Rackspace is a leading provider of expertise and managed services across all the major public and private cloud technologies. The Rackspace Cloud is a set of cloud computing products and services billed on a utility computing basis.

You can deploy the ASA virtual for Rackspace as a virtual appliance in the Rackspace cloud. This chapter explains how to install and configure a single instance ASA virtual appliance.

Instance types in the Rackspace Cloud are referred to as flavors. The term flavor refers to a server's combination of RAM size, vCPUs, network throughput (RXTX factor), and disk space. The following table lists Rackspace flavors suitable for ASA virtual deployment.

About Rackspace Flavors

Rackspace Virtual Cloud Server Flavors fall into the following classes:

• General Purpose v1

  • Useful for a range of use cases, from general-purpose workloads to high performance websites.

  • The vCPUs are oversubscribed and “burstable”; in other words, there are more vCPUs allocated to the Cloud Servers on a physical host than there are physical CPU threads.

• Compute v1

  • Optimized for web servers, application servers, and other CPU-intensive workloads.

  • The vCPUs are “reserved”; in other words, there are never more vCPUs allocated to the Cloud Servers on a physical host than there are physical CPU threads on that host.

• Memory v1

  • Recommended for memory-intensive workloads.

• I/O v1

  • Ideal for high performance applications and databases that benefit from fast disk I/O.

• Create a Rackspace account.

  All Rackspace Public Cloud accounts are set to the Managed Infrastructure service level by default. You can upgrade to the Managed Operations service level inside the Cloud Control Panel. At the top of the Cloud Control Panel, click your account username and then select Upgrade Service Level.

• License the ASA virtual. Until you license the ASA virtual, it will run in degraded mode, which allows only 100 connections and throughput of 100 Kbps. See Licensing for the ASA Virtual.

• Interface requirements:

  • Management interface

  • Inside and outside interfaces

  • (Optional) Additional subnet (DMZ)

• Communications paths:

  • Management interface—Used to connect the ASA virtual to the ASDM; can’t be used for through traffic.

  • Inside interface (required)—Used to connect the ASA virtual to inside hosts.

  • Outside interface (required)—Used to connect the ASA virtual to the public network.

  • DMZ interface (optional)—Used to connect the ASA virtual to the DMZ network.

• For ASA and ASA virtual system compatibility and requirements, see Cisco Secure Firewall ASA Compatibility.

Your cloud configuration can include several kinds of networks, connected as appropriate for your needs. You can manage the networking capabilities of your cloud servers in many of the same ways you manage your other networks. Your ASA virtual deployment will interact primarily with three types of virtual networks in the Rackspace Cloud:

• PublicNet―Connects cloud infrastructure components such as cloud servers, cloud load balancers, and network appliances to the Internet.

  • Use PublicNet to connect the ASA virtual to the Internet.

  • The ASA virtual attaches to this network via the Management0/0 interface.

  • PublicNet is dual-stacked for IPv4 and IPv6. When you create a server with PublicNet, your server receives an IPv4 address and an IPv6 address by default.

• ServiceNet―An internal, IPv4-only multi-tenant network within each Rackspace cloud region.

  • ServiceNet is optimized to carry traffic across servers within your configuration (east-west traffic).

  • It provides servers with no-cost access to regionalized services such as Cloud Files, Cloud Load Balancers, Cloud Databases, and Cloud Backup.

  • The networks 10.176.0.0/12 and 10.208.0.0/12 are reserved for ServiceNet. Any servers that have ServiceNet connectivity will be provisioned with an IP address from one of these networks.

  • The ASA virtual attaches to this network via the Gigabit0/0 interface.

• Private Cloud Networks―Cloud Networks lets you create and manage secure, isolated networks in the cloud.

  • These networks are fully single tenant, and you have complete control over the network topology, IP addressing (IPv4 or IPv6), and which Cloud Servers are attached.

  • Cloud Networks are regional in scope, and you can attach them to any of your Cloud Servers in a given region.

  • You can create and manage Cloud Networks via an API or by using the Rackspace Cloud Control Panel.

    The ASA virtual attaches to these networks via Gigabit0/1 through Gigabit0/8 interfaces.

When a VM is deployed in the Rackspace Cloud, a CD-ROM device containing files with Rackspace provisioning information is attached to the VM. The provisioning information includes:

• The hostname

• IP addresses for required interfaces

• Static IP routes

• Username and password (Optional SSH public key)

• DNS servers

• NTP servers

These files are read during the initial deployment and ASA configuration is generated.

ASA Virtual Hostname

By default, the ASA virtual hostname is the name you assign to your cloud server when you begin to build your ASA virtual.

hostname rackspace-asav

Note

The ASA virtual will alter the cloud server name to comply with these rules while making it as close as possible to the original cloud server name. It will drop special characters from the beginning and end of the cloud server name, and replace non-compliant interior characters with a hyphen. For example, a cloud server named ASAv-9.13.1.200 will have hostname ASAv-9-13-1-200.

Interfaces

Interfaces are configured in the following manner:

• Management0/0

  • Named ‘outside’ because it is connected to the PublicNet.

  • Rackspace assigns both IPv4 and IPv6 public addresses to the PublicNet interface.

• Gigabit0/0

  • Named ‘management’ since it is connected to the ServiceNet.

  • Rackspace assigns an IPv4 address from the ServiceNet subnet for the Rackspace region.

• Gigabit0/1 through Gigabit0/8

  • Named ‘inside’, ‘inside02’, ‘inside03’, etc. because they are connected to private Cloud Networks.

  • Rackspace assigns an IP address from the Cloud Network subnet.

The interface configuration for an ASA virtual with 3 interfaces would look something like this:

interface GigabitEthernet0/0
 nameif management
 security-level 0
 ip address 10.176.5.71 255.255.192.0 
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 172.19.219.7 255.255.255.0 
!
interface Management0/0
 nameif outside
 security-level 0
 ip address 162.209.103.109 255.255.255.0 
 ipv6 address 2001:4802:7800:1:be76:4eff:fe20:1763/64

Static Routes

Rackspace provisions the following static IP routes:

• Default IPv4 route via PublicNet interface (outside).

• Default IPv6 route via PublicNet interface.

• Infrastructure subnet routes on ServiceNet interface (management).

route outside 0.0.0.0 0.0.0.0 104.130.24.1 1
ipv6 route outside ::/0 fe80::def
route management 10.176.0.0 255.240.0.0 10.176.0.1 1
route management 10.208.0.0 255.240.0.0 10.176.0.1 1

Login Credentials

A username ‘admin’ is created with a password created by Rackspace. A public key for user ‘admin’ is created if the cloud server is deployed with a Rackspace Public Key.

username admin password <admin_password> privilege 15
username admin attributes
 ssh authentication publickey <public_key>

The Day0 SSH configuration:

• SSH via PublicNet interface (outside) is enabled for IPv4 and IPv6.

• SSH via ServiceNet interface (management) is enabled for IPv4 .

• Configure stronger key exchange group at request of Rackspace.

aaa authentication ssh console LOCAL
ssh 0 0 management
ssh 0 0 outside
ssh ::0/0 outside
ssh version 2
ssh key-exchange group dh-group14-sha1

DNS and NTP

Rackspace provides two IPv4 service addresses to be used for DNS and NTP.

dns domain-lookup outside
dns server-group DefaultDNS
 name-server 69.20.0.164 
 name-server 69.20.0.196

ntp server 69.20.0.164
ntp server 69.20.0.196