Content Switching. Koen Denecker, IT Architect. Cisco Public. Session Number Presentation_ID Cisco Systems, Inc. All rights reserved.

Size: px

Start display at page:

Rosamond Gardner
5 years ago
Views:

1 Content Switching Koen Denecker, IT Architect 2

Outline Content Switching Overview Service Switch Architecture Case Study 1: www.

2 Outline Content Switching Overview Service Switch Architecture Case Study 1: Infrastructure Content Landscape Case Study 2: Service Virtualization Q&A 3

3 Content Switching Overview 4

4 Content Switching What Is it? Server Farm (SF) Group of one or more servers with nearly identical configuration and providing equal functionality Server Load Balancing (SLB) Distribution of data connections across servers in a single serverfarm, such that the overall capacity and availability increase (typically at Layer 3 4) Content Switching (CS) Intelligent distribution of data requests across servers in different serverfarms, such that the appropriate serverfarm is used and the overall capacity, availability and/or functionality increase (up to Layer 7) GET *.gif GET *.asp 5

5 Content Switching Why Do We Need it? High Availability (HA) Required for mission-critical applications Achieved through load-balancing, health monitoring (reactive), server maintenance (proactive) Functionality Flexible back-end infrastructure while keeping user-friendly URL s through URL load-balancing, manipulation and redirection Example: retain the paradigm Cache control Manual and proactive control of cache-logic on Content Engine Security Provides limited Denial-of-Server (DoS) protection Facilitates SSL Offload though SSL Service Module 6

6 The Paradigm Separate the user interface (front-end) from the specialpurpose server farms (back-end) Domain Name System (DNS) resolves the vanity name to a Virtual IP address hosted on a content switch ACNS Content Engine Farm Multiple serverfarms Software distribution Cacheable /software/<etc> /app/aaa.cgi Applications CGI DNS: > /app/bbb.pl Applications Perl 7

7 The Paradigm Separate the user interface (front-end) from the specialpurpose server farms (back-end) Domain Name System (DNS) resolves the vanity name to a Virtual IP address hosted on a content switch Virtual service Cacheable /app/bbb.pl Transparent application migration 8

8 Service Switch Architecture 9

Product Evolution LocalDirector 430 (LD430) Large-scale deployment in Cisco IT LD pair per serverfarm (VLAN) Still used for DNS, DHCP, ACS, etc LD430 End-of-Saled (EOS) in 2002 Content Switching

9 Product Evolution LocalDirector 430 (LD430) Large-scale deployment in Cisco IT LD pair per serverfarm (VLAN) Still used for DNS, DHCP, ACS, etc LD430 End-of-Saled (EOS) in 2002 Content Switching Module (CSM) Current Cisco IT Preferred Platform L2-3 Network integration L4-7 capabilities Integrated IOS Time Content Services Switch (CSS 11503) Limited adoption of CSS in Cisco IT True Content Switch: L4-7 capabilities 10

10 Architectural Requirements Cost Flexibility Security Scalability High Availability Manageability Lower CAPEX and OPEX Old world: SLB Pair per Serverfarm New world: Convergence of Content Switching Services Easy Integration With Other Network Services: Caching, Application Acceleration, Security Keep Existing Data Center Architecture and VLAN Design Integration for Content Security Services, e.g. for SSL Offload Access Control and DoS Protection on Virtual Server Secure Management Require >1 Gbps Throughput Require 2,000 10,000 New Connections per Second (cps) Hardware Assisted No Single-point of Failure in the Design Target SLA Is % Availability (going to %) Leverage Existing Skill Set and Management Interface/tools Troubleshooting Capabilities, e.g. Server Logging of Client IP 11

11 Service Switch Architecture Aggregation (L3) Access (L2) 12

12 Service Switch Architecture Trunk VLANs as needed Aggregation (L3) Service Switch (L2) Service Switch (L2) Access (L2) Dedicated 6500 or 7600 chassis running native IOS 13

13 Service Switch Architecture Active CSM Aggregation (L3) Standby CSM Service Switch (L2) Service Switch (L2) Supervisor (free) Uplink1 Uplink2 CSM1 (free CSM2) SSLM1 (free SSLM2) NAM1 Access (L2) No Content Services in Data Center Gateways to avoid IOS dependencies 14

14 Bridged Mode Content Switching CSM deployed in bridged mode Multiple routable/non-routable VLAN pairs Active/standby with stateful failover ( replicate ) Pro No L3 Changes VLAN Segregation No Changes to Server Source IP Preserved Con All Server Traffic Through CSM Spanning Tree Loop Risk Complex Troubleshooting Layer3 View Layer2 View Layer1 View Virtual IP SSW DC-GW Real IP 1 Real IP 2 VLAN 301 VLAN 601 CSM Subnet x/24 15

15 IT Adoption Status Hardware Past Present Future LD Peak: >50 pairs CSS Peak: ~30 pairs LD ~30 pairs CSM: ~20 pairs CSM: Planned: ~25 pairs CSS ~10 pairs Time LD CSS CSM In 13 Service Switch pairs 16

16 IT Adoption Status Services Converged infrastructure From: ~100 virtual servers on 50 LD pairs To: 600+ virtual servers on 25 CSM pairs Many applications on CSM, for example (CCO): > 50,000,000 L7 decisions per day Instant Messaging (Sametime): 20k+ simultaneous connections Oracle11i Livelink External and Internal Java2 Enterprise Edition Microsoft Exchange Front-End (SMTP, POP3, IMAP4, HTTP) 17

17 Case Study 1 Infrastructure 18

Cisco Connection Online (CCO) Cisco Connection Online (CCO) Cisco s public web presence as www.

18 Cisco Connection Online (CCO) Cisco Connection Online (CCO) Cisco s public web presence as Responsible for 90+% of Cisco s revenue Average net sales is $2.5M/hour or $42k/minute 19

19 Overview of CCO Migration CCO Migration is part of a larger CCO Roadmap The program s vision is to: Enable application specific architecture Increase scalability Increase availability Increase flexibility Decrease Total Cost of Ownership (TCO) 20

20 Old Environment LocalDirector Internet Front (Web) WCCP LD Cache Farm HTTP request from Internet reaches DMZ Router (IOS) intercepts request through Web Cache Communications Protocol (WCCP) and sent to cache farm for server offload Request served from cache if available and fresh Back (App) otherwise, request is proxied to Virtual Server on LocalDirector (LD) Internal LD load balances request to a real server; Only Layer3/4 loadbalancing is supported 21

21 New Environment CSM Internet Front (Web) Back (App) Internal CSM ACNS Cache Farm CSM policy controls which traffic is sent to cache *.gif, *.jpeg, *.zip to cache ACNS has built-in cache intelligence (freshness control, authentication) Modularization of web and application servers into distinct serverfarms Static content (software distribution) Web Application environment 1 Web Application environment 2 Traffic is sent to appropriate serverfarm using L5+ rules on CSM In addition, CSM also does content redirection through HTTP/302 Futureproof URL-based flexibility 22

22 Migration in Multiple Stages Time Go-live Saturday evening Deploy CSM hardware Dev Solaris serverfarm Dev Add Linux serverfarm Stage Infrastructure teams Pre-production (internal) Production (customers) Development Testing Development Testing Stage Test Pre-Production Full testing Production P1/2 testing Application teams Strict QA Guidelines! 23

First Attempt Go-live issues We had to roll back changes on evening of first live cutover www.cisco.

23 First Attempt Go-live issues We had to roll back changes on evening of first live cutover was down for several minutes LocalDirector would not relinquish MAC address of virtuals Problem duplicated in lab afterwards Problem fixed by restarting LD s Second evening went without issue 24

24 What Next? Program continues and changes Solaris Upgrade Ecommerce and FTP services to be moved behind CSM Use of SSL for encrypted login 25

200 Mbps CSM supports 2 Gbps New L7 Connections per Second (cps) for www.

25 CCO SSW Performance Bandwidth Usage on Each Uplink of the Active Service Switch Over a Two Week Period 100 Mbps Throughput (right) Regularly exceeds 200 Mbps CSM supports 2 Gbps New L7 Connections per Second (cps) for Average ~500 new L7 cps Peak 10k+ new L7 cps CSM supports 70k new L7 cps 26

26 Lessons learned Manageability IOS integration provides known CLI and leverages existing management tools Administrative access (TACACS+) shared between Networking and Application teams Cache control: L7 rules instead of WCCP/ACNS provides improved cache service integration Legacy applications incompatible with caching logic are bypassed More sophisticated load-balancing than WCCP L5+ rules are processed in hardware on CSM ACNS load is reduced by only sending cacheable Default URL Parsing length (4000 bytes) is insufficient, but can easily be increased 27

27 Content Landscape 28

SSL Service Module Extend Service Switch model with CSM to provide SSL services Two scenarios SSL Offload SSL Back-end Re-encryption Benefits: Performance: offload SSL from real server Security:

28 SSL Service Module Extend Service Switch model with CSM to provide SSL services Two scenarios SSL Offload SSL Back-end Re-encryption Benefits: Performance: offload SSL from real server Security: enables payload inspection Functionality: intelligent content switching of SSL traffic (L5-7) PKI Consolidation Scenario 1: SSL Offload Goal: Performance, security Encrypted Clear Scenario 2: SSL Back-End Re-encryption Goal: Intelligent Content Switching of SSL traffic Encrypted Encrypted Encrypted Clear Clear Intelligent L5-7 CS 29

29 SSL Service Module Network Design Design SSLM acts as ssl-proxy in routed mode from CSM One new subnet introduced for entire Data Center Adoption SSL Intelligent Content Switching in J2EE environment SSL Offload for Exchange HTTP, POP3 and IMAP4 CSM is active/standby SSLM is active/active Service Switch (L2) Layer3 View Layer2 View Layer1 View Virtual IP /24 SSW DC-GW Real IP 1 VLAN 301 VLAN 601 Real IP 2 CSM SSLM Subnet x/24 VLAN

30 SSL Back-End Re-Encryption: J2EE Traffic Flow: Logical View J2EE Environment #1 (e.g. IBM)../appA > SSL-Proxy2../appB > SSL-Proxy3 appa appb L4 SLB SSL-Proxy1 L5-7 SLB (URL Load-balancing) 2x L4 SLB J2EE Environment #2 (e.g. Borland) SSL-Proxy1 Acts as SSL Server SSL-Proxy2 & 3 Acts as SSL Client 31

31 SSL Content Switching in J2EE Traffic Flow: Physical View One SSLM Pair in Active/Active mode One CSM Pair in Active/Standby mode 32

32 Content Landscape Global SLB CSM is only used for Local SLB No External Global SLB (e.g. nearest VPN concentrator) Internal Global SLB is achieved through a number of solutions Product Method Pro Con Comments Distributed Director Enterprise Service Locator (ESL)** ACNS Content Router Router/ACNS DRP* > DNS Config parsing > DNS Coverage Zone > SHR* WCCP Robust AD site granularity Control Zeromanagement D-proxy DNS caching Stability (P3) DNS caching Mgmt overhead Requires redirect WCCP support Not transparent High Availability (with CSM) IT developed ACNS only Global Site Selector No DRP until recently [Under evaluation] Proximity** Address mgmt > dynamic URL Subnet type (wireless/r) 24-hr update IT developed for streaming *DRP = Director Response Protocol *SHR = Simplified Hybrid Routing (DNS + HTTP/RTSP Redirect) ** IT developed 33

33 Content Landscape ACNS Global ACNS deployment Tiered Architecture More than 300 Content Engines IP/TV for live streaming over IP Multicast Tier-1 Core San Jose San Jose Software Distribution Streaming Media Security Web Application Acceleration Altiris, AntiVirus (HTTP) XP Build Live Splitting for Unicast (VPN, WLAN) Video-on-Demand URL Filtering (ISP Edge, WAN Edge, Labs) Transparent Caching (Field Office) Reverse Proxy Caching (CCO) Tier-2 Sites (~15) CE-7325 Big sites CE-7325 Full Prepositioning (300+ GB) Simplified Hybrid Routing (SHR) No transparent Caching 2RU CE CE-565 CE-565 CE-7305 CE-565 CE-565 CE-565 CE-565 Medium/Small sites Tier-3 Sites (~180) Partial Prepositioning WCCP Transparent Caching 1RU CE NM-CE 34

34 Case Study 2 Service Virtualization 35

Email Services Exchange infrastructure Regionally Centralized Exchange

requirements Provide SMTP, POP3, IMAP4 and HTTP access to Exchange

com Security requirements no cleartext credentials over network Enforce SSL

35 Services Exchange infrastructure Regionally Centralized Exchange deployment (about 5 Data Centers worldwide) Virtualized service requirements Provide SMTP, POP3, IMAP4 and HTTP access to Exchange mailservers through one global DNS name mail.cisco.com Security requirements no cleartext credentials over network Enforce SSL encryption for HTTP Provide SSL encryption for POP3/IMAP4 (no enforcement due to legacy scripts) No SSL encryption for SMTP 36

36 Solution Step 1 Local SLB Local Server Load Balancing Active/standby CSM Virtual IP on port 25, 80, 110,

37 Solution Step 2 DNS-based Global SLB Local Server Load Balancing Active/standby CSM Virtual IP on port 25, 80, 110, 143 Distributed Director Resolve mail.cisco.com to nearest Virtual IP 38

38 Solution Step 3 Add SSL Offload Local Server Load Balancing Active/standby CSM Virtual IP on port 25, 80, 110, 143 Distributed Director Resolve mail.cisco.com to nearest Virtual IP Add SSL Offload for HTTP, POP3 and IMAP4 Add URL Redirection for HTTP 39

39 End Result User Types Mail In Browser User Gets Redirected to Nearest Outlook Web Access Server Over SSL Similar for POP3 and IMAP4 (Requires Client Configuration for SSL) 40

40 Q and A 41

More Resources Cisco IT @ Work Website (Case Studies, Operational Practices,

41 More Resources Cisco Work Website (Case Studies, Operational Practices, Design Guides, Success Stories, Videos and more) Call to get Product, Solution and Financing Information ext 4699 Order Resources 42

42 43

Enterprise Content Networking System

Enterprise Content Networking System How Cisco IT Deployed Content Networking to Improve Application Performance and Security A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge Consolidate