APIC-EM Vedran Hafner Systems Engineer

Transcription

1 APIC-EM Vedran Hafner Systems Engineer

2 APIC-EM Aleksandar Vulović Systems Engineer

3 Agenda Introduction to Cisco SDN and APIC-EM intent What is APIC-EM? APIC-EM Deployment what you get and how to use it Use Cases 3

4 SDN Still Don t know Stanford Defined Networking Many things to Many people An open solution for customized flow forwarding control in the Data-Center A way to reduce the CAPEX of my network and leverage commodity switches A platform for developing new control planes A way to avoid lock-in to a single networking vendor With SDN I can develop solutions to my problems far faster at software speeds. I don t have to work with my network vendor or go through length standardization A means to do traffic engineering without MPLS An open solution for VM mobility in the Data-Center A solution to build a very large scale layer-2 network A means to scale my fixed/mobile gateways and optimize their placement A solution to build virtual topologies with optimum multicast forwarding behavior A way to distribute policy/intent, e.g. for DDoS prevention, in the network A way to define virtual networks with specific topologies for my multi-tenant Data-Center A way to optimize link utilization in my network, through new multi-path algorithms A way to configure my entire network as a whole rather than individual devices A way to build my own security/encryption solution, avoiding RSA A way to scale my firewalls and loadbalancers A solution to get a global view of the network topology and state

5 SDN Controller Overview OK that looks really ugly but wait a minute all cars Four wheels Steering wheel Gas pedal Brake pedal But complete different usecases

6 APIC Application Policy Infrastructure Controller Application Centric Infrastructure (ACI) User Centric Infrastructure (UCI) APIC (DC) Data Center (Nexus 9000) EM Enterprise Module (Catalyst, ISR, ASR, Nexus 7k*, 6k*, 5k*, WLAN, NfV*) *limited support

7 APIC - Design Points There are two approaches to Control Systems IMPERATIVE CONTROL DECLARATIVE CONTROL Baggage handlers follow sequences of simple, basic instructions Air traffic control tells where to take off from, but not how to fly the plane

8 What is APIC-EM? 8

9 The challenges! Simplify your network Automate your network deployment and RMA Keep the configuration consistent Copyright by Saskia Dynamic Policies where necessary Control network traffic and optimize it Interface with the User and Application (UCI and ACI) Quickly react on events like Intrusion detection, collaboration events etc 9

10 APIC-EM similarity to Smartphone The APIC-EM has: A strong base platform for SDN use cases It has build in App s (eg QoS, ACL, Policy etc) It offers an API to be used by ISV & App s can be developed by many One App example Jabber / Unified communication integration 10

11 Flexible Programmable Interfaces Applications Controller Network Elements APIC EM Web UI YANG REST API CLI SNMP Web UI* NETCONF* RESTConf* Openstack* OpenFlow* Allow Protocol/API choice while maintaining stack integrity * Future Options

12 APIC-EM: High-Level Controller Architecture Security Collaboration Services Orchestration WAN Northbound APIs RESTful API GET PUT POST DELETE Network Information Database Policy Infrastructure Automation Southbound APIs Network Element Layer CLI, SNMP 12

13 APIC-EM - Platform Architecture APIC-EM Applications Network PnP IWAN Advanced Topology Visualizer Path Trace Network Inventory Easy static and dynamic QoS APIC-EM Applications APIC-EM Controller Northbound REST APIs APIC-EM Services Inventory Manager Topology Services RBAC Policy Analysis Policy (QoS) Data Access Service Network PnP IWAN Services APIC-EM Services Grapevine Elastic Service Infrastructure Addresses Scale Out and HA Requirements 13

14 Controller in Action! Controller creates and enforces Policies: The WHAT The horse takes care of: The HOW Source:

15 APIC-EM Deployment what you get and how to use it 15

16 APIC-EM Deployment Considerations Bare Metal/HW Appliance Virtual Appliance GV Root GV Client Libs/Bins GV Client Libs/Bins GV Client GV Client LXC Container LXC Container GV Root Libs/Bins Libs/Bins Operation System LXC Container LXC Container Virtual Machine Operation System Hypervisor and/or Host OS Server Hardware Server Hardware 16

17 Before You Deploy: System Requirements Server: 64-bit x86 (should be supported by Ubuntu LTS) vcpu: 6 (2.4 GHz) or more RAM: 64 GB (for single-host deployments)/ 32 GB (for multi-host deployments) Storage: 500 GB HDD Hardware-based RAID at RAID level 10 Disk I/O Speed: 200 MBps Network adaptor: 1 x Browser: Google Chrome (44.0 or later) Hypervisor: VMware vsphere 5.1/5.5 (for Virtual Appliance) tested should run on any 17

18 Single Host Multi Host There will be no virtual IPs configured All inbound requests into APIC-EM will be via the host IPs (like they are with CA2 and CA3) The customer can convert their deployment into a multi-host deployment at a later time The customer will provide the virtual IPs Grapevine should use (one for each external network) during the config wizard workflow On startup, Grapevine will bring up the virtual IPs on one of the hosts All inbound requests into APIC-EM will be via these virtual IPs (instead of the host IPs), and the requests will be routed to the services running on different hosts via the reverse-proxy If the host which has the virtual IP dies, Grapevine will bring up the virtual IP on one of the remaining hosts 18

19 Multi-Host Deployment APIC-EM Cluster Node 1 DNS NTP Cisco Cloud, NTP, DNS, etc. IP Addr1 Node 2 IP Addr2 Virtual IP Address REST APIs and APIC-EM UI Node 3 IP Addr3 Network Devices Note: For the general availability release, all the nodes in the APIC-EM cluster need to be in the same subnet 19

20 APIC-EM 5 step installation Physical Appliance or Virtual.ISO for virtual Pre-installed APIC-EM software APIC-EM Appliance SKUs: APIC-EM-APL-R-K9 APIC-EM-APL-G-K9 Downloadable ISO Image OS: Ubuntu bit Deployment Options: Bare-metal install (recommended) Virtual machine Boot.iso Enter IP address Change Credentials Add NTP Server Finalize Installation Enter APIC-EM IP (Subnet / Def GW learned automatically) Shell and UI Username and PWD plus CCO login for update Enter NTP Server IP (mandatory!) Finalize installation and bring up controller 20

21 Network Discovery - Input Parameters For Your Reference Seed IP address for CDPbased network discovery IP address range for discovery scope - Click on the Add icon to provide multiple IP address ranges 21

22 SDN Innovation: Network Information Base Provides 1 Source of Truth For Your Reference User Defined Group Tagging Allows Applications to Segment Analysis and Control (not shown here)

23 APIC-EM Demo 23

24 API: VERBS + NOUNS + Syntax GET POST PUT DELETE /host /link /network-device /interface JSON Syntax: { "policyowner": "Admin", "networkuser": {"useridentifiers":[" "], "applications":[{"raw": "12340;UDP"}] } } Header: Content-Type: Application/JSON GET/POST

25 Use Cases 25

26 Network Plug and Play (PnP) Deployment Device receives target image and configuration 2 Discovery Device can reach PnP Server on APIC-EM 1 Routers (ISR, ASR) Switches (Catalyst ) Wireless Access Points No Staging No Staging Required PnP Runs from Cisco Factory-Default Configuration 26

27 Network Plug and Play (PnP) Components PnP Helper App [ Optional ] Delivers bootstrap, status and troubleshooting checks Cloud Redirect Service [ Optional ] Roadmap Phase 2 PnP Server Central Server on APIC-EM Manages sites, devices, images, licenses, workflow Provides Northbound REST APIs Redpark RJ45 Apple 8pin Redpark RJ45 Apple 30pin GetConsole Airconsole2.0 Bluetooth Adapter PnP Agent Runs on Cisco switches, routers, and wireless access points PnP Protocol Runs between Agent and Server Open Schema Automates the deployment process 27

28 PnP Discovery Options 1 DHCP Server DHCP with options 60 and 43 PnP string: 5A1D;B2;K4;I ;J80 Wireless Access Points 2 DNS Server DNS lookup pnpserver.localdomain (PnP Server) Routers (ISR, ASR) 3 Cloud re-direction - roadmap (Q4CY2015) re-directs to (PnP Server) 4 USB-based bootstrapping Switches (Catalyst ) 5 Manual - using the Cisco Installer App iphone, ipad, Android, (roadmap - Windows mobile and PC) X Others Any other manual or automated discovery method Scripting, AN, EEM, NAP, etc. 28

29 APIC-EM GA Code in production

30 APIC-EM GA Production (Cont.) 4784 Hosts 867 Devices

31 Path Trace (Trace) For Your Reference

32 Path Trace with Statistics GA+1

33 EasyQoS Solution Applications can interact with APIC-EM via Northbound APIs, informing the network of application-specific and dynamic QoS requirements Network Operators express high-level business-intent to APIC-EM EasyQoS EM Southbound APIs translate business-intent to platformspecific configurations Wireless AP Trust Boundary PEP 4Q (WMM) Catalyst P7Q1T Nexus 7700 F3: 1P7Q1T ASR/ISRs MQC Wireless AP Trust Boundary PEP 4Q (WMM) Catalyst 3650 Trust Boundary PEP 2P6Q3T Catalyst P3Q4T 1P7Q4T 2P6Q4T WLC PEP Catalyst 2960-X Trust Boundary PEP 1P3Q3T

34 What Do We Do Under-the-Hood? Apply RFC 4594-based Marking / Queuing / Dropping Treatments Application Class Per-Hop Behavior Queuing & Dropping Application Examples VoIP Telephony EF Priority Queue (PQ) Cisco IP Phones (G.711, G.729) Broadcast Video CS5 (Optional) PQ Cisco IP Video Surveillance / Cisco Enterprise TV Real-Time Interactive CS4 (Optional) PQ Cisco TelePresence Multimedia Conferencing AF4 BW Queue + DSCP WRED Cisco Jabber, Cisco WebEx Multimedia Streaming AF3 BW Queue + DSCP WRED Cisco Digital Media System (VoDs) Network Control CS6 BW Queue EIGRP, OSPF, BGP, HSRP, IKE Signaling CS3 BW Queue SCCP, SIP, H.323 Ops / Admin / Mgmt (OAM) CS2 BW Queue SNMP, SSH, Syslog Transactional Data AF2 BW Queue + DSCP WRED ERP Apps, CRM Apps, Database Apps Bulk Data AF1 BW Queue + DSCP WRED , FTP, Backup Apps, Content Distribution Best Effort DF Default Queue + RED Default Class Scavenger CS1 Min BW Queue (Deferential) YouTube, Netflix, itunes, BitTorrent, Xbox Live

35 What happens if you get a new Application? Example: QoS Video Classification Enables Enterprise Wide Jabber 1. Define new Application Jabber Video APIC-EM Easy-QoS Qo S 2. Update QoS Policy 3. Push Updated QoS Policy to Network Devices 4. Deploy Jabber Video Client

36 SDN-Enabled QoS for Collaboration CUCM Prime Collaboration Assurance EF AF41 BE WAN Express Business Intent Deploy Policy Identify Media Classify & Schedule Provision Resource Control Monitor Troubleshoot Optimize Campus Switches: APIC-EM EasyQoS WAN Edge: APIC-EM IWAN Untrusted devices: Per-flow marking via APIC-EM Trusted devices: Trust extension via APIC-EM Consistent marking of audio (EF) Single video queue (AF4x) Allow different drop priorities for video Bandwidth Planning Video Rate Adaptation Prime Collaboration Monitoring Assurance and Diagnostics: Media Flow Analysis with APIC-EM

37 SourceFire Integration: Network Threat Defense Dynamic Network Branch security SDN Controller Controller Notification 1. BYOD Malware/Javascript Attack Remediation Policy Enforcement Cisco APIC- Enterprise Module HQ SourceFire Defence Center 2. SF Sensor detects threat Internet WAN Defence Centre Alert!!!! 3. SF DC notifies Controller Malware Attack 4. Remediation API event ISR Sensor ISR Sensor 5. Policy installed on Access switch port by Controller. X Branch 6. Block or quarantine end-point Host Quarantined

38 Use Case: Granular Control Per User Per Application Access Policy Enforcement 1. Admin configures business policy to block application traffic on a per user basis ISE AD/Radius Server 2. Controller uses identity information to install user specific access policy at the edge 3. If the user moves, the controller dynamically moves the user policy along with it, providing near real time granular control CAMPUS Block Bit-Torrent Block Bit-Torrent User moves to a branch site. Policy moves with it

39 Identity Services Service Description APIC-EM can gather user identity information via: Cisco Identity Services Engine (ISE) though Cisco Platform Exchange Grid (pxgrid) RADIUS proxy Active Directory through LDAP calls (*) Identity information is a key enabler for highly sophisticated policies with user level information for tighter enforcement. Network as firewall (*) Roadmap

40 Intelligent WAN (IWAN) Solution Components AVC MPLS Private Cloud Virtual Private Cloud 3G/4G-LTE Branch IWAN APP WAAS Akamai PfRv3 Internet Public Cloud Management and Orchestration Cisco Prime Transport Independence Intelligent Path Control Application Optimization Secure Connectivity IPSec WAN overlay Optimal application routing Performance monitoring NG strong encryption Consistent operational model Efficient use of bandwidth Optimization and caching Threat defense DMVPN, PKI Performance Routing (PfR) QoS AVC, WAAS, Akamai Suite-B, CWS, ZBFW 40

41 IWAN App on APIC-EM 1. Step-by-Step Network and Hub Settings 2. Simple Policy Definition and Customization Three main areas: 1.Hub site and settings 2.Administration of application policy 3.Branch site setup 3. Policy-Driven IWAN Site Deployment including PnP and Monitoring 41

42 Use Case: Path Preference (iwan) Automated Provisioning of Routing Paths Video TP - Video Data Center 1. Video forwarded over MPLS and Youtube over Internet Deteriorating Video Quality Delay = ASR ASR 2. Delay goes up on MPLS circuits, deteriorating Video quality 3. Performance monitoring App instructs controller to reroute Video traffic over better path APIC-EM ACTION SP MPLS ISP Internet 4. Appropriate QoS policies are also provisioned to ensure proper handling of video on internet circuit ISR-G2 Branch TP - Video

43 Cisco Prime and Cisco APIC Enterprise Module Management Layer Control Layer Device Layer Cisco IAC UCSD Catalog/ Provisioning Fault/ Events APIC for datacenter PRIME INFRASTRUCTURE & NAM User / Data Management REST API (ONE DevKit) Cisco APIC Common ACI Architecture CLI, OpenFlow, OnePK API Performance Monitoring APIC Enterprise Module Cisco Devices Enterprise Networks, Data Center 3 rd Party Apps Reporting / Analytics Operational Automation Policy and Service Definition Automated Assurance Provisioning Visualization, Trending and Analytics Network Intelligence Device Layer Abstraction Network Control Policy Enforcement & Network Change

44 Cisco Prime Infrastructure PnP your choice today For PnP Cisco IAC UCSD PRIME INFRASTRUCTURE & NAM 3 rd Party Apps Catalog/ Provisioning Fault/ Events User / Data Management Performance Monitoring Reporting / Analytics REST API (ONE DevKit) Cisco APIC Common ACI Architecture APIC for datacenter APIC Enterprise Module CLI, OpenFlow, OnePK API Cisco Devices Enterprise Networks, Data Center

45 Conclusion & Summary 45

46 APIC EM as a Platform Solution Apps BASIC SERVICES Discovery, Inventory, Topology Policy, PnP REST APIs App-Service Extensions App-Services (Licensed based on Solution purchased includes API s) Basic-Services (Free platform and API s) GRAPEVINE ELASTIC ARCHITECTURE TAC Support if Appliance or Network has a service coverage.

47 APIC-EM in dcloud

48 APIC-EM on DevNet

49 Fun stuff to watch Fundamentals of Cisco APIC-EM Metadata-Defined Data Center, Mike Dvorkin, Cisco Systems Developing OpenDaylight Apps with MD-SAL Application Centric Infrastructure (ACI) Overview

50 Thank you 50