK.

5. Repeat as required for PKT0 and PKT1 network interfaces.

Instantiating a Standalone GCE SBC Instance

Complete the following steps to instantiate a Standalone SBC instance in Google Cloud:

1. From the GCP Console Navigation menu, navigate to, select Compute Engine > VM instances.
2. Click Create. 
   The Create an instance page is displayed.
   
3. Enter a name in the Name field.
4. Select an appropriate Region.
5. Select an appropriate Zone.
6. Click Customize in the Machine type panel to open the expanded list.
7. Use the sliders to select 4 vCPU and 15 GB memory. 
   
8. Select Intel Broadwell or later under CPU platform.
9. Choose the Boot disk option and then press Change to open the Boot disk panel: 
   
10. Select Custom Images, then select the account containing the image (if not the current) and choose the SBC image.
11. Select SSD persistent disk as the Boot disk type with the disk size as ≥ 65GB. 
12. Click Select.
13. Under Identity and API access click Allow full access to all Cloud APIs.
14. Click on Management, security, disks, networking, sole tenancy. The tab will expand.
    

15. Click Management.

16. In the Metadata section, enter the following data using Key value "user-data". The following table describes the user-data. 

    Meta Data Format - Key = user-data

    Meta Data value

    #cloud-config
    runcmd:
        - usermod -p '$6$io3njQos$gZtBJ4MazQeWC0beqQwRPUDZCQcKXhMr2B8QLWYGajchR2BtkyHPvBTCQj0LctHAFaYTwbsIsUkm12ta4IoLe/' linuxadmin
    write_files:
        - content: | 
              {
                "CEName": "<CEName>",
                "SystemName": "<SystemName>",
                "SbcPersonalityType": "isbc",
                "Mgt0Prefix": "<prefix>",
                "ThirdPartyCpuAlloc" : "0",
                "ThirdPartyMemAlloc" : "0"
              } 
    path: /opt/sonus/conf/userData.json

    Meta Data Example - Key = user-data

    Meta Data value

    #cloud-config
    runcmd:
        - usermod -p '$6$io3njQos$gZtBJ4MazQeWC0beqQwRPUDZCQcKXhMr2B8QLWYGajchR2BtkyHPvBTCQj0LctHAFaYTwbsIsUkm12ta4IoLe/' linuxadmin
    write_files:
        - content: |
              {
                "CEName": "vsbc1",
                "ReverseNatPkt0" : "False",
                "ReverseNatPkt1" : "False",
                "SystemName": "vsbcSystem",
                "SbcPersonalityType": "isbc",
               "ThirdPartyCpuAlloc" : "0",
               "ThirdPartyMemAlloc" : "0",
                "Mgt0Prefix": "20"
              }
          path: /opt/sonus/conf/userData.json

    Userdata Content Description

    Parameter	Length	Type/Format	Description
    CEName	64	string	This specifies the actual CE name of the SBC instance. For more information, see System and Instance Naming Conventions. CEName Requirements: Must start with an alphabetic character. Only contain alphabetic characters and/or numbers. No special characters. Cannot exceed 64 characters in length
    SystemName	26	string	This specifies the actual system name of the SBC instance. For more information, see System and Instance Naming Conventions. System Requirements: Must start with an alphabetic character. Only contain alphabetic characters and/or numbers. No special characters. Cannot exceed 26 characters in length.
    Mgt0Prefix	2	digits	The prefix (for example, /24) of the MGT0 subnet.
    SbcPersonalityType	4	string	The name of the SBC personality type for this instance. At this time only integrated SBC (isbc) is supported in AWS.
    ThirdPartyCpuAlloc	n/a	0-? in vCPUs	Enter the number of CPUs to be reserved for use with third-party apps.   Note: Default is 0
    ThirdPartyMemAlloc	n/a	0-? in MB	Enter the number of MB of memory to be reserved for use with third-party apps.    Note: Default is 0

17. Click Networking.

18. Click default under Network interfaces. The default Network interface will expand.

    

19. Select the management VPC Network that you created earlier.

20. For Subnetwork select the management network that you created earlier.

21. Select Ephemeral (Automatic) for Primary internal IP.

22. Select an External IP for management based on that you created earlier.

23. Click Done.

24. Click Add network interface to add an interface for HA0.

25. Select the appropriate VPC Network that you created earlier.

26. For Subnetwork select the management network that you created earlier.

27. Select Ephemeral (Automatic) for Primary internal IP.

28. Click Done.

29. Repeat steps 24-28 for PKT0 and PKT1 networks.

    When completed, the Networking tab will be similar to this example: 

    
30. Click Create to instantiate the VM.

Enabling Serial Console Access to the Instance

1. After you create the instance, click the instance name and then click EDIT.
2. Enable the console access by clicking Enable connecting to serial ports.
3. Click Save. 

Connecting to the Serial Console of the Instance

1. After you create the instance, click the instance name and then click EDIT.
2. Connect to the serial console by clicking Connect to serial console. 
   
3. The first item shown in the console is the ssh key information needed to connect to the instance using SSH key.