Overview of Cisco Catalyst 8000V Edge Software on Microsoft Azure

Cisco Catalyst 8000V Edge Software is a full-featured Cisco IOS XE router, enabling IT departments to deploy enterprise-class networking services in the Microsoft Azure cloud. Most Cisco IOS XE features are also available on the virtual Cisco Catalyst 8000V.

You can choose to deploy Cisco Catalyst 8000V software on new or existing infrastructure such as a virtual network.

The following VPN features are supported on Cisco Catalyst 8000V: IPsec, DMVPN, FlexVPN, and SSLVPN. You can use dynamic routing protocols such as EIGRP, OSPF, and BGP to construct multi-tier architectures within Azure, and interconnect with corporate locations or other clouds.

You can secure, inspect, and audit hybrid cloud network traffic with application-aware Zone Based Firewall. You can also use IP SLA and Application Visibility and Control (AVC) to find out about performance issues, fingerprint application flows, and export detailed flow data for real-time analysis and network forensics.

Prerequisites for Deploying Cisco Catalyst 8000V on Microsoft Azure

These are the main three prerequisites for deploying a Cisco Catalyst 8000V:

  • You must have a user account/subscription with Microsoft Azure. For more information about creating an account with Microsoft Azure, see Get started with Azure.

  • You must deploy a number of resources before or during the deployment of the Cisco Catalyst 8000V. For a description of the required resources, see Microsoft Azure Resources.

  • You must either obtain a BYOL software license or opt for the Pay-As-You-Go licensing model for the Cisco Catalyst 8000V instance. For more information, see the Licensing section in this guide.

Microsoft Azure Resources

To deploy a Cisco Catalyst 8000V on Microsoft Azure, the following resources are required. You must create the required resources when you deploy Cisco Catalyst 8000V if they do not already exist in the Azure network.

  • Resource group - container for resources. Resources include virtual machines, interfaces, virtual networks, routing tables, public IP addresses, security groups and storage accounts. These resources are described in detail below.


    Note


    You must deploy a Cisco Catalyst 8000V with a Single Interface within an existing resource group. The resource group can already contain other resources.


    If you create an object in a resource group that depends upon an object in a second resource group, the second resource group cannot be deleted until you delete your object in the first resource group. Create a new resource group for a new deployment. For more information about resource groups, see: Azure Resource Manager overview.

  • Virtual network - a Cisco Catalyst 8000V with a 2-, 4-, or 8- Network Interface Cards (NICs), requires a virtual network with a set of defined subnets. Cisco Catalyst 8000V with a single interface requires a new or an existing virtual network with 1 subnet. For more information about virtual networks, see Azure Virtual Network.

  • Route table - contains user defined routes (UDRs) for subnet​works.

  • Security group - contains security rules for the virtual network.

  • Public IP address - IP address of the Cisco Catalyst 8000V instance.

  • Storage account - required for the Cisco Catalyst 8000V image, VM disk files and boot diagnostics. The storage account type Standard_LRS is the only currently supported type. For more details about creating a storage account, see: About Azure storage accounts.

  • Boot Diagnostics - useful for debugging issues found during the operation of the Cisco Catalyst 8000V.

  • Availability Set - contains a group of VMs. The VMs are logically separate and can run across multiple servers, racks and switches in a data center. For more information on availability sets, see Information about Availability Sets, in this document. Also search for Availability Set in the Microsoft Azure Documentation.

  • Managed Disks - manage the storage accounts of VM disks. When you create a managed disk, specify the disk type (Premium or Standard) and the size of disk that you require. Azure Storage Service Encryption (SSE) is used by default for all managed disks. For more information on managed disks, see Azure Managed Disks Overview.

  • Interfaces - For a Cisco Catalyst 8000V VM with 2, 4, or 8 network interfaces, you can assign a public IP address to any interface. Commonly, the public IP address is assigned to the first interface. All Cisco Catalyst 8000V VM interfaces are in a private subnet. You can assign the IP address of each private interface using the ip address dhcp command in the interface configuration or assign a static IP address using the ip address command. For example, ip address 1.1.1.1 255.255.255.0. If you use a static IP address, ensure that the IP address is the same as the IP address assigned by Microsoft Azure. View the IP address of an interface by looking at the VM network settings in the Azure marketplace.

Cisco Catalyst 8000V Deployments in the Microsoft Azure Marketplace

Cisco has published a set of deployments in the Microsoft Azure marketplace to help create and manage resources. The following templates are currently supported:

  • Cisco Catalyst 8000V solution template - Using this template, you can deploy a Cisco Catalyst 8000V with 2-, 4-, or 8- NICs, with other required resources.

  • Cisco Catalyst 8000V Virtual Machine template - Using this template, you can deploy a Cisco Catalyst 8000V with a single interface, with pre-existing resources.

If you are deploying a Cisco Catalyst 8000V instance in a new network with no existing resources, Cisco recommends that you use a full solution template. For more information, see the Cisco Catalyst 8000V Public Cloud Deployments section.

For a government cloud deployment, see the Cisco Catalyst 8000V Government Cloud Deployments section.

When you deploy a Cisco Catalyst 8000V instance with 2-, 4-, or 8- NICs solution template, many resources are automatically created. Ensure that you select a solution template based on the number of interfaces or subnets that you want in the virtual network. To know how to deploy the instance, see the Deploy a Cisco Catalyst 8000V with Multiple Interfaces in this guide.

To deploy a Cisco Catalyst 8000V instance and use the resources that already exist in Microsoft Azure, deploy the instance using a single interface template. For more information, see the Deploy a Cisco Catalyst 8000V with a Single Interface section. After you deploy a Cisco Catalyst 8000V instance with a single interface, you can manually add further interfaces using Powershell or Azure CLI commands. From Cisco IOS XE 17.15.1a release, Cisco Catalyst 8000V supports Microsoft Azure CLI version 2.9.1.

Supported Instance Types for Microsoft Azure

The following 2, 4 and 8 NIC solution templates are currently offered in the Microsoft Azure marketplace in the public cloud:

Cisco IOS XE Release

Supported Instance Types/Max NICs supported

Cisco IOS XE 17.13.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

  • D16_v5

Cisco IOS XE 17.12.2,

Cisco IOS XE 17.12.1

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

  • D16_v5

Cisco IOS XE 17.11.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.10.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.9.4a

Cisco IOS XE 17.9.3a

Cisco IOS XE 17.9.2a

Cisco IOS XE 17.9.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.8.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.7.2

Cisco IOS XE 17.7.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.6.6a

Cisco IOS XE 17.6.5a,

Cisco IOS XE 17.6.4a

Cisco IOS XE 17.6.3a

Cisco IOS XE 17.6.2a

Cisco IOS XE 17.6.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.5.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco IOS XE 17.4.2

Cisco IOS XE 17.4.1b

Cisco IOS XE 17.4.1a

  • D4_v2 / DS4_v2

  • D3_v2 / DS3_v2

  • D2_v2 / DS2_v2

  • F16s_v2

  • F32s_v2

Cisco Catalyst 8000V with 2 Network Interfaces - Example

This example shows the configuration that results after deploying a 2 network interface solution template from the Azure Marketplace.

A Cisco Catalyst 8000V virtual machine (2 vCPU, 7G RAM) is set up with 2 interfaces. There is a public IP address attached to the interface on the first subnet (NIC0). The first subnet (NIC0) has a security group with inbound rules for the interface. A default routing table is set up on the Microsoft Azure hypervisor router for the Cisco Catalyst 8000V. You can deploy a Cisco Catalyst 8000V instance on a new or existing virtual network.

Subnetting Limits

The Cisco Catalyst 8000V on Microsoft Azure supports a subnet mask between /8 and /29 (CIDR definition).

The subnet /29 is the smallest available in Microsoft Azure which supports 8 IP host addresses. 4 IP host addresses per subnet are reserved by Microsoft Azure. Therefore, for a /29 subnet, you have 4 IP host addresses available.

Information about Availability Sets

If you are deploying a Cisco Catalyst 8000V using a solution template for 2, 4 or 8 network interfaces from the Azure Marketplace, and you choose to use the availability set feature, you must use a new availability set.

Availability sets are only available in solution templates for the public cloud and not for solution templates in the government cloud.

For more information, see Azure Managed Disks Overview.

Availability Sets for a Cisco Catalyst 8000V with 2, 4 or 8 Network Interfaces

The logical grouping of VM resources in an availability set helps to keep groups of VMs isolated from one another. The VMs in an availability set can run across multiple physical servers, compute racks, storage units, and network switches. If you use availability sets and a hardware or Microsoft Azure software failure occurs, only a subset of your VMs are affected. You must use a new availability set if you are deploying a Cisco Catalyst 8000V using a solution template for 2, 4 or 8 network interfaces . An availability set is only available for Cisco Catalyst 8000V public cloud deployments. Availability sets are not available for Cisco Catalyst 8000V government cloud deployments.

When you choose to use an availability set and you are deploying a Cisco Catalyst 8000V with 2, 4 or 8 network interfaces using a solution template, you are asked to enter the following parameters:

  • Availability Set Name - name of the new availability set. You cannot use the name of an existing availability set.

  • Platform Fault Domain Count - count of the fault domains. VMs that are in the same fault domain share common storage as well as a common power source and network switch. Value: 1 or 2 (the default value is 2).

  • Platform Update Domain Count - count of the update domains which are a group of VMs and underlying physical hardware that can be rebooted simultaneously. Value: 1 to 20 (the default value is 20).

Availability Sets for a Cisco Catalyst 8000V with a Single Interface

To use an existing availability set, you must deploy a Cisco Catalyst 8000V with a Single Interface.

Frequently Asked Questions About Deploying Cisco Catalyst 8000V

1. When I search for C8000V in Azure Marketplace, I am presented with a list of Cisco Catalyst 8000V solution templates/deployments. Which one should I pick?

The best practices for deciding whether to pick a solution template (for 2-, 4- or 8- NICs) or to pick an individual Cisco Catalyst 8000V are as follows:

If you are creating a new virtual network, use one of the solution templates (for 2-, 4- or 8- NICs). This saves you the time and effort of manually creating all the resources.

If any of the following conditions are true, use an individual Cisco Catalyst 8000V.

  • You have an existing resource group which does not contain a Cisco Catalyst 8000V and you want to deploy Cisco Catalyst 8000V in the resource group.

  • You have an existing resource group which already contains a Cisco Catalyst 8000V and you want to deploy another one in the same availability set.

2. I want to create multiple Cisco Catalyst 8000V instances in my subscription and I want them all to be deployed in a single availability set. How can I do this?

Perform the following steps:

  1. Deploy the first Cisco Catalyst 8000V using a 2, 4, 8 NIC solution template. Create a new availability set for this Cisco Catalyst 8000V instance.

  2. Deploy an individual Cisco Catalyst 8000V. Select the same availability set that you created in step 1. Using this Bring Your Own License individual Cisco Catalyst 8000V allows you to reuse existing resources in existing non-empty resource groups.

  3. Repeat step 2 for all of the remaining Cisco Catalyst 8000V instances.

Licensing

The Cisco Catalyst 8000V supports the following license models:

Bring Your Own License Model

The Bring Your Own License (BYOL) licensing model for Cisco Catalyst 8000V on Microsoft Azure is supported through Cisco Smart Licensing Usage Policy. This licensing model allows you to assign licenses to Cisco Catalyst 8000V instances dynamically. You can manage licenses across different Cisco Catalyst 8000V instances without having to lock each license to a specific Cisco Catalyst 8000V UDI serial number.


Note


In addition to paying for a Cisco Catalyst 8000V license, you have to pay for a Microsoft VM instance.


Pay-As-You-Go Licensing

Pay-As-You-Go or PAYG is a licensing model that is supported by Cisco Catalyst 8000V running on Microsoft Azure. In this licensing model, you can launch hourly Cisco Catalyst 8000V instances from the Azure Marketplace and consume the instances for a defined period of time based on your requirements. This allows you to pay only for the time you've used the instance instead of paying for an annual or multi-year billing. A Cisco Catalyst 8000V PAYG instance supports all the existing deployment models that are available in the BYOL licensing model.


Note


To enable the throughput license performance, you must enable the Accelerated Networking functionality.