记录如何在KVM上手动部署山石vfw

准备工作

KVM环境

• 确认宿主机支持KVM虚拟化，下面命令返回值不应该为空

#egrep '^flags.*(vmx|svm)' /proc/cpuinfo

• 确认软件版本（建议CentOS7.x）

# cat /etc/redhat-release

• 安装相关软件

# yum install qemu-kvm libvirt libvirt-python libguestfs-tools virt-install -y

Linux bridge

• 该bridge用来提供VFW的管理/控制面连通性
• 创建bridge后将宿主机的管理接口加入到该bridge上

# brctl show
bridge name	bridge id		STP enabled	interfaces
virt-mgmt-br		8000.20040fe827d4	no		em1

• 在该bridge上配置宿主机原来的管理IP和需要的路由

OVS bridge

• 需要将要加入的OVS bridge建好，例如"xyzbr0"
• 后续VFW的数据口都会加入到这个bridge上

安装VFW虚机和OVS配置

文件准备

• 创建并进入目录

# pwd
/opt/hillstone-cmd-libvirt
# ll
total 2097760
-rw-r--r--. 1 root root        258 Jan 11 15:55 hillstone-br0
-rw-r--r--. 1 root root        135 Jan 11 14:51 hillstone-br1
-rw-r--r--. 1 root root        135 Jan 11 14:52 hillstone-br2
-rw-r--r--. 1 root root        135 Jan 11 14:52 hillstone-br3
-rw-r--r--. 1 root root        135 Jan 11 14:52 hillstone-br4
-rw-r--r--. 1 root root        135 Jan 11 14:52 hillstone-br5
-rwxrwxrwx. 1 root root        762 Jan 11 16:07 install.sh
-rw-r--r--. 1 root root        133 Jan 11 16:09 xyzbr-network.xml
-rw-r--r--. 1 qemu qemu 2148073472 Jan 12 12:17 SG6000-CloudEdge-5.5R5-VM01-v6.qcow2

```shell
* VFW的镜像文件先要准备好

```shell
# ll | grep qcow2
-rw-r--r--. 1 qemu qemu 2148073472 Jan 12 10:57 SG6000-CloudEdge-5.5R5-VM01-v6.qcow2

• 加载描述bridge信息的xml文件

# cat xyzbr-network.xml
<network>
  <name>xyzbr0</name>
  <forward mode='bridge'/>
  <bridge name='xyzbr0'/>
  <virtualport type='openvswitch'/>
</network>
# virsh net-define  xyzbr-network.xml 
# virsh  net-start  xyzbr0
# virsh  net-autostart xyzbr0

• 定义管理口的文件(目前使用VFW的eth0/0),指向之前创建的Linux bridge

# cat hillstone-br0
<network>
 <name>hillstone-br0</name>
 <bridge name='virt-mgmt-br' stp='n' delay='0' />
 <forward mode='bridge'/>
 <ip address='10.25.130.100' netmask='255.255.0.0'>
  <dhcp>
   <range start='10.25.130.100' end='10.25.130.100.'/>
  </dhcp>
 </ip>
</network>

• 定义其它接口的文件，以br1为例，其它只是改一下br编号

# cat hillstone-br1
<network>
 <name>hillstone-br1</name>
 <forward mode='bridge'/>
 <bridge name='xyzbr0'/>
 <virtualport type='openvswitch'/>
</network>

• 添加安装脚本

# cat install.sh 
virt-install \
    --name hillstone \
    --wait 0 \
    --os-type linux \
    --virt-type kvm \
    --accelerate \
    --vnc --vnclisten 0.0.0.0 \
    --ram 2048 \
    --vcpus 2 \
    --boot cdrom \
    --disk path=/opt/hillstone-cmd-libvirt/SG6000-CloudEdge-5.5R5-VM01-v6.qcow2,device=disk,bus=ide,format=qcow2 \
    --serial tcp,host=0.0.0.0:8123,mode=bind,protocol=telnet \
    --network network=xyzbr0,model=virtio,target=he0 \
    --network network=xyzbr0,model=virtio,target=he1 \
    --network network=xyzbr0,model=virtio,target=he2 \
    --network network=xyzbr0,model=virtio,target=he3 \
    --network network=xyzbr0,model=virtio,target=he4 \
    --network network=xyzbr0,model=virtio,target=he5 \
    --network network=xyzbr0,model=virtio,target=he6

安装设置和串口登录

• 安装只需要执行脚本即可

# ./install.sh 
WARNING  No operating system detected, VM performance may suffer. Specify an OS with --os-variant for optimal results.
Starting install...
Domain creation completed.
# 

• 启动并查看相关信息

# virsh start hillstone
#
# virsh list
 Id    Name                           State
----------------------------------------------------
 4     hillstone                      running
#
# virsh domiflist hillstone
Interface  Type       Source     Model       MAC
-------------------------------------------------------
he0        bridge     xyzbr0     virtio      52:54:00:9a:51:32
he1        bridge     xyzbr0     virtio      52:54:00:44:e3:98
he2        bridge     xyzbr0     virtio      52:54:00:9c:ae:d4
he3        bridge     xyzbr0     virtio      52:54:00:e8:4b:b8
he4        bridge     xyzbr0     virtio      52:54:00:51:ee:11
he5        bridge     xyzbr0     virtio      52:54:00:f2:84:0a
he6        bridge     xyzbr0     virtio      52:54:00:74:6d:9d

• 设置OVS上接口(自然不包含连到Linux bridge)的vlan id,此处先以x来举例

ovs-vsctl set port he2 tag=x

• telnet登录console口，端口号在创建时候指定，默认用户名密码:hillstone/hillstone

# telnet localhost 8123
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

login:

#VFW配置和验证
##基本配置

• 管理口配置和网关配置,供远程ssh/web登录配置

configure
interface eth0/0
no ip address dhcp
ip address 10.25.130.100/16
  manage ssh
  manage ping
  manage snmp
  manage https
exit
ip vrouter trust-vr
ip route 0.0.0.0/0 10.25.0.1
exit

• 如果需要配置HA，指定心跳线出口

ha link interface ethernet0/5
ha link ip 2.2.2.1 255.255.255.0
ha group 0
ha cluster 1 node 1

• 配置业务接口，未来作为内网虚机的网关，下面是一个例子

interface eth0/1
zone trust
no ip address dhcp
ip address 10.3.3.254/254
 manage ping

• 如果内网业务需要做DNAT对外网呈现，建议使用web来配置更加方便
• HA的参数配置(略)