Pressures on the WAN

Transcription

1 IWAN Radek Boch, Systems Engineer, Cisco, CCIE# Cisco and/or its affiliates. All rights reserved. Cisco Public 1

2 The Application Landscape Is Changing Applications Are Moving to the Data Center and Cloud Cloud Branch Internet Edge Is Moving to the Branch Pressures on the WAN Data Centers Cloud Mobility Fat Apps of CIOs Expect to Operate via the Cloud by 2015 More Mobile Data Traffic by 2015 of Mobile Traffic Will Be Video 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 2

3 Average Number of Apps per Device*: Average App Size**: OS Update File Size***: 23 MB ios 750 MB ios 7 for iphone MB Android 168 MB Jelly Bean MB Windows 400 MB Windows 7 Sources: * ** *** Cisco and/or its affiliates. All rights reserved. Cisco Public 3

4 Third-Party Lab Test: Chromebook vs. Windows 8 Laptop Document Manipulation Photo Manipulation Chromebook creates as high as times more network traffic Video Manipulation Music Manipulation On average, Chromebook creates152 times more network traffic Web Browsing Note Taking Test Taking Asus VivoBook S200E Notebook Running Microsoft Windows 8 Samsung Chromebook Running Chrome OS 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

5 Secure WAN Transport and Internet Access Hybrid WAN Transport IPsec Secure MPLS (IP-VPN) Private Cloud Virtual Private Cloud Branch Direct Internet Access Internet Public Cloud Secure WAN transport for private and virtual private cloud access Leverage local Internet path for public cloud and Internet access Increased WAN transport capacity; and cost effectively! Improve application performance (right flows to right places) 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 5

6 Low Cost Alternative of Organizations Are Planning to Transition to Internet Connections 1. Internet Transit Pricing based on surveys and informal data collection primarily from Internet Operations Forums street pricing estimates 2. Packet delivery based on 15 years of ping data from PingER for WORLD (global server sample) from EDU.STANFORD.SLAC in California Source: William Norton (DrPeering.net); Stanford ping end-to-end reporting (PingER) 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 Dual MPLS Hybrid Public Public Enterprise Dual Internet Internet MPLS MPLS Internet MPLS Internet Internet Dual MPLS Highest SLA guarantees Tightly coupled to SP ẋ Expensive Hybrid More BW for key applications Balanced SLA guarantees Moderately priced Dual Internet Best price/performance Most SP flexibility Enterprise responsible for SLAs Consistent VPN Overlay enables Security across Transition 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 AVC MPLS Private Cloud 3G/4G-LTE Virtual Private Cloud Branch WAAS PfR Internet Public Cloud Transport Independent Intelligent Path Control Secure Connectivity Application Optimization Consistent operational model Simple Provider migrations Scalable and Modular design DMVPN IPsec overlay design Application best path based on delay, loss, jitter, path preference Load Balancing for full utilization of all bandwidth Improved network availability Performance Routing (PfR) Application monitoring with Application Visibility and Control (AVC) Application Acceleration and bandwidth savings with WAAS Certified strong encryption Comprehensive threat defense with ASA and IOS Firewall/IPS Cloud Web Security (CWS) for scalable secure direct Internet access 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 Transport-Independent Design Simplifying Internet-Based WANs 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 9

10 Dynamic Multipoint VPN (DMVPN) Transport-Independent Flexible Secure Simplifies WAN Design Easy multi-homing over any carrier service offering Single routing control plane with minimal peering to the provider Dynamic Full-Meshed Connectivity Consistent design over all transports Automatic site-to-site IPsec tunnels Zero-touch hub configuration for new spokes Proven Robust Security Certified crypto and firewall for compliance Scalable design with highperformance cryptography in hardware Internet ISR-G2 WAN ASR 1000 Branch MPLS ASR 1000 Data Center 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 10

11 Traditional and IWAN TRADITIONAL HYBRID IWAN HYBRID Active/Standby WAN Paths Primary With Backup Data Center Data Center Active/Active WAN Paths Two IPsec Technologies MPLS/GETVPN Internet/DMVPN ASR 1000 ASR 1000 ISP A SP V ASR 1000 ASR 1000 ISP A SP V One DMVPN IPsec Overlay Two WAN Routing Domains MPLS: ebgp or Static Internet: ibgp, EIGRP, or OSPF Route Redistribution to Force Primary Path Route Filtering Loop Prevention DMVPN Internet GETVPN MPLS DMVPN Internet DMVPN MPLS One WAN Routing Domain ibgp, EIGRP, or OSPF ISR-G2 Branch ISR-G2 Branch 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

12 Intelligent Path Control Improving Application Delivery and WAN Efficiency 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 12

13 Benefits of Intelligent Path Control Lower WAN Costs Full Utilization of All WAN Bandwidth Improved Application Performance Increased Application Availability Enabling Internet-Based WANs Efficient Distribution of Traffic Based Upon Load, Circuit Cost, and Path Preference Per Application Best Path Based on Delay, Loss, Jitter Measurements Protection From Carrier Black Holes and Brownouts AVC Internet ISR G2 ISR G2 ASR 1000 ASR 1000 Branch WAAS PfR WAN Data Center 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 CLASSICAL PfR Path Control Topological state Least cost path Static user preference Application-aware Policy controlled Measured performance Metrics Path cost Interface state + Delay Jitter Bandwidth Adaptive Responds To: Link and node state changes (up/down) Responds To: Measured performance changes (degradation) 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 14

15 The Decision Maker: Master Controller (MC) Discover BRs, collect statistics Apply policy, verification, reporting No packet forwarding/ inspection required Data Center MC The Forwarding Path: Border Router (BR) Gain network visibility in forwarding path (Learn, measure) Enforce MC s decision (path enforcement) Does all packet forwarding BR DSL BR Cable Optimize By: Reachability, Delay, Loss, Jitter, MOS, Throughput, Load, and/or $Cost MC+BR Branch 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Verify New Path: Verify traffic is flowing on new path Revert to previous path if performance remains out-of-policy 5 1 Learn Your Traffic Classes: Prefix-based flows ACL-based flows Application flows Select Path: Send Good path to BRs for each traffic class BRs inject best path into FIB Gather new path performance info 4 PfR 2 Measure: Network Performance Passive: Netflow Data (Throughput) Active: IPSLA Probes (Jitter, Delay) Network Availability Reachability and Topology Info via Routing Processe 3 Apply Your Traffic Policy: Compute Path Performance Compare to defined policy per traffic class Passive Mode: BW, Delay (TCP), Loss (TCP) Active Mode: Delay, Loss, Jitter, MOS 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 Passive Measurement For Data or Best Effort Applications Data Center Ingress/Egress Bandwidth and TCP Loss and Delay derived from Netflow Active Measurement For Video, Voice and delay sensitive data applications MC Path Jitter, Delay, Loss and MOS derived from IPSLA synthetic traffic probes BR Probe BR PfR automatically enables Netflow and IPSLA No knowledge or config experience needed MC Performance Database to determine Policy Enforcement actions DSL Cable Destination Prefix DSCP App Id Delay Jitter Loss Ingress BW Egress /32 EF BR1 Gi1/1 BW BR Exit Respond /24 AF BR1 Gi1/ BR2 Gi1/1 MC+BR Branch 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 17

18 Choose your policy actions for various traffic classes Alternate path selection based on flexible criteria FLEXIBLE CRITERIA Application Performance Example: Voice / Video 1. Link-Group: Path-A 2. Loss 3. Jitter 4. Delay Reachability Delay Loss MOS Jitter Critical Application Remaining Traffic 1. Link-Group: Path-B 2. Loss 4. Delay Load-Balance Link Load Balancing Max Utilization Link-Group Path Preference Bandwidth Costs ($) 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

19 Master controller monitors traffic classes and BR exit links for out-of-policy conditions Appropriate enforcement method is determined automatically by the MC MC commands the BRs to enforce path changes for policy compliance BGP Destination Prefix Egress: Route injection or BGP Local Preference attribute Ingress: BGP AS-PATH Prepend or AS Community EIGRP Route injection Static Route injection Protocol Independent Route Optimization (PIRO) with PBR injection Application Dynamic PBR NBAR/CCE 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Use Case Example HUB1 HUB2 Requirements: Broadband Internet to reduce WAN transport costs Dual ISP design to improve availability Protect multimedia applications from Internet brownouts Load balance traffic to maximize WAN bandwidth utilization DC1 DC2 MC ASR1002-X MC ASR1002-X BR BR BR BR Solution Overview: 1. Policies: Voice/Video: Delay < 200ms, Jitter < 30ms, Preferred Path = FTTH DMVPN FTTH DMVPN ADSL Data: Load Balance, max link utilization 90% 2. DMVPN for secure IPsec transport independent design Per-tunnel QOS at hub to minimize branch bandwidth oversubscription 100M Dn 10M Up 20M Dn 2M Up Site to site dynamic tunnels to reduce latency for multimedia applications 3. Performance Routing (PfR) to protect multimedia apps and maximize bandwidth 4. Advanced QoS to prioritize critical applications during congestion 5. Prime Plug-n-Play automated deployment to simplify and expedite Branch rollout ISR 890 ISR Branches + 2 Traffic Classes 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

21 Branch Internet Access 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 ISR Cloud Connector to CWS Firewall towers IWAN Tunnels for HQ/DC Traffic Branch WAN2 (Internet) WAN1 (IP-VPN) Private Cloud CWS Encapsulated HTTP, HTTPS Secure Public Cloud and Internet Access Public Cloud CWS - Web Filtering, Access Policy, Malware Detect - Single Sign-On / guest Internet 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 Optimize Application Performance 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 Track and Report Application Flows and Performance AVC Users/ Machines CSR Proliferation of Devices Enterprise Edge AVC WAN NetFlow v9 AVC Private Cloud AVC Branch DC/Headquarters NetFlow v9 Export/IPFIX Export Exporting P r o v i s i o n i n g Collecting Collecting Collecting NetFlow/IPFIX Records (Same provisioning, same format) Traffic statistics records Application Response Time records Media monitoring records (Application, Jitter, Loss, etc) Inside router no additional external probe Partner Tools Ecosystem InfoVista Plixer ActionPacked CompuWare CA Technologies Living Objects Glue 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25 Group Your Traffic by Application Using NBAR Advanced Traffic Classification COS DSCP IP PROTOCOL VLAN Protocol Category Sub-Category Application-Group HTTP RTP Citrix Exchange Oracle Lync YouTube Skype Kazaa Enterprise App Browsing Gaming IM Voice and Video File Sharing URL Host MIME Client Header Server Header From Location Referer Server User-Agent NBAR and NBAR2* Mark DSCP for WAN SLA Police and Shape Set DSCP based on Application Monitor flows PfR Path Selection Business Critical Real Time Video Best Effort PfR Apply QoS Bandwidth guarantees Packet drop Queuing Policy Traffic Logging * NBAR2 Capability more integrated in future release 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

26 Simplified Branch Deployments 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27 No CLI Skills Required PnP 1 PnP 2 PnP 3 PnP 4 Cisco Integrated Customization Services (CICS) ISR router is delivered with CICS factory installed bootstrap config Installer connects LAN/WAN cables at the site USB stick to bootstrap the ISR Installer connects LAN/WAN cables ISR loads bootstrap config from USB memory stick Prime Plug-n-Play Application Installer connects LAN/WAN cables + a USB console cable to a Laptop/iPhone/iPad PnP Application bootstraps the router Cisco Configuration Professional Express (ISR Device GUI) Installer connects LAN/WAN cables + a PC to a LAN port CCP Express Application to bootstrap the router 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

28 C, JAVA Program API Presentation BENEFITS Provides a consistent, programmable interface across Cisco platforms onepk API Infrastructure Industry s most comprehensive programmability kit: Branch, Campus, Data Center, Service Provider, Cloud IOS-XE/ IOS ASR1k, ISR, CSR Catalyst IOS-XR CRS, ASR9k NX-OS Nexus Supports a wide array of APIs 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 28

29 Current Platforms 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

30 Interface Density 3900 Series 3900E Series 4451-X Series 800 Series Forwarding with Services 25Mbps 35Mbps 50Mbps 75Mbps 100Mbps 250Mbps 350Mbps 500Mbps 2Gbps 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31 Unprecedented Performance and Service Scalability with IT Simplicity Appliance-level Services Performance 1-2 Gbps Performance Separate Services Planes for Continuity Pay-As-You-Grow Model No Disruptions or Truck Rolls Simplified Service Integration Ease of L2-L7 Service Deployment Native, Full-featured WAN Optimization Security with Application Visibility Application Service Assurance Cisco ISR 4451-X The Ultimate ISR with Application Experience 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 31

32 IWAN Capabilities Embedded in the Router One Network UNIFIED SERVICES Visibility L4-L7 Application Control Services Optimization ASR1000-AX Simplify Application Delivery Transport Independent Secure L2-L3 Transport Routing ISR-AX Cisco AX Routers ASR1002-X 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 32

33 Summary 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 33

34 AVC MPLS Private Cloud 3G/4G-LTE Virtual Private Cloud Branch WAAS PfR Internet Public Cloud Transport Independent Intelligent Path Control Secure Connectivity Application Optimization Consistent operational model Simple Provider migrations Scalable and Modular design DMVPN IPsec overlay design Application best path based on delay, loss, jitter, path preference Load Balancing for full utilization of all bandwidth Improved network availability Performance Routing (PfR) Application monitoring with Application Visibility and Control (AVC) Application Acceleration and bandwidth savings with WAAS Certified strong encryption Comprehensive threat defense with ASA and IOS Firewall/IPS Cloud Web Security (CWS) for scalable secure direct Internet access 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 34

35 Thank you Cisco and/or its affiliates. All rights reserved. Cisco Public 35