Virtualization Aware Networking

Transcription

1 irtualization Aware Networking Nexus 1000 Overview & Design The Power When You Need It Effect Cloud Computing aciej Bocian Architecture Sales anager Data Center and irtualization, Central Europe CCIE# Cisco Systems, Inc. All rights reserved. 1

2 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture t Deployment Installation Difference to the vswitch 2

3 The Story Today Networking with I3.5 Separation of Network and Server provisioning and management systems irtual Center managing & provisioning ESX hosts and vswitches vswitch vswitch vswitch Physical network managed and provisioning separately irtual Center Network visibility ends at physical switch port Different interfaces and tools IOS or IOS-like cli for physical network Network anagement C GUI and esxcfg cli for vswitches 3

4 vsphere vnetwork Distributed Switch (DS) CUR RRENT DS vswitch vswitch vnetwork Distributed Switch vswitch Unified network virtualization management vcenter provides abstracted, resource-centric view of networking Simplifies network management oves away from hostlevel network configuration (cluster level) Statistics and policies follow the simplifying debugging and troubleshooting Builds foundation for networking resource pools (view the network as a clustered resource) 4

5 vnetwork Distributed Switch & Cisco Nexus 1000 CURRE NT vswitch vswitch vswitch Enterprise networking vendors can provide proprietary networking interfaces to monitor, control and manage virtual networks First offering: Cisco Nexus 1000 irtual machines retain policies, QoS as they move around the datacenter vnetwork Distributed Switch Cisco Nexus 1000 DS 5

6 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture Deployment Installation Difference to the vswitch 6

7 N-Link With the Cisco Nexus 1000 Cisco Nexus 1000 Software Based Industry s first 3rd-party vnetwork Distributed Switch for ware vsphere Built on Cisco NX-OS Compatible with all switching platforms aintain vcenter provisioning model unmodified for server administration; allow network administration of virtual network via familiar Cisco NX-OS CLI Nexus 1000 Nexus 1000 vsphere Policy-Based Connectivity it obility of Network & Security Properties Non-Disruptive Operational odel 7

8 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture Deployment Installation Difference to the vswitch 8

9 Cisco Nexus 1000 Components Cisco Ss vcenter Server irtual Ethernet odule(e) Replaces mware s virtual switch Enables advanced switching capability on the hypervisor Provides each with dedicated switch ports irtual Supervisor odule(s) CLI interface into the Nexus 1000 Leverages NX-OS 4.04a Controls multiple Es as a single network device Cisco E Cisco E Cisco E

10 Cisco Nexus 1000 irtual Chassis pod5-vsm# show module od Ports odule-type odel Status irtual Supervisor odule Nexus1000 active * 2 0 irtual Supervisor odule Nexus1000 ha-standby irtual Ethernet odule NA ok Cisco Ss Cisco E Cisco E

11 Single Chassis anagement Upstream-Switch#show cdp neighbor Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGP, r - Repeater, P - Phone Device ID Local Intrfce Holdtme Capability Platform Port ID N1K-Rack10 Eth 1/8 136 S Nexus 1000 Eth2/2 N1K-Rack10 Eth 2/ S Nexus 1000 Eth3/2 A single switch from control plane and management plane perspective Protocols such as CDP and SNP operate as a single switch Cisco Ss Cisco E Cisco E 11

12 irtual Supervisor odules Options S-PA S - irtual Appliance ESX irtual Appliance Supports 64 Es Installable via ISO or OA file S - Physical Appliance 2HCY09 Cisco Branded Physical Server Hosts 4 S irtual Appliance Deployed in pairs for redundancy Cisco E Cisco E Cisco E S-AA

13 Cisco Nexus 1000 Scalability A single Nexus 1000 supports: 2 irtual Supervisor modules (HA) 64 irtual Ethernet modules 512 Active LANs 2048 Ports (Eth + eth) 256 Port Channels Nexus 1000 A single irtual Ethernet module supports: 216 Ports eths 32 Physical NICs 8 Port Channels Cisco E 13

14 Cisco Nexus 1000 Domain Each S is assigned a unique Domain ID Domain ID ensures that Es do not respond to commands from non- participating Ss. Each packet between S and E is tagged with the appropriate Domain ID Domain range from Active S Other S DID 15 CD DID 25 CD Cisco E DID 15 Cisco E DID 15 Cisco E DID 15 DID 25 CD 14

15 Distributed Data Plane Each irtual Ethernet odule forwards packets independent of each other. No address learning/synchronization across Es No concept of Crossbar/Fabric between the Es irtual Supervisor odule is NOT in the data path No concept of forwarding from an ingress linecard to an egress linecard (another server) No Etherchannel across Es Cisco Ss Cisco E Cisco E Cisco E 15

16 Cisco Nexus 1000 Switch Interfaces Ethernet Port (eth) 1 per physical NIC interface Specific to each module vmnic0 = ethx/1 Up to 32 per host Port Channel (po) Aggregation g of Eth ports Up to 8 Port Channels per host irtual Ethernet Port (veth) 1 per NIC (including SC and K) Notation is eth(port number). No module number is assigned to enable consistent naming when moved 216 per host Eth3/1 eth1 1 Po1 Eth3/2 eth2 2 16

17 Cisco Nexus 1000 veth Interface irtual Ethernet Port veths are assigned sequentially vnics are statically bound to a veth Assignment persistent through reboots ay change if the vnic is reassigned to another port profile veths will move between modules when a is moved (HA, motion, etc ) Default virtual speed is Gigabit as negotiated with the guest OS By default performance is un-gated (i.e 1Gb vnic can run faster than 1Gb) 2048 veths supported system wide 17

18 Loop Prevention without STP Eth4/1 Eth4/2 X Cisco E Cisco E Cisco E X BPDU are dropped No Switching From Physical NIC to NIC Local AC Address Packets Dropped on Ingress (L2) 18

19 AC Learning Each E learns independently and maintains a separate AC table ACs are statically ti mapped Other veths are learned this way (vmknics and vswifs) No aging while the interface is up Devices external to the E are learned dynamically Eth3/1 Cisco E 1 2 E 3 AC Table 1 eth12 Static 2 eth23 Static 3 Eth3/1 Dynamic 4 Eth3/1 Dynamic Eth4/1 Cisco E 3 4 E 4 AC Table 1 Eth4/1 Dynamic 2 Eth4/1 Dynamic 3 eth8 Static 4 eth7 Static 4 Eth3/1 Dynamic 4 eth7 Static 19

20 Port Channels 1. Standard Cisco Port Channels Behaves like EtherChannel 2. Link Aggregation Control Protocol (LACP) Support hashing algorithms available Po1 Po2 Selected either system wide or per module Default is source AC 4. Automated creation using Port Profiles Cisco E

21 What is a Port-Profile? Profile? 1. A port-profile profile is a container used to define a common set of configuration commands for multiple interfaces 2. Define once and apply many times 3. Simplifies management by storing interface configuration 4. Key to collaborative management of virtual networking resources 5. Why is it not like a template or SmartPort macro? Port-profiles are live policies Editing an enabled profile will cause config changes to propagate to all interfaces using that profile (unlike a static one-time macro) 21

22 Port Profile Configuration n1000v# show port-profile name WebProfile port-profile WebProfile description: status: enabled capability uplink: no system vlans: port-group: WebProfile config attributes: switchport mode access switchport t access vlan 110 no shutdown evaluated config attributes: switchport mode access switchport access vlan 110 no shutdown assigned interfaces: eth10 Support Commands Include: Port management LAN PLAN Port-channel ACL Netflow Port Security QoS 22

23 Port Profile Policy Distribution n1000v(config)# port-profile WebServers n1000v(config-port-prof)# switchport mode access n1000v(config-port-prof)# switchport access vlan 100 n1000v(config-port-prof)# p no shut Cisco S PP vcenter Server 23

24 Overriding Port Profile Configuration 1. Administrators can interact with individual switchports, overriding a port profile 2. Use to isolating problems with one or two interfaces without changing the port-profile and affecting other ports 3. anual configuration always takes precedence over a port profile configuration n1000v(config)# int vethernet t 2 n1000v(config-if)# switchport access vlan The no command can remove the override and restore the profile s config by doing: n1000v(config)# int vethernet 2 n1000v(config-if)# if)# no switchport access vlan 24

25 Port Profile Inheritance Profile inheritance allows the construction of profile hierarchies Parent profiles pass configuration to child profiles Only the child profiles need to be visible within C Updates to the parent filter to the child Child profiles can be updated independently n1000v(config)# port-profile Web n1000v(config-port-prof)# switchport mode access n1000v(config-port-prof)# switchport access vlan 100 n1000v(config-port-prof)# no shut n1000v(config)# port-profile Web-Gold n1000v(config-port-prof)# prof)# inherit port-profile profile Web n1000v(config-port-prof)# service-policy output Gold n1000v(config-port-prof)# vmware port-group Web-Gold n1000v(config)# port-profile Web-Silver n1000v(config-port-prof)# prof)# inherit port-profile profile Web n1000v(config-port-prof)# service-policy output Silver n1000v(config-port-prof)# vmware port-group Web-Silver Effective Port Profile Web-Gold Effective Port Profile Web-Silver Access Port LAN 100 Gold QoS Policy Access Port LAN 100 Silver QoS Policy 25

26 Uplink Port Profiles Special profiles that define physical NIC properties Usually configured as a trunk Defined by adding capability uplink to a port profile Uplink profiles cannot be applied to veths Non-uplink profiles cannot be applied to NICs Only selectable in vcenter when adding a host or additional NICs n1000v(config)# port-profile DataUplink n1000v(config-port-prof)# switchport mode trunk n1000v(config-port-prof)# switchport trunk allowed vlan n1000v(config-port-prof)# system vlan 51, 52 n1000v(config-port-prof)# channel-group mode auto sub-group cdp n1000v(config-port-prof)# prof)# capability uplink n1000v(config-port-prof)# no shut Cisco E

27 Cisco Nexus 1000 Architecture Nexus 1000 E Nexus 1000 E Nexus 1000 E vsphere vsphere vsphere irtual Supervisor odule (S) irtual or Physical appliance running Cisco irtual NXOS Ethernet (supports odule HA) (E) Performs Enables management, advanced networking monitoring, & configuration Cisco capability Nexus on the 1000 hypervisor Installation Tight Provides integration ESX & each ESXi with ware with dedicated vcenter switch port U & anual Installation Collection of Es = 1 vnetwork Distributed E installed/upgraded Switch like an ESX patch vcenter Nexus 1000 S 27

28 Scaling Server irtualization with Nexus Offload networking to network team Abstracts network configuration from virtualization team Network administrator to provide consistent network configuration to 2. Optimize bandwidth to server w/ greater availability Dual connectivity to non-clustered switches Quality of Service for otion, Service Console, and traffic 3. Enable virtual machines to be basic building blocks of data center Consistent network operational model for physical and virtual infrastructure Easier regulatory compliance SG0 SG1 SG0 SG1 Po1 Po2 Cisco E C P SC K Data 28

29 Cisco Nexus 1000 Faster Deployment Policy-Based Connectivity Defined Policies WEB Apps HR DB DZ Cisco N-Link: irtual Network Link obility of Network & Security Properties Nexus 1000 E vsphere Non-Disruptive Operational odel Nexus 1000 E vsphere Connection Policy Defined in the network Applied in irtual Center Linked to UUID vcenter Nexus 1000 S 29

30 Cisco Nexus 1000 Richer Network Services Policy-Based Connectivity s Need to ove otion DRS SW Upgrade/Patch Cisco N-Link: irtual Network Link obility of Network & Security Properties Nexus 1000 E Non-Disruptive Operational odel Nexus 1000 E Hardware Failure vsphere vsphere N-Link Property obility otion for the network Ensures security aintains connection state vcenter Nexus 1000 S 30

31 Cisco Nexus Increased Operational Efficiency Policy-Based Connectivity I Admin Benefits aintains existing mgmt Reduces deployment time Improves scalability Reduces operational workload Enables -level visibility Cisco N-Link: irtual Network Link obility of Network & Security Properties Nexus 1000 E vsphere Non-Disruptive Operational odel Nexus 1000 E vsphere Network Admin Benefits Unifies network mgmt and ops Improves operational security Enhances network features Ensures policy persistence Enables -level visibility vcenter Nexus 1000 S 31

32 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture Deployment Installation Difference to the vswitch 32

33 Key Features of the Nexus 1000 Switching Security Provisioning isibility L2 Switching, 802.1Q Tagging, LAN Segmentation, Rate Limiting (TX) IGP Snooping, QoS arking (COS & DSCP) Policy obility, Private LANs w/ local PLAN Enforcement Access Control Lists (L2 4 w/ Redirect), Port Security Automated vswitch Config, Port Profiles, irtual Center Integration Optimized NIC Teaming with irtual Port Channel Host ode otion Tracking, ERSPAN, NetFlow v.9 w/ NDE, CDP v.2 -Level Interface Statistics anagement Cisco CLI, Radius, TACACs, Syslog, SNP (v.1, 2, 3) irtual Center Provisioning, Cisco Network Provisioning, CiscoWorks 33

34 Deploying the Cisco Nexus 1000 Collaborative Deployment odel 1. W vcenter & Cisco Nexus 1000 relationship established Nexus 1000 E 2. Network Admin configures Nexus 1000 to support new ESX hosts 3. vsphere Server Admin plugs new ESX host into network & adds host to Cisco switch in vcenter vcenter Nexus 1000 S 1. 34

35 Deploying the Cisco Nexus 1000 Collaborative Deployment odel 1. W vcenter & Cisco Nexus 1000 relationship established 2. Network Admin configures Nexus 1000 to support new ESX hosts Nexus 1000 E vsphere Nexus 1000 E vsphere 3. Server Admin plugs new ESX host into network & adds host to Cisco switch in vcenter 4. Repeat step three to add another host and extend the switch configuration 4. vcenter Nexus 1000 S 35

36 Policy Based Connectivity Enabling Policy 1. Nexus 1000 automatically enables port groups in ware vcenter 2. Server Admin uses vcenter to assign vnic policy from available port groups 3. Nexus 1000 automatically enables connectivity at power-on o Nexus 1000 E vsphere WEB Apps: PLAN 108, Isolated Security Policy = Port 80 and 443 Rate Limit = 100 bps QoS Priority = edium Remote Port irror = Yes vcenter Defined Policies WEB Apps HR DB DZ Nexus 1000 S 36

37 Policy Based Connectivity What can a policy do? Policy definition supports: LAN, PLAN settings ACL, Port Security, ACL Redirect Nexus 1000 E vsphere Cisco Trust Sec (SGT) NetFlow Collection Rate Limiting QoS arking (COS/DSCP) Remote Port irror (ERSPAN) vcenter Nexus 1000 S 37

38 obility of Security & Network Properties Following your s around 1. vcenter kicks off a motion (manual/drs) and notifies Nexus During replication, Nexus 1000 copies port state to new host Nexus 1000 E vsphere Nexus 1000 E vsphere obile Properties Include: Port policy Interface state and counters Flow statistics Remote port mirror session vcenter otion Network Notification Persistence Current: port 1 config, state Server 1 New: monitoring 1 Server statistics 2 Nexus 1000 S 38

39 obility of Security & Network Properties Following your s around 1. vcenter kicks off a motion (manual/drs) and notifies Nexus During replication, Nexus 1000 copies port state to new host 3. Once otion completes, port on new ESX host is brought up & s AC address is announced to the network Nexus 1000 E vcenter vsphere Nexus 1000 E Network Update ARP for 1 sent to network Flows to 1 AC redirected to Server 2 vsphere Nexus 1000 S 3. 39

40 Increase Operational Efficiency What stays the same? What gets better? Task irtualization or Server Admin Network Admin vswitch Config Automated Same as physical network Port Group Config Automated Policy Based Port Group Unchanged - Assignment (irtual Center based) Add new ESX host Automated (assign NIC & go) Unchanged NIC Teaming Config Automated EtherChannel Optimized Creation Unchanged Policy Based Security Policy Based ACL, PLAN, IP Redirect, Port Security, TrustSec isibility Specific Specific anagement Tools Unchanged Cisco CLI, XP API, (irtual Center) SNP, DCN 40

41 Cisco Nexus 1000 Security I P C C I vsphere vsphere vsphere Private Pi LAN Promiscuous port Isolated port Community port Security Features Access Control List Port Security DHCP Snooping IP Source Guard Dynamic ARP Inspection Cisco TrustSec Admission control: 802.1X Hop-by-hop crypto: 802.1AE Security Group Tag SGACL atrix Source Group Destination Group

42 Nexus 1000 Deployment Scenarios Pick your flavor 1. All types of servers 2. 1G & 10G NICs 3. Any type of physical switch (Cisco & other vendors) 4. Requires External anagement Appliance (S) which can be a virtual or physical appliance 5. Requires ware vsphere 4.0 Enterprise Plus License 6. Network stats, interface state, flow stats maintained in E, exposed through S vcenter Blade Servers Rack Optimized Servers Nexus 1000 S 42

43 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture Deployment Installation Difference to the vswitch 43

44 Cisco Nexus 1000 Installation Overview 1. Installing the Cisco Nexus 1000 is a five step process involving the server and network administrators 1) Install the primary and secondary Ss 2) Define uplink and port profiles 3) Connect the primary S and C 4) Install the E (manually or using U) 5) Adding the ESX host to the Nexus Repeat steps 4 and 5 for each additional ESX host 44

45 Creating the S using ISO 1. Create Type: Other 64 bit Linux 1 Processor 2GBRA 3 vnics (e1000 Driver) inimum 3GB SCSI Hard Disk with LSI Logic adapter (default) 2. Reserve 2GB RA for the 3. Configure network adapters 4. Attach ISO to and power on 45

46 Creating the S using OA 1. From C File menu, select Deploy OF Template OA deployment automated the S configuration Configuration is limited to mapping portgroups to proper networks 2. CPU and RA still need to be reserved for the 46

47 S Dedicated Resources 1. Each S requires dedicated resources (not shared) 2. Set the RA reservation to 2GB 3. Set CPU reservation to 1Ghz 47

48 S Setup Wizard 1. Automatically runs when the S is started for the first time 2. inimum configuration suggested: Switch name Out-of-band management configuration Default gateway Telnet/SSH service Domain parameters (domain ID, control/packet LAN) 3. Secondary S will reboot and gather configuration from the Primary S 48

49 Registering Nexus 1000 Plug-in 1. Plug-in enables C to communicate with the S and contains the security certificate 2. Download IP>/cisco_nexus1000_extension.xml extension xml 3. In C client, go to Plug-ins menu and select anage plug-ins 4. Right-click under Available Plug-ins and select New Plug-in 49

50 Connecting the S to the C 1. Nexus 1000 Plug-in must be registered first! 2. Configure the connection on the S n1000(config)# svs connection vc n1000(config-svs-conn)# protocol vmware-vim n1000(config-svs-conn)# remote ip address n1000(config-svs-conn)# vmware dvs datacenter-name WestDC n1000(config-svs-conn)# connect The connection name ( vc in the example) is arbitrary Protocol specifies the type of server to connect to (only ware is supported) Remote IP address is the C IP address Datacenter name is the name of the datacenter that will contain the Nexus 1000 Datacenter must be present on C before connecting Connect command initiates the connection with the C and creates the Nexus 1000 in C 50

51 Connecting the S to the C (cont.) 1. Resulting output on C after issuing connect command 51

52 Adding an Uplink Port Profile 1. In order to insert a module into the S (i.e. add a host to the vds on C), you must configure an uplink port-profile for a host to use n1000(config)# port-profile SystemUplinks n1000(config-port-prof)# capability uplink n1000(config-port-prof)# switchport mode trunk n1000(config-port-prof)# switchport trunk allowed vlan n1000(config-port-prof)# system vlan 51, 52 n1000(config-port-prof)# vmware port-group SystemUplinks n1000(config-port-prof)# no shutdown n1000(config-port-prof)# prof)# state enabled 2. The third parameter of the vmware port-group command is optional Used to specify the name that t is displayed d in the C If left blank, the port-profile name will be used 52

53 Adding an Uplink Port Profile (cont.) 1. Resulting output on C after issuing port-profile command 53

54 anual E Installation 1. The host E.IB file must be installed before performing the Add Host operation on C 2. Steps to install E bits on host Copy the E package onto the ESX host using (SCP or through h C) SSH into the host and run esxupdate # esxupdate -b./cross_cisco-vem-v release.vib --nosigcheck update cross_cisco-vem-v100-4 v ######################################## [100%] Unpacking cross_cisco-vem-v1.. ######################################## [100%] Installing cisco-vem-v100-esx ######################################## [100%] Running [/usr/sbin/vmkmod-install.sh]... ok. # After esxupdate completes, the Add Host operation can be performed on the C 54

55 Automated Installation with U 1. What is U? ware Update anager Used for patching/updating software on ESX Uses esxupdate on application on ESX host to do the installation and management of software modules 2. Starting the installation Simply click Add Host, and U will take care of loading the E onto the host The host pulls the packages from the U repository. The S web server is only used to populate the U repository 55

56 Adding a Host to the Nexus Right click on the Cisco Nexus 1000 and select Add Host 56

57 erifying the Installation 1. The show module command on the S will display the E if the installation is completed successfully pod5-vsm# show module od Ports odule-type odel Status irtual Supervisor odule Nexus1000 active * 2 0 irtual Supervisor odule Nexus1000 ha-standby irtual Ethernet odule NA ok od Sw Hw (4)S1(0.42) (4)S1(0.42) (4)S1(0.42) 0.4 od AC-Address(es) Address(es) Serial-Num c-5a-a8 to c-62-a8 NA c-5a-a8 to c-62-a8 NA c to c NA od Server-IP Server-UUID Server-Name NA NA NA NA e e phx2-dc-pod5-hv1 pod5 h 57

58 igrating to the Cisco Nexus 1000 igration Wizard enables simple migration from the vswitch to the Cisco Nexus

59 Agenda 1. vsphere vnetwork Distributed Switch 2. Cisco irtual Network Link Technology 3. Cisco Nexus 1000 Architecture Deployment Installation Difference to the vswitch 59

60 Keep your process consistent Network Administrator view Server Administrator view N1k-S# sh port-profile name Ubuntu- port-profile Ubuntu- description: status: enabled capability uplink: no capability l3control: no system vlans: none port-group: Ubuntu- max-ports: 32 inherit: it config attributes: switchport mode access switchport access vlan 95 no shutdown assigned interfaces: ethernet2 ethernet4 60

61 Keep your process consistent Few of the Datacenter are completely virtualized Using Nexus 1000 keeps all the process consistent and give you the same visibility for s and Server Troubleshoot your network as before using tools you know ake your regulatory compliance much easier because of the simpler process Cisco E ERSPAN Counters Netflow CDP PLAN 61

62 virtual Port Channel Host ode Allows a single PC to span multiple upstream switches using subgroups Forms up to two subgroups based on Cisco Discovery Protocol (CDP) Subgroups can be manually defined outside of a Port Profile Does not require EtherChannel upstream when using source hashing EtherChannel is recommended upstream Required when connecting to multiple switches (only supports two upstream switches when using flow based hashing) SG0 Po1 SG1 Cisco E

63 Cisco Nexus new features that make a difference Encapsulated Remote SPAN (ERSPAN) irror interface traffic to a remote sniffer Identify root cause for connectivity issues No host based sniffer virtual appliance to maintain Follows your w/ otion or DRS Netflow v.9 with Data Export iew flow based stats for individual s Captures multi-tiered app traffic inside a single ESX host Export aggregate stats to dedicated collector for DC-wide view Follows your w/ otion or DRS Private LANs (PLANs) Great for mixed use ESX clusters Segment s w/o burning IP addresses Supports isolated, community and promiscuous trunk ports Follows your w/ otion or DRS 63

64 W vswitch & the Cisco Nexus 1000 Switching Features Feature ESX 3.5: Standard vswitch ESX 4.0: vnetwork Standard Switch ESX 4.0: vnetwork Distributed Switch Cisco Nexus 1000 Layer 2 Forwarding Yes Yes Yes Yes IEEE 802.1Q LAN Tagging Yes Yes Yes Yes ulticast Support Yes Yes Yes Yes IGP Snooping v Yes otion Support Yes Yes Yes Yes Network Policy otion - - Yes Yes Upstream Switch Connectivity EtherChannel Yes Yes Yes Yes Asyncronous Port Channels Yes Link Aggregation Control Protocol (LACP) Yes Load Balancing Algorithms irtual Switchport ID Yes Yes Yes Yes Source AC Yes Yes Yes Yes Source-Destination IP Yes Yes Yes Yes Source-Destination AC Yes Source-Destination-Port IP Yes Additional Hashing Options Yes 64

65 W vswitch & the Cisco Nexus 1000 Feature Traffic anagement Features ESX 3.5: Standard vswitch ESX 4.0: vnetwork Standard Switch ESX 4.0: vnetwork Distributed Switch Cisco Nexus 1000 Tx Rate Limiting iti Yes Yes Yes Yes Rx Rate Limiting - - Yes Yes Quality of Service arking DSCP Yes Type of Service Yes Class of Service Yes Security Features Port Security Yes Yes Yes Yes Safe Compatible Yes Yes Yes Yes Private LANs - - Yes Yes PLAN Promiscuous Trunk Support Yes Access Control Lists Yes DHCP Snooping Yes IP Source Guard Yes Dynamic ARP Inspection Yes 65

66 W vswitch & the Cisco Nexus 1000 Feature anagement Features ESX 3.5: Standard vswitch ESX 4.0: vnetwork Standard Switch ESX 4.0: vnetwork Distributed Switch Cisco Nexus 1000 ware vcenter Support Yes Yes Yes Yes Third Party Accessible APIs Yes Yes Yes Yes Network Policy Groups Yes Yes Yes Yes ulti-tier Policy Groups Yes SPAN Yes ERSPAN Yes Netflow v5 * * * Yes Netflow v Yes SNP v3 Read/Write Yes CDP v1/v2 Yes Yes Yes Yes Syslog ** ** ** Yes Packet Capture & Analysis Yes Radius/TACACS Yes * Experimental Support ** Network Syslog information is compiled and exported with other, non-network network related, vcenter events. 66

67 Accelerate Server irtualization Benefits of the Nexus 1000 Security & Policy Enforcement Enable -level security and policy Scale the use of otion and DRS Operations & Organizational anagement Structure Simplify Enable flexible management and collaboration with troubleshooting individual team with -level autonomy visibility Scale with Simplify and automated server & maintain existing network mgmt model provisioning 67

68 68