Integrate VOS Devices in an Alibaba Cloud Deployment

Activate the OSS

To activate the Alibaba object storage service (OSS):

1. Log in to the Alibaba cloud website.
2. In the product list, click Object Storage Service.
3. On the Object Storage Service page, click Buy Now.
4. When the OSS is activated, access the OSS console. To do this, eithe rclick Management Console on the Object Storage Service page, or click Console in the upper right corner to access the Alibaba cloud console and then select Object Storage Service in the left menu bar.
   
   

Create an OSS Bucket

To create an OSS storage bucket:

1. Log in to the OSS console.
2. Click Create Bucket to open the Create Bucket screen. Enter information for the following fields.
   
   
   
    

   Field	Description
   Bucket Name	Enter a name for the bucket. The name must comply with the Alibaba bucket naming conventions, and it must be unique among all existing buckets in the Alibaba cloud OSS. Note that once you have created a bucket, you cannot change its name.
   Region	Select the data center for the bucket. Note that once you have created a bucket, you cannot change its region.
   Storage Class	Select Standard.
   Access Control List (ACL)	Select Private Access Permission. With private permission, only the owner of the bucket and the authorized users can perform read, write, and delete operations on the objects in the bucket. Other users cannot access objects in the bucket.

3. Click OK.

Upload the VOS Image

The Alibaba cloud classifies ECS images as public images, custom images, shared images, and marketplace images. VOS images must be deployed as custom images. You can import image files whose format is QCOW2, RAW, or VHD.

To upload the VOS image to the OSS bucket:

1. Log in to the OSS console.
2. In the bucket name list, click the name of the bucket to which you want to upload the VOS image file.
3. Select the Files tab.
   
   
4. Click Upload.
5. In the Directory Address field, enter the directory to which to upload the file.
6. In the File ACL field, select the read and write permissions of the file that you are uploading. By default, a file inherits the read and write permissions of its bucket.
7. In the Upload field, drag one or more files to upload to this area, or click Upload Them Directly to select one or more files to upload.
   
   
   

Create a Custom Image for Versa VMs on Alibaba

1. Navigate to the Images page.
   
   
   
   
   
   
   
   
2. On the Images page, click Import Image.
   
   
3. In the Import Image screen, enter information for the following fields.
   
   
    

   Field	Description
   Region of Image	Select the region where the OSS Bucket of the image file to upload is located.
   OSS Object Address	Copy the object address of the image file from the OSS console.
   Image Name	Enter a name for the custom image. The name must be 2 to 128 characters in length and can contain letters, numbers, Chinese characters, periods (.), underscores (_), colons (:), and hyphens (-).
   Operating System	Select Linux
   System Disk Size	Select 80 GiB. The system disk size can be from 40 through 500 GiB.
   System Architecture	Select x86_64.
   Platform	Select Ubuntu.
   Image Format	Select the image format: QCOW2 RAW VHD. This is the recommended format

4. Click OK.

To copy a custom image to a different region:

1. Click Copy Image.
   
   
2. In the Copy Custom Image screen, select the region.
   
   
3. Click OK.

Create an Instance from a Custom Image

1. Log in to the Elastic Computer Service console.
2. In the left menu bar, click Instances. Alternatively, you can click Images to locate the target image, and then click Create Instance in the Actions column.
3. Click Create Instance.
   
   
4. Use the wizard to create the instance. In the Region field, select the region where the image is located. In the Image field, select Custom Image, and then select an image.
    
   • 
     
     
     
     
5. Confirm the order.
6. Check that your cloud infrastructure is correct.

Create a VPC

A virtual private cloud (VPC) is a private network established in the Alibaba cloud. VPCs are logically isolated from other virtual networks in the Alibaba Cloud. Each VPC is assigned a private CIDR block and contains one virtual router (VRouter) and at least one virtual switch (VSwitch).

VSwitches are basic network devices that are used to form a VPC and that connect different cloud product instances. VPCs are region-level resources. A VPC cannot be used across multiple regions, but it can contain all zones in a region. You can create one or more VSwitches in a zone to divide the zone into multiple subnets.

To create a VPC:

1. In the left menu bar, select Virtual Private Cloud.
   
   
2. In the Create VPC screen, configure the VPC as illustrated in the following screenshots.
   
   
   
   
   
   
3. Click Add.

Create a VOS Virtual Machine

You create a virtual machine (VM) for the VOS device. Note that this is a critical step, because the first network that you choose below becomes the primary elastic network interface (ENI), and it must be the LAN interface. You cannot change the primary ENI later to a different network. Another reason that the primary ENI must be the interface is that when you later deploy HAVIP (VRRP), Alibaba requires that you must deploy it on the primary ENI.

To create a VOS VM:

1. Select the network type.
   
   
2. Select the type of login credentials and the instance name. For the login credentials, you can choose SSH key pair or Password, depending on the requirements of your cloud administrator. Note that SSH key pair is the more secure option.
   
   
   
   
3. When prompted, save the .pem key on the managing workstation.
4. If required by your cloud administrator, create a deployment set.
5. Click Preview > Purchase.
6. If, at any point, you want to use a username and password instead of SSH, go to ECS > instance-name > More > Reset Password.
   
   
    

7. Create the ENIs for LAN, WAN, MGMT and the EIP for WAN and MGMT, as describe below. After you create these, you can log in using SSH.

Create Security Groups

To create security groups for the WAN, LAN, and MGMT interfaces:

1. Go to ECS > Network and Security > Security Groups > Create Security Group. The following example is for MGMT.
   
   
2. Select the Add Security Group Rule tab. In the Add Security Group Rules screen, enter information for the security group rule.
   
   
3. Select the Inbound tab, and enter information about inbound ports.
   
   
4. Select the Outbound tab, and enter information about outbound ports.
   
   
5. Click OK.

For the LAN security group, you restrict it or set it to any/any.

The following table is the ports required for the WAN security group.

Create ENIs

1. Go to ECS > Network and Security > ENI > Create ENI.
   
   
    
2. Select the IP address to allocate, or leave this field blank to allocate an available IP address from within the subnet.
3. Select the security group depending on whether the ENI belongs to a LAN, WAN, or MGMT interface.
   
   
4. Repeat Steps 1, 2, and 3 for the MGMT ENI and an other ENIs

Create the EIPs (public IP addresses) for the WAN and MGMT interfaces:

1. Go to ECS > Network and Security > EIP, or go to VPC > Elastic IP addresses > Create EIP or VPC > Elastic IP addresses > Create EIP.
   
   
2. Create the EIPs.
   
   
3. Confirm the order and click Activate.
   
   
4. Click End.
   
   
5. Associate the EIPs with the WAN and MGMT ENIs:
   
   

​​Configure HAVIP

High availability virtual private network IP (HAVIP) is a private network IP resource that you can create and release independently. Afeature of this private network IP is that the user can use the ARP protocol on the ECS to announce this IP address.

A HAVIP object can be bound to a maximum of two ECS instances. Instances can be bound by ARP by the way of private network IP announcement.

An ECS instance can hold the common private network IP address. A user can declare multiple private network IP addresses of HAVIP type, thereby simultaneously holding multiple private IP addresses.

Utilizing the private network IP announcements available on ECS, you can implement high-availability solutions based on VRRP, including mature open source solutions such as keepalived and heartbeat.

HAVIP can be bound to the EIP so that when HAVIP switches between ECS instances, messages sent to the EIP are redirected to the new ECS instance.

HAVIP supports only VPC network environments. The HAVIP function is not available in the Classic network environment.

By default, HAVIP is not visible under the VPC. You must open a support ticket with Alibaba to enable the HAVIP dashboard for the cloud account. When you open the support ticket, you must include the open source tools keepalived and heartbeat, at a minimum, in the HAVIP backend.

A typical use case for using HAVIP is when an application on ECS needs to rely on the declaration of private IP addresses by ARP. Because open source tools such as keepalived and heartbeat are used in HAVIP to achieve high availability for the network and services, two ECS instances are needed, as shown in the following figure. These two ECS instances, based on HAVIP, use keepalived to form a private network service with high availability. Other instances in the VPC can access the service through the private network, and the service address is the IP address of HAVIP. When instance 1 fails, instance 2 takes over the service and the service IP address does not change.

HAVIP has the following imitations:

• Each instance can hold a maximum of five HAVIP objects. Deleted HAVIP objects are not counted.
• A maximum of five HAVIP objects can exist simultaneously in each VPC. Deleted HAVIP objects are not counted.
• Each cloud server instance can bind up to five HAVIPs at the same time. A user can only bind a maximum of two cloud server instances at a time.
• Multicast communication cannot be used.
• Broadcast communication cannot be used.

Before you configure HAVIP, you must modify the VOS boot configuration file and stage the VOS device using ZTP.

~$ sudo nano /etc/ssh/sshd_conf

Match Address 172.23.1.2/32 
  PasswordAuthentication yes 
Match all 

~$ sudo nano /etc/ssh/sshd_conf
PasswordAuthentication yes 

~$ sudo nano /etc/network/interfaces
//Change eth0 to eth2 

~$ sudo /opt/versa/scripts/staging.py -w 1 -c 103.231.208.60 -d -l SDWAN-Branch@Versa.com -r Controller01-staging@Versa.com

Control Route Tables

After you create a VPC, the system creates a default route table to control routes in the VPC. By default, al the l VSwitches in the VPC use this route table. You cannot create or delete the default route table. However, you can create a custom route table and attach it to the VSwitch to control the routes in the subnet.

To create a custom route table:

1. Go to VPC > Route Table > Create Route Table.
2. Go to Created Route Table > Add Route Entry

The example here creates a custom route using the HAVIP IP address (here, the VRRP virtual IP address), to reach the Beijing LAN subnet 192.168.100.0/24:

The following figures and ping command output illustrate the convergence times when a LAN or WAN link fails.The following figure shows the operational topology.

Failure of a Shanghai LAN:

Recovery of the Shanghai LAN:

Failure of a Beijing LAN:

Recovery of the Beijing LAN:

Result of the Shanghai LAN failure:

Result of the Beijing LAN failure:

Supported Software Information

Releases 21.2.2 and later support all content described in this article.