Deploy Secure Mesh Site v2 in OpenStack (ClickOps)

Published April 5, 2023 | Last modified February 24, 2025

Objective

This guide provides instructions on how to create a customer edge (CE) site using F5® Distributed Cloud Console to deploy a Linux Kernel-based Virtual Machine (KVM) on OpenStack cloud platform. For more information on a CE Site, refer to F5 Distributed Cloud - Customer Edge.

As part of the new site deployment workflow, you can deploy the CE site as a Secure Mesh Site using OpenStack.

Important: This guide does not provide instructions on how to deploy an F5® App Stack Site. This functionality is in Early Access (EA) and can be used for PoC/PoV deployments. This will be made Generally Available (GA) over the next couple of releases. Please reach out to your account representative for more information.

Prerequisites

The following general prerequisites apply:

A Distributed Cloud Services Account. If you do not have an account, see Getting Started with Console.
Resources required per node: Minimum 4 vCPUs, 14 GB RAM, and 80 GB disk storage. For a full listing of the resources required, see the Customer Edge Site Sizing Reference guide. All the nodes in a given CE Site should have the same resources regarding the compute, memory, and disk storage. When deploying in cloud environments, these nodes should use the same instance flavor.
Allow traffic from and to the Distributed Cloud public IP addresses to your network and allowlist related domain names. See Firewall and Proxy Server Allowlist Reference guide for the list of IP addresses and domain names.
F5 assumes that an existing IPv4 subnet exists with Internet connectivity to attach to the node.
The new Secure Mesh Site workflow enables you to have up to eight interfaces. However, these interfaces should be in different subnets. Therefore, make sure you have the required subnets available before creating the CE Site nodes.
Internet Control Message Protocol (ICMP) needs to be opened between the CE nodes on the Site Local Outside (SLO) interfaces. This is needed to ensure intra-cluster communication checks.

Important: After you deploy the CE Site, the IP address for the SLO interface cannot be changed. Also, the MAC address cannot be changed.

Procedure

In this guide, the procedure demonstrates the steps to deploy a single-node site.

Create Site Object

Create a secure mesh site object in Distributed Cloud Console. Refer to the Create Secure Mesh Site guide.
Set the Provider Name option to OpenStack. The Orchestration Mode is set automatically to Not Managed by F5XC (in other words, manual mode).

Figure: Provider Type

Confirm the High Availability (HA) setting. Refer to the Create Secure Mesh Site guide. For this procedure, High Availability is disabled since a single node is being deployed.
Leave the other options with default values. These options have intelligent default values and do not need further configuration. Refer to the Create Secure Mesh Site guide for more information on these options.
Click Save and Exit.
For the site object, under Actions, click ... > Copy Image Name to receive a download link to use for CLI with the curl or wget commands. To download the image file locally, click Download Image.

Create a Network Security Group

Add rules for the following:

Allowed SSH from the instance.
Allowed ICMP for troubleshooting.
Allowed TCP for any port for the local UI on the CE.
For three-node clusters, ensure that traffic is allowed between the nodes.

Figure: Security Group Rules

Download and Create Node Image

Step 1: Download and unzip file.

In Console, navigate to the Multi-Cloud Network Connect service.
Click Manage > Site Management > Secure Mesh Sites v2.
For your site, click ... > Download Image. This action will start downloading the f5xc-ce-<version>.qcow2 file onto your local machine.

Figure: Download Node Image

Step 2: Upload file to OpenStack portal.

In OpenStack portal, navigate to the Images page under the Compute section.
Click Create Image.
Define the image name and then upload the image in the Image Source with format QCOW2. Leave all other default settings.

Figure: Upload Node Image

Configure Network Settings

Step 1: Create a new network.

Ignore this step if you already have such network configured in your OpenStack environment.

In OpenStack portal, navigate to Networks and click Create Network.
Configure the network details, such as network name, enable admin state, create subnet, and MTU. This network will be used as the primary network for the site. Make sure this network is pingable and accessible from your local network. Also, this network should have connectivity to the public Internet.

Figure: Create Network

Step 2: Add one or more subnets.

Ignore this step if you already have a subnet associated with this network.

Navigate to the Subnet tab and enter a Subnet Name and Network Address.
Set the IP Version to IPv4.
Enter a Gateway IP address.

Figure: Add Subnet

Step 3: Configure advanced settings for subnet.

Ignore this step if you already have a pre-configured subnet.

In the Subnet Details tab, enter other details, such as Enable DHCP, Allocation Pools, DNS Name Servers and Host Routes (next hop), if any.
Click Create.

Figure: Subnet Details

Generate Node Token

A one-time node token is required to register a CE Site node to the Distributed Cloud Console. A new token must be generated for every new node in a CE Site. A token is valid for 24 hours. Make sure that the CE node is deployed soon after the token is generated.

The token is included in the cloud-init information under the Content variable. Also included are two variables commented out: slo_ip and slo_gateway. These variables can be commented out if you are using your own DNS service and not the default DNS service provided by F5.

In Distributed Cloud Console, select the Multi-Cloud Network Connect service.
Navigate to Manage > Site Management > Secure Mesh Sites v2.
For your site, click ... > Generate Node Token.

Figure: Node Token

Click Copy cloud-init.
Save the value locally. This token will be used later. The token value is hidden for security purposes.

Figure: Copy Node Token

Click Close.
Generate one token per node you intend to deploy.

Create OpenStack Virtual Machine

Before deploying a new virtual machine in OpenStack, ensure that suitable flavors are available with a minimum of 4 vCPUs, 16 GB of RAM, and an 80 GB root disk. For demonstration purposes, the m1.xlarge flavor is used, which meets these minimum requirements.

Important: The name of the VM should not have . in it. For example, the hostname can be node-0 or node0, but it cannot be node.f5.com since it is not supported. If configuring a multi-node site, each node hostname must be unique.

Figure: Instance Types

Step 1: Launch new instance.

Navigate to the Compute section in the left-hand menu.
Click Launch Instance and fill in the details along with the Availability Zone.

Figure: Launch Instance

Step 2: Select source image.

From the Select Boot Source menu, select Image.
Select the latest f5xc-ce-<version> image from the Available list of images and click the up arrow to select it.

Figure: Boot Source

Step 3: Select flavor for the virtual machine.

Select the flavor that meets minimum requirement of 4 vCPUs, 16 GB RAM, and 80 GB root disk.
Click the up arrow to select the flavor.

Figure: Image Flavor

Step 4: Select VM network.

Navigate to the Networks section.
Select the network that was created in the previous section.

Figure: Instance Network

You can add additional networks either during VM creation or after it has been launched. However, the primary interface must have Internet connectivity enabled. Ensure the primary network is attached first, followed by the other networks in sequence.

Step 5: Select security groups.

Select the security group that has appropriate inbound and outbound rules, as described in the previous section.

Figure: Instance Security Group

Step 6: Apply the configuration.

Navigate to the Configuration section.
Copy the cloud-init information (which includes the node token) generated as part of the Generate Node Token section above and paste it in the Customization Script text box.
Click Launch Instance.

Figure: Instance Configuration

Figure: Instance Node Created

Verify CE Site Registration

In Distributed Cloud Console, navigate to Multi-Cloud Network Connect > Overview > Infrastructure > Sites.
Select the site. The Dashboard tab should clearly show that the CE Site has registered successfully with the System Health of 100% as well as Data Plane/Control Plane both being up.
Select the Infrastructure tab and view the Interfaces table.

Figure: Verify Interfaces Created

Note: For more information on the site registration process, see the Customer Edge Registration and Upgrade Reference guide.

Add New Network Interface

After the CE Site is successfully registered, you may want to add additional network interfaces to cater to different customer requirements.

Important: Adding a new network interface will cause the data plane services to restart. Therefore, it is strongly recommended to perform this operation during maintenance windows. As data plane services restart, traffic drops are expected, as well as tunnels going down.

When adding interfaces, it is important to make sure that the interfaces are added to each node in the cluster. Nodes with non-homogenous interfaces within a CE Site might cause issues. Therefore, each node in a given CE Site should have the same number of interfaces placed in the same VRFs.

Troubleshooting

For troubleshooting issues, see the Troubleshooting Guide for Secure Mesh Site v2 Deployment guide. It provides step-by-step instructions to debug and resolve the issues that may arise due to registration and provisioning errors.