Extreme Networks OneFabric Connect Integration with VMware vrealize Orchestrator

Transcription

1 Extreme Networks OneFabric Connect Integration with VMware vrealize Orchestrator Application Note Abstract: This application note details the integration of Extreme Networks OneFabric Connect solution with the VMware vrealize Orchestrator technology and describes the reference architectures, integration goals, constraints and enabling technical model. Published: July 2015 Extreme Networks, Inc. 145 Rio Robles San Jose, California Phone / Toll-free / Extreme Networks, Inc. All Rights Reserved. AccessAdapt, Alpine, Altitude, BlackDiamond, Direct Attach, EPICenter, ExtremeWorks Essentials, Ethernet Everywhere, Extreme Enabled, Extreme Ethernet Everywhere, Extreme Networks, Extreme Standby Router Protocol, Extreme Turbodrive, Extreme Velocity, ExtremeWare, ExtremeWorks, ExtremeXOS, Go Purple Extreme Solution, ExtremeXOS ScreenPlay, ReachNXT, Ridgeline, Sentriant, ServiceWatch, Summit, SummitStack, Triumph, Unified Access Architecture, Unified Access RF Manager, UniStack, XNV, the Extreme Networks logo, the Alpinelogo, the BlackDiamond logo, the Extreme Turbodrive logo, the Summit logos, and the Powered by ExtremeXOS logo are trademarks or registered trademarks of Extreme Networks, Inc. or its subsidiaries in the United States and/or other countries. sflow is the property of InMon Corporation. Specifications are subject to change without notice. All other registered trademarks, trademarks, and service marks are property of their respective owners. For additional information on Extreme Networks trademarks, see

2 Introduction The integration of Extreme Networks OneFabric Control Center (which includes NetSight Advanced Management, NAC, Data Center Manager, and the OneFabric Connect API) and the VMware vrealize Orchestrator delivers the benefits of dynamic network and/or virtual environment reconfiguration based on specific triggers and events, such security or service provisioning. Component Overview and Workflows The solution is composed of: VMware vrealize Orchestrator application VMware vsphere Virtualization infrastructure Extreme Networks physical switch Extreme Networks OneFabric Control Center The traffic generated by the ESXi host enters the physical network that is being managed by Extreme Networks NetSight Advanced application. The workflow consists in having NetSight to trigger an Orchestrator workflow (script) in order to adapt the virtual environment: Extreme Networks, Inc. All rights reserved. 2

3 A second workflow enables VMware Orchestrator to reconfigure the network, running a JAVA plugin developed by Extreme Networks, using the OneFabric Connect API: NetSight Advanced and Data Center Manager NetSight Advanced s Data Center Manager (DCM) module provides visibility into and control over a virtual data center, and manages network provisioning on both hypervisor and switching environments. In a typical DCM scenario, a switch connected to a virtualization server enforces VM access control and network profiling, triggering a RADIUS MAC authentication request as soon the VM MAC is seen on a port. The RADIUS server (NAC gateway) will evaluate an internal rule matching condition, eventually replying with an access granted/rejected message and optionally a VLAN ID and or a Policy profile. Extreme Networks, Inc. All rights reserved. 3

4 While conceptually identical to a traditional RADIUS-based NAC edge deployment, the main difference is the need to authenticate and profile multiple MAC addresses (one for each VM, potentially hundreds) on a single physical port. Furthermore, depending on the virtualization server configuration, an incoming VM packet could be already encapsulated using the 802.1Q standard. In order to serve a Data Center Manager (DCM) deployment, a networking switch requires at least the following: Multi-user authentication framework Egress multiple MACs to multiple VLANs capability Port dynamic VLAN egress configuration, based on 802.1Q incoming tagged frame identification Asyncronous re-authentication framework (SNMP or RFC 3576) to push change of state requests In such a deployment, special consideration is needed when designing VLAN distribution, configuration and provisioning, as broadcast propagation could impact network performances. The reference model requires a dynamic access port VLAN egress configuration and avoiding a static pre-provisioning of every possible VLAN needed by the virtualization server, as explained later in this document. As the scope of this document is to define the Extreme XOS switching capabilities required to serve a DCM solution, please refer to specific DCM documentation for virtualization hypervisor integration details. Extreme Networks, Inc. All rights reserved. 4

5 NetSight Management One Fabric Connect APIs Extreme Networks OneFabric Connect API provides a simple, open, programmable and centrally-managed method for implementing Software Defined Networking (SDN) solutions across networks. With the OneFabric Connect API, business applications can be directly controlled to reduce costs, streamline efficiency, and extend transparency throughout virtual and physical environments. Organizations can integrate a limitless variety of systems and applications, including Extreme Networks predefined integrations that allow programmatic control of VM, MDM, UC, web filtering and firewall systems. Customers can also develop their own integrations simply and easily via the open, XML/SOAP-based API. Benefits include: New services innovation and agility - An open Northbound API enables innovation with technology/integration partners and customers for a uniquely rich network High-quality user experiences and scalability - Application and flow-aware network fabric scaling to meet current and future requirements Operational simplicity - Completely centralized management and control across the entire network fabric for any device, user and application Improved orchestration and efficiency - The storage, compute and networking resources are fully orchestrated to automate the deployment of new services Network-based business intelligence and control - Not only providing an awareness of what business applications are used, by whom, where and when, but also enabling optimization and a higher utilization of the existing network Extreme Networks, Inc. All rights reserved. 5

6 Use Cases VM Network Profile Assignment One of the actions available through the specific Java plugin is the ability to assign a VM to a specific network profile group. The VM will then be identified by the network, and all the traffic generated will inherit the specific policy (QoS/Security). This action can be used in any workflow where specifying the VM network profile is required. Extreme Networks, Inc. All rights reserved. 6

7 The following parameters are required in order to successfully connect to OFC APIs: (Please refer to OFC documentation for details about each parameter) The VM MAC address will be added to a specific NAC end-system group, so when the network infrastructure will authenticate the virtual machine, a specific group network profile will be applied. Workflow creation example Extreme Networks, Inc. All rights reserved. 7

8 Spine Switches Routing and VLAN configuration Specific L3 interfaces can be added/removed on VM gateways (physical Data Center Spine devices). This action can be used in combination with a vswitch VLAN and port configuration/creation. Extreme Networks, Inc. All rights reserved. 8

9 Among the parameters necessary to specify is the new VLAN ID, the subnet/mask used for that VLAN, the Spine Switches location where the Subnet will be deployed, and finally the vswitch physical port to trigger a network re-configuration as highlighted in the following diagram: *Logic: read parameters (Subnet/Mask/VLAN-ID/DC location/vswitch ports) retrieve/lookup DC-to-SpineSwitch location (sw IPs) define "hardcoded" gateway IP (physical) i.e..1 and.2 define "hardcoded" VRRP VIP i.e..3 run configuration for: create VLAN create VLAN interface configure VLAN interface IP (GW) configure VRRP add ports to VLAN Note: Feature enhancements like MLAG automatic configuration will rely OneFabric Connect, without needing to update the vro Plugin. Extreme Networks, Inc. All rights reserved. 9

10 The following parameters are required in order to successfully connect to the OneFabric Connect APIs: (Please refer to OFC documentation for details about each parameter) Generic Workflow Trigger To trigger an Orchestrator workflow after a certain network event has occurred, NetSight will use REST APIs to send the VM MAC address and event details. Depending on the virtual infrastructure configuration, it is possible to run VM-specific workflows. vrealize Content Packs from Extreme Networks All plugins can be downloaded from the VMware Content Pack Marketplace, which is accessed directly from the web interface. The latest Extreme Networks Orchestration vro plug-in can be downloaded from the VMware Cloud Management Marketplace: Extreme Networks, Inc. All rights reserved. 10