Integration of Hypervisors and L4-7 Services into an ACI Fabric

Transcription

1

2 Integration of Hypervisors and L4-7 Services into an ACI Fabric Bradley Wong Principal Engineer, INSBU Technical Marketing #clmel

3 This session provides a technical introduction to how the ACI fabric handles single and multi-hypervisor environments, how the ACI controller provides integration into different VMMs for a single point of management for virtual network management as well as how the fabric integrates and automates both virtual and physical L4-L7 services ABSTRACT

4 Agenda Introduction to ACI Review of ACI Policy Model Hypervisor Integration Layer 4-7 Services Integration Conclusion 4

5 Introduction to ACI

6 Cisco ACI Logical Network Provisioning of Stateless Hardware Web App DB Outside (Tenant VRF) QoS Filter QoS Service QoS Filter APIC ACI Fabric Scale-Out Penalty Free Overlay Application Policy Infrastructure Controller 6

7 ACI Nomenclature Spine Nodes Leaf Nodes AVS EPG Internet Service Producers EPG Files EPG Users Service Consumers

8 ACI Network Profile Policy-Based Fabric Management Application Extend the principle of Cisco UCS Manager service profiles to the entire fabric Network profile: stateless definition of application requirements - Application tiers - Connectivity policies - Layer 4 7 services - XML/JSON schema Fully abstracted from the infrastructure implementation - Removes dependencies of the infrastructure - Portable across different data centre fabrics Web Tier Storage App Tier ## Network Profile: Defines Application Level Metadata (Pseudo Code Example) <Network-Profile = Production_Web> <App-Tier = Web> <Connected-To = Application_Client> <Connection-Policy = Secure_Firewall_External> <Connected-To = Application_Tier> <Connection-Policy = Secure_Firewall_Internal & High_Priority>... <App-Tier = DataBase> <Connected-To = Storage> <Connection-Policy = NFS_TCP & High_BW_Low_Latency>... Storage DB Tier The network profile fully describes the application connectivity requirements 8

9 Opflex: AN OPEN, Extensible Policy Protocol OPFLEX WAS DESIGNED TO OFFER: 1. Abstract policies rather than device-specific configuration APIC Policies: Who can talk to w hom What about Ops requirements 2. Flexible, extensible definition of using XML / JSON 3. Support for any device including virtual switches, physical switches, network services with strong interoperability across vendors OPFLEX PROXY OPFLEX AGENT OPFLEX AGENT OPFLEX AGENT 4. Open, standardised API with an open source reference implementation FIREWALL HYPERVISOR SWITCH ADC 9

10 Multi-Hypervisor-Ready Fabric Virtual Integration APIC Network Admin APIC ACI Fabric Integrated gateway for VLAN, VxLAN, and NVGRE networks from virtual to physical Normalisation for NVGRE, VXLAN, and VLAN networks VLAN VXLAN VLAN NVGRE ESX Hyper-V KVM VLAN VXLAN VLAN Customer not restricted by a choice of hypervisor Fabric is ready for multihypervisor Application Admin VMware Red Hat Microsoft XenServer Hypervisor Management VMware Microsoft Red Hat PHYSICAL SERVER 10

11 Providers Service Profile Service Graph ACI Layer 4-7 Service Integration Centralised, Automated, And Supports Existing Model Elastic service insertion architecture for physical and virtual services Helps enable administrative separation between application tier policy and service definition APIC as central point of network control with policy coordination Automation of service bring-up/tear-down through programmable interface Supports existing operational model when integrated with existing services Service enforcement guaranteed, regardless of endpoint location Application Admin Service Admin Web Tier A Web Server Server begin Policy / Contract Chain Security 5 Security 5 Chain Defined Stage 1.. Stage N inst inst Firew all.. inst inst Load Balancer end App Tier B Web App Server Server 11

12 Review of the ACI Policy Model

13 End-points Things that connect to the fabric and use it to interface with other things A compute, storage or service instance attaching to a fabric ACI Fabric NIC vnic... end-points [ EP ] 13

14 End-points Things that connect to the fabric and use it to interface with other things A compute, storage or service instance attaching to a fabric EP EP EP... A collection of end-points with identical network behaviour form a End Point Group (EPG) 14

15 End-point Groups (EPGs) EPG APP SERVER policies EPG WEB EP EP EP.. Allows to specify rules and policies on groups of physical or virtual end-points without understanding of specific identifiers and regardless of physical location. Can flexibly map into application tier of multi-tier app segmentation construct (ala VLAN) a security construct ESX port group, SCVMM VMNetwork end-point group [ EPG ] 15

16 Tenant L3, L2 Isolation EPG subnet EPG APP SERVER outside BD Tenant self-contained tenant definition representable as a recursive structured text document EPG WEB EP EP EP... network profile subnet subnet BD With or without flooding semantics L3 context (isolated tenant VRF) 16

17 Integration with Multiple Hypervisors

18 Hypervisor Integration Agenda Hypervisor Integration Overview VMWare vcenter Integration Microsoft SCVMM & Azure Pack Integration OpenStack Integration 18

19 Hypervisor Interaction with ACI Two modes of Operation Non-Integrated Mode Integrated Mode VLAN 10 VLAN 10 VXLAN APP WEB DB DB ACI Fabric as an IP-Ethernet Transport Encapsulations manually allocated Separate Policy domains for Physical and Virtual ACI Fabric as a Policy Authority Encapsulations Normalised and dynamically provisioned Integrated Policy domains across Physical and Virtual 19

20 Hypervisor Integration with ACI Control Channel - VMM Domains Relationship is formed between APIC and Virtual Machine Manager (VMM) Multiple VMMs likely on a single ACI Fabric Each VMM and associated Virtual hosts are grouped within APIC vcenter DVS vcenter AVS SCVMM Called VMM Domain VMM Domain 1 VMM Domain 2 VMM Domain 3 There is 1:1 relationship between a Virtual Switch and VMM Domain 20

21 Hypervisor Integration with ACI F/W EPG WEB APIC Application Network Profile L/B EPG APP WEB PORT GROUP APP PORT GROUP DB PORT GROUP VM VM VM EPG DB ACI Fabric implements policy on Virtual Networks by mapping Endpoints to EPGs Endpoints in a Virtualised environment are represented as the vnics VMM applies network configuration by placement of vnics into Port Groups or VM Networks EPGs are exposed to the VMM as a 1:1 mapping to Port Groups or VM Networks 21

22 ACI Fabric Integrated Overlay Data Path - Encapsulation Normalisation IP Fabric Using VXLAN Tagging Normalised Encapsulation Any to Any VTEP VXLAN IP Payload Localised Encapsulation VXLAN VNID = Q VLAN 50 VXLAN VNID = All traffic within the ACI Fabric is encapsulated with an extended VXLAN header NVGRE VSID = 7456 External VLAN, VXLAN, NVGRE tags are mapped at ingress to an internal VXLAN tag Forwarding is not limited to, nor constrained within, the encapsulation type or encapsulation overlay network External identifies are localised to the Leaf or Leaf port, allowing re-use and/or translation if required Outer IP Outer IP 802.1Q NVGRE VXLAN Eth MAC Eth IP IP IP Eth IP Normalisation of Ingress Encapsulation Payload Payload Payload Payload Payload 22

23 Hypervisor Integration with ACI VMM Domains & VLAN Encapsulation 16M Virtual Networks VLAN ID only gives 4K EPGs (12 bits) Scale by creating pockets of 4K EPGs EP EP EP EP EP EP VMM Domain 1 4K EPGs EP EP EP EP EP EP VMM Domain 2 4K EPGs EP EP Map EPGs to VMM Domain based on scope of live migration Place VM anywhere Live migrate within VMM domain 23

24 Hypervisor Integration with ACI VMM Domains & VLAN Encapsulation 16M Virtual Networks VLAN ID only gives 4K EPGs (12 bits) Scale by creating pockets of 4K EPGs EP EP VLAN 5 VMM Domain 1 4K EPGs VNID 6032 EP VLAN 16 EP VMM Domain 2 4K EPGs Map EPGs to VMM Domain based on scope of live migration Place VM anywhere Live migrate within VMM domain 24

25 Hypervisor Integration with ACI Endpoint Discovery Virtual Endpoints are discovered for reachability & policy purposes via 2 methods: APIC Control Plane Learning: - Out-of-Band Handshake: vcenter APIs - Inband Handshake: OpFlexenabled Host (AVS, Hyper-V, etc.) Data Path Learning: Distributed switch learning Control (OpFlex) Data Path Data Path VMM Control (vcenter API) LLDP used to resolve Virtual host ID to attached port on leaf node (non-opflex Hosts) OpFlex Host DVS Host 25

26 Hypervisor Integration Agenda Hypervisor Integration Overview VMWare vcenter Integration Microsoft SCVMM & Azure Pack Integration OpenStack Integration 26

27 VMWare Integration Three Different Options Distributed Virtual Switch (DVS) vcenter + vshield Application Virtual Switch (AVS) + Encapsulations: VLAN Installation: Native VM discovery: LLDP Software/Licenses: vcenter with Enterprise+ License Encapsulations: VLAN, VXLAN Installation: Native VM discovery: LLDP Software/Licenses: vcenter with Enterprise+ License, vshield Manager with vshield License Encapsulations: VLAN, VXLAN Installation: VIB through VUM or Console VM discovery: OpFlex Software/Licenses: vcenter with Enterprise+ License 27

28 ACI Hypervisor Integration VMware DVS/vShield APIC 5 Create Application Policy F/W Application Network Profile EPG WEB L/B EPG APP EPG DB APIC Admin 9 Push Policy ACI Fabric 1 Cisco APIC and VMw are vcenter Initial Handshake 6 Automatically Map EPG To Port Groups 4 Learn location of ESX Host through LLDP 2 Create VDS VIRTUAL DISTRIBUTED SWITCH VI/Server Admin vcenter Server / vshield 8 Instantiate VMs, Assign to Port Groups 7 3 Create Port Groups Attach Hypervisor to VDS WEB PORT GROUP APP PORT GROUP DB PORT GROUP W eb App DB W eb W eb DB H YPER VISOR H YPER VISOR 28

29 ACI Hypervisor Integration VMware DVS Name of VMM Domain Type of vswitch (DVS or AVS) Associated Attachable Entity Profile (AEP) VLAN Pool vcenter Administrator Credentials vcenter server information 29

30 ACI Hypervisor Integration VMware DVS 30

31 Application Virtual Switch (AVS) Integration Overview OpFlex Control protocol - Control channel - VM attach/detach, link state notifications VEM extension to the fabric vsphere 5.0 and above BPDU Filter/BPDU Guard SPAN/ERSPAN Port level stats collection Remote Virtual Leaf Support (future) Southbound OpFlex API VM VM VM VM N1KV VEM Hypervisor Manager vsphere 31

32 ACI Hypervisor Integration AVS APIC 5 Create Application Policy F/W Application Network Profile EPG WEB L/B EPG APP EPG DB APIC Admin 9 Push Policy ACI Fabric 1 Cisco APIC and VMw are vcenter Initial Handshake 6 Automatically Map EPG To Port Groups 4 Learn location of ESX Host through OpFlex OpFlex Agent OpFlex Agent VI/Server Admin vcenter Server 8 Instantiate VMs, Assign to Port Groups Create AVS VDS Create Port Groups Attach Hypervisor to VDS Application Virtual Sw itch (AVS) WEB PORT GROUP APP PORT GROUP DB PORT GROUP W eb App H YPER VISOR DB W eb W eb DB H YPER VISOR 32

33 ACI Hypervisor Integration VMware DVS Name of VMM Domain Type of vswitch (DVS or AVS) Switching mode (FEX or Normal) Associated Attachable Entity Profile (AEP) VXLAN Pool Multicast Pool vcenter Administrator Credentials vcenter server information 33

34 ACI Hypervisor Integration VMware 34

35 Hypervisor Integration Agenda Hypervisor Integration Overview VMWare vcenter Integration Microsoft SCVMM & Azure Pack Integration OpenStack Integration 35

36 Microsoft Interaction with ACI Two modes of Operation Integration with SCVMM Integration with Azure Pack APIC APIC + Policy Management: Through APIC Software / License: Windows Server with HyperV, SCVMM VM Discovery: OpFlex Encapsulations: VLAN, NVGRE (Future) Plugin Installation: Manual Superset of SCVMM Policy Management: Through APIC or through Azure Pack Software / License: Windows Server with HyperV, SCVMM, Azure Pack (free) VM Discovery: OpFlex Encapsulations: VLAN, NVGRE (Future) Plugin Installation: Integrated 36

37 ACI Hypervisor Integration MSFT SCVMM APIC Admin SCVMM Admin APIC OpFlex Agent Hypervisor Virtual Switch APIC OpFlex Agent Q2 CY 15 WEB VM NETWORK APP VM NETWORK DB VM NETWORK WEB APP WEB APP DB MSFT SCVMM HYPERV ISOR HYPERV ISOR VIRTUAL Push Cisco Attach Learn Automatically Create Instantiate Policy APIC location Hypervisor Virtual Application VM VMs, Networks and Map Switch of MSFT Assign HyperV to EPG Policy Virtual SCVMM to To Host Switch Networks through Initial Handshake OpFlex

38 Cisco ACI: Microsoft Azure Pack Integration Q2 CY 15 Azure Pack GUI Policy Management: APIC / Azure Pack Websites, Apps, Database, VMs, ACI Provider Portal Consumer Self-Service Portal VM Discovery: OpFlex Websites VMs SQL Service Bus Future Services ACI PROVIDER SERVICE Encapsulation: VLAN in Q2 CY15 Microsoft System Center R2 w/ Service Provider Foundation OpFlex Driver (VXLAN, NVGRE in future) Zero touch network provisioning Service Insertion (Physical/ Virtual) ACI FABRIC

39 Hypervisor Integration Agenda Hypervisor Integration Overview VMWare vcenter Integration Microsoft SCVMM & Azure Pack Integration OpenStack Integration 39

40 OpenStack Components Initial Focus on Networking (Neutron) 40

41 OpenStack Neutron Networking Model Tenant Router Network: external Network Security Group Subnet Port Security Group Rule L3 + External Net Extension Core API Sec Grp Extension 41

42 Cisco ACI Model Tenant Outside Network App Profile Bridge Domain Context (VRF) Contract Subnet Subject Endpoint Group 42

43 Cisco OpenStack ACI Model Neutron API Mapping OpenStack Tenant No Equivalent Network Subnet Security Group Security Group Rule Router Network:External ACI Tenant Application Profile EPG + Bridge Domain Subnet Handled by Host Handled by Host L3 Context L3 Outside 43

44 ACI OpenStack Integration Phase 1 APIC 3 Create Application Policy APIC Admin (Performs Steps 3) 5 Push Policy ACI Fabric 2 Automatically Push Netw ork Profiles to APIC Create Netw ork, Subnet, Security Groups, Policy 1 NETWORK ROUTING SECURITY OPEN VIRTUAL SWITCH OPEN VIRTUAL SWITCH OPEN VIRTUAL SWITCH NEUTRON NOVA 4 W eb App W eb App DB W eb W eb DB OpenStack Tenant (Performs Steps 1,4) Instantiate VMs H YPER VISOR H YPER VISOR H YPER VISOR 44

45 Group-Based Policy in OpenStack GBP release Juno Messy mapping ACI to current OpenStack component Endpoint groups (ports + security groups) Contracts (security groups + security group rules) Goal: Introduce ACI model into OpenStack Starting with groups and group-based policies

46 ACI OpenStack Integration Phase 2 Create Application Netw ork Profile 1 F/W L/B Application Network Profile EPG WEB L/B EPG APP EPG DB NEUTRON NOVA 4 W eb App W eb App DB W eb W eb DB OpenStack Tenant (Performs step 1,4) Instantiate VMs H YPER VISOR H YPER VISOR H YPER VISOR 2 Automatically Push Netw ork Profiles to APIC APIC 3 Create Application Policy F/W L/B Application Network Profile EPG WEB L/B EPG APP EPG DB ACI Admin (manages physical netw ork, monitors tenant state) 5 Push Policy ACI Fabric

47 Layer 4-7 Services Integration

48 Agenda Challenges with Network Service Insertion Goals of ACI Services Insertion and Automation Key concepts and building blocks Services Insertion Configuration Wizard 48

49 Challenges with Network Service Insertion Router Configure Network to insert Firewall FW Configure firewall network parameters Service insertion takes days Router Switch vfw LB Configure firewall rules as required by the application Configure Load Balancer Network Parameters Configure Router to steer traffic to/from Load Balancer Network configuration is time consuming and error prone Difficult to track configuration on services servers Service Insertion In traditional Networks Configure Load Balancer as required by the application 49

50 Goals of ACI Service Insertion and Automation Configure and Manage VLAN allocation for service insertion Configure the network to redirect traffic through service device Configure network and service function parameters on service device

51 APIC Application Profile Application profile EXTERNAL Policy WEB Policy APP Policy DB APIC Policy Model Endpoint Group (EPG): Collection of similar End Points identifying a particular Application Tier. Endpoint could represent VMs, VNICs, IP, DNS name etc Application Profile: Collection of Endpoint Groups and the policies that define way Endpoint group communicate with each other 51

52 ACI Communication Abstraction Single Point of Orchestration Different administrative groups use same interface, high level of object sharing (APIC) Policy Contract Users Files All TCP/UDP: Accept UDP/ : Prioritise All Other: Drop Create Contracts Between Endpoint Groups Port-level rules: drop, prioritise, push to service chain; reusable templates ACI Fabric Enforce Ingress Fabric Rules Hardware rules on each port, security in depth, embedded QoS Single Pass Services Define Endpoint Groups Security administrator defines generic templates in APIC, availed to contract creation Service Graph Files Users Any endpoints anywhere within the fabric, virtual or physical

53 Application Policy db Contract APP Consumes MSSQL: Accept MySQL: Accept HTTP: Accept, Count Provides DB EPG - APP EPG - DB Contract Filter Named collection of L4 port ranges - HTTP = [80, 443] - MSSQL = [ ] - MySQL = [3306, 25565] - DNS = [53, 953, 1337, 5353] Action What action or actions to take on packet - Accept - Service Insert - Count - Copy (future sw release) 53

54 Network Service Insertion EXTERNAL Consumes Web Contract HTTP: Accept, Service Graph WEB Consumer Provider LB FW Contract provides a mechanism to add Network Services through associating a Service Graph A Service Graph identifies a set of network service functions required by an application APIC configures network service functions on devices like firewall, Load Balancers through a device packages A device package can be uploaded on APIC at run time Adding new network service support through device package does not require APIC reboot

55 Key Concepts in Service Insertion Concrete Device: it represents a service device, e.g. one load balancer, or one firewall Logical Device: represents a cluster of 2 devices that operate in active/standby mode for instance. Service Graph: defines a sequence of functions connected: e.g. a firewall from Checkpoint followed by a load balancing from F5. Logical Device Context: specifies upon which criteria a specific device in the inventory should be used to render a service graph Device Package: defines things such as how to label connectors for a function, and how to translate names from ACI to the specific device. E.g. a load balancer function has predefined connectors called: external internal management. 55

56 Service Insertion Architecture Device Package Configuration Model (XML File) Python Scripts Service functions are added to the APIC through a device package Device package contains a device model and device python scripts APIC APIC Policy Manager Configuration Model Device Model defines Service Function and Configuration Script Engine APIC Script Interface Python Scripts Device scripts translates APIC API callouts to device specific callouts Device Interface: REST/CLI Service Device Script can interface with the device using REST, SSH or any mechanism

57 Device Package Example Following functions can be configured through APIC 57

58 Device Information Extracted Out of Device Package Functions (Or Services) provided by the Service Device SLB, SSL, Responder Vendor Info, Software Version Info and Model Info of Service Device Info on how many interfaces types the appliance has (Inside, Outside and Mgmt for e.g.)

59 Register Service Devices with APIC Configure Management IP address on the device Create username/password for APIC to manage the device Attach the management interface to appropriate interface/port-group Register the device with APIC Provide IP address and Login credentials 59

60 Device Cluster Devices on APIC are registered as a cluster Cluster can contain one or more physical or virtual devices Devices within the cluster can be deployed in Active-Active or Active-Standby mode APIC configures Service Function using Cluster Mgmt IP and Login Credentials Logical Device (LDev): Represents a cluster Concrete Device (CDev): A Physical or Virtual Service Device -1 Concrete Device (CDev): A Physical or Virtual Service Device -N APIC can configure device specific feature ike (Port-channel configuration etc) using device s IP address and login credentials 60

61 Service Function Graph Functions rendered on the same device Service Graph: web-application Func: Firewall Func: SSL offload Func: Load Balancing Terminals Firewall params Permit ip tcp * dest-ip <vip> dest-port 80 Deny ip udp * Connectors SSL params Ipaddress <vip> port 80 Terminals Load-Balancing params virtual-ip <vip> port 80 Lb-aglorithm: round-robin 61

62 Create Service Graph 62

63 Configure Function Parameters 63

64 Service Insertion Application profile EXTERNAL Policy WEB Policy APP Policy DB Terminal: Input1 Terminal: Output1 Service Graph: WebGraph Service Graph: appgraph Func: Firewall Func: Load Balancer Func: Load Balancer 64

65 Associate Graph to a Contract 65

66 Example Graph 66

67 Services Insertion Configuration Wizard Three step process and each can be re-used 1 Create L4-L7 Service Devices 2 Create L4-L7 Service Graph Template 3 Apply L4-L7 Service Graph Template to EPGs

68 Create a L4-7 Service Devices Single Device Device Management IP Address and port Name of the device Specify Device Package to manage this Cluster Model of the device Policy domain Login Credentials to manage the device and connectivity information

69 Create a L4-7 Service Devices - HA This shows how Wizard will look if you select HA Cluster

70 Create a L4-7 Service Devices Device Package List of device package that APIC has will be shown here

71 Create a L4-7 Service Devices Model (Citrix) Associated interfaces on the device to interface labels Single device or cluster / HA

72 Create a L4-7 Service Devices Connectivity (Citrix) Management connectivity to the device

73 Create a L4-7 Service Devices Connectivity (Citrix) Device Parameter that is required.

74 Create a L4-7 Service Devices Connectivity (Citrix) Shows all the parameters

75 Create a L4-7 Service Graph Template Templates gives you option to choose simple Service Graph based on your requirement

76 Create a L4-7 Service Graph Template Single Node ADC Device Package gives you an option that you want to use for the particular Services Graph Profile will give the service graph all the parameters that is needed. E.g. SSL Users can also customise the profile. You can click on profile to see what parameters are available.

77 Apply L4-L7 Service Graph Template to EPGs EPG and Service Graph Template If you uncheck Allow All Traffic i.e. IP Any any or you can create your own specific filter entries

78 Apply L4-L7 Service Graph Template to EPGs

79 Q & A

80 Complete Your Online Session Evaluation Give us your feedback and receive a Cisco Live 2015 T-Shirt! Complete your Overall Event Survey and 5 Session Evaluations. Directly from your mobile device on the Cisco Live Mobile App By visiting the Cisco Live Mobile Site Visit any Cisco Live Internet Station located throughout the venue T-Shirts can be collected in the World of Solutions on Friday 20 March 12:00pm - 2:00pm Learn online with Cisco Live! Visit us online after the conference for full access to session videos and presentations.

81

82