Smart Software is Indispensable, Smart Networking Hardware is Fundamental

Transcription

1 Smart Software is Indispensable, Smart Networking Hardware is Fundamental Al da Silva, Consulting Systems Engineer, CoE- APAC, Juniper Networks Cedric Rajendran, Staff Engineer-TS, VMware

2 Agenda Value of the SDDC SDDC Vision & NSX Overview Convergence of Overlay & Underlay Security in the SDDC Management Integration Demo

3 Value of SDDC

4 Network challenges in real terms Weeks POST VIRTUALIZATION Latency in Communications Time Seconds Spinning up Server Resources Provisioning the Network and Security

5 Network was built for bare metal servers 100% VIRTUAL COMPUTE 46% PHYSICAL COMPUTE Share of virtualized servers and storage is growing rapidly VIRTUAL COMPUTE 71% 0% Time 54% PHYSICAL COMPUTE 29%

6 VMware s SDDC Vision Software-Defined Data Center Priorities: Data Center Virtualization and Standardization Streamlined and Automated Data Center Ops Security Controls Native to Infrastructure High Availability and Resilient Infrastructure Application and Infrastructure Delivery Automation Software-Defined Data Center Outcomes: CapEx Reduction OpEx Reduction Effortless Security Improved Uptime ITaaS

7 NSX Perspective 7

8 MetaFabric Guiding Principles Simple Smart Open Easy to buy Easy to deploy Easy to operate Easy to secure Self-healing Proactive Event Correlation Security intelligence Embrace open standards Enable choice Alleviate lock-in Standard APIs

9 Juniper s MetaFabric Differentiators High-Performance DC Fabrics Virtual Networking Intelligence Data Center Interconnect Joint Management and Automation Complementary Network Security DC Switches Any topology Fabric technologies Operational ease Highly available Massively scalable Open standards API/tool automatable VXLAN switching NSX SDN-overlay bridging gateway In-hypervisor & in-switch cloud analytics engine Adaptive load balancing of elephant & mice flows / flowlets Best-of-breed WAN and DCI routing VPLS and E-VPN NSX SDN-overlay routing gateway Universal SDN Gateway for multiple VXLAN & MPLS overlays In-VM-Router scaling to 160Gbps Web 2.0-style GUI Manage DC network Correlate physical and virtual networks Monitor vmotion Analytics collector with network and in- VM application visibility NSX hypervisor FW and virtual network micro-segmentation Juniper DC L2-7 perimeter with highperformance NGFW Juniper in-vm FW offers Anti-APT/UTM with vsphereintegrated management

10 BETTER TOGETHER + SDDC: Virtualization & Automation MetaFabric: Performance & Automation NOW YOUR NETWORK IS plugged into THE SDDC Maximize agility and flexibility DC programmatic control Common policy across DC NSX Virtual Networking VMware Compute Virtualization + High performance and scalable Secure and reliable foundation Physical-Virtual Ops. simplification Physical-to-Virtual Switching & Routing VM-aware Management and VNFs 1. Seamless forwarding across physical and virtual infrastructure 2. Virtualization-aware network management and orchestration 3. Analytics and visibility of both physical and virtual

11 Convergence of Overlay & Underlay

12 How overlays treat the network SDDC IP Network

13 How the network actually is SDDC

14 VXLAN replication modes -Multicast Standard VxLAN implementation (RFC7348) Multicast in the underlay Data Plane Learning (i.e. No controller required for endpoint learning)

15 VXLAN replication modes -Unicast Mode Proprietary unicast replication method. Unicast to remote UTEP with replicate locally bit set Default option while configuring VNI Not recommended for large scale deployments.

16 VXLAN replication modes -Hybrid Mode Only medium to large scale deployment option. Underlay performs L2 multicast replication. Unicast to MTEP for L2 replication in other VxLAN transport zones.

17 VMware NSX Overlay Tunnels VxLAN VxLAN Overlay attributes L2 extension over Layer 3 underlay Any to any at massive scale, up to 16 million logical segments Overlay address are hidden from underlay VTEP Virtual Tunnel End Point Underlay attributes Ideally a single element to manage (One Fabric) All links active 100% of the time All features on every port Predictable latency and performance In Service Software Upgrade

18 SDDC : The Network Perspective What you DO get with SDDC Networking L2 transport over L3 network Increased logical scale Application Orchestration and Provisioning Logical separation of tenants and apps What you DON T get with SDDC Networking Software upgrades Configuration of the underlay Routing protocol configuration Provisioning of new nodes and core facing links Management and monitoring of network elements and interactions

19 All Devices Need to Communicate Provide SDN-to-non-SDN translation, same IP subnet SDN to IP (Layer 2) Layer2 Provide SDN-to-non-SDN translation, different IP subnet SDN to IP (Layer 3) Layer3 Provide SDN-to-SDN translation, same or different IP subnet, same or different overlay SDN to SDN SDN Provide SDN-to-WAN translation, same or different IP subnet, same or different encapsulation SDN to WAN Remote Data Center Public Cloud Internet WAN

20 Virtual Chassis Fabric The Ideal SDDC Fabric Virtual Chassis Fabric Single point of management Ethernet Fabric L2/L3 for entire DC or Pods Single VTEP/L2 Gateway on any port (with OVSDB integration) Simplified multicast support (No need for PIM) Flexibility in size, interface types, future expansion Spine-Leaf topology for predictable performance and maximum resilience AFS for even ECMP distribution of traffic (Elephant Flow Handling)

21 How VCF presents the network SDDC Single Switch Management Plug and Play Implementation VTEP Anywhere Deterministic Performance Flowlet based load balancing Set and forget operation

22 VCF Bidirectional Multicast Distribution Trees for BUM and multicast IGMP Snooping Configuration igmp-snooping { vlan VXLAN { Multicast l2-querier Distribution { Trees (MDT) One minimal } cost tree rooted at interface ae0.0 { each node multicast-router-interface; } Total interface of N trees ae1.0 { multicast-router-interface; Shared } among all members to carry interface ae2.0 { traffic in both directions } Benefits: } } vlan default; source-address ; multicast-router-interface; Predictable latency and replication points vlan-id 203; Automatic load rebalance on topology change VLAN203 { } VXLAN { description "This is the VLAN created to enable interhost VXLAN overlays"; vlan-id 1001; Load balancing l3-interface among irb.1001; N trees } default BUM { traffic : VLAN-ID (hw-token) mapped to tree-id vlan-id 1; } Known multicast: multicast next-hop (IPMC) assigned to tree-id RE SW1 SW2 SW3 L1 L2 L3 L4 SW4 SW 5 SW 16 RE

23 IP Fabric Multicast Complexities PIM Multicast Routing Spine IGMP Snooping Configuration IP Fabric Leaf

24 Intelligent Underlays: Adaptive Flowlet Splicing VN VN VN Virtual Chassis Fabric overlay underlay Dynamic load balancing algorithm for VCF TCP flow splicing No packet re-ordering Load and queue depth measures used for flowlet balancing Better ECMP utilisation for overlay and underlay traffic. More predictable and balanced performance

25 Networking End to End Hosted/ Managed Campus and Branch WAN Internet Public Cloud (Hybrid) MX (USG) ANY NETWORK OR SDN Virtual & Physical Security QFX, EX, and QFabic Switching Junos Space Network Director MX (USG) Virtual & Physical Security QFX, EX, and QFabic Switching Private Cloud Private Cloud Multi-Data Center, Multi-Cloud, One Network Architecture

26 MX-Series Universal SDN Gateway Layer 3 GW WAN WAN GW Layer 2 GW SDN GW VMware NSX/BMS Pod 1 DC 1 VMware NSX/BMS Pod 2 VMware NSX/BMS Pod n DC 2

27 EVPN and VM Traffic Optimizer on the MX Layer-2 Stretch Between Data Centers DC #1 DC #2 Ethernet VPN Advantages Traffic is load balanced across all WAN links MAC tables are populated via control plane unicast (similar to BGP L3VPNs) No packet flooding on the WAN DC #1 VM L2 Location Awareness with VM-TO VM Traffic Optimizer detects L2-connected VMs and their migration across data centers Dynamic WAN gateway optimization Avoid traffic trombones with normal EVPN WAN VM DC #2 DC #3 Original path Usual path after VM migration VM-TO path

28 Security in the SDDC

29 Enemies in Your Internal Network: The Zero Trust Use Case Major security breaches originate from a compromised low security system with low security internal network access, this is used to attack high value targets East-west traffic comprises around 80% of datacenter network traffic on average (Gartner/ixiacom) Network architects have attempted to increase security by dividing the network into an ever increasing number of network segments Even with the large number of network segments, traditional firewalls are unable to control the traffic of IP adjacent workloads 29

30 Security follows the Virtual Machine 30

31 Micro-Segmentation Fine-grained policies enable firewall controls and advanced security down to the level of the virtual NIC. The NSX Distributed Firewall (DFW) can apply firewall rules before traffic ever hits the (virtual) wire Performance is near line rate DFW allows the application of firewall policy to IP adjacent virtual workloads Integration with the industry s leading security products 31

32 The Solution Landscape is Expanding Stand-alone Virtual Appliance SDN Service 9 SDN 8 VA VA 7 Virtual Appliance with API Hooks Embedded Compute Chipset 5 Hypervisor VT-x 6 Hypervisor Kernel Module 12 Cloud Services 2 Router/SLB/etc. 1 Stand-Alone Physical Security Appliance Security Service VM 3 Secure Fabric (Silicon) VM 4 11 Libraries App A App B App C PaaS Host OS 10 Containers or PaaS In a guest OS/VM or App (Virtualized or Bare Metal) Hypervisor VT-x

33 Integrated Physical and Virtual Security MANAGEMENT AND SECURITY SERVICES Security Director JSA Juniper Secure Analytics SRX SERVICES VSRX SRX Series DoS Firewall IPS DoS Prevention AppSecure VM VM VM VM vsrx Hypervisor Virtual Network

34 SRX Series Services Gateways 2Tb BRANCH CAMPUS DATA CENTER Up to 2 TbpsFW throughput and 100 million concurrent sessions scaling SRX5800 High-End SRX SRX5600 SRX5400 SRX3400 SRX G 1G SRX100 Branch SRX SRX110 SRX210 SRX220 SRX240 SRX550 SRX650 SRX1400 Integrated Routing, Switching and Security Single Junos Unprecedented Scale

35 Maximum Performance and Scale Express Path Elephant Flows Area Border Router 10G/40G/100G links Enterprise Border Firewall Dramatically increases secured traffic with extremely high bandwidth flows Science DMZ Switch/Router 10G/40G/100G links Site/Campus Access to Science DMZ resources Suitable for express downloads and data transfers of large amounts of data SRX5000 Reduces packet path latency Site/Campus LAN Price/Performance gains Data Transfer Cluster Project X Data Transfer Node Project Y DTN

36 SRX in Virtual Format Junos Routing Protocols and SDK Junos Rich and Extensible Security Stack PERIMETER SECURITY Firewall VPN NAT Routing CONTENT SECURITY Anti-Virus Web Filtering Content Filtering Anti-Spam APPLICATION SECURITY AppTrack AppFW AppQoS IPS Junos Space Security Director & Virtual Director, CLI, JWEB, SNMP, HA/FT

37 Virtual Security Solutions Do make sense Higher guest virtual machine densities One virtual instance of anti-malware software + one virtual instance of anti-malware signature database Higher performance for critical applications and business processes vsrx Easy deployment and automatic protection of the newly created virtual machine Higher return on investment Security gaps are eliminated (e.g. instant-ongaps, scanning storms etc.) VM VM VM VM VM VM VM VM VM VM VM VM Hypervisor x86 Box

38 Management Integration

39 Today s Reality in Operations Management Monitoring Data Overload Alert Storms N/w VI Storage Over-provisioning Finger Pointing 39

40 Operations Management Goals Goal Status Quo Quality of Service Are you able to meet or exceed service level expectations? Can you remediate issues before end users are impacted? Operational Efficiency What is your average Mean Time to Incident & Resolution? Do you manage your infrastructure capacity? Control and Compliance Is your IT infrastructure compliant to regulatory standards? Can you proactively enforce IT standards in your organization? 40

41 NSX Operations Dashboard NSX deployment compliance checks Health of VM s hosting NSX services TopN stats including VXLANs, VM s Health, capacity, performance views of all NSX services deployed 41

42 NSX Visibility Health of the NSX components Open Alerts Heat map of the hypervisor in NSX Transport Zone All NSX resources Top N logical networks and VMs 42

43 Technology Integration Cloud Orchestration VMware vrealize Automation (formerly vcac & vcloud Director) 1) Smart forwarding across physical and virtual infrastructure 2) Analytics & visibility of both physical and virtual 3) Management & orchestration 4) Application/flow-based traffic handling Juniper Management & Operations vrealize Operations (vcenter Ops) vcenter vrealize Log Insight Network Director Virtualization vsphere / ESXi (Compute Virtualization) vsan (Storage Virtualization) NSX (Network Virtualization) L4-l7 Firewall Services L3 Gateway vsrx EX9200 MX Physical Hardware Compute Storage Network L2 Gateway QFX5100 EX9200 MX

44 Integrated Management, Orchestration & Automation Network Director Overview Custom DevOps/ITSM Web 2.0 GUI ND App B/OSS, ITSMs, DevOps, Platforms & Apps Open RESTful API Junos Space Junos OS NETCONF DMI

45 Integrated Management, Orchestration & Automation Network Director-to-VMware Integration Overview server controller VISUALIZE ANALYZE CONTROL Holistic and correlated view Data center and campus topologies Correlated server/vm/network visibility Overlay and underlay connectivity Physical and virtualized connectivity Smarter and Proactive Networks Built-in collection and correlation engine Heat map and root-cause analysis Telemetry for overlays & underlays Inter-VM network trace and flow analysis Lifecycle and Workflow Automation Scalable multi-site management Provisioning templating and planning Fabric automation and management Data center fabric management

46 Physical & Virtual Visibility in Junos Space ND Data Center Topology and Devices NSX Overlay Networks Topology Physical to Virtual Topology

47 Monitoring in JunosSpace ND Network Telemetry VM bandwidth monitoring

48 Exceptional Networking Analytics JOINT-OPS ADVANTAGES VXLAN ping, traceroute, VM path visibility Insightful metrics monitoring Faster troubleshooting and planning Proactive & passive application QoE Correlate & coordinate network and apps Overlay Awareness s1>show analytics overlay vxlan VNI Green: VM1, VM2, VM6, VM7 VNI Blue: VM5, VM10 VNI Red: VM3, VM4, VM8, VM9 VN VN VN VM VM VM VM VM VM VM VM VM KVM KVM KVM overlay underlay compute

49 CAE Flow/App Visibility & Analysis VMs/Apps, Hosts, Networks Flow-path Analytics Network Telemetry App Placement Troubleshooting Watch lists Health & capacity assessment End-to-end and per-hop analysis Unhealthy VMs/apps/hosts Physical/virtual correlation Topology visualization Simple end-to-end mirroring

50 Juniper Inventory Tree

51 Object Level Dashboard

52 Juniper Infrastructure Overview Dashboard

53 Juniper Top Network Fabrics Dashboard

54 Fault Drill Down

55 Device Down Alert

56 Launch to Network Director

57 Launch to Network Director

58 Summary The SDDC is compelling but network alignment is important SDDC will improve agility of the DC Network overlays are here to stay as the predominant form of SDN Network overlays abstract service models but do not transform network hardware Plug and play fabrics converge how the network is with how SDDC sees it Bare metal servers and physical network connectivity needs to be considered Coherent physical and virtual end-to-end visibility is critical The network must not be an inhibitor to innovation

59 + BETTER TOGETHER