VMware Hybrid Cloud Manager on IBM Cloud Solution Architecture

Transcription

1 VMware Hybrid Clud Manager n IBM Clud Slutin Architecture Date: 9/11/2017 Versin 1.0 Cpyright IBM Crpratin 2017 Page 1 f 58

2 Table f Cntents 1 Intrductin VMware Hybrid Clud Manager n IBM Clud Slutins VMware Hybrid Clud Manager n IBM Clud Slutins Overview Layer 2 Netwrk Extensin Virtual Machine Migratin Lw-Dwntime Migratin vmtin Migratin Cld Migratin Cmmn Migratin Features Netwrking Intelligent Flw Ruting Prximity Ruting Security Cmpnents f Hybrid Clud Manager Hybrid Clud Manager Hybrid Clud Gateway WAN Optimizatin Layer 2 Cncentratrs Hybrid Clud Manager Deplyment Architecture: Cnnect t IBM Clud via Public Internet Usage verview Base Design Dependencies Architecture, Surce Intrducing Hybrid Clud Manager Enterprise (Surce/Client Side) Layer 2 Netwrk Extensin Virtual Machine Migratin Methds Netwrking Features Understanding Hybrid Clud Manager Deplyment Overview Deplyment Cmpnent Perfrmance Cnsideratins Maximum Number f Migratin and Netwrk Extensin Hybrid Clud Management Enterprise Hybrid Clud Manager Service Virtual Appliance Hybrid Clud Manager Hybrid Clud Gateway WAN Optimizer Layer 2 Cncentratr Cpyright IBM Crpratin 2017 Page 2 f 58

3 3.2.9 Layer 2 Appliance Psitin in the Single-Path Deplyment Chsing a Deplyment Architecture Migratin Only Netwrk Extensin IP Address Requirements Prximity Ruting Asymmetric Ruting with Prximity Ruting Slutin MAC Address Retentin Security Plicy Migratin Cmpnent level Architecture, Target NSX Edge Hybrid Clud Manager Clud Gateway WAN Optimizer Layer 2 Cncentratr Summary Appendix A - Prt Access Requirements Appendix B - Preparing Installatin Envirnment Cnfigure Netwrk Cnnectivity On Premises Verify Layer 2 Installatin Envirnment Appendix C - Installing and Cnfiguring Hybrid Clud Manager n Surce Install the Hybrid Clud Manager Appliance Prcedure Appendix D - Register Hybrid Clud Manager with the vcenter Prerequisites Prcedure Appendix E - Cnfigure Prxy Settings Prxy Server Settings Prerequisites Prcedure Appendix F - Installing and Cnfiguring Hybrid Services Installing and Cnfiguring Hybrid Services Cnfiguratin Overview Start Hybrid Service Virtual Appliance Installatin and Cnfiguratin Cnfigure the Hybrid Clud Gateway Cnfigure the Netwrk Extensin Service Cpyright IBM Crpratin 2017 Page 3 f 58

4 11.6 Mnitr Service Appliance Deplyment View Tunnel Status Stretching a Layer 2 Netwrk t IBM Clud Appendix G - Migrating a Virtual Machine Migrating a Virtual Machine (VM) Lw Dwn-Time Migratin Crss-Clud vmtin Cld Migratin Migrate Virtual Machine using bi-directinal Wizard Checking Yur Virtual Machine befre Migratin Mnitr a Migratin View Migrated Virtual Machine Appendix H - Mdifying r Uninstalling HCM Mdifying r Uninstalling HCM Unstretch a Layer 2 Netwrk Uninstall Hybrid Clud Manager Service Virtual Appliances Uninstall Hybrid Clud Manger Lgin t the HCM Management Prtal Appendix I - Trubleshting Trubleshting Clud Registratin Fails Duplicate MAC Address High Hst Resurce Cnsumptin Table f Figures Figure 1 VMware Clud Fundatin Hybrid Clud Manager... 8 Figure 2 Hybrid Clud Manager with single surce Figure 3 Hybrid Clud Manager with multiple surces Figure 4 Surce Hybrid Clud Services Figure 5 Surce Clud Gateway Figure 6 Surce WAN Optimizer Figure 7 Surce L2 Cncentratr Figure 8 VIP Cnfiguratin fr NSX Edge Figure 9 Pl Cnfiguratin fr NSX Edge Figure 10 Target - Hybrid Clud Manager Appliance Figure 11 Clud Gateway Deplyment Cpyright IBM Crpratin 2017 Page 4 f 58

5 Figure 12 WAN Optimizer Deplyment Figure 13 L2 Cncentratr Deplyment List f Tables Table 1 NSX Edge Deplyment Table 2 NSX Edge Anti-Affinity Rules Table 3 Clud Gateway Deplyment Table 4 WAN Optimizatin Appliance Sizing Table 5 HT L2C Appliance Sizing Cpyright IBM Crpratin 2017 Page 5 f 58

6 Summary f Changes This sectin recrds the histry f significant changes t this dcument. Versin Date Authrs Descriptin f Change 1.0 TBD IBM Clud VMware Architecture Team Daniel de Arauj Frank Chdacki Bb Kellenberger Simn Kfkin-Hansen Jack Benney Initial Draft Cpyright IBM Crpratin 2017 Page 6 f 58

7 1 Intrductin 1.1 VMware Hybrid Clud Manager n IBM Clud Slutins The VMware Hybrid Clud Manager n IBM Clud Slutins enables creating a seamless cnnectin between IBM Clud fr VMware Slutins instances and an n-premise VMware virtualized datacenter. The IBM Clud fr VMware Slutins include fully autmated, rapid deplyments f either Clud Fundatin (VCF) r vcenter Server (VCS) cnfiguratins in the IBM Clud. These fferings cmplement the n-premise infrastructure and allws existing and future wrklads t run in the IBM Clud withut cnversin using the same tling, skills, and prcesses they use n premise. Please visit IBM Architecture Center fr the architecture fr these fferings. The VMware Hybrid Clud Manager n IBM Clud Slutin takes this hybridity t the next step blending instances f either IBM Clud fr VMware Slutins Clud Fundatin r vcenter Server with existing npremise virtualized datacenters by enabling the creatin f seamless netwrk extensins and bidirectinal migratin f wrklads. The VMware Hybrid Clud Manager n IBM Clud Slutin cmpnents deplyed as virtual machines in the IBM Clud VMware target site enable the establishment f a cnnectin with the VMware Hybrid Clud Manager n IBM Clud Slutin cmpnents installed in the peer n-premise surce site. This creates a lsely cupled intercnnectivity between n-premise and IBM Clud and enables capabilities such as: Simple intercnnectivity lgical netwrk cnnectins are established easily ver any physical cnnectin including public internet, private VPN, r direct link Layer 2 extensin n-premise netwrks are extended int the clud including n-premise subnets and IP addressing Encryptin netwrk traffic is securely encrypted between the tw sides Optimized netwrk selects the best cnnectin and efficiently flds the cnnectin s that netwrk traffic is mved as fast as pssible Data deduplicatin as much as 50% reductin in netwrk traffic can be achieved Cpyright IBM Crpratin 2017 Page 7 f 58

8 Intelligent ruting when a wrklad is mved, prximity ruting can change the netwrk path (i.e. gateway) s that netwrk traffic uses the target site gateway and des nt hairpin back t the riginating site Zer dwn time migratin a running system can be mved t (r back frm) the clud using vmtin Scheduled migratin any number f virtual machines can be replicated t the destinatin site and then activated n that site at a designated time replacing the systems running n the riginating site Migratin f security plicies if NSX is used n-premise any security plicies, firewalls, etc. are mved alng with the wrklad This dcument details the design f VMware Hybrid Clud Manager n IBM Clud Slutin ffering including bth the cmpnents n the target side IBM Clud fr VMware Slutins instance and as well as the cmpnents deplyed n the surce, n-premise side. Figure 1 VMware Clud Fundatin Hybrid Clud Manager Cpyright IBM Crpratin 2017 Page 8 f 58

9 2 VMware Hybrid Clud Manager n IBM Clud Slutins Overview VMware Hybrid Clud Manager n IBM Clud Slutins is a VMware develped technlgy that seamlessly integrates n-premise vsphere vcenter netwrks int IBM Clud fr VMware Slutins deplyments. Hybrid netwrking extends n-premises vsphere vcenter netwrks int the IBM Clud, supprting bidirectinal virtual machine (VM) mbility. Hybrid Clud Manager wns the surce and destinatin encryptin and decryptin prcesses, ensuring cnsistent security and prviding admissin fr hybrid wrkflws such as virtual machine migratin and netwrk extensin. This ffering creates an ptimized, sftware-defined WAN t increase stretched netwrk perfrmance, enabling perfrmance appraching LAN speed. Hybrid Clud Manager als enables bidirectinal wrklad and VMware NSX security plicy migratin t the IBM Clud. Hybrid Clud Manager integrates with vsphere vcenter and is managed frm the vsphere Web Client. 2.1 Layer 2 Netwrk Extensin Hybrid Clud Manager allws an existing n-premises vsphere estate t securely stretch a netwrk frm its n-premise vcenter t an IBM Clud datacenter running VMware Clud Fundatin r vcenter Server. This feature is enabled by the fllwing: Hybrid Clud Manager prvides a Layer 2 appliance called a High Thrughput Layer 2 Cncentratr (HT L2C). Extended netwrks link t IBM Clud NSX edge appliances deplyed n VMware Clud Fundatin r vcenter Server. One can deply multiple standard Layer 2 cncentratrs t achieve scalability and increase thrughput frm the n-premise vcenter. Virtual machines migrated thrugh the Clud Gateway and ver stretched Layer 2 can retain their IP and MAC addresses. 2.2 Virtual Machine Migratin Hybrid Clud Manager prvides three methds f virtual machines mvement: lw-dwntime migratin, vsphere vmtin migratin, and cld migratin Lw-Dwntime Migratin Lw-dwntime migratin relies n vsphere Replicatin, which is a distributed technlgy implemented in the VMware ESX /ESXi hypervisr. The n-premise Hybrid Clud Manager creates a replica f a live virtual machine, mves it t the IBM Clud, and perfrms a switchver t pwer ff the surce virtual machine and pwer n the migrated virtual machine. The migratin path is always thrugh the Clud Gateway. The transprt can be the Internet, a Layer 2 stretched netwrk, r a Direct Cnnect line. A virtual machine can be migrated multiple times in either directin vmtin Migratin Live virtual machines can be transferred using vmtin Migratin acrss a netwrk stretched t the IBM Clud. vmtin migratin is als called zer-dwntime migratin, r crss-clud vmtin. Cpyright IBM Crpratin 2017 Page 9 f 58

10 2.2.3 Cld Migratin Cld migratin prvides the ability t transfer a pwered-ff virtual machine t the IBM Clud ver a stretched netwrk created via the Layer 2 Cncentratr Cmmn Migratin Features Additinal features available acrss all three types f migratin include Optinal sftware-defined WAN ptimizatin, if installed, increases migratin thrughput and speed. Additinally, migratin can be scheduled t ccur at a specified time and keep its hstname, virtual machine name, r bth. 2.3 Netwrking The fllwing netwrking features are built int the Clud Gateway and the Layer 2 Cncentratrs Intelligent Flw Ruting This feature autmatically selects the best cnnectin based n the Internet path, efficiently flding the entire cnnectin s that wrklads are mved as fast as pssible. When larger flws, such as backup r replicatin, cause CPU cntentin, smaller flws are ruted t less busy CPUs, imprving perfrmance f interactive traffic Prximity Ruting Prximity ruting ensures that frwarding between virtual machines cnnected t stretched and ruted netwrks, bth n-premises and in the clud, is symmetrical. This feature requires Advanced Netwrks Services with Dynamic Ruting cnfigured between the custmer premises and the clud. When users extend their netwrks t the clud, Layer 2 cnnectivity is stretched nt IBM Clud netwrks. Hwever, withut rute ptimizatin, Layer 3 cmmunicatin requests must return t the npremises netwrk rigin t be ruted. This return trip is called "trmbning" r "hairpinning." Trmbning is inefficient because packets must travel back and frth between the netwrk rigin and the Clud, even when bth surce and destinatin virtual machines reside in the Clud. In additin t inefficiency, if the frwarding path includes stateful firewalls, r ther inline equipment that must see bth sides f the cnnectin, cmmunicatin might fail. Virtual machine cmmunicatin (withut rute ptimizatin) failure ccurs when the egress path exiting the clud can be either the stretched Layer 2 netwrk r the Org Ruted Netwrk. The n-premises netwrk des nt knw abut the stretched netwrk "shrtcut." This prblem is called asymmetric ruting. The slutin is t enable prximity ruting s the n-premises netwrk can learn the rutes frm the IBM Clud. The Clud Gateway maintains an inventry f virtual machines in the clud. It als understands the virtual machine state, which can be: Transferred t the IBM Clud with vmtin (zer-dwntime migratin) Migrated t the clud using hst-based replicatin (lw-dwntime migratin). Created in the clud (n a stretched netwrk) Security The Clud Gateway ffers Suite B-cmpliant AES-GCM with IKEv2, AES-NI fflad, and flw-based admissin cntrl. Hybrid Clud Manager als wns the surce and destinatin encryptin and decryptin prcess, ensuring cnsistent security and administratin fr hybrid wrkflws such as virtual machine migratin and netwrk extensin. Security plicies defined and assigned t a virtual machine npremises can be migrated with the virtual machine int the IBM Clud. Nte that plicy migratin is nly available under the fllwing cnditins The n-premises data center must be running NSX r greater. Cpyright IBM Crpratin 2017 Page 10 f 58

11 In vsphere, the security plicy is a single NSX Sectin which can cntain many rules. One can name a Set f IP addresses r MAC addresses t participate in the plicy. The name f the MAC Set r IP Set cannt exceed 218 characters. Supprted rules specify Layer 3 IP addresses r IP Sets, r Layer 2 MAC addresses r MAC Sets as the surce r destinatin. 2.4 Cmpnents f Hybrid Clud Manager The Hybrid Clud Manager n IBM Clud Slutin deplyment is cmprised f at least fur virtual appliances that are installed and cnfigured n the n-premises datacenter as well as the IBM Clud. This sectin describes each f the fur required virtual appliances. Optinally, edge devices may be required depending upn the implementatin design Hybrid Clud Manager The Hybrid Clud Manager virtual appliance is an extensin t the n-premises vcenter. It is deplyed as a virtual machine. The Hybrid Clud Manager appliance file structure cntains all the hybrid service virtual appliances. The Hybrid Clud Manager versees the deplyment and cnfiguratin f the Clud Gateway, the Layer 2 Cncentratrs, and WAN Optimizatin virtual appliance bth n-premises and within the IBM Clud Hybrid Clud Gateway The Hybrid Clud Gateway maintains a secure channel between the n-premises vsphere estate and the IBM Clud. The Hybrid Clud Manager uses strng encryptin t btstrap a site-t-site cnnectin t the IBM Clud. The secure channel between vsphere and IBM Clud prevents netwrking "middle mile" security prblems. The Clud Gateway als incrprates vsphere replicatin technlgy t perfrm bidirectinal migratin WAN Optimizatin The WAN Optimizatin appliance is an ptinal, yet highly recmmended, cmpnent that perfrms WAN cnditining t reduce effects f latency. It als incrprates Frward Errr Crrectin t negate packet lss scenaris, and deduplicatin f redundant traffic patterns. Altgether, these reduce bandwidth use and ensure the best use f available netwrk capacity t expedite data transfer t and frm the IBM Clud. It is imprtant t nte that virtual machine migratin relies n the cmbinatin f Clud Gateway and WAN Optimizatin appliance t achieve unparalleled mbility between vsphere n-premises and the IBM Clud. Additinally, Layer 2 extensin benefits frm WAN ptimizatin when the data path is ruted thrugh the Clud Gateway Layer 2 Cncentratrs The Layer 2 cncentratr are the appliances that allws the extensin f a Layer 2 netwrk frm the npremises vsphere data center t the IBM Clud. The Layer 2 Cncentratrs have tw interfaces: 1. Internal trunk interface: Handles virtual machine traffic n-premises fr the extended netwrks using a translatinal bridge mapping t a crrespnding stretched netwrk in IBM Clud 2. Uplink interface: Hybrid Clud Manager uses this interface t send encapsulated verlay traffic t and frm IBM Clud. Applicatin data travels thrugh this interface Cpyright IBM Crpratin 2017 Page 11 f 58

12 2.5 Hybrid Clud Manager Deplyment Architecture: Cnnect t IBM Clud via Public Internet This sectin describes the layut f the Hybrid Clud Manager cmpnents within the IBM Clud as well as client n-premises. In this design, the architecture specified such that a hub-and-spke mdel exists between the surce envirnment and the IBM Clud. Thus, the surce estate serves as the hub with cnnectins t different IBM Clud envirnments as shwn in Figure 2 Hybrid Clud Manager with single surce. Figure 2 Hybrid Clud Manager with single surce Nte that the surce can be placed within the IBM Clud envirnment as well; spkes are always clud deplyments within this design as shwn in Figure 3 Hybrid Clud Manager with multiple surces. Cpyright IBM Crpratin 2017 Page 12 f 58

13 2.5.1 Usage verview Figure 3 Hybrid Clud Manager with multiple surces The fllwing tasks are cmpleted frm the vsphere Web Client: Deply the Hybrid Clud Manager Service virtual appliance, and cnfigure sftware-defined WAN cmpnents. Extend n-premises VLAN and VXLAN netwrks frm n-premise vcenter t Clud (IBM Clud). Migrate wrklads t the clud and back Base Design Dependencies Befre the cmpnents are described in mre detail, it is imperative t understand the base deplyment required as part f this design. The surce envirnment must cntain a vsphere implementatin managed by a vcenter Server. Supprted vcenter f 5.5U3 r vcenter 6.0U2 and higher, with ESXi 5.5 r higher is required fr Hybrid Clud Manager. If NSX is used, versin r higher. NSX is required fr plicy migratin. If crss-clud vmtin is intended, the same affinity restrictins apply acrss cluds as they d n-premises. The surce envirnment must have a methd t cnnect t clud envirnments. This includes public Internet access r private cnnectins via IBM Clud Direct link. Nte that cnnectins ther than public Internet t ther clud vendrs will nt be discussed. The IBM Clud must cntain at least ne instance f either a VMware Clud Fundatin r vcenter Server deplyment. Sufficient resurces fr the virtual appliances. The netwrks must permit the appliances t cmmunicate with bth lcal and remte virtual appliances, and ther virtual machines. Cpyright IBM Crpratin 2017 Page 13 f 58

14 Prt Access Requirements (Appendix A) lists prts that must be pened s that Hybrid Clud Manager virtual appliances can install successfully. A vsphere service accunt with the Administratr vcenter Server system rle assigned t it. Enugh disk space fr installing Hybrid Clud Manager and the assciated service appliances. Sufficient IP addresses fr the n-premises VMs prvisined during the installatin. If the SSO server is remte, the URL f the vcenter, external SSO Server, r Platfrm Services Cntrller (PSC) that runs the external lkup service must be identified. When the Hybrid Clud Manager is registered with the vcenter, this URL must be supplied. Cpyright IBM Crpratin 2017 Page 14 f 58

15 3 Architecture, Surce This sectin describes the architecture f each Hybrid Clud Manager cmpnent deplyed in the surce envirnment. 3.1 Intrducing Hybrid Clud Manager Enterprise (Surce/Client Side) Hybrid Clud Manager technlgy seamlessly integrates vsphere vcenter netwrks int IBM Clud VCF r VCS platfrms. Hybrid netwrking extends n-premise vsphere vcenter netwrks int IBM Clud, supprting bidirectinal virtual machine (VM) mbility. This intrductin summarizes the tasks which can be accmplished and the features that supprt and enhance migratin and netwrk extensin. Hybrid Clud Manager wns the surce and destinatin encryptin and decryptin prcesses, ensuring cnsistent security and prviding admissin fr hybrid wrkflws such as virtual machine migratin and netwrk extensin. Hybrid Clud Manager creates an ptimized, sftware-defined WAN t increase stretched netwrk perfrmance, enabling perfrmance appraching LAN speed. Hybrid Clud Manager als enables bidirectinal wrklad and VMware NSX security plicy migratin t IBM Clud Netwrking services. Hybrid Clud Manager integrates with vsphere vcenter and is managed frm the vsphere Web Client Layer 2 Netwrk Extensin Securely stretch a netwrk frm a vcenter t IBM Clud. Hybrid Clud Manager prvides the High Thrughput Layer 2 Cncentratr (HT L2C). Extended netwrks link t IBM Clud NSX edge appliances Multiple standard Layer 2 cncentratrs can be deplyed t achieve scalability and increase thrughput frm. Virtual machines migrated thrugh the Clud Gateway and ver stretched Layer 2 can retain their IP and MAC addresses Virtual Machine Migratin Methds Lw-Dwntime Migratin vmtin Migratin Cld Migratin Lw-dwntime migratin relies n vsphere Replicatin, which is a distributed technlgy implemented in the VMware ESX/ESXi hypervisr. The Hybrid Clud Manager creates a replica f a live virtual machine, mves it t IBM Clud, and perfrms a switchver t pwer ff the surce virtual machine and pwer n the migrated virtual machine. The migratin path is always thrugh the Clud Gateway. The transprt can be the Internet, a Layer 2 stretched netwrk, r a Direct Cnnect line. A virtual machine can be migrated multiple times in either directin. Uses vmtin t transfer a live virtual machine acrss a netwrk stretched t IBM Clud. vmtin migratin is als called zer-dwntime migratin, r crss-clud vmtin. Transfer a pwered-ff virtual machine t IBM Clud ver a stretched netwrk. Cpyright IBM Crpratin 2017 Page 15 f 58

16 Cmmn Features Netwrking Features Optinal sftware-defined WAN ptimizatin, if installed, increases migratin, thrughput, and speed. Migratin can be scheduled t ccur at a specified time. A migrated virtual machine can keep its hst name, virtual machine name, r bth. The fllwing netwrking features are built int the Clud Gateway and the Layer 2 Cncentratrs. Intelligent Flw Ruting Autmatically selects the best cnnectin based n the Internet path, efficiently flding the entire cnnectin s that wrklads are mved as fast as pssible. When larger flws, such as backup r replicatin, cause CPU cntentin, smaller flws are ruted t less busy CPUs, imprving perfrmance f interactive traffic Prximity Ruting Security Ensures that frwarding between virtual machines cnnected t stretched and ruted netwrks bth n-premises and in the clud is symmetrical. The Clud Gateway ffers Suite B-cmpliant AES-GCM with IKEv2, AES-NI fflad, and flwbased admissin cntrl. Hybrid Clud Manager wns the surce and destinatin encryptin and decryptin prcesses, ensuring cnsistent security and prviding admissin fr hybrid wrkflws such as virtual machine migratin and netwrk extensin. A security plicy defined in the n-premise vcenter and assigned t a virtual machine can be migrated with the virtual machine Understanding Hybrid Clud Manager Hybrid Clud Manager supprts a many-t-many relatinship between n-premises vcenters and IBM Clud. vcenter Server in Linked Mde is supprted. This tpic prvides a high-level verview f hw the installer interacts with bth the n-premises data center and the IBM Clud IBM Clud. During the installatin, the Hybrid Clud Manager virtual appliance is imprted and cnfigured as a plug-in fr the n-premises vcenter. This plug-in is then used t cnfigure the Sftware-Defined WAN service deplyment. The autmated cnfiguratin prvisins each hybrid service appliance as a virtual machine in the n-premises vcenter, and deplys a crrespnding virtual machine in IBM Clud IBM Clud. A successful deplyment requires: Sufficient resurces fr the virtual appliances. The netwrk must permit the appliances t cmmunicate with bth lcal and remte virtual appliances, and ther virtual machines. 3.2 Deplyment Overview The Hybrid Clud Manager virtual machine is installed first, and it manages the installatin f any ther service virtual machine appliances n premises and in the clud. The fllwing is a summary f the basic installatin tasks. Obtain Hybrid Clud Enterprise OVA file frm VMware Cpyright IBM Crpratin 2017 Page 16 f 58

17 Frm the vsphere Web Client, install the Hybrid Clud Manager service virtual appliance in the n-premises vcenter that cnnects t IBM Clud Frm the vsphere Web Client, register an IBM Clud endpint with the Hybrid Clud Manager plug-in. Registratin establishes the ne-t-ne relatinship between the n-premises Hybrid Clud Manager and the Hybrid Clud Manager Clud instance n IBM Clud. Identify the apprpriate architecture. See Chsing a Deplyment Architecture. Install and cnfigure the service virtual appliances. Fr each appliance installed n premises, the installer prvisins a crrespnding service virtual appliance in the target IBM Clud. After the installatin, Hybrid Clud Manager cntrls bth lcal and remte service virtual appliances. In the IBM Clud, Hybrid Clud Manager manages the prvisined Sftware-Defined WAN cmpnents as a service Deplyment Cmpnent Perfrmance Cnsideratins Architecture planning includes the VMs t be migrated, the netwrks used fr virtual machine traffic, and the netwrks t be extended. This tpic summarizes sme maximum and minimum values fr the deplyment cmpnents. vsphere vcenter The Hybrid Clud Manager appliance must be installed n the vcenter that requires hybrid services. There can be nly ne Hybrid Clud Manager deplyment per vcenter. This restrictin applies t linked mde: the Hybrid Clud Manager management appliance is nly installed in the primary vcenter. The Hybrid Clud Manager supprts up t five registered vcenters (in linked mde). Clud Registratins The maximum number f clud endpints is ten. T find the number f endpints, Hybrid Clud Manager tracks vcenter cnnectins t the clud Maximum Number f Migratin and Netwrk Extensin Max cncurrent lw dwntime migratin tasks - 15 Max cncurrent L2C stretching tasks - 1 Max cncurrent vmtin migratin tasks Hybrid Clud Management Enterprise The Hybrid Clud Management Enterprise OVA is deplyed n the surce envirnment and registered as a plugin fr the vcenter Server managing the surce vsphere infrastructure. This plugin is then used t cnfigure the migratin and netwrk services required t enable crss clud migratin and L2 netwrk stretching. Nte that there can be nly ne Hybrid Clud Service deplyment per vcenter. This restrictin applies t linked mde: the Hybrid Clud Services management appliance is nly installed in the primary vcenter. The Hybrid Clud Service manager supprts up t five registered vcenters (in linked mde). Cpyright IBM Crpratin 2017 Page 17 f 58

18 Figure 4 Surce Hybrid Clud Services Hybrid Clud Manager Service Virtual Appliance The installatin package is an OVA file cntaining the Hybrid Clud Manager plug-in. This Hybrid Clud Manager management appliance is installed and cnfigured the, and then used t cnfigure the service appliance virtual machines. Hybrid Clud Manager Hybrid Clud Gateway Layer 2 Cncentratrs WAN Optimizers Hybrid Clud Manager The Hybrid Clud Manager plug-in is deplyed n-premises nly. It manages the service virtual appliances fr the SD-WAN. The Hybrid Clud Manager virtual appliance is an extensin t the surce vcenter and is deplyed as a virtual machine. The Hybrid Clud Manager appliance file structure cntains all the hybrid service virtual appliances. The Hybrid Clud Manager versees the deplyment and cnfiguratin f the Clud Gateway, the Layer 2 Cncentratrs, and WAN Optimizatin virtual appliance bth n-premises and in the clud. When the Hybrid Clud Manager virtual appliance is installed either thin r thick prvisining fr the hard drive can be selected. By default, hard drives fr the service virtual appliances are thinly prvisined. After the service, virtual appliance cnfiguratin and deplyment is dne, lg in t this virtual machine t use the Hybrid Clud Manager Management Prtal Hybrid Clud Gateway The Hybrid Clud Gateway maintains a secure channel between vsphere and the IBM Clud. Cpyright IBM Crpratin 2017 Page 18 f 58

19 Hybrid Clud Manager uses strng encryptin t btstrap a site-t-site cnnectin t IBM Clud. The secure channel between vsphere and IBM Clud achieves multi-tenancy fr vsphere prtcls that are nt tenant-aware, and t prevent netwrking "middle mile" security prblems. The Clud Gateway als incrprates vsphere replicatin technlgy t perfrm bidirectinal migratin WAN Optimizer Figure 5 Surce Clud Gateway Hybrid Clud Manager uses sftware-defined WAN Optimizatin. The WAN Optimizatin appliance is an ptinal, yet highly recmmended, cmpnent that perfrms WAN cnditining t reduce effects f latency. It als incrprates Frward Errr Crrectin t negate packet lss scenaris, and deduplicatin f redundant traffic patterns. Altgether, these reduce bandwidth use and ensure the best use f available netwrk capacity t expedite data transfer t and frm IBM Clud. Virtual machine migratin relies n the cmbinatin f Clud Gateway and WAN Optimizatin appliance t achieve unparalleled mbility between vsphere n-premises and IBM Clud. Layer 2 extensin benefits frm WAN ptimizatin when the data path is ruted thrugh the Clud Gateway. Cpyright IBM Crpratin 2017 Page 19 f 58

20 3.2.8 Layer 2 Cncentratr Figure 6 Surce WAN Optimizer The Netwrk Extensin Service extends a Layer 2 netwrk frm the n-premises vsphere data center t IBM Clud. The Layer 2 Cncentratr virtual service appliances make extensin pssible. The Layer 2 Cncentratrs have tw interfaces: Internal trunk interface: Handles virtual machine traffic n-premises fr the extended netwrks using a translatinal bridge mapping t a crrespnding stretched netwrk in IBM Clud. Uplink interface: Hybrid Clud Manager uses this interface t send encapsulated verlay traffic t and frm IBM Clud. Applicatin data travels thrugh this interface. Cpyright IBM Crpratin 2017 Page 20 f 58

21 Figure 7 Surce L2 Cncentratr Layer 2 Appliance Psitin in the Single-Path Deplyment The cnfiguratin wizard's default strategy is t define the Clud Gateway, then place the Layer 2 Cncentratr "behind" the Clud Gateway. The WAN ptimizer btstraps frm the Clud Gateway s it uses the gateway s address by default. A rutable IP address must be assigned; therefre, tw IP addresses are cnsumed Chsing a Deplyment Architecture The mst cmmn use case is t install the Hybrid Clud Manager, then install a single-path cnfiguratin. Single path architecture uses the Clud Gateway fr migratin, netwrk extensin, and netwrk cmmunicatin. This single-path architecture is smetimes called a "fleet" installatin. In additin t the fleet cnfiguratin, the architecture can include Layer 2 Cncentratrs that create alternate paths used t extend netwrks int the clud, r t handle cmmunicatin amng virtual machines. The Clud Gateway handles all migratin and any netwrk traffic fr appliances in the fleet, while the independent Layer 2 Cncentratrs handle cmmunicatin amng virtual machines. Separating the migratin path frm the data path minimizes the chance f migratin wrklads interfering with cmmunicatin between VMs. Netwrk extensin with either cncentratr requires a virtual distributed switch. HT L2C can cnnect t nly ne VLAN. vmtin requires a high-thrughput L2C and a stretched netwrk Migratin Only The minimal cnfiguratin t perfrm migratin nly requires the Hybrid Clud Manager and the Hybrid Clud Gateway appliance is required. The minimum requirement fr lw-dwntime migratin is vcenter 5.5 Update 3, r vcenter 6.0 r greater and vsphere hst must be ESXi 5.5 r higher. Cpyright IBM Crpratin 2017 Page 21 f 58

22 It is pssible t migrate virtual machines withut netwrk extensin. In this case, the virtual machine btains a new IP address using the Guest Custmizatin service after it is migrated. T stretch a netwrk, a distributed virtual switch must be cnfigured in the n-premise vsphere vcenter. WAN Optimizatin can imprve speed in the situatins described; cnfiguring the Hybrid Clud Gateway t use a high-speed li ne (such as a Direct Cnnect) imprves speed by prviding a higher bandwidth link fr WAN ptimized traffic. Migrating virtual machines n extended netwrks int IBM Clud is advantageus because it reduces dwntime and the cnfiguratin des nt change n the virtual machine. The virtual machine can retain the IP addresses, MAC addresses, cmputer names, and virtual machine names. Retaining these prperties greatly simplifies the migratin t IBM Clud and enables easy return trips t the n-premises data center. The Netwrk Extensin feature requires a vsphere Distributed Switch, which is available with vsphere Enterprise Plus Editin Netwrk Extensin The n-premise netwrk can be extended using either f the Layer 2 cncentratrs. The Layer 2 cncentratr is required t stretch the n-premises netwrk t IBM Clud and enable seamless migratin between the data center and the clud. By using the default deplyment cnfiguratin (single path), bth migratin traffic and extended netwrk traffic are ruted thrugh the Clud Gateway. Bth WAN ptimizatin (if installed) and intelligent ruting are applied t all wrklads. The Clud Gateway maintains the secure channel, which gets the benefits f WAN ptimizatin. Typically, cmmunicatin traffic between virtual machines is ruted ver the alternate path s migratin wrklads d nt affect cmmunicatin traffic. Data traffic between virtual machines uses the data paths established by the Layer 2 cncentratrs. T cnfigure a Layer 2 netwrk extensin, certain prerequisites must be set, as explained in the Verify Layer 2 Installatin Requirements sectin f the appendices IP Address Requirements T deply the Hybrid Clud Manager, the prper number f IP addresses must be available bth npremises and in the target IBM Clud. This sectin addresses hw t calculate the addresses required vmtin Address Maintaining a separate netwrk fr vmtin is a cmmn practice in the n-premises data center. The Hybrid Clud Gateway must have access t the vmtin netwrk. If it des nt, an extra IP address is needed t cmmunicate with the vmtin netwrk. On Premises One IP address fr the Hybrid Clud Manager appliance. One fr each Hybrid Clud Gateway, add ne if there is a separate vmtin netwrk. One fr each standard Layer 2 Cncentratr, if nt using the autmatically assigned IP address. One fr each HT L2C. IBM Clud Tw IP addresses per Hybrid Clud Manager appliance cnnected t IBM Clud. The addresses can be used t cnnect t the Internet r ne r mre Direct Cnnect lines. Add ne if there is a separate vmtin netwrk cnnectin. Cpyright IBM Crpratin 2017 Page 22 f 58

23 Prximity Ruting Prximity Ruting is a netwrking feature which can be enabled when the Clud Gateway is cnfigured. Prximity ruting ensures frwarding between virtual machines cnnected t stretched and ruted netwrks, bth n-premises and in the clud, is symmetrical. This feature requires Dynamic Ruting cnfigured between the custmer premises and the clud. When users extend their netwrks t the clud, Layer 2 cnnectivity is stretched nt IBM Clud. Hwever, withut rute ptimizatin, Layer 3 cmmunicatin requests must return t the npremises netwrk rigin t be ruted. This return trip is called "trmbning" r "hairpinning." Trmbning is inefficient because packets must travel back and frth between the netwrk rigin and the Clud, even when bth surce and destinatin virtual machines reside in the Clud. In additin t inefficiency, if the frwarding path includes stateful firewalls, r ther inline equipment that must see bth sides f the cnnectin, cmmunicatin might fail. Virtual machine cmmunicatin (withut rute ptimizatin) failure ccurs when the egress path exiting the clud can be either the stretched Layer 2 netwrk r the Org Ruted Netwrk. The n-premises netwrk des nt knw abut the stretched netwrk "shrtcut." This prblem is called asymmetric ruting. The slutin is t enable prximity ruting s the n-premises netwrk can learn the rutes frm IBM Clud. The Clud Gateway maintains an inventry f virtual machines in the clud. It als understands the virtual machine state, which can be: Transferred t the clud with vmtin (zer-dwntime migratin). Migrated t the clud using hst-based replicatin (lw-dwntime migratin). Created in the clud (n a stretched netwrk). T prevent trmbning, VCF/VCS Hybrid Clud Manager uses intelligent rute management t chse rutes apprpriate t the virtual machine state Asymmetric Ruting with Prximity Ruting Slutin In the diagram, the N*a cmpnents n the left reside in the n-premises data center, and the N*b cmpnent n the right reside in the clud. R1 is the default gateway fr N1-b, therefre, N1-b must return t R1 t rute traffic thrugh R2. T prevent asymmetric ruting, VCF/VCS Hybrid Clud Manager injects hst rutes int the n-premises netwrk. If the virtual machine was newly created in the clud, r it was mved with lw-dwntime migratin, the hst rute is injected immediately. If the virtual machine was transferred using vmtin, the rute is nt injected until the virtual machine rebts. Waiting until after the rebt ensures that the n-premises stateful devices cntinue t service the existing sessin until the virtual machine rebts. After the rebt, the ruting infrmatin is cnsistent bth n-premises and in the clud. That is, R1 can use ruting t reach a specific virtual machine thrugh R2, rather than using the lcally cnnected extended Netwrk. R2 fully wns the path fr ther netwrks t reach virtual machines with Prximity Ruting enabled Cpyright IBM Crpratin 2017 Page 23 f 58

24 MAC Address Retentin Asymmetric Ruting with Prximity Ruting Slutin The ptin t retain the MAC address is a check bx in the migratin wizard. It is nly visible fr replicatin-based migratin. By default, Retain MAC is enabled if the surce virtual machine is in a stretched netwrk, and disabled when the netwrk is nt stretched. If the MAC address is nt retained the virtual machine btains a new address when the migratin is dne. The decisin t retain a MAC address r acquire a new ne can impact the migratin prcess and the pst-migratin netwrk traffic flw. Retaining the MAC address is required fr the fllwing reasns: Licenses based n the MAC address: Sme sftware pairs the license t the MAC address f the VM. Changing the MAC address f a virtual machine invalidates the license. Linux NIC rder: In Linux, if the MAC address is changed n a virtual machine, the NIC Ethernet device number might change after a rebt. A device number change can alter the NIC presentatin rder within the perating system, breaking applicatins r scripts that depend n NIC rder. Less dwntime if the netwrk is stretched: If the virtual machine is migrated ver a stretched netwrk, enabling Retain MAC minimizes dwntime because the netwrk des nt have t learn a new MAC address. The check bx is n the Select destinatin netwrk page during migratin peratin Security Plicy Migratin The Plicy Migratin feature enables NSX distributed firewall rules t be mved frm an n-premises vcenter t a VCF/VCS Hybrid Clud Manager enabled Clud. Plicy Migratin is pssible when using lw-dwntime migratin r vmtin t mve a virtual machine ver a netwrk stretched with the High Thrughput Layer 2 Cncentratr. The n-premises data center must be running NSX r greater. Cpyright IBM Crpratin 2017 Page 24 f 58

25 In vsphere, the security plicy is a single NSX Sectin, which can cntain many rules. There can be nly ne Sectin (plicy) per Org vdc. A Set f IP addresses r MAC addresses can be identified t participate in the plicy. The name f the MAC Set r IP Set cannt exceed 218 characters. All rules in a Sectin must have a unique name. D nt leave a rule name blank. Supprted rules specify Layer 3 IP addresses r IP Sets, r Layer 2 MAC addresses r MAC Sets as the surce r destinatin. Nte: Rules that specify security grups r applicatin grups fr the surce r destinatin are nt migrated. Any change t the migrated plicy is prpagated t all VMs that use the plicy. Cpyright IBM Crpratin 2017 Page 25 f 58

26 4 Cmpnent level Architecture, Target This sectin describes the architecture f each Hybrid Clud Manager cmpnent deplyed within the IBM Clud r Nn-IBM Clud envirnment. Nte that the spke (i.e., target) deplyment mdel within the IBM Clud is discussed NSX Edge The first cmpnent cnfigured within the IBM Clud is a pair f NSX Edge virtual machines. It is imprtant t nte that all IBM Clud fr VMware Slutins deplyments already install and cnfigure an edge device fr cluddriver utbund cmmunicatin. While this ESG culd be re-used fr Hybrid Clud Manager cmmunicatin, hwever it is advised that a new pair are deplyed. The NSX Edge virtual machines are cnfigured as an Active/Passive pair f X-Large NSX Edge devices. These devices are used t cnnect int the IBM Clud VMware envirnment via a public internet cnnectin. The X-Large NSX Edge was chsen fr the internal envirnment since it is suited fr envirnments which have lad balancer with millins f cncurrent sessins that d nt necessarily require high-thrughput. As part f the cnfiguratin prcess, the NSX Edge is cnnected t the IBM Clud public VLAN as well as the IBM Clud private VLAN designated fr management infrastructure. Cmpnent CPU RAM Disk Cnfiguratin 6 vcpu 8 GB 4.5 GB VMDK resident n shared strage with 4 GB swap Table 1 NSX Edge Deplyment Since the set f NSX Edges are cnfigured as active/passive in either the internal r dedicated deplyment, vsphere Distributed Resurce Scheduler (DRS) anti-affinity rules must be created by the user t ensure that NSX Edges d nt execute n the same hst as their respective peer appliance. Field Name Type Value Members NSX Edge 1 NSX Edge External Gateway Separate Virtual Machines NSX Edge 2 Table 2 NSX Edge Anti-Affinity Rules In additin t the NSX Edge appliances deplyed within the IBM Clud, there is anther virtual machine that is deplyed that are part f a single OVA fr Hybrid Clud Services. After the deplyment f this OVA, the afrementined NSX Edge is enabled t utilize lad balancing and cnfigured with applicatin prfiles that utilize a certificate fr inbund cnnectin frm the surce. The NSX Edge is als cnfigured with pls t pint the Hybrid Clud Manager appliance, vcenter, and PSC appliances. Additinally, a virtual server is created with a virtual IP address (VIP) n the public interface with rules that cnnect the pls with VIP. A sample f the virtual server cnfiguratin and pl cnfiguratin n the NSX Edge is shwn in Figure 8 VIP Cnfiguratin fr NSX Edge and Cpyright IBM Crpratin 2017 Page 26 f 58

27 Figure 8 VIP Cnfiguratin fr NSX Edge Figure 9 Pl Cnfiguratin fr NSX Edge Once the lad balancing cnfiguratin is cmplete, the firewall rules n the NSX are updated t accept inbund cnnectins t the Hybrid Clud Manager fr prt 443 (HTTPS) frm the surce HCX Hybrid Clud Manager The Hybrid Clud Manager cmpnent is the first appliance deplyed after the NSX Edge appliances are cnfigured n the target. This appliance is used as the main interface int the clud envirnment fr the previusly discussed surce cmpnents, and prvides an abstracted netwrking user interface that can be used t add, edit, and delete netwrks as well as design and cnfigure ruting withut direct use f NSX. As a result f the vcenter and NSX integratin, the Hybrid Clud Manager appliance is assigned a private prtable IP address n the management VLAN. Additinally, it is cnfigured t access vcenter and NSX with a specific user. It is imprtant t nte the Hybrid Clud Manager s IP address is the same IP address used in the NSX edge fr lad balancing. After the Hybrid Clud Manager clud cmpnent is deplyed and cnfigured, the surce cmpnents create a cnnectin t the Hybrid Clud Manager via the VIP addresses cnfigured in the NSX ESG. Once this cnnectin is made, the clud gateway and WAN ptimizer appliances are deplyed within the IBM Clud. Cpyright IBM Crpratin 2017 Page 27 f 58

28 4.1.3 Clud Gateway Figure 10 Target - Hybrid Clud Manager Appliance As previusly mentined, a virtual appliance is deplyed after a cnnectin is established frm the surce t the target clud. This appliance is the Clud Gateway (CGW) and is used t maintain a secure channel between vsphere envirnment designated as the surce and the IBM Clud. The sizing specificatin f the CGW appliance deplyed within the IBM Clud is listed in Table 3 Clud Gateway Deplyment. Cmpnent CPU RAM Disk Cnfiguratin 8 vcpu 3 GB 2.0 GB VMDK resident n shared strage Table 3 Clud Gateway Deplyment This Clud Gateway is deplyed cnfigured t reside n the management VLAN (Private Prtable Subnet) as well as the vmtin VLAN (Private Prtable Subnet) f the IBM Clud fr VMware Slutins deplyment. Additinally, anther interface is cnfigured n the Public VLAN (Public Prtable) fr cnnectins made ver the public internet. Nte that public access is nt required if there is a direct cnnectin (i.e., private cnnectin in place). The last cnnectin assciated with the Clud Gateway is a lgical switch that is created and cnfigured upn site pairing. This lgical switch is a private, nn-rutable netwrk that is used as a cmmunicatin channel between the Clud Gateway and WAN Optimizer discussed in WAN. Figure 11 Clud Gateway Deplyment depicts a high-level cmpnent diagram f the clud gateway appliance and assigned cnnectins. Cpyright IBM Crpratin 2017 Page 28 f 58

29 4.1.4 WAN Optimizer Figure 11 Clud Gateway Deplyment The secnd cmpnent deplyed is the WAN Optimizatin appliance. While the WAN Optimizatin appliance is ptinal, it perfrms WAN cnditining t reduce effects f latency. It als incrprates Frward Errr Crrectin t negate packet lss scenaris, and deduplicatin f redundant traffic patterns. Altgether, these reduce bandwidth use and ensure the best use f available netwrk capacity t expedite data transfer t and frm the IBM Clud. Nte that the WAN Optimizer is disk intensive and requires sufficient amunt f IOPS t functin prperly. As a result, the WAN ptimizer resides n vsan strage within the VCF envirnment and Endurance strage supprting ver 2000 IOPS within a VCS deplyment. The sizing specificatin fr the WAN Optimizatin appliance is specified in Table 4 WAN Optimizatin Appliance Sizing Cmpnent CPU RAM Disk Cnfiguratin 8 vcpu 14 GB 30 GB VMDK + 70 GB VMDK resident n shared strage Table 4 WAN Optimizatin Appliance Sizing Cpyright IBM Crpratin 2017 Page 29 f 58

30 Unlike the Clud Gateway, the WAN Optimizatin appliance is nly attached t a lgical switch t enable cmmunicatin between itself and the Clud Gateway. Nte that is appliance is required if WAN ptimizatin is in use within the surce envirnment. See Figure 12 WAN Optimizer Deplyment fr a view f the netwrk layut Layer 2 Cncentratr Figure 12 WAN Optimizer Deplyment The third cmpnent is knwn as the Layer 2 Cncentratr (L2C) and is part f the Netwrk Extensin Services. The L2C is the virtual machine that allws the extensin f n-premises datacenter netwrks t the IBM Clud. Currently, there are tw types f appliances that can be deplyed: Standard L2C r Max HT L2C. The standard L2CC stretches VLANs and VXLANs. Custmers can use trunking t maximize a single appliance fr lw thrughput cases (500 Mbps r belw). The HT L2C stretches up t fur VLANs. If custmers are using a Direct Cnnect line t the IBM Clud, an HT L2C appliance makes the best use f the bandwidth. An HT L2C is required if zer-dwntime migratin (vmtin) is required. Nte that HT L2C appliances supprt up t 4 netwrk extensins. Deplyment f mre L2C appliances is supprted if additinal netwrk extensins are required. Cpyright IBM Crpratin 2017 Page 30 f 58

31 As part f this design, the HTL2C appliance is deplyed such that a custmer can stretch multiple VLANs and VLXANs int the IBM Clud ver the public internet r via the private netwrk via Direct Link. The sizing specificatin f the L2C appliance n the IBM Clud is listed in Table 5 HT L2C Appliance Sizing Cmpnent CPU RAM Disk Cnfiguratin 8 vcpu 38 GB 2 GB VMDK n shared strage Table 5 HT L2C Appliance Sizing The L2C appliance is deplyed n the management VLAN as well as the public VLAN. The public interface is used fr applicatin traffic that bund fr the surce f the extended netwrk. Additinal cnnectins, i.e., the extended netwrks, are created and attached t the L2C appliance nce the Hybrid Clud Manager surce administratr initiates the netwrk extensin int the IBM Clud. Example f these netwrks and cnnectins are dented depicted in Figure 13 L2 Cncentratr Deplyment. Figure 13 L2 Cncentratr Deplyment Cpyright IBM Crpratin 2017 Page 31 f 58

32 Cpyright IBM Crpratin 2017 Page 32 f 58

33 5 Summary The architecture discussed in this dcument explains the cnfiguratin details f VMware Hybrid Clud Manager n IBM Clud within an IBM Clud fr VMware Slutin deplyment in additin t an npremises vsphere estate. Fr mre infrmatin n VMware Clud Fundatin, please visit: Fr mre infrmatin n the VMware Clud Fundatin architecture, please visit: Cpyright IBM Crpratin 2017 Page 33 f 58

34 6 Appendix A - Prt Access Requirements Hybrid Clud Manager must traverse the public Internet and private lines, and cnnect t data center cmpnents, such as netwrks, switches, and prt grups. The fllwing Prt Access Requirements table lists prts that must be pened s that Hybrid Clud Manager virtual appliances can install successfully. Bth the vsphere envirnment and the IBM Clud envirnment must permit Netwrk Time Prtcl (NTP) clck synchrnizatin amng vsphere n-premises devices and the IBM Clud devices. UDP prt 123 must be accessible t Hybrid Clud Manager virtual appliances and netwrks. Installed NTP Servers can be specified when the Hybrid Clud Manager Appliance is installed. Surce Target Prt Prtcl Purpse Services HCM Custmer DNS 53 TCP/UDP Name Reslutin HCM NSX LB in IBM Clud 443 TCP Registratin service HCM vcenter in IBM Clud 443 TCP HCM REST service HCM PSC in IBM Clud 443 TCP HCM REST service HCM cnnect.hcx.vmware.cm 443 TCP Registratin service Web Brwser Admin Netwrk HCM 9443 TCP Hybrid Clud Manager Virtual Appliance Management Interface fr Hybrid Clud Manager system cnfiguratin. HCM 22 SSH Administratr SSH access t Hybrid Clud Manager. HCM ESXi Hsts 902 TCP Send management and prvisining instructins frm Hybrid Clud Manager t ESXi Hsts in IBM Clud HCM vcenter SSO Server 7444 TCP vsphere Lkup Service DNS HTTPS HTTPS HTTPS HTTPS HTTPS SSH Internal Cpyright IBM Crpratin 2017 Page 34 f 58

35 HCM NTP Servers 123 UDP Time Synchrnizatin HCM Syslg User Cnfigured Cnnectin between Hybrid Clud Manager (the client) and the Syslg server. Values fr the Syslg prt and prtcl specified in the vsphere Web Client (fr example, prt 514 fr UDP prtcl). HCM Clud Gateway 8123 TCP Send hstbased replicatin service instructins t the Hybrid Clud Gateway. HCM Clud Gateway 9443 TCP Send management instructins t the lcal Hybrid Clud Gateway using the REST API. Clud Gateway Clud Gateway L2C 443 TCP Send management instructins frm Clud Gateway t L2C when L2C uses the same path as the Hybrid Clud Gateway. L2C 8443 TCP Bidirectinal management instructins frm Clud Gateway t L2C, when L2C uses an alternate data path. HTTP HTTP HTTPS HTTP HTTPS HTTP HTTPS Cpyright IBM Crpratin 2017 Page 35 f 58

36 L2C L2C (remte) 443 TCP Bidirectinal management instructins frm Clud Gateway t L2C, when L2C uses an alternate data path. Clud Gateway ESXi Hsts 80, 902 TCP Management and OVF deplyment ESXi Hsts Clud Gateway 31031, Clud Gateway Clud Gateway (lcal) Clud Gateway (lcal) Clud Gateway (lcal) TCP Internal hstbased replicatin traffic. ESXi Hsts 8000 TCP vmtin (zerdwntime migratin) Clud Gateway (remte) 50 IP IP prtcl t encapsulate hybrid netwrk traffic fr bidirectinal tunnel. Clud Gateway (remte) 4500 UDP Internet key exchange (IKEv2) t encapsulate wrklads fr the bidirectinal tunnel. Netwrk Address Translatin- Traversal (NAT- T) is als supprted. Clud Gateway (remte) 500 UDP Internet key exchange (ISAKMP) fr the bidirectinal tunnel. HTTP HTTPS Internal Internal IPSEC IPSEC IPSEC Cpyright IBM Crpratin 2017 Page 36 f 58

37 7 Appendix B - Preparing Installatin Envirnment The installatin f Hybrid Clud Manager has the fllwing sftware requirements: vsphere 5.5 U3, r vsphere 6.0u2 r higher. If NSX is used, versin r higher. NSX is required fr plicy migratin. T use crss-clud vmtin, the same affinity restrictins apply acrss cluds as they d n-premises. See the VMware EVC and CPU Cmpatibility FAQ lcated at: Cnfigure Netwrk Cnnectivity Hybrid Clud Manager must traverse the public Internet and private lines, and cnnect t data center cmpnents, such as netwrks, switches, and prt grups. Prt Access Requirements (Appendix A) lists prts that must be pened s that Hybrid Clud Manager virtual appliances can install successfully. Bth the n-premise vsphere envirnment and the VCF/VCS Hybrid Clud Manager Clud envirnment must permit Netwrk Time Prtcl (NTP) clck synchrnizatin amng vsphere n-premises devices and the VCF/VCS Hybrid Clud Manager devices. UDP prt 123 must be accessible t Hybrid Clud Manager virtual appliances and netwrks. 7.2 On Premises Befre installing Hybrid Clud Manager, verify that yur envirnment can supprt the tasks yu want t accmplish. The n-premise envirnment must supprt the fllwing tasks befre Hybrid Clud Manager can be installed. Virtual Center with vsphere 5.5 Update 3 r 6.0 Update 2. vmtin and plicy migratin features require NSX versin r higher. A vsphere service accunt with the Administratr vcenter Server system rle assigned t it. See 60/index.jsp?tpic=%2Fcm.vmware.vsphere.security.dc%2FGUID-93B962A7-93FA-4E96-B68F- AE66D3D6C663.html. In the vcenter, enugh disk space fr Hybrid Clud Manager and the assciated service appliances t be installed. Sufficient IP addresses fr the n-premises VMs prvisined during the installatin. See IP Address Requirements fr the minimum requirements fr each cnfiguratin. Prts and firewalls pened as required as dcumented in Prt Access Requirements. If the single sign-n (SSO) server is remte, the URL f the vcenter, external SSO Server, r Platfrm Services Cntrller (PSC) that runs the external lkup service must be identified. When the Hybrid Clud Manager is registered with the vcenter, this URL must be supplied. If a vcenter des nt have its wn internal instance f the lkup service, it might be fr ne f the fllwing reasns: vcenter 6.0u2 is running an external Platfrm Services Cntrller. The vcenter is in linked mde (where the secndary vcenter uses the SSO service frm the primary vcenter r an external SSO service). 7.3 Verify Layer 2 Installatin Envirnment Layer 2 netwrk stretching requires the fllwing A vsphere enterprise plus editin. The vsphere vcenter must meet the fllwing requirements t supprt Layer 2 extensin. vsphere Enterprise Plus license Cpyright IBM Crpratin 2017 Page 37 f 58

38 Must have a vsphere Distributed Switch (vds). The distributed switch is available with vsphere Enterprise Plus Editin. When installed, the n-premises Layer 2 cncentratr service appliance must have access t a vnic prt and any VLANs t be stretched. If the netwrk is t be stretched ver the public Internet r a VPN (n an alternate path) the L2C virtual machine in VCF/VCS requires an IP address. The remte IP address is required t cnfigure the Layer 2 cncentratr. If multiple Layer 2 cncentratrs are desired, each must have an IP address n-premises and in the clud. Cpyright IBM Crpratin 2017 Page 38 f 58

39 8 Appendix C - Installing and Cnfiguring Hybrid Clud Manager n Surce The n-premise installatin entails deplying the Hybrid Clud Manager management appliance and registering it with the vcenter and ne r mre VCF/VCS HCX enabled clud endpints. Install the Hybrid Clud Manager Appliance Install the Hybrid Clud Manager appliance in the n-premises vcenter. Register the Hybrid Clud Manager With the vcenter Register the Hybrid Clud Manager plug-in in the vsphere Web Client and start the Hybrid Clud Manager management service. Cnfigure the Prxy Settings The Hybrid Clud Manager can be cnfigured t wrk with a prxy server. Register the Hybrid Clud Manager With a VCF/VCS Hybrid Clud Manager enabled clud Assciate the Hybrid Clud Manager (n premises) with a VCF/VCS Hybrid Clud Manager enabled clud endpint. 8.1 Install the Hybrid Clud Manager Appliance Install the Hybrid Clud Manager appliance in the n-premises vcenter. 8.2 Prcedure 1. Lg in t My VMware and dwnlad the Hybrid Clud Manager OVA file frm the prduct dwnlad page. Fr early adpters, cntact IBM Office f the CTO fr special link. T verify the OVA file, take nte f the MD5. After the file dwnlads, d an MD5 checksum. 2. Open a brwser and lg in t the vsphere Web Client. (This task cannt be perfrmed frm the vsphere Client.) View the Hme tab. 3. In the Inventries Trees list, click Hst and Clusters. 4. Expand the hierarchy t shw the data centers. 5. Right-click the target data center and select Deply OVF Template frm the cntext menu (it might take a few secnds fr the Deply OVF Template menu item t appear). The Deply OVF Cpyright IBM Crpratin 2017 Page 39 f 58

40 template wizard pens. 6. Chse Deply OVF template Select Lcal file and click Brwse t find the OVA file dwnladed t the cmputer. Click Next. On the Review details page, click the Accept extra cnfiguratin ptins check bx and click Next. On the "Accept EULAs" page, scrll dwn t review the VMware end-user license agreement. Click Accept and Next. On the Select name and flder page, edit the name (if necessary) and select the lcatin fr the Hybrid Clud Manager. Click Next. On the Select a resurce page, select the installatin lcatin. On the Select strage page, select the strage fr the Hybrid Clud Manager and click Next. Frm the Select virtual disk frmat drp-dwn menu, either thin r thick prvisining can be selected. On the Setup netwrks page, map the Hybrid Clud Manager adapter t a hst netwrk chsen frm the Destinatin drp-dwn menu. 7. On the Custmized template page, enter the values specific t the envirnment. Passwrds. The default user name fr bth the cmmand-line interface (CLI) and the Web user interface is: admin. The admin user and passwrd t lg in t the Web user interface (see Lg in t the Hybrid Clud Manager Management Prtal ) is required as is als a rt user accunt that has a passwrd that can be set. Enter and reenter the CLI admin user passwrd. Enter and reenter the rt user passwrd. In the future, if help is needed frm VMware Glbal Supprt Services (GSS), this passwrd might have t be shared s they can trublesht the system. Netwrk Prperties. Cpyright IBM Crpratin 2017 Page 40 f 58

41 Enter the hstname fr the Hybrid Clud Manager VM. Enter the netwrk IPv4 address, the IPv4 prefix (the CIDR), and the default gateway. The fllwing values are samples: DNS. Click DNS, and enter the IP addresses fr DNS servers (separated by spaces) and the dmain search list. The values in the fllwing screensht are samples: DS cnfiguratin Services Cnfiguratin. Click Services Cnfiguratin, and enter the NTP server list (separated by spaces) fr the Hybrid Clud Manager VM. Checking Enable SSH gives an administratr SSH access t the Hybrid Clud Manager virtual management appliance. If SSH is enabled, plan t address the security risk. 8. Review the vservice bindings page. Click Next t cntinue, r t change previus screens, click Back. 9. On the Ready t cmplete page: Check the Pwer n after deplyment check bx. Review the Hybrid Clud Manager settings, and click Finish. It might take several minutes fr the Hybrid Clud Manager appliance t pwer n. Cpyright IBM Crpratin 2017 Page 41 f 58

42 T check the status, g t the vsphere Web Client hme page, and in the Hme tab, g t Inventries and click Hsts and Clusters. Expand the data center hierarchy, and click the Hybrid Clud Manager service virtual machine t display a summary in the center pane. The Summary tab, the cnsle reads Pwered On and the Play buttn is green. 10. The Hybrid Clud Manager is pwered n and ready t be registered with the vcenter. Cpyright IBM Crpratin 2017 Page 42 f 58

43 9 Appendix D - Register Hybrid Clud Manager with the vcenter Register the Hybrid Clud Manager plug-in in the vsphere Web Client and start the Hybrid Clud Manager management service. 9.1 Prerequisites The Hybrid Clud Manager virtual appliance must be pwered n befre it can be registered. 9.2 Prcedure 1. Lg in t Hybrid Clud Manager service virtual appliance. 2. Click the Manage Settings tile. a. In the left pane, under Cnfigure Systems, select vcenter. b. Click the Add vcenter buttn n the upper right. c. Enter the IP address f the vcenter Server in the frm r d. Fr example, r e. Enter the vcenter Server user name and passwrd. The accunt used must have the vcenter Administratr rle. f. Click OK. D nt restart when the Yu need t restart the app" message is displayed. Prceed t next step. 3. Cnfigure the lkup service. a. Click the Manage tab. b. Click the Edit buttn n the far right f the Lkup Service URL text bx. c. Enter the lkup service endpint in the fllwing frm: i. vcenter Server 5.5u3: ii. vcenter Server 6.0u2: d. Click OK. D nt restart when a message t restart the Web Engine is displayed. Prceed t next step. 4. Click the Summary tab, and find the Hybridity Management Cmpnents sectin. Cpyright IBM Crpratin 2017 Page 43 f 58

44 a. Stp and start bth the applicatin engine and the Web engine. 5. T finalize the registratin, lg ut f the vsphere Web Client. Lg back in t verify that the screen update has ccurred. Ntice the existing Hybrid Clud icn and the Hybrid Clud Services menu item n the left, as indicated in red the fllwing screensht. The Hybrid Clud Manager registratin updates these labels as shwn in the fllwing screensht. In the inventry, Hybrid Clud Services becmes Hybrid Clud Manager, and the icn label als becmes Hybrid Clud Manager. Cpyright IBM Crpratin 2017 Page 44 f 58

45 10 Appendix E - Cnfigure Prxy Settings The Hybrid Clud Manager can be cnfigured t wrk with a prxy server. While this is nt recmmended, it is pssible. Please nte that effective thrughput f migratin peratins will be severely affected as Prxy servers will likely be a bttleneck in Enterprise envirnments Prxy Server Settings Argument -Dhttps.prxyHst=<prxy-server> Descriptin IP address r hstname f the prxy server, if name reslutin is in place -Dhttps.prxyPrt=<prxy-serverprt> - Dhttp.nnPrxyHsts="lcalhst 127. * <ther-lcal-ip-ranges>" IP prt required fr the prxy server IP addresses, subnets, r dmain names that can be accessed withut ging thrugh the prxy server. These values are prvided in a string, where the names r addresses are separated with the character. Wildcards are supprted. Fr example: "lcalhst 127.* crp.mydmain.cm * * 10. * <additinal-hst>" Perfrm the manual cnfiguratin prcess after registering the Hybrid Clud Manager service virtual appliance with the vcenter, and befre registering the Hybrid Clud Manager with IBM Clud. T cnfigure the prxy, mdify the /etc/rc.d/init.d/app-engine and /etc/rc.d/init.d/web-engine scripts t include the prxy infrmatin, and then restart bth services Prerequisites The fllwing infrmatin is required t cnfigure the prxy settings: The prxy server IP address r hst name (fr example, prxy.xyz.cm) The prxy prt number n the prxy server (fr example, 8080) The subnets, dmain names, r hst IP addresses that d nt need t use the prxy server. Specify bth the lcal dmain name and the private subnet t avid using the prxy server fr the lcal netwrk Prcedure Lg in t the Hybrid Clud Manager service virtual appliance using the cnsle r remte SSH. Supply the admin user name and passwrd set when the Hybrid Clud Manager was installed. Switch user t rt. Change directry t: /etc/rc.d/init.d Make cpies f the riginal web-engine and app-engine scripts. Edit /etc/rc.d/init.d/app-engine t add the prxy infrmatin, as shwn in the fllwing sample. java -Xmx2048m -Xms2048m -XX:MaxPermSize=512m Dhttps.prxyHst=myprxy.mycmpany.cm Dhttps.prxyPrt=8080 Cpyright IBM Crpratin 2017 Page 45 f 58

46 Dhttp.nnPrxyHsts="lcalhst 127.* * * 10.*" DUSE_HTTP_TUNNELING=true Djavax.xml.bind.JAXBCntext=cm.sun.xml.internal.bind.v2.CntextFactry Djsse.enableSNIExtensin=false Dext.prperties.dir=/etc/hybridity/app engine Dlgback.cnfiguratinFile=/etc/hybridity/app lgback.xml jar /usr/lcal/platfrm jars/applicatin engine 1.0.jar >> $LOG_FILE 2>&1 &date >> $LOG_FILE ech "Dne." Edit /etc/rc.d/init.d/web-engine t add the prxy infrmatin. java -Xmx2048m -Xms2048m -XX:MaxPermSize=512m Dhttps.prxyHst=prxy.xyz.cm Dhttps.prxyPrt=8080 Dhttp.nnPrxyHsts="lcalhst 127.* 10.* *.eng.xyz.cm" Djsse.enableSNIExtensin=false DsslEnabled=false Dext.prperties.dir=/etc/hybridity/web engine Dspring.cnfig.lcatin=/etc/hybridity/web engine/applicatin.prperties Dlgging.cnfig=/etc/hybridity/web lgback.xml jar /usr/lcal/platfrm jars/web server war >> $LOG_FILE 2>&1 & ech "Dne." Frm a brwser, specify the IP address fr the Hybrid Clud Manager appliance and lg in t the Hybrid Clud Manager Management Prtal. G t the Summary tab. Under Hybridity Management Cmpnents, find the "Web Engine" service listed under "Hybridity Management Cmpnents." Stp and start the Web engine and the applicatin engine. G t the vsphere Web client, lg ut, and lg back in. Cpyright IBM Crpratin 2017 Page 46 f 58

47 11 Appendix F - Installing and Cnfiguring Hybrid Services 11.1 Installing and Cnfiguring Hybrid Services The installer prvisins and cnfigures a virtual machine fr each service virtual appliance. The service virtual machines are deplyed bth n-premises and in the clud. Prerequisites The Hybrid Clud Manager must be installed n premises, and registered with a VCF/VCS HCX enabled clud endpint. The target virtual data center must have sufficient resurces. See IP Address Requirements and Verify the Minimum Installatin Envirnment. Cnfiguratin Overview The cnfiguratin prcedure assumes the cnfiguratin f all service virtual appliances; hwever, they are nt all required. Start Hybrid Service Virtual Appliance Installatin and Cnfiguratin The virtual appliances can be installed and cnfigured using a simple Web interface. Cnfigure the Hybrid Clud Gateway This tpic describes hw t cnfigure the Hybrid Clud Gateway service virtual appliance. Cnfigure the Netwrk Extensin Service This tpic describes hw t cnfigure a Netwrk Extensin service. Yu can perfrm this task fr a single path deplyment, r fr a standalne netwrk extensin n an alternate path. Stretching a Layer 2 Netwrk t IBM Clud This prcedure extends a Layer 2 netwrk frm the n-premises data center t IBM Clud Cnfiguratin Overview The cnfiguratin prcedure assumes all service virtual appliances will be cnfigured, hwever, they are nt all required. The Hybrid Clud Gateway is required. Installing WAN ptimizatin is accmplished by checking the WAN Optimizatin Service bx during the installatin. N further cnfiguratin is required. T cnfigure the Netwrk Extensin service, see Cnfigure the Netwrk Extensin Service. The deplyment f the ptinal appliance and can be deferred by returning t the Hybrid Services page and install the appliance later Start Hybrid Service Virtual Appliance Installatin and Cnfiguratin The simple web interface is used t install the service virtual appliances and t cnfigure additinal Layer 2 Cncentratrs. Prerequisites The Hybrid Clud Manager must be installed and registered with the VCF/VCS HCX enabled clud endpint. Prcedure Cpyright IBM Crpratin 2017 Page 47 f 58

48 Lg in t the vsphere Web Client. On the Hme tab, click the Hybrid Clud Manager icn. Click the Hybrid Services tab. Click Install Service. The "Chse Hybrid Services" page pens. Select the Services t be installed Click Next. What t d next The next step is t cnfigure the Hybrid Clud Gateway if required. A Layer 2 cncentratr can be added t an existing installatin at any time prvided there are sufficient resurces t supprt the extensin Cnfigure the Hybrid Clud Gateway This tpic describes hw t cnfigure the Hybrid Clud Gateway service virtual appliance. Prerequisites Prcedure Fllw the steps in "Start the Hybrid Service Virtual Appliance" and check Hybrid Clud Gateway. On the Hybrid Clud Gateway page, prvide the fllwing values: Netwrk: The switch that cnnects the Hybrid Clud Gateway management interface. In use cases 1 and 2, it can be a standard virtual switch r a virtual distributed switch. Fr any cnfiguratin using Layer 2 extensin, it must be a virtual distributed switch. Cluster/Hst: Select the Cluster r Hst in which the Clud Gateway is t be deplyed. Datastre: Select the datastre where t deply the Clud Gateway. VM/Hstname: This value is ptinal. Prvide the IP address/cidr, Default Gateway, and DNS server t use fr the Clud Gateway management interface. T enter multiple addresses fr the DNS server, separate them with cmmas. Under Extended (ptinal), chse the vmtin netwrk (if applicable), and set the admin and rt passwrds. These passwrds are specifically fr the Hybrid Clud Gateway appliance. The user name and passwrd d nt have t match the nes cnfigured fr the Hybrid Clud manager appliance. Click Next Cnfigure the Netwrk Extensin Service This tpic describes the cnfiguratin f a Netwrk Extensin service either fr single path deplyment, r fr a standalne netwrk extensin n an alternate path. Prerequisites Select the Netwrk Extensin service. (If the Single Path cnfiguratin is installed, Netwrk Extensin is yur nly chice). Prcedure On the Netwrk Extensin Service page, select a virtual distributed switch frm the Distributed Switch drp-dwn menu. When installing a standard Layer 2 Cncentratr, the "Rute stretched netwrks via Hybrid Clud Gateway" check bx will be available. It is nt there fr the high thrughput L2C. If Rute stretched netwrks via Hybrid Clud Gateway is selected the installer determines a reasnable placement fr the Layer 2 Cncentratr (based n the switch) and ppulates the placement infrmatin accrdingly. Cpyright IBM Crpratin 2017 Page 48 f 58

49 Otherwise the placement infrmatin must be manually entered in the next step. Set the rute fr the L2 Cncentratr placement. (If Rute stretched netwrks via Hybrid Clud Gateway was selected these values cannt be edited.) Netwrk: The deplyment netwrk fr the Layer 2 Cncentratr s management interface. Cmpute: The deplyment cluster r hst fr the Layer 2 Cncentratr. Datastre: Deplyment datastre fr the Layer 2 Cncentratr. VM/Hstname: This value is ptinal. Specify the Netwrk Parameters fr the lcal Layer 2 Cncentratr. If this ptin is disabled, use the default parameters prvided by the installer. If the prt grup selected in the Hybrid Clud Gateway page Netwrk drp-dwn menu is nt part f the distributed switch, check Specify the Netwrk Parameters fr the lcal Layer 2 Cncentratr And edit the Extended Cnfiguratins text bxes. (Optinal) Extended Cnfiguratins: Set the admin and rt passwrds fr this specific Layer 2 Cncentratr. Click Next. On the Ready t cmplete page, review the infrmatin, and click Finish Mnitr Service Appliance Deplyment The task cnsle can be used t mnitr deplyment prgress fr a service virtual machine. Prcedure Lg in t the vsphere Web Client. On the Hme tab, click the Hybrid Clud Manager icn. The Hybrid Clud Manager pane pens. Click the Hybrid Services tab. The virtual appliance deplyment can be mnitred frm the Task cnsle. G t the Recent Tasks panel and view the All Users Tasks Click Mre Tasks t pen the Task Cnsle. In the Task Cnsle, watch the deplyment tasks. When all tasks are cmpleted, g t the inventry list and click Hybrid Clud Manager. In the central panel, click the Hybrid Services tab. Review the cnfiguratin summary fr the hybrid service virtual appliances 11.7 View Tunnel Status This prcedure describes hw t view the Clud Gateway tunnel status. Prerequisites The netwrk extensin service must be up if befre stretching a netwrk. Prcedure T check the tunnel status frm the Web client, select Hybrid Clud Manager in the inventry, and click the Hybrid Services tab. The fllwing screensht shws a successful Hybrid Clud Gateway tunnel. CGW is the acrnym fr the Hybrid Clud Gateway. The status is "Active," and n the far right, the tunnel is clr-cded green. Cpyright IBM Crpratin 2017 Page 49 f 58

50 11.8 Stretching a Layer 2 Netwrk t IBM Clud This prcedure extends a Layer 2 netwrk frm the n-premises data center t VCF/VCS HCX enabled clud. Prerequisites Only VLAN tagged prt grups (ther than VLAN type Nne, r VLAN ID 0) can be stretched. VXLANs are cnsidered VLANs. This prcess uses the Extend Netwrk wizard. This wizard must be run frm the vsphere Web Client netwrking inventry view. Althugh the wizard is visible frm ther views, it must be run frm the inventry cntext t get the crrect infrmatin. Prcedure Lg in t the vsphere Web Client. On the Hme tab in the central pane, click the Netwrking icn in the Inventries list. In the Netwrking hierarchy, identify the prt grup fr the netwrk t be extended. Right-click the prt grup, and frm the cntext menu, select Hybridity Actins and select Extend Netwrk. The Extend netwrk t Clud wizard pens. On the Select surce prt grups page, cnfirm the prt grup infrmatin and enter the Gateway IP address and prefix fr the netwrk. Click Next. On the Select destinatin gateway page: Select the VCF/VCS Hybrid Clud Manager Clud Organizatin frm the Organizatin menu. Select the VCF/VCS Hybrid Clud Manager Clud virtual data center frm the menu. Leave Prximity Ruting disabled t frce a VM within VCF/VCS Hybrid Clud Manager enabled clud t always use the n-premises gateway t access the Internet. By default, traffic riginating frm a VM in VCF/VCS Hybrid Clud Manager enabled clud traverses the Layer 2 data path back t the n-premises data center and ut t the default gateway. If Prximity Ruting is checked, a VM within VCF/VCS Hybrid Clud Manager enabled clud can access the Internet withut traversing the Layer 2 data path t vsphere. Select the remte destinatin gateway frm the list f gateways (click the rw). Click Next. On the Ready t cmplete page, review all values prvided. Click Finish. Cpyright IBM Crpratin 2017 Page 50 f 58