HW virtualizace a podpora hypervizorů různých výrobců

Size: px

Start display at page:

Download "HW virtualizace a podpora hypervizorů různých výrobců"

Egbert Joseph
5 years ago
Views:

2 Twitter Talk2cisco SMS Cisco Cisco Expo Expo 2

3 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 3

6 The Right Solution at the Right Time Legacy UCS Management and Control SAN A Primary Network SAN B Secondary Network Server = Application Server = Resource Inefficient Complex High Cost Fragile Efficient Agile Transformative Cisco Cisco Expo Expo 6

7 From ad hoc and inconsistent to structured, but siloed, complicated and costly to simple, optimized and automated Cisco Cisco Expo Expo 7

8 72% Maintain 28% Invest Complex Inefficient Inflexible Costly Cisco Cisco Expo Expo 8

9 Data Created Since Jan ,240,036,374,697,152,065,225 Bytes. 10 up21 aka sextillion aka trilliard Cisco Cisco Expo Expo 9

10 75,000,000,000 ipads 125,000,000 years Cisco Cisco Expo Expo 10

11 Cisco Cisco Expo Expo 11

12 The Tipping Point 17,500,000 15,000,000 12,500,000 10,000,000 7,500,000 5,000,000 2,500,000 VM Cross Over Physical Hosts Virtual Machines Cisco Cisco Expo Expo 12

13 Waste Waste 45% Value 55% Value Cisco Cisco Expo Expo 13

14 But, need this? Deploy this Much?? IT impedes growth or, But, need this? Deploy this Much? IT spends too much Cisco Cisco Expo Expo 14

15 Variable Cost Fixed Cost Cisco Cisco Expo Expo 15

16 SAN LAN Dynamic resource provisioning Virtualization at scale Cisco Cisco Expo Expo 16

17 WAN / SP Cisco Cisco Expo Expo 17

18 Servers directly connected to access layer switches Very little virtualization Network configuration and policy enforcement for the server done at the switch All management primarily at the physical element level Management of Physical ( ) Elements Cisco Cisco Expo Expo 18

19 Management Challenges Policy Enforcement Issues Shift towards server virtualization Multiple VMs inside each physical server, connected by virtual switches Rapid proliferation of logical elements that need to be managed Feature parity issues between virtual and physical elements VSwitch VSwitch VSwitch VSwitch vnics vnics vnics vnics VMs VMs VMs VMs Separate management of physical ( ) and logical ( ) elements Cisco Cisco Expo Expo 19

20 Management Challenges Policy Enforcement Issues Switch lacks visibility into packets originated by vnics Can t tie packet back to VM, forcing reliance on the software switch for policy enforcement Leads to policy enforcement and network management issues VSwitch VSwitch VSwitch VSwitch vnics vnics vnics vnics VMs VMs VMs VMs Access layer switch lacks visibility into virtual network elements Cisco Cisco Expo Expo 20

21 VN-Link: Consolidated Management Virtual Interfaces within VMs are now visible to the switch Both network configuration and policy enforcement for these interfaces can now be driven from the switch This allows consolidated management of physical and virtual elements VSwitch VSwitch VSwitch VSwitch vnics vnics vnics vnics VMs VMs VMs VMs Consolidated management of physical ( ) and logical elements Cisco Cisco Expo Expo 21

22 VN-Link: Consolidated Policy Enforcement VN-Link allows the packets to be tagged Switch has full visibility into which vnic originated the packet Allows switch to forward packets between both physical and virtual elements VN-Link capable adapters allow bypassing software based switches VSwitch VSwitch VSwitch VSwitch vnics vnics vnics vnics VMs VMs VMs VMs Full visibility into the virtual network elements from switch Cisco Cisco Expo Expo 22

23 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 23

25 Cisco Cisco Expo Expo 25

26 IEEE P802.1BR Cisco Cisco Expo Expo 26

27 Cisco Cisco Expo Expo 27

28 VEB (Virtual Embedded Bridge) VEPA (Edge Virtual Bridging) IEEE-802.1Qbg VBE (Virtual Bridge Port Extension) IEEE-802.1BR Relevant IEEE Datacenter Standards: 802.1Qau 802.1Qaz 802.1Qbb 802.1Qbg 802.1BR 802.1aq Congestion Notification Enhanced Transmission Selection Priority based Flow Control Edge Virtual Bridging Virtual Bridge Port Extension Shortest Path Bridging IEEE Bridge Port Extender = Cisco FEX (Fabric Extender) Cisco Cisco Expo Expo 28

29 Cisco Cisco Expo Expo 29 29

30 Cisco Cisco Expo Expo 30 30

31 Cisco Cisco Expo Expo 31

32 Cisco Cisco Expo Expo 32

33 Identifies and isolates traffic between ports within an Extended Bridge Specifies a tag format for this identification Establishes an Extended Bridge consisting of a Controlling Bridge and one or more Bridge Port Extenders Specifies the functionality and the specific requirements of a Bridge Port Extender Extends the MAC service of a Bridge Port across the interconnected Bridge Port Extenders, including support of Customer Virtual Local Area Networks (C-VLANs) Establishes the requirements of bridge components and systems for the attachment of Bridge Port Extenders Specifies a protocol to provide for the configuration and monitoring of Bridge Port Extenders by a Controlling Bridge Establishes the requirements for Bridge Management to support Port Extension, identifying the managed objects and defining the management operations. Cisco Cisco Expo Expo 33

enclosure using 802 LAN technologies and interoperable

34 The purpose of this standard is to extend a bridge, and the management of its objects, beyond its physical enclosure using 802 LAN technologies and interoperable interfaces. Micro & Macro Cosmos Cisco Cisco Expo Expo 34

35 Aggregating Port Extender: A Bridge Port Extender that supports the full E-CID space and is capable of aggregating base Port Extenders. Base Port Extender: A Bridge Port Extender that supports a subset of the E-CID space. Cascade Port: A Port of a Controlling Bridge or Bridge Port Extender which connects to an Upstream Port. In the case of the connection between two Bridge Port Extenders, the Cascade Port is the Port closest to the Controlling Bridge. Controlling Bridge: A Bridge that supports one or more Bridge Port Extenders. Extended Bridge: A Controlling Bridge and at least one Bridge Port Extender under the Controlling Bridge's control. Extended Port: A Port of a Bridge Port Extender that is not operating as a Cascade Port or Upstream Port. This includes the Ports of a Bridge Port Extender connected via internal LANs to the Port of a C-VLAN component within a Controlling Bridge Cisco Cisco Expo Expo 35

36 E-channel: An instance of the MAC service supported by a set of two E-paths forming a bidirectional service. An E-channel is point-to-point or point-to-multipoint. E-path: A configured unidirectional connectivity path between an internal Extended Port and one or more external Extended Ports and/or Upstream Ports. E-paths initiating from the Internal Bridge Port Extender can be point-to-point or point-to-multipoint. E-paths can be point-to-point or multipoint-to-point. E-channel Identifier (E-CID): A value conveyed in a E-TAG that identifies an E-channel. E-TAG: A tag header with a Tag Protocol Identification value allocated for 802.1BR E-Tag Type. External Extended Port: An Extended Port that is part of an External Bridge Port Extender. External Bridge Port Extender: A Bridge Port Extender that is not physically part of a Controlling Bridge but is controlled by the Controlling Bridge. Internal Extended Port: An Extended Port that is part of an Internal Bridge Port Extender. Cisco Cisco Expo Expo 36

37 Internal Bridge Port Extender: A Bridge Port Extender that is physically part of a Controlling Bridge. Bridge Port Extender: A device used to extend the MAC service of a C-VLAN component to form a Controlling Bridge and to extend the MAC service of a Controlling Bridge to form an Extended Bridge. Port Extender Control and Status Agent: The entity within a Bridge Port Extender that implements the Port Extender Control and Status Protocol. Port Extender Control and Status Protocol (PE CSP): A protocol used between a Controlling Bridge and Bridge Port Extenders that provides the ability of the Controlling Bridge to assert control over and retrieve status information from its associated Bridge Port Extenders. Replication Group: Within a Controlling Bridge, the set of C-VLAN component Ports connected to a single Bridge Port Extender. Upstream Port: A Port on a Bridge Port Extender that connects to a Cascade Port. In the case of the connection between two Bridge Port Extenders, the Upstream Port is the Port furthest from the Controlling Bridge. Cisco Cisco Expo Expo 37

38 E-CID E-Channel Identifier PCID Port E-CID PE CSP Port Extender Control and Status Protocol PEISS Port Extender Internal Sublayer Service Cisco Cisco Expo Expo 38

39 A simple two-port Bridge that is capable of acting as a Controlling Bridge Cisco Cisco Expo Expo 39

40 Attachment of a physical Bridge Port Extender to the top port of the two-port Bridge. At this point, the Bridge and the Bridge Port Extender execute LLDP. The Bridge learns that a Bridge Port Extender is directly attached when it receives the Port Extension TLV from the Bridge Port Extender. Cisco Cisco Expo Expo 40

41 Upon detection of the directly attached Bridge Port Extender, the Controlling Bridge instantiates an Internal Bridge Port Extender between the C-VLAN component and the External Bridge Port Extender. An E-channel is established for communication between the Bridge Port Extender and the C-VLAN component. The E-channel used for communication between the C-VLAN component and the Bridge Port Extender is identified as E-channel a in this example. Cisco Cisco Expo Expo 41

42 Next both the C-VLAN component and the Bridge Port Extender initiate communication with each other using the Bridge Port Extender Control and Status Protocol (PE CSP). This is accomplished using the CSP Open message. Note that prior to completion of the CSP Open message, the Bridge Port Extender does not know the E-CID of the E-channel to be used for this communication. It therefore uses a default E-CID of one. Since the E-channel is not tagged, the communication is established even though the Controlling Bridge and the Bridge Port Extender are using a different E-CID. After completion of the CSP Open, the Controlling Bridge informs the Bridge Port Extender of the proper E-CID, which is a in this example, using the E-channel Register message. Cisco Cisco Expo Expo 42

43 The Extended Ports have not been instantiated. Extended Ports are not necessarily instantiated at the same time the Bridge Port Extender itself is instantiated. For example, the Extended Ports may be instantiated coincident with the instantiation of virtual machines. Cisco Cisco Expo Expo 43

44 The instantiation of the virtual machines and the corresponding Extended Ports. When the Extended Ports are instantiated, the new Bridge Port Extender informs the controlling bridge by issuing an Extended Port create message for each extended Port. The Controlling Bridge allocates a Port on the C-VLAN component and an E-channel for each new Extended Port and informs the new Bridge Port Extender of the E-CID for these E-channels.E-CIDs d and e are established in this example. In addition, the Controlling Bridge issues E-channel Register messages to the first Bridge Port Extender to establish the new E-channels through the first Bridge Port Extender. At this point, the virtual machines have connectivity to the network. Cisco Cisco Expo Expo 44

45 Cisco Cisco Expo Expo 45

46 Cisco Cisco Expo Expo 46

47 Cisco Cisco Expo Expo 47

48 Server VM VM VM VM VM VM Nexus 5K Hypervisor PE Tag 802.1BR Port Extender Adapter PE Tag 802.1BR FEX (Nexus 2K) Eth Switch Port Extension 802.1BR vnic 1 Port 0 NIV Capable Adapter vnic 2 vnic 3 vnic 4 Port 5 vnic 5 IEEE-802.1BR Bridge Port Extender = Cisco FEX (Fabric Extender) Cisco Cisco Expo Expo 48

49 VEB (Virtual Embedded Bridge) VEPA (Virtual Ethernet Port Aggregator) IEEE-802.1Qbg PE (Virtual Bridge Port Extension) IEEE-802.1BR Other Datacenter Standards: IEEE-802.1Qau IEEE-802.1Qaz IEEE-802.1Qbb IEEE-802.1Qbg IEEE-802.1BR IEEE-802.3bd Congestion Notification Enhanced Transmission Selection Priority based Flow Control Edge Virtual Bridging Virtual Bridge Port Extension MAC Control Frame for Priority based Flow control Cisco Cisco Expo Expo 49 49

50 Cisco Cisco Expo Expo 50

51 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 51

53 Back Plane Comparison to a Physical Switch Modular Switch Supervisor-1 Supervisor-2 Linecard-1 Linecard-2 Linecard-N Server 1 Server 2 Server 3 Cisco Cisco Expo Expo 53

54 Back Plane Moving to a Virtual Environment Modular Switch Supervisor-1 Supervisor-2 Linecard-1 Linecard-2 Linecard-N ESX ESX ESX Cisco Cisco Expo Expo 54

55 Back Plane Supervisors Virtual Supervisor Modules (VSMs) Virtual Appliance VSM1 VSM2 Modular Switch Supervisor-1 Supervisor-2 Linecard-1 Linecard-2 Linecard-N ESX ESX ESX Cisco Cisco Expo Expo 55

56 Back Plane Linecards Virtual Ethernet Modules (VEMs) Virtual Appliance VSM1 VSM2 Modular Switch Supervisor-1 Supervisor-2 Linecard-1 Linecard-2 Linecard-N VEM-1 VEM-2 VEM-N ESX ESX ESX Cisco Cisco Expo Expo 56

57 L2 Mode L3 Mode VSM + VEMs = Nexus 1000V Virtual Chassis Virtual Appliance VSM1 64 VEMs per 1000V (connected by L2 or L3) VSM veth ports per VEM 2K veths per 1000V Multiple 1000Vs can be created per vcenter VEM-1 VEM-2 VEM-N VSM: Virtual Supervisor Module VEM: Virtual Ethernet Module ESX ESX ESX Cisco Cisco Expo Expo 57

58 L2 Mode L3 Mode Customer Request: Host VSMs on a Physical Appliance Virtual Appliance Physical Appliance? VSM1 VSM veth ports per VEM 64 VEMs per 1000V 2K veths per 1000V Multiple 1000Vs can be created per vcenter VSM: Virtual Supervisor Module VEM: Virtual Ethernet Module VEM-1 VEM-2 VEM-N ESX ESX ESX Cisco Cisco Expo Expo 58

59 L2 Mode L3 Mode VSMs hosted on a Physical Appliance: Nexus 1010 Virtual Appliance Nexus 1010 VSM-A1 VSM-A4 Up to 4 VSMs per Nexus 1010 VSM-B1 VSM-B4 Nexus 1010s deployed in redundant pair 200+ veth ports per VEM 64 VEMs per 1000V 2K veths per 1000V Multiple 1000Vs can be created per vcenter VSM: Virtual Supervisor Module VEM: Virtual Ethernet Module VEM-1 VEM-2 VEM-N ESX ESX ESX Cisco Cisco Expo Expo 59

Gateway for 1000v vwaas Virtual WAAS vpath Traffic Steering VEM-1 vpath ESX

60 L2 Mode L3 Mode vpath Virtual Service Datapath Virtual Appliance vwaas VSG VSM VSG and vwaas available now vpath Virtual Service Datapath VSG Virtual Security Gateway for 1000v vwaas Virtual WAAS vpath Traffic Steering VEM-1 vpath ESX VEM-2 vpath ESX Fast -Path Offload Nexus 1000V ver 1.4 & above Cisco Cisco Expo Expo 60

61 L2 Mode L3 Mode Virtual Appliance Nexus 1010 vwaas VSG VSM-A1 VSM-A4 NAM VSM-B1 VSM-B4 NAM vpath Virtual Service Datapath VSG Virtual Security Gateway for 1000v vwaas Virtual WAAS VEM-1 vpath ESX VEM-2 vpath ESX *VSG on 1010 target: 2Q CY11 Cisco Cisco Expo Expo 61

62 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 62

VM VM VM VM VMware vsphere 5.0 Isolate Intel Virtualisation and Intel Trusted Execution Technology (Intel TXT) work together to better isolate VMs Measure Intel TXT measures vsphere 5.

63 VM VM VM VM VMware vsphere 5.0 Isolate Intel Virtualisation and Intel Trusted Execution Technology (Intel TXT) work together to better isolate VMs Measure Intel TXT measures vsphere 5.0 for launch protection Encrypt Intel New instructions in Intel Xeon processors quickly encrypts data in flight and at rest Intel TXT* and AES New instructions in Intel Xeon processors Make Multi-Tenancy More Secure *Intel TXT available on Cisco UCS M3 Servers Cisco Cisco Expo Expo 63

64 2x 1 Link 20 Gbps per Chassis 2x 2 Link 40 Gbps per Chassis 2x 4 Link 80 Gbps per Chassis 2x 8 Links 160 Gbps per Chassis I/O On- Demand via Service Profile Wire Once Architecture Policy-Driven Bandwidth Allocation Virtual Interface Granularity Cisco Cisco Expo Expo 64

UCS Server Blade VM Platinum VM Pool VM Silver VM Pool VM Bronze VM Pool VM QoS controls for tuning Storage & Network flows Platinum, Gold, Silver, Bronze, best effort, FC QoS Classes VMware vsphere

65 UCS Server Blade VM Platinum VM Pool VM Silver VM Pool VM Bronze VM Pool VM QoS controls for tuning Storage & Network flows Platinum, Gold, Silver, Bronze, best effort, FC QoS Classes VMware vsphere Multi-cast optimizations Bandwidth controls Cisco VIC Lossless Ethernet drop/no drop Burst size controls FEX 2200 Platinum Pool 50% Bandwidth Lossless Ethernet NFS Max burst 64K FI 6200 Silver Pool 30% Bandwidth FC with max burst 32k Bronze Pool 20% Bandwidth FC with max burst of 16K Cisco Cisco Expo Expo 65

66 Up to 67% reduction in Application latency Up to 50% increase in Application performance Near linear deterministic Application delivery with scale Cisco Cisco Expo Expo 66

83 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 83

102 Server Zones Portal Records Database Application Virtual Security Gateway (VSG) HVD Zones Assistant IT Admin Doctor Guest it Admin Network Guest Doctor Cisco Cisco Expo Expo 102

103 Server Zones Portal Records Database Application Virtual Security Gateway (VSG) HVD Zones Assistant IT Admin Doctor Guest it Admin Network Guest Doctor Cisco Cisco Expo Expo 103

104 Server Zones Portal Records Database Application Virtual Security Gateway (VSG) HVD Zones Assistant IT Admin Doctor Guest it Admin Network Guest Doctor Cisco Cisco Expo Expo 104

105 Server Zones Portal Records Database Application Virtual Security Gateway (VSG) HVD Zones Assistant IT Admin Doctor Guest it Admin Network Guest Doctor Cisco Cisco Expo Expo 105

Application Servers Training Servers R&D Servers If vm-name contains TRNG, that VM belongs to TRNG zone Source

106 VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM Database Servers DMZ Servers Exchange Servers VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM Application Servers Training Servers R&D Servers If vm-name contains TRNG, that VM belongs to TRNG zone Source Destination Protocol Action Zone=TRNG Zone=TRNG Any Permit Any Zone=TRNG Any Permit Zone=TRNG Any Any Drop Cisco Cisco Expo Expo 106

Application-Zone App Server App Server Database-Zone DB Server DB Server Only Permit Web Servers

107 Web Client Permit Only Port 80(HTTP) of Web Servers Permit Only Port 22 (SSH) to Application Servers Block All External Access to Database Servers Web-Zone Web Server Web Server Application-Zone App Server App Server Database-Zone DB Server DB Server Only Permit Web Servers Access to Application Servers Only Permit Application Servers Access to Database Servers Cisco Cisco Expo Expo 107

120 Introduction Architecture Evolution Implementation Security Capabilities Use Case Example Conclusion VMware Cisco Cisco Expo Expo 120

126 Twitter Talk2Cisco SMS Zveme Vás na Ptali jste se v sále LEO 1.den 17:45 18:30 2.den 16:30 17:00 Cisco Cisco Expo Expo 126

127 Kód přednášky Prosíme, ohodnoťte tuto přednášku. Cisco Cisco Expo Expo 127

128

Cisco Virtual Security Gateway (VSG) Mohammad Salaheldin

Cisco Virtual Security Gateway (VSG) Mohammad Salaheldin Virtual Security Gateway (VSG) Overview VSG Packet Flow VSG Policy Model Use Case Example ASA on 1000V Summary 2011 Cisco and/or its affiliates.