#NET1338BU CONFIDENTIAL

Transcription

1 NET1338BU VMware Integrated OpenStack and NSX Integration Deep Dive Russ Starr, Cerner Marcos Hernandez, VMware #NET8343

2 #NET1338BU CONFIDENTIAL

3 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. #NET1338BU CONFIDENTIAL 3

4 Agenda 1 Introduction and Objectives 2 IaaS Options from VMware 3 4 OpenStack + NSX - High Level Architecture OpenStack vsphere and NSX Integration Points Basic Neutron Workflows and NSX Equivalents NSX Neutron Plugin Supported Topologies Tenant Networks vs. Provider Networks Tenant Self Service Networking Is This What You Need? Tenant Reachability Using Neutron Networks Dynamic Routing BGP Neutron Availability Zones NSX Micro-segmentation in OpenStack Service Chaining in OpenStack and FWaaS 5 Next steps - Q&A 6 Summary CONFIDENTIAL 4

5 Introduction and Objectives VMware NSX vsphere and NSX Transformers (multi-hypervisor) both integrate with OpenStack Neutron to deliver robust network capabilities in vsphere and/or KVM OpenStack-based clouds This session is largely focused on the vsphere edition of NSX, but some of the interactions between Neutron and NSX-T are also discussed, as well as some of the differences between the two implementations of the plugin. We will review advanced network and security services provided by OpenStack, including Load-Balancing-as-a-Service (LBaaS), Firewall-as-a-Service (FWaaS), advanced microsegmentation, service chaining and dynamic routing (BGP). Networking remains a challenge in most OpenStack deployments, as signaled by the results of the latest OpenStack User Survey. Users want a networking service to be less complicated to use, with more substantial documentation and better integration with compute functions and PaaS layer integration Source: OpenStack User Survey Where do I start? What does my journey look like? CONFIDENTIAL 5

6 IaaS Options from VMware vrealize Suite is a complete Cloud Management Platform Google Cloud AWS Simple IaaS External Cloud Connector vrealize Automation Orchestration Policies Service Catalog Chargeback App Lifecycle Management Compliance & Governance Configuration and Change Management Basic IaaS & Virtual Infra Consumption OpenStack delivers APIs to consume infrastructure Additional CMP components needed for Governance Developer Owned Toolsets -or- 3 rd Party Tool Vendor Neutral APIs Restrictions with Quotas Nova Neutron Cinder Consistent Virtual Infrastructure Virtual Infrastructure vsphere NSX VSAN CONFIDENTIAL 6

7 VMware Is Committed to Open Source and OpenStack Founders of the Neutron Project in OpenStack (formerly known as Quantum ) Founders and largest contributor to the Open vswitch Project (OVS) Founders of Open Virtual Networking (OVN), an open source control plane for OVS Authors of OVSDB, the de-facto standard for physical switch (ToR) ecosystem compatibility Don t take our word for it: - Who is doing what in OpenStack - OVS/OVN project page - RFC The Open vswitch Database Management Protocol CONFIDENTIAL

8 OpenStack + NSX High Level Architecture Cloud Consumption Management Plane Control Plane OpenStack Built for consumption by developers Support for endpoint heterogeneity Central Control Cluster CCP Local Control Plane LCP ESXi (+ kernel modules) Data Plane KVM (+ kernel modules) NSX Edge VM Or Bare Metal Layer 2 Bridge Improved performance and resiliency

9 Ecosystem Open source VIO HPE Mirantis Redhat SUSE Canonical The NSX Networking and Security Platform VMware Redhat Canonical ESXi 6.5 U1 RHEL 7.2 RHEL 7.3 Ubuntu LTS 9

10 OpenStack vsphere and NSX Integration Points vcenter VMDK Driver VMDK Driver vsphere Plugin Cinder Glance Nova Compute OpenStack Nova Services Neutron Server Heat Neutron Plugin RabbitMQ Keystone ESXi-1 NSX ESXi-2 NSX NSX Manager CONFIDENTIAL\ 10

11 3 rd Party OpenStack vsphere and NSX Integration Points ESXi-1 Host Switch vcenter (s) VMDK Driver VMDK Driver ESXi-2 Host Switch vsphere Plugin Cinder Nova Compute Nova Compute KVM-1 Host Switch Glance Nova Services OpenStack Neutron Plugin NSX Control/MGMT Plane RabbitMQ Neutron Server Keystone Heat

12 Basic Neutron Workflows and NSX Equivalents Load Balancer (NSX Edge Services Gateway) Floating IP (NSX Edge Services Gateway-DNAT) Web Network (Logical Switch or VLAN) App Network (Logical Switch or VLAN) VMworld 2017 Content: Not for DHCP (NSX Edge Services Gateway) Security Group (Distributed Firewall Security Group) Intranet Internet publication Router (NSX ESG - SNAT or NO-NAT) CONFIDENTIAL 12

13 Enterprise Model Enterprise Model NSX Neutron Plugin Supported Topologies Available out-of-the-box Use Case L2 Technology L3 Technology NSX Microsegmentation Notes 1 VLAN-Backed Networks VLAN Physical router Yes Micro-segmentation with NSGs VLAN-Backed with NSX L3 Services and NAT VLAN NSX Edge Yes VLAN-Backed with NSX L3 Services and No-NAT VLAN NSX Edge Yes VXLAN-backed with NSX L3 Services and NAT VXLAN NSX Edge NSX DLR NAT Yes No Distributed Routing support Load Balancers Provider Networks Micro-segmentation with NSGs and FWaaS No Distributed Routing support Dynamic routing Load Balancers Provider Networks Micro-segmentation with NSGs and FWaaS Overlapping IPs allowed Load Balancers Provider and Tenant Networks Micro-segmentation with NSGs and FWaaS Enterprise Model 3.2 VXLAN-backed with NSX L3 Services and No-NAT VXLAN NSX Edge NSX DLR No-NAT Yes No overlapping IPs allowed Dynamic routing Load Balancers Provider and Tenant Networks Micro-segmentation CONFIDENTIAL with NSGs and FWaaS13

14 Distributed Switch Options in the Neutron NSX Plugin Option 1 Option 2 Option 3 OpenStack Framework Nova Neutron Cinder Glance Keystone Load Balancer Neutron Routers Instances Management Cluster Edge Cluster Compute Cluster(s) Management VDS Management and Edge VDS Compute and Management/Edge VDS Edge VDS VMworld 2017 Content: Not for publication Compute VDS Compute VDS CONFIDENTIAL 14

15 Tenant Networks vs. Provider Networks The primary difference revolves around who provisions the network: Provider networks are created by the OpenStack administrator on behalf of tenants Tenant networks are created by tenants for use by their instances and cannot be shared Provider networks typically rely on the physical network infrastructure to provide default gateway/first hop routing services Tenant networks rely on Neutron routers to fulfill this role The Neutron NSX-v Plugin supports the following: VXLAN-Backed Tenant Networks VLAN-backed and VXLAN-backed Provider Networks VLAN-backed and VXLAN-backed External Networks All version of the Neutron-NSX Plugins are available at CONFIDENTIAL 15

16 Tenant Reachability Using Neutron Networks Source NAT/destination NAT- instances use IP addresses from an external provider network, aka Floating IPs VMworld 2017 Content: Not for If NAT is disabled, how do you make tenant networks reachable? Answer: Routing configuration (static or BGP) publication * Dynamic routing support was added in VIO

17 BGP Design Considerations BGP is configured and owned by the Cloud Admin Use ebgp for external peering (AWS/Cloud model) Use same AS number on all OpenStack objects in same region. Neutron only supports 2-byte AS and does not offer AS_TRANS support, even though NSX does it Connect to 4-byte AS clos-fabric using BGP Local-AS feature neighbor nsx local-as Can advertise self-service networks or only networks defined by Cloud Admin Neutron Address Scopes are used. VMworld 2017 External Network used for BGP peering Internal Network The prefixes that will be advertised over BGP Advertise only a default route ( /0) to OpenStack s BGP speaker Create BGP peers, routes, networks per AZ for resiliency Content: Not for publication

18 Neutron Object Relationships CONFIDENTIAL

19 Tenant Self-Service Networking Is this What You Need? With Tenant Networks, Tenants are free to create their own IP Subnets Will most cloud users in your organization know what to do when presented with these configuration options? VMworld 2017 Content: Not for publication CONFIDENTIAL 19

20 Managing IP Subnet Assignment and Consumption Admin Controlled DHCP Scopes VMworld 2017 When using Provider Networks, which can only be provisioned by an OpenStack Admin, the DHCP scope could also be provided by the Admin Tenants will launch VMs on these precreated networks/subnets and get an IP address from a controlled pool This ensures proper connectivity and reachability is in place Content: Not for publication Subnet configured by the Admin CONFIDENTIAL 20

21 Managing IP Subnet Assignment and Consumption Neutron Subnet Pools In Kilo, a new feature called Neutron Subnet Pools was added to the OpenStack networking workflows Neutron subnet pools allow an administrator to create a large Classless Inter-Domain Routing (CIDR) IP address range for a Neutron network, from which Tenants can create subnets without specifying a CIDR In cases where valid, routable IPs are used, subnet pools are very useful. Tenants only need to specify minimal configuration parameters for creating a subnet without worrying about the IP subnet on which the VMs/Instances will sit. # neutron subnetpool-create --default-prefixlen 24 --pool-prefix /16 TestSubnetPool Created a new subnetpool: Field Value default_prefixlen 24 default_quota VMworld 2017 id d963acd5-1afc-477c-a434-cef46f017b17 ip_version 4 max_prefixlen 32 min_prefixlen 8 name TestSubnetPool prefixes /16 shared False tenant_id 4b36a201448b4fc19b91439d8e883b Content: Not for publication CONFIDENTIAL 21

22 Neutron Availability Zones AZ 1 AZ 2 AZ 3 Neutron Routers, DHCP, LB and FW Edge Cluster 1 Edge VDS 1 Neutron Routers, DHCP, LB and FW Edge Cluster 2 Neutron Routers, DHCP, LB and FW Edge Cluster 3 Edge VDS 2 Edge VDS 3 Datastore 1 Datastore 2 Datastore 3 CONFIDENTIAL

23 Neutron Availability Zones (continued) Core plugin must support the following extensions: availability_zone network_availability_zone router_availability_zone Attributes (router & network) availability_zone_hints Which zones to prefer placement in availability_zone Which zones actually got selected after scheduling If hints are not specified look in /etc/neutron/neutron.conf default_availability_zones = az1,az2,az3 CONFIDENTIAL

24 Neutron Role Based Access Control (RBAC) for Networks Limiting Neutron Networks to Specific Tenants Starting with Liberty, Neutron added a new policy model allowing the sharing of networks for a group of tenants, as opposed to this being a global operation. Both the Admin and a User can leverage this capability, but there are some restrictions for non-admin users (inability to delete Neutron ports, for example) This feature, when combined with Provider Networks, enables more granular control of access and connectivity without delegating complex operations to the end user. # neutron rbac-create --target-tenant 118dedfc737d46f49ab176a657bf23ce --action access_as_shared --type network 40bff a-4a42-847c-f02e7ef7abbf Created a new rbac_policy: Field Value action access_as_shared id f7a3ecd9be054d f6cc9c4e object_id 134a5f236a d a2 object_type network target_tenant 118dedfc737d46f49ab176a657bf23ce tenant_id d0d3aca886ad4ddcac8e2233e4598dc

25 1 Enterprise Migration Option: VXLAN/VLAN Bridging in Neutron The Neutron NSX Plugin supports the creation of a L2 Bridge: VXLAN - VLAN bridging can help customers preserve physical L3 services while leveraging the benefits of VXLAN for Tenant topologies. # neutron-l2gw l2-gateway-create L2GW1 device name=l2gw1,interface_names=dvportgroup-456 Created a new l2_gateway: Field Value devices {"interfaces": [{"segmentation_id": [], "name": "dvportgroup-456"}], "id": "21d7078c-10b9-40bc-bbb3-418d296eac3c", "device_name": "edge-164"} id 84c59e94-b0ce-43e7-9c52-a0a5f88b7014 name L2GW1 tenant_id b0131a c079eeeca26c2265ec # neutron-l2gw l2-gateway-connection-create L2GW1 VXLAN-A --default-segmentation-id 10 Created a new l2_gateway_connection: Field Value id ddf11ca0-16ed-40ab-8892-a208d532627a l2_gateway_id 84c59e94-b0ce-43e7-9c52-a0a5f88b7014 network_id 61b83f49-c bbe2-05c8666ef1b7 segmentation_id 10 tenant_id b0131a c079eeeca26c2265ec

26 What Is NSX Microsegmentation? VMworld 2017 Content: Not for Web App DB Alignment of Policy Controls Security and networking policy that travels with the workload independent of physical network topology publication Granular Policy Enforcement Enabling least privilege security with policy enforced at every workload CONFIDENTIAL 26

27 Microsegmentation with Provider Networks Using NSX Traditionally, network security has been enforced at the network perimeter, where a layer 3 boundary exists (firewall, router) Neutron Security Groups and Neutron Port Security provide vnic-level security protection Perimeter firewall cannot protect what it cannot see Traffic must be steered to security appliance Firewall policy controlled by security admin Controlled Path VMworld 2017 No traffic steering required vnic-level stateful FW protection If using NSX, global security policy is controlled by security admin (Neutron Admin Rules): Neutron Security Group 1 Controlled Path Neutron Security Group 2 Controlled Path Neutron Security Group 3 Content: Not for publication CONFIDENTIAL 27

28 Advanced Networking and Service Chaining in Neutron As of OpenStack Newton, Neutron has added support for Service Function Chaining, to enable a number of NFV use cases There is applicability in the Enterprise when using this feature with NSX NetX partner extensibility: Next Generation Firewall inspection for East-West traffic IPS/IDS services for E-W Visibility and troubleshooting VMworld 2017 Redirect TCP port 81 for additional inspection Content: Not for publication /24 CONFIDENTIAL 28

29 Firewall-as-a-Service - FWaaS Ability for Tenants to define and apply their own North-South Firewall rules Compatible with version 1.0 of the Neutron FWaaS spec (v 2.0 is under consideration) Implemented on the NSX Edge Firewall, for both NSX-v and NSX-T In NSX-v, FWaaS requires an exclusive router, i.e. an Edge dedicated for this function Can combine Allow and Deny rules CONFIDENTIAL

30 Network Virtualization Journey with OpenStack What Does My Journey Look Like? VLAN-backed Provider Net DHCP Neutron Security Groups VLAN-backed Provider Net DHCP Neutron Security Groups Neutron Routers LBaaS VXLAN Networks (Provider/Tenant) DHCP Neutron Security Groups Neutron Routers LBaaS CONFIDENTIAL 30

31 Summary Tenant networks and provider networks are different tools in the OpenStack administrator s toolbox Tenant networks present some unique challenges for the enterprise private cloud (especially if you re simultaneously hosting both cattle and pets) The Ocata release of the NSX plugin offers rich and robust Enterprise-grade networking and security services, such as BGP, Load Balancing, East-West and North-South Firewalling and Service Chaining Application tiering/security zones no longer necessitate the deployment of dedicated layer 2 networks and can be implemented using security groups on a common, shared provider network Leverage vsphere and NSX investments, knowledge and expertise to deliver on your OpenStack mandate The API that I want with the Infrastructure that I know VMworld 2017 Crawl, Walk, Run: Journey to Network Virtualization Content: Not for publication CONFIDENTIAL 31

32 Physical Infrastructure Security Application Delivery Operations and Visibility DYNAMIC INSERTION OF PARTNER SERVICES NSX partner ecosystem

33 Where to get started Learn Use Connect & Engage communities.vmware.com NSX Product Page & Technical Resources vmware.com/products/nsx Network Virtualization Blog blogs.vmware.com/networkvirtualization VMware NSX on YouTube youtube.com/user/vmwarensx NSX Proactive Support Service Optimize performance based on data monitoring and analytics to help resolve problems, mitigate risk and improve operational efficiency. vmware.com/consulting Experience Take 70+ Unique NSX Sessions Spotlights, breakouts, quick talks & group discussions Visit the VMware Booth Use case demos, chat with NSX experts Visit NSX Technical Partner Booths Integration demos EPSec & NetX, Hardware VTEP, Ops & Visibility Test Drive NSX with free Hands-on Labs Expert-led or Self-paced. labs.hol.vmware.com Training and Certification Several paths to professional certifications. Learn more at the Education & Certification Lounge. vmware.com/go/nsxtraining

34

35