Service Oriented Virtual DC Design

Transcription

1 Dubrovnik, Croatia, South East Europe May, 2013 Service Oriented Virtual DC Design Višnja Milovanović Consulting Systems Engineer Data Center & Virtualization Cisco and/or its affiliates. All rights reserved. Cisco Connect 1

2 Setting the Stage: What s the Meaning of Virtual? If you can see it and it is there It s real If you can t see it but it is there It s transparent If you can see it and it is not there It s virtual If you can not see it and it is not there It s gone 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 2

3 Setting the Stage: Delivering a Service (With End-to-End Automation) Architect It Design It Where Can We Put It? Procure It Install It Configure It Cloud Secure It Manual Is It Ready? Architect It Design It Automated Self-Service On-Demand Where Can We Put It? Procure It Install It Configure It Secure It Is It Ready? Before After Machine-oriented Manual provisioning Hard to control utilization High provisioning & ops cost Extended provisioning time Configuration risk Service-oriented Self-service; automated provisioning Elasticity (capacity-on-demand) Optimized provisioning & ops cost Rapid provisioning Increased Resiliency and Availability 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 3

4 Use Case: Acquisition of New Sales Force, Consolidation and Rapid Provisioning via Templates Create 500 Virtual Desktops to Enable New Team to Access Corporate Information and Applications Virtual Desktops Storage Template Compute Template Fabric Template Application Template Increase Database Capacity to Support Sales Consolidation Effort Database Storage Template Compute Template Fabric Template Application Template Create 500 New Mailboxes Storage Template Compute Template Fabric Template Application Template 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 4

5 Agenda Data Center Virtualization Overview Front-End Data Center Virtualization Core Layer Aggregation Layer Networking Services Access Layer Server Virtualization Unified Computing System Virtual Access Layer Virtualized Services Server IO Virtualization Back-End Virtualization Q&A Unified Fabric & FCoE SAN & Storage 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 5

6 Virtualized Multi Service Data Center Infrastructure FC SAN A MDS 9500 SAN Director FC SAN B Nexus GE Core Layer 3 Layer 2-1GE Layer 2-10GE 10 GE DCB 10 GE FCoE/DCB 4/8 Gb FC Nexus GE Aggr vpc+ FabricPath L3 L2 Network Services FC SAN A FC SAN B MDS 9200 / 9100 Nexus 5500 FCoE Catalyst 6500 End-of-Row Nexus GE Nexus 2248 End-of-Row CBS 31xx switch Nexus 7000 End-of-Row Nexus 5500 FCoE Nexus 2232 Top-of-Rack UCS FCoE Nexus 3000 Top-of-Rack Nexus 4000 FIP-Snoop. IBM Center 1 GbE Server Access & 4/8Gb FC via dual HBA (SAN A // SAN B) 10Gb DCB / FCoE Server Access or 10 GbE Server Access & 4/8Gb FC via dual HBA (SAN A // SAN B) 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 6 B22 FEX HP C-class

7 Virtualized Network Infrastructure: Evolution and Considerations Typical DC Challenges L2 Fate-sharing VLAN Location L2 Adjacency Higher Scale L3 Access App Environments What are the implications Dynamic routing protocol for L2 (e.g.: IS-IS) Any VLAN anywhere resonates well Lower oversubscription Larger subnet sizes Global VLANs Specific app environments Designs Density & quantity of aggregation switches Density and Capabilities of access switch Classic Pod Access Ports in management domain Modern Pod 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 7

8 Leaf Layer Spine Layer DR Data Center Virtualized Data Center Infrastructure (2 Layers) OTV: Layer 2 Extension 1 / 10GE FC Converged FCoE link Dedicated FCoE link 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 8

9 Virtualized Data Center Infrastructure Maintaining Dual SAN Fabrics with Layer2 Multipath (Fabric Path) FabricPath enabled for LAN traffic Fabric A 1 / 10GE FC Converged FCoE link Dedicated FCoE link FabricPath Dual Switch core for SAN A & SAN B Fabric B All Access and Aggregation switches are FCoE FCF switches Dedicated FCoE links between switches are VE_Ports Storage VDC (Nexus 7000 only) for additional operation separation at high function agg/core (aka spine) SAN can utilize higher performance, higher density, lower cost Ethernet switches (F2 module on Nexus 7000 and unified ports on Nexus 5500) (*) FC connectivity to storage only available on Nexus 5000/5500. FCoE target and NAS / iscsi target connectivity to any Nexus switch. Leaf Layer Spine Layer VE L3 L2 CNA FCF FCF FCoE FCF FCF FC (*) NAS iscsi 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 9

10 Virtualized Data Center Infrastructure Virtualized Data Center Switch 1 Layer? Campus Access WAN Nexus 5500 with L3 module and vpc+ L3 ACE 4710 L2 ASA 5500 Nexus 2200 FCoE FC NAS iscsi VM #2 VM #3 VM #4 SMB Customer 1 / 10GE FC Converged FCoE link Dedicated FCoE link FabricPath 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 10

11 Agenda Data Center Virtualization Overview Front-End Data Center Virtualization Core Layer Aggregation Layer Networking Services Access Layer Server Virtualization Unified Computing System Virtual Access Layer Virtualized Services Server IO Virtualization Back-End Virtualization Q&A Unified Fabric & FCoE SAN & Storage 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 11

12 Front-End: LAN Core Layer LAN Core Layer 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 12

13 Virtual Device Contexts (VDC) Separate Resource Allocation Domains (Layer 3) Linecard 1 (M1) VDC-2 IP routes: 100K ACL entries: 50K Linecard 2 (M1) FIB TCAM Size 128K - 1M ACL TCAM Size: 64K - 128K VDC-1 IP routes: 20K ACL entries: 10K FIB TCAM Size: 128K 1M ACL TCAM Size: 64K - 128K Linecard 4 (F2) VDC-3 Storage VDC E.g.:FCoE on F1 linecard(s) Linecard 3 (F1) FIB TCAM Size 32K ACL TCAM Size: 16K - 192K VDC-4 F2 linecard(s) FIB TCAM Size 128K 1M (from M1-F1 combination) ACL TCAM Size: 1K - 16K 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 13

14 Front-End: Aggregation Layer Aggregation Layer 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 14

15 Virtual Port Channel (VPC) Active Active Layer 2 Links L2 Si Si Non-vPC vpc Physical Topology Logical Topology Bi-sectional BW with vpc Virtual Port Channel vpc is a Port-channeling concept extending link aggregation to two separate physical switches Allows the creation of resilient L2 topologies based on Link Aggregation. Eliminates the need for STP in the access-distribution Layer Enable seamless VM Mobility, Server HA Clusters Scale Available Layer 2 Bandwidth Dual-homed server operate in active-active mode Simplify Network Design Available on Nexus 7000 and Nexus 5000 / Cisco and/or its affiliates. All rights reserved. Cisco Connect 15

16 Logical View with FabricPath: Distributed Topology without L2 loops Virtual Access Switch POD (Nexus 7000 / 5x00 + Nexus 2200) S10 S20 S30 S40 L5 L6 L7 L8 L1 L2 L3 L4 L9 L10 L11 L12 FabricPath S200 S100 S101 S201 vpc+ vpc+ Virtual Switching (VBS) Server Unified Computing System (UCS) vpc+ allows dual-homed connections from edge ports into FabricPath domain with active/active forwarding. E.g.: Classical Ethernet switch, Layer 3 router, dual-homed server, etc Cisco and/or its affiliates. All rights reserved. Cisco Connect 16

17 Front-End: Networking Services Networking Services 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 17

18 Data Center Virtualized Services Physical Appliances/Modules Context Combination Example VRF VRF VRF VRF Front-End VRFs (MSFC) v5 1 v6 v7 3 v8 4 Firewall Module Contexts v105 v206 2 v107 v207 3 v108 v208 4 ACE Module Contexts VRF Back-End VRFs (MSFC) BU-1 BU-2 BU-3 BU-4 v105 v206 v207 v2081 v2082 v Server Side VLANs * vx = VLAN X **BU = Business Unit 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 18

19 VMDC Sample Containers Flexible framework allows variations as need be Bronze Silver Gold Palladium Expanded L3 L3 L2 vfw L3 LB L3 L2 vfw L3 FW LB L3 L2 vfw Public Zone Private Zone L3 L2 LB FW LB Protected Front-End Protected Back-End L3 L2 vfw FW LB FW LB vfw Predefined containers provide examples for different types of deployments Automated provisioning and management logic for each container type is predefined in the Management and Orchestration software Customers can choose from existing models or define their own customized models Cisco and/or its affiliates. All rights reserved. Cisco Connect 19

20 Business Continuance and Disaster Recovery? Cisco Data Center Interconnect (DCI) Solution based on OTV, VPLS, EoMPLS, LISP NetApp s FlexCacheenabled Intelligent Storage Arrays EMC svplex + Avamar VMware vsphere & VMotion Technologies Cisco Catalyst 6500 Series Cisco Nexus 7000 Series Cisco Nexus 7000 Series The Solution: VMotion enabled over Cisco DCI solution Benefits Workload balancing across data centers and clouds Proactive response to disruptions mitigates risks of Approaching disasters, viz. hurricanes, floods, etc., Power grid maintenance, Data center maintenance and migrations Planned events scheduled over a period of time Backup and Disaster Recovery aas Cisco and/or its affiliates. All rights reserved. Cisco Connect 20

21 Front-End: Access Layer Access Layer (LAN & SAN) 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 21

22 Cisco FEXlink: Virtualized Access Switch Nexus 2200 Fabric Extender (FEX) Cisco Nexus 5500 Cisco Nexus Distributed High Density Edge Switching System (up to 4096 virtual Ethernet interfaces) Cisco Nexus 2000 FEX Cisco Nexus 2000 FEX 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 22

23 To2R: Nexus 2200 Deployment Example Nexus 7000 Nexus 7000 vpc Aggregation Layer vpc Nexus 5500 Nexus 5500 Access Layer Nexus 2200 x4 Nexus 2200 x4 x4 x4 x4 x4 x4 x4 Rack Rack 1 1 Rack 2 Rack 1 Rack Rack 122 Rack Rack 131 Rack Rack Rack 1 Rack Rack Cisco and/or its affiliates. All rights reserved. Cisco Connect 23

24 IEEE 802.1BR: Bridge Port Extension Fully specifies a Port Extender (FEX Equivalent) Extends ports of a switch to lower entities in a network Port Extenders are not individually managed Their ports become ports of the controlling switch Cascading Port Extenders Allows one to choose the appropriate controlling switch Frame replication supported for efficient multicast / flooding Traffic from each Extended Port is reliably segregated to an E-channel and identified by a tag containing an E- channel identifier (ECID) Does not require prior knowledge of MAC addresses; switch performs standard learning functions Works with all devices including VEBs, VEPAs, individual VMs, physical services, and devices providing transparent services Controlling Bridge + PE = Extended Bridge Single Point of Management Extended Bridge Server VM1 PE PE PE PE PE vfw PE Bridge Port Extender Controlling Bridge ECID 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 24

25 Representation of Port Extender & Fabric Extender Switch Nexus 5500 Port Extension 802.1BR Eth Eth PE Tag Port 802.1BR Extender Nexus 2200 (FEX) Server Adapter Hypervisor PE Tag 802.1BR Port 0 1 Port Port n NIV Capable Adapter VM VM VM VM VM VM vnic 1 vnic 2 vnic 3 vnic 4 vnic 5 IEEE Bridge Port Extender = Cisco FEX (Fabric Extender) 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 25

26 UCS 1280 Virtual Interface Card (VIC) Customer benefits UCS 2208 IOM UCS 2208 IOM Dual 4x 10 GE (80 Gb per host) VM-FEX scale, up to 112 VM interfaces /w ESX 5.0 Feature details Dual 4x 10 GE port-channels to a single server slot Host connectivity PCIe Gen2 x16 PCIe Gen 2 x16 bandwidth limit is 32 Gbps HW Capable of 256 PCIe devices OS restriction apply PCIe virtualization OS independent (same as M81KR) Single OS driver image for both M81KR and 1280 VIC FabricFailover supported Eth hash inputs : Source MAC Address, Destination MAC Address, Source Port, Destination Port, Source IP address, Destination IP address, and VLAN FC Hash inputs: Source MAC Address, Destination MAC Address, FC SID and FC DID Side A Side B UCS 1280 VIC 256 PCIe devices 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 26

27 Agenda Data Center Virtualization Overview Front-End Data Center Virtualization Core Layer Aggregation Layer Networking Services Access Layer Server Virtualization Unified Computing System Virtual Access Layer Virtualized Services Server IO Virtualization Back-End Virtualization Q&A Unified Fabric & FCoE SAN & Storage 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 27

28 Front-End: Servers Layer Servers Layer 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 28

29 Cisco Unified Computing System (UCS) Form Factor Independence Mgmt LAN Any IEEE Compliant LAN SAN A SAN B Any ANSI T11 Compliant SAN Any ANSI T11 Compliant SAN One Logical Chassis to Manage* LAN Connectivity SAN Networking Chassis Server s Rack Servers Server Identity Management Monitoring, Troubleshooting etc. *architectural limit of 320 servers with 160 servers supported as of UCS release Cisco and/or its affiliates. All rights reserved. Cisco Connect 29 29

30 Network Has Complete Visibility to Servers UCS Service Profiles Capture more than MAC & WWN MAC, WWN, Boot Order, Firmware, network & storage policy Stateless compute where network & storage see all movement Better diagnostics and QoS from network to blade, policy follows Server Name: SP-A UUID: 56 4d cd 3f 59 5b 61 MAC : 08:00:69:02:01:FC WWN: Boot Order: SAN, LAN Chassis-1/-5 LAN Chassis-9/-2 Service Profiles deliver Service Agility regardless of Physical or Virtual Machine SAN 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 30

31 Stateless UCS Old Deployment: Web Servers Oracle RAC VMware Total Server Deployment 14 Servers Reduction of 4 Servers 22% CapEx Savings Cisco UCS Deployment: (still 18 Service Profiles) Web Servers Oracle RAC VMware Cisco s Deployment: Resources provisioned based on business need Still HA with fewer spares Burst Capacity HA Spare 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 31

32 Cisco VN-Link What is that and which problems does it solve? VN-Link (or Virtual Network Link) is a term that refers to a VM specific link that is created between the VM and Cisco switch. VNIC Hypervisor VNIC Logical equivalent & combination of a NIC, a Cisco switch interface and the RJ-45 patch cable that hooks them together. VETH VETH 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 32

33 Virtual Access Virtualized Servers Virtual Access Layer Nexus 1000v 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 33

34 Port Profiles How to 1. Nexus 1000V automatically enables port groups in vcenter via API Server 1 2. Server Admin uses vcenter to assign vnic policy from available port groups VM #1 VM #2 VM #3 VM #4 3. Nexus 1000V automatically enables VM connectivity at VM power-on 2. Nexus 1000V - VEM VMW ESX 3. WEB Apps Port Profile: 1. Nexus 1000V Available Port Groups PVLAN 108, Isolated Security Policy = Port 80 and 443 Rate Limit = 100 Mbps QoS Priority = Medium vcenter WEB Apps DB HR Compliance VSM Remote Port Mirror = Yes 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 34 34

35 Cisco Nexus 1000v multi-hypervisor support VM VM VM VM VM VM VM VM Nexus 1000V VSM Nexus 1000V VEM VMware vsphere Nexus 1000V VSM Nexus 1000V VEM Windows 8 Hyper-V VMware vcenter SCVMM Consistent architecture, feature-set & network services ensures operational transparency across multiple hypervisors Cisco and/or its affiliates. All rights reserved. Cisco Connect 35

36 Cloud Network Services Virtualized/Cloud Data Center WAN Router Switches Servers Imperva SecureSphere WAF Citrix NetScaler VPX vwaas ASA 1000V Cloud Firewall Cisco Virtual Security Gateway Cloud Services Router 1000V Zone A Tenant A Zone B Physical Infrastructure vpath VXLAN Nexus 1000V Multi-Hypervisor (VMware, Microsoft*, RedHat*, Citrix*) Nexus 1000V VSG ASA 1000V vwaas CSR 1000V (Cloud Router) Ecosystem Services Distributed switch NX-OS consistency VM-level controls Zone-based FW Edge firewall, VPN Protocol Inspection WAN optimization Application traffic WAN L3 gateway Routing and VPN Citrix NetScaler VPX virtual ADC Imperva Web App. Firewall Customers Shipping Shipping Shipping Beta Cisco and/or its affiliates. All rights reserved. Cisco Connect 36

37 Securing Tenant Edge with ASA 1000V Proven Cisco Security Virtualized Physical virtual consistency vcenter Virtual Network Management Center (VNMC) Collaborative Security Model VSG for intra-tenant secure zones Virtual ASA for tenant edge controls Seamless Integration With Nexus 1000V & vpath Scales with Cloud Demand Multi-instance deployment for horizontal scale-out deployment vsphere Tenant A Virtual ASA Tenant B VDC VDC vapp VSG VSG VSG vapp VSG Virtual ASA vpath Nexus 1000V 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 37

38 Cisco Nexus 1000v InterCloud Enterprise DC Public Cloud Physical Services Virtual Services vpath Secure L2 Extension (Cloud GW) Virtual Services vpath L2-VPC Nexus HW Switches vpath Nexus 1000V Nexus 1000V vpath Cloud Manager VM VM VM VM VM Cloud Service Router ASR 1K/9K ISR Enterprise Campus Enterprise Branch Remote Access Kumo Benefits: Security * Consistency * Control 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 38

39 Agenda Data Center Virtualization Overview Front-End Data Center Virtualization Core Layer Aggregation Layer Networking Services Access Layer Server Virtualization Unified Computing System Virtual Access Layer Virtualized Services Server IO Virtualization Back-End Virtualization Q&A Unified Fabric & FCoE SAN & Storage 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 39

40 Server IO Virtualization Unified Fabric 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 40

41 Unified Fabric Flexibility and Serialized Re-Use FCoE SAN iscsi Appliance iscsi Gateway NAS Appliance NAS Gateway Ability to re-provision any compute unit to leverage any access method to the data stored on the spindle Serialized Re-Use Boot from SAN and Run from NAS Virtualization requires that the Storage Fabric needs to exist everywhere the IP fabric does Computer System Computer System Computer System Computer System Application File System Volume Manager SCSI Device Driver FCoE Driver NIC Ethernet FCoE Block I/O Application File System Volume Manager SCSI Device Driver iscsi Driver TCP/IP Stack NIC Block I/O Ethernet NIC TCP/IP Stack iscsi Layer Bus Adapter Application File System Volume Manager SCSI Device Driver iscsi Driver TCP/IP Stack NIC Ethernet NIC TCP/IP Stack iscsi Layer FC HBA FC Application File System I/O Redirector NFS/CIFS TCP/IP Stack NIC Ethernet NIC TCP/IP Stack File System Device Driver Block I/O File I/O Computer System Application File System I/O Redirector NFS/CIFS TCP/IP Stack NIC Ethernet NIC TCP/IP Stack File System FC HBA FC 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 41

42 Unified I/O Architecture Consolidation Initial Goal No Consolidated IO I/O Consolidation with FCoE LAN SAN A SAN B LAN SAN A SAN B Nexus 5000 Ethernet FC FCoE 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 42

43 Example: Embedded FCoE at Cisco UCS From ad hoc and inconsistent to structured, but siloed, complicated and costly to simple, optimized and automated 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 43

44 Thank you Cisco and/or its affiliates. All rights reserved. Cisco Connect 44