Campus network: Looking at the big picture

Transcription

1 Outline Politecnico di Torino architecture and management Marcello Maggiora, Antonio Lantieri, Marco Ricca Building blocks Core, Distribution, Access, Edge network architecture Core network Distribution and Access network Wireless network Telephone service Edge network Datacenter and Business Continuity management Wired network management Wireless network management Marcello Maggiora, Antonio Lantieri, Marco Ricca 2 Campuses Internetworking Politecnico di Torino Campus network: Looking at the big picture Students: ~32,000 Staff: 2,000 Campus: ~300,000 mq Metropolitan campuses: 5 Regional campuses: 6 Verrès Biella Torino Alessandria Mondovì Marcello Maggiora, Antonio Lantieri, Marco Ricca 3 Marcello Maggiora, Antonio Lantieri, Marco Ricca 4 Campus Data Core network at a glance Capacity Internet Connection (via GARR): 10 Gbps Core network aggregate bandwidth: 60 Gbps Datacenter 2 main datacenters in Business Continuity 3 switching rooms Many technical rooms ing devices Access Points: ~450 Switches & routers: ~450 ed devices Telephones: ~3,000 nodes: ~14,000 Thousands of mobile devices Datacenters (DC) 2 main DC (labeled 1,5) 3 switching rooms (labeled 2,3,4) Many technical rooms Core network devices 2 Cisco 6500 switches in DC 1,5 6 HP 5500 switches in DC 2,3,4 Switches, not Routers! Layer 2 High bandwidth, low latency Marcello Maggiora, Antonio Lantieri, Marco Ricca 5 Marcello Maggiora, Antonio Lantieri, Marco Ricca 6 1

2 Politecnico di Torino Architecture Data center 5 EDGE Internet Data center 1 Politecnico di Torino Architecture Data center 5 EDGE Internet Data center 1 Marcello Maggiora, Antonio Lantieri, Marco Ricca 7 Marcello Maggiora, Antonio Lantieri, Marco Ricca 8 Three-layer hierarchical model Break a complex network into smaller and more manageable network Core network: optimized and reliable transport structure by forwarding traffic at very high speeds Distribution network: defines policy for the network such as Access Control List (ACL) and routing Access network: supplies traffic to the network and performs network entry control Core network Layered models are useful Facilitate modularity Devices at each layer have similar and well-defined functions Scalable design Marcello Maggiora, Antonio Lantieri, Marco Ricca 9 Marcello Maggiora, Antonio Lantieri, Marco Ricca 10 Core physical architecture Preventing switching loops Cisco 6509 L2/L3 switches Spanning Tree Protocol (STP) Standard approach Increase network management complexity Reduces capacity Convergence takes time HP 5500 L2 switches Switch virtualization techniques Provide a loop free topology A smart way to build a logical topology Proprietary technologies like clustering and Marcello Maggiora, Antonio Lantieri, Marco Ricca 11 Marcello Maggiora, Antonio Lantieri, Marco Ricca 12 2

3 Core network: Switch virtualization Core network: Virtual Switching System (VSS) Switch virtualization technologies: pools multiple switches into single virtual switch Virtual Switching System (VSS) Intelligent Resilient Framework (IRF) Benefits Simplifying the network increases operational efficiency Scales system bandwidth capacity Providing a loop-free Layer 2 topology: operate as a single logical virtual switch High availability Load balancing Two physical chassis cluster into a single logical entity The cluster appears as a single logical switch to neighboring device Only one active control plane and the other as standby The switch fabric of both switch are in active state Aggregate switch fabric capacity = 1440 Gbps or 1.44 Tbps One supervisor engine act as central management point for the entire system Control Plane Forwarding Plane Control Plane Forwarding Plane Control Plane Forwarding Plane Virtual Switch Active Cluster Forwarding Plane Virtual Switch Passive Marcello Maggiora, Antonio Lantieri, Marco Ricca 13 Marcello Maggiora, Antonio Lantieri, Marco Ricca 14 Virtual Switching Link (VSL) Special signaling and control information must be exchanged between the two chassis Need a special link, VSL, to transfer both data and control traffic between the peer chassis The VSL is formed as a Cisco EtherChannel interface (1 to 8 ports) Control traffic gets highest priority across the VSL Virtual switch header is appended onto every frame sent across the VSL Cisco 6509 switch Modules Supervisor Engine Connection modules Service modules Wireless LAN Controller WLC Application Control Engine ACE Marcello Maggiora, Antonio Lantieri, Marco Ricca 15 Marcello Maggiora, Antonio Lantieri, Marco Ricca 16 Modules that support the formation of a VSL port channel 10 Gigabit Ethernet uplink ports on the Supervisor Engine G Cisco 8-Port 10 Gigabit Ethernet Switching Module VSL formed out of Two Supervisor Engine Ports Fewer hardware components VSL module fails entire VSS fail VSL bandwidth not scalable Marcello Maggiora, Antonio Lantieri, Marco Ricca 17 Marcello Maggiora, Antonio Lantieri, Marco Ricca 18 3

4 VSL formed out of Cisco 10 Gigabit Ethernet ports VSL across Supervisor Engine Ports and 10 Gigabit Ethernet ports More hardware components VSS deployment is highly redundant Scalable VSL bandwidth PoliTo case: cost balanced scenario More hardware components Offers link and line-card redundancy Scalable VSL bandwidth Marcello Maggiora, Antonio Lantieri, Marco Ricca 19 Marcello Maggiora, Antonio Lantieri, Marco Ricca 20 Core network: VSS Logical topology after VSS configuration Single active control and management plane Combined switching fabric capacity 10Gbps 720 Engine switch #1 720 Engine switch #2 20Gbps VSS 1440 Terabit switch Switch virtualization benefits revisited Simplifying the network increases operational efficiency Only single logical switch Providing a loop-free Layer 2 topology No STP configuration needed Scales system bandwidth capacity Both chassis data plane is active No STP so all links are used fully Load balancing and redundancy Meshed network Loop-free network High availability boosts nonstop forwarding/stateful switchover (NSF/SSO) Marcello Maggiora, Antonio Lantieri, Marco Ricca 21 Marcello Maggiora, Antonio Lantieri, Marco Ricca 22 Core network: VSS High Availability In an Stateful switchover (SSO) system, protocols and features synchronize events and state information from the active supervisor engine to the hot-standby supervisor engine Core network: Intelligent Resilient Framework (IRF) Can we do the same for the 6 HP switches? 720 Engine 720 Engine switch #1 switch #2 VSS 1440 Terabit switch In the event of a failover, the standby supervisor engine does not need to re-learn this information resulting in a minimal amount of outage time Marcello Maggiora, Antonio Lantieri, Marco Ricca 23 Marcello Maggiora, Antonio Lantieri, Marco Ricca 24 4

5 Core network: Intelligent Resilient Framework (IRF) 6500-VSS Core network: Final logical architecture Importance Simplified management STP free High capacity High availability Protocols involved EtherChannel LACP Virtualization technologies VSS IRF Hardware 2 Cisco 6500 switches 6 HP 5500 switches VSS,5 Link aggregation control protocol (LACP) 60Gbps DC2,3,4 IRF Marcello Maggiora, Antonio Lantieri, Marco Ricca 25 Marcello Maggiora, Antonio Lantieri, Marco Ricca 26 Politecnico di Torino network: Final logical architecture Data center 5 Data center 1 Bade system Enclosure #1 SWBLADE_1.2 Blade Server SWBLADE_1.1,5 DC2,3,4 SWBLADE_2.2 Blade Server SWBLADE_2.1 Bade system Enclosure #2 Access and Distribution network Departments Marcello Maggiora, Antonio Lantieri, Marco Ricca 27 Marcello Maggiora, Antonio Lantieri, Marco Ricca 28 Distribution network and Access network Distribution: management at layer 3, routing capabilities Access: supply traffic to the network, performs network entry control Rapid STP configuration: Why? Use case scenarios: Wireless network, Telephone network Departments DC2,3,4 IRF Polito WiFi In production since 2004 Protocols supported: a/g/n/ac 54Mbps, 600Mbps, 1.3Gbps SSID: polito, eduroam n (2.4GHz) October November December January ac n (5.0GHz) Time Associated Client Authenticated Client Marcello Is it working? Maggiora, Antonio Lantieri, Marco Ricca 29 Marcello Maggiora, Antonio Lantieri, Marco Ricca 30 5

6 A Layer 3 Campus WLAN logical view ap_manager port VLAN CAPWAP tunnel (over IP) PoliTo SSID: polito One CAPWAP tunnel for every AP-Centralized controller connection Users mobility management Alternative 1) disable roaming between VLAN 2) (try to) keep each user s session alive Same SSID, different VLANs VLAN deployment to define multiple broadcast domain AP 1 AP 2 Layer 2 Roaming PoliTo CAPWAP tunnel (over IP) SSID: polito AP1 polito AP 2 AP AP2 polito VLAN 1 VLAN VLAN, client IP address and router gateway IP address remain the same SSID: polito Centralized controller keeps the information about the user s session Roaming handled in less than 10 ms AP AP1 polito AP1 polito Marcello Maggiora, Antonio Lantieri, Marco Ricca 31 Marcello Maggiora, Antonio Lantieri, Marco Ricca Layer 3 Roaming VLAN2 PoliTo Client IP Add. As. VLAN Cur. VLAN Cur. AP SSID AP1 polito VLAN2 VLAN2 AP8 polito AP 1 AP 2 AP SSID: polito VLAN SSID: polito Access network: Wireless network Wi-Fi Controller Wired Client IP Add. As. VLAN Cur. VLAN Cur. AP State SSID AP1 polito VLAN2 AP2 Roamed polito Design goal: Allow users mobility among the campus, w/out closing user s session Keep same IP address on a different VLAN Transparent operation from user s Marcello prospective Maggiora, Antonio Lantieri, Marco Ricca 33 Default gateway remains the same, wi-fi controller marks a device as visitor on a different VLAN Marcello Maggiora, Antonio Lantieri, Marco Ricca 34 Wireless network: unique features Control And Provisioning of Wireless Access Points (CAPWAP) protocol Enables a central wireless LAN Controller (WLC) to manage Wireless Access points Provides configuration and device management Full Datagram Transport Layer Security (DTLS) tunnel Uses UDP ports 5246 (control channel) and 5247 (data channel) Mobility Layer 2 roaming: same VLAN, client IP address, router gateway IP address Layer 3 roaming: different VLAN, client labeled as visitor for the whole session eduroam authentication procedure eduroam (education roaming) world-wide roaming access service for the international research and education community Hierarchal system of RADIUS servers 1. Client host institution RADIUS 2. Host institution NREN RADIUS 3. TERENA central RADIUS 4. Client home institution NREN RADIUS 5. Client home institution RADIUS 6. Auth. 'ack' travels back over the proxyhierarchy to the host institution and the user is granted access Marcello Maggiora, Antonio Lantieri, Marco Ricca 35 Marcello Maggiora, Antonio Lantieri, Marco Ricca 36 6

7 Edge network: Generalized schema Bastion Hosts (web, mail relay, other) Internal Hosts dmz Edge network Internet ISP Border Router outside inside Firewall Inside LAN LAN switch dmz DC Firewall LAN2LAN and Remote VPN OUTSIDE INSIDE Protected Server Marcello Maggiora, Antonio Lantieri, Marco Ricca 37 Marcello Maggiora, Antonio Lantieri, Marco Ricca 38 Edge network: Detail LAN2LAN and Remote VPN Border Router Firewall Router dmz outside inside 10Gbps Firewall Only one BGP Process 1Gbps outside inside Router dmz Firewall Core Switch Core Switch Core Switch Protected Server Internal Hosts Firewall Inside LAN Others server Core Switch DC2, 3, 4 Firewall Protected Server Edge network: unique features VPN concentrator: advanced encryption and authentication techniques built specifically for creating a remote-access or site-to-site Firewalls: control the incoming and outgoing network traffic based on an applied rule set BGP: exterior border gateway protocol (ebgp) designed to exchange routing and reachability information between autonomous systems on the Internet VSS implementation Connection to Internet Remote places LAN2LAN and Remote VPN Marcello Maggiora, Antonio Lantieri, Marco Ricca 39 Marcello Maggiora, Antonio Lantieri, Marco Ricca 40 Datacenters Layout Datacenters and Business continuty Setup Marcello Maggiora, Antonio Lantieri, Marco Ricca 41 Marcello Maggiora, Antonio Lantieri, Marco Ricca 42 7

8 Business Continuity Business Continuity 600 m Logical Unit Number LUN A Sync LUN B Marcello Maggiora, Antonio Lantieri, Marco Ricca 43 Marcello Maggiora, Antonio Lantieri, Marco Ricca 44 Business Continuity Application Control Engine (ACE) External DNS Server External Users External FW-POLITO Server INTERNAL POLITO LAN Local Users CLIENT SIDE VLAN CLIENT SIDE VLAN VIP address MX.POLITO.IT VIP address MAIL.POLITO.IT ACE CONTEXT Active ACE CONTEXT Stand-by ACE CONTEXT Active ACE CONTEXT Stand-by LUN A Sync LUN B VIP address SERVER SIDE VLAN VIP address SERVER SIDE VLAN Marcello Maggiora, Antonio Lantieri, Marco Ricca 45 ANTISPAM ENGINE Marcello Maggiora, Antonio Lantieri, Marco Ricca 46 MAIL BOXES management Tools mainly relying on SNMP protocols Wireless network management Wired network management Unified management management Marcello Maggiora, Antonio Lantieri, Marco Ricca 47 Marcello Maggiora, Antonio Lantieri, Marco Ricca 48 8

9 management Wireless management Wired network management Marcello Maggiora, Antonio Lantieri, Marco Ricca 49 Marcello Maggiora, Antonio Lantieri, Marco Ricca 50 At a glance EDGE Marcello Maggiora (marcello.maggiora@polito.it) Antonio Lantieri (antonio.lantieri@polito.it) Marco Ricca (marco.ricca@polito.it) Marcello Maggiora, Antonio Lantieri, Marco Ricca 51 Marcello Maggiora, Antonio Lantieri, Marco Ricca 52 9