Once access is approved send the following information to opnfv-helpdesk@rt.linuxfoundation.org along with attached approval email

1. Your name and email address
2. Add a copy of your PGP public key, as attachment
   1. If you do not have a PGP key, please generate it following this guide
   2. Export your public key using "gpg --export -a [your@email.addr] > pgp-key.asc" and attach pgp-key.asc to the request

It is important to send the request to opnfv-helpdesk@rt.linuxfoundation.org as opposed to any individual administrator, as we require the ticket number for the necessary papertrail.

Prerequisites: Make sure that you have openvpn installed (e.g. "apt-get install openvpn" on a Debian system) on your system. Also make sure that you have a user and a group "openvpn" configured (e.g. "addgroup openvpn", "adduser openvpn openvpn").

Note: In case you're behind a firewall (e.g. a corporate firewall), udp port 1203 needs to be open - or you experience issues (i.e it won't work).

You should have received an encrypted tarball with your credentials. This tarball includes the following files:

1. opnfv.ovpn : configuration file for the command-line client
2. opnfv-ca.crt : CA certificate for the VPN
3. opnfv-ta.key : TLS Authentication key
4. your@email.addr.crt : Your VPN certificate
5. your@email.addr.key : Your VPN private key
6. admin-credentials.txt : admin credentials to access the UCS manager

To use the command-line client, just copy these files into /etc/openvpn/ and run:

sudo openvpn --config /etc/openvpn/opnfv.ovpn

1. Click on Add→VPN→OpenVPN
2. Name: opnfv VPN
3. Firewall Zone: default
4. Gateway: vpn.opnfv.org
5. Type: Certificates (TLS)
6. User Certificate: Choose your@email.addr.crt from the bundle
7. CA Certificate: Choose opnfv-ca.crt from the bundle
8. Private key: Choose your@email.addr.key from the bundle
9. Private key password: leave blank
10. Click the "Advanced" button
11. General Tab:
    1. Use custom gateway port: 1203
    2. Use LZO data compression: yes
    3. Set virtual device type: Choose TUN, name: tun
    4. Use custom UDP fragment size: 1400
12. TLS Authentication tab:
    1. Use additional TLS authentication: yes
    2. Key file: Choose opnfv-ta.key from the bundle
    3. Key direction: 1

Once you establish the VPN connection, you should be able to access two private subnets:

1. 172.30.8.0/24 : lights-out management subnet
2. 172.30.9.0/24 : POD1 subnet
3. 172.30.10.0/24 : POD2 subnet
4. 172.30.11.0/24 : POD3 subnet
5. 172.30.12.0/24 : POD4 subnet
6. 172.30.13.0/24 : POD5 subnet

You can test your connectivity by pinging 172.30.[8-13].1 for each range.

NOTE: Traffic between 172.30.8.0/24 and 172.30.9-13.0/24 is filtered. If you need specific ports to be open, contact opnfv-helpdesk@rt.linuxfoundation.org with details.

To access UCS infrastructure, please connect to the following addresses:

1. https://172.30.8.21/ : UCS Manager (make sure that you have JRE (pick Oracle's Java) installed on your machine)
2. 172.30.8.11:22 : SSH access for fiber interconnect A
3. 172.30.8.12:22 : SSH access for fiber interconnect B

The credentials have been shared with you as part of the encrypted bundle.

POD1 jump host opnfv@172.30.9.66 POD2 jump host opnfv@172.30.10.72

• OPNFV Linux Foundation Lab wiring
• POD1 hardware setup
• POD2 hardware setup

IP rules for the class-C networks: (UCSM, CIMC usage)

• 172.30.8.1-63 : reserved LF use
• 172.30.8.64-255 : project use

similar rules for 172.30.9-13.0/24 subnet: (POD1-POD5 subnets)

• 172.30.x.1-63 : reserved LF use
• 172.30.x.64-255 : project use

There are three main firewall zones:

The following traffic is allowed:

Same topology as POD2

Jumpserver public IP: 172.30.9.66 (opnfv/octopus)

Jumpserver public IP: 172.30.10.72 (opnfv/octopus)

CIMC/Lights+out management                             Admin     Private   Public   Storage  
                                                        PXE   
                                                      vlan 300       
172.30.8.64/26                                     192.168.1.0/24            +   
+                                                        +     192.168.0.0/24|        |           
|                                                        |         +         +        |           
|                                                        |         |   172.30.10.0/24 |           
|        +-----------------+                             |         |         +        |           
|        |                 | enp6                        |         |         |        |           
+--------+  Jumpserver     | 192.168.1.66                |         |         |        |           
|        |  CentOS 7       +-----------------------------+         |         |        |           
|        |                 |                             |         |         |        |           
|        |                 | enp7                        |         |         |        |           
|        |                 | 192.168.0.66                |         |         |        |           
|        |  user/pass      +---------------------------------------+         |        |           
|        |  opnfv/octopus  |                             |         |         |        |           
|        |                 | enp8                        |         |         |        |           
|        |                 | 172.30.10.72                |         |         |        |           
|        |                 +-------------------------------------------------+        |           
|        |                 |                             |         |         |        |           
|        |                 | enp9                        |         |         |        |           
|        |                 |                             |         |         |        |           
|        |                 +----------------------------------------------------------+           
|        |                 |                             |         |         |        |           
|        +-----------------+                             |         |         |        |           
|                                                        |         |         |        |           
|                                                        |         |         |        |           
|                                                        |         |         |        |           
|       +----------------+                               |         |         |        |           
|       |             1  |                               |         |         |        |           
+-------+ +--------------+-+                             |         |         |        |           
|       | |             2  |                             |         |         |        |           
|       | | +--------------+-+                           |         |         |        |           
|       | | |             3  |                           |         |         |        |           
|       | | | +--------------+-+                         |         |         |        |           
|       | | | |             4  |                         |         |         |        |           
|       +-+ | | +--------------+-+                       |         |         |        |           
|         | | | |             5  +-----------------------+         |         |        |           
|         +-+ | |  nodes for     |                       |         |         |        |           
|           | | |  deploying     +---------------------------------+         |        |           
|           +-+ |  opnfv         |                       |         |         |        |           
|             | |                +-------------------------------------------+        |           
|             +-+                |                       |         |         |        |           
|               |                +----------------------------------------------------+           
|               +----------------+                       |         |         |        |           
|                                                        |         |         |        |           
|                                                        |         |         |        |           
|                                                        +         +         +        +

This pod is used for virtual deployments. Each server is connected to separate public subnet (if connected).

Note: IPMI IPs can be also used for console connection. Use web browser to access them through https (java is required)