Service Insertion with ACI using F5 iworkflow

Transcription

1 Service Insertion with ACI using F5 iworkflow Gert Wolfis F5 EMEA Cloud SE October 2016

2 Agenda F5 and Cisco ACI Joint Solution Cisco ACI L4 L7 Service Insertion Overview F5 and Cisco ACI Integration Models F5 BIG-IP Integrate with Cisco ACI as Unmanaged Device F5 iworkflow and Cisco ACI Integration Update

3 F5 and Cisco ACI Joint Solution

4 Applications Deployment is Difficult Traditional Network Service Insertion Challenges Router Configure Network to insert Firewall User FW Configure firewall rules as required by the application Service insertion takes days vfw Router Switch LB Configure Router to steer traffic to/from Load Balancer Configure Load Balancer as required by the application Configure Switches for L2 connectivity Network configuration is time consuming and error prone Difficult to track configuration on services Service Insertion In traditional Networks Configure vfw to protect Virtualized App Tier F5 Networks, Inc 4

5 How does ACI accelerate Application Deployments? Application Centric Infrastructure Building Blocks Traditional 3-Tier Application APPLICATION NETWORK PROFILE FW ADC WEB ACC APP DB Virtual Edition Appliance Chassis CONTROLLER POLICY MODEL NEXUS 9300 AND 9500 F5 BIG-IP Building blocks of ACI Policy Model Extended to L4-L7 Application 3 tier application (WEB-APP-DB) This may use ADC, FW services End point Group (EPG) Grouping of application Components Policy model Define QOS, Security, Network, L4-L7 etc. to be applied to EPG F5 Networks, Inc 5

6 What does L4-L7 Services in ACI mean? Moving ADC parameters from vendor device to ACI is not the solution! F5 Networks, Inc 6

7 Cisco ACI L4 L7 Service Insertion Overview

8 F5 and Cisco ACI Joint Benefits Automated L4-L7 application service insertion F5 DEVICE PACKAGE FOR APIC Preserves richness of F5 Synthesis offering. Ease of integration due to rich programmability Accelerated application deployments with scalable L4-L7 services ACI Fabric Existing F5 Physical and Virtual appliances, topologies integrate seamlessly with Cisco ACI Application agility & significant reduction in operating costs Programmability (irules / iapps / icontrol) Data Plane Control Plane Management Plane F5 Synthesis Fabric Maintains operational best practices & offers faster provisioning of workflows Virtual Edition Appliance Chassis

9 ACI Service Automation thru Device Package F5 Device Package Device Package contains Configuration Model (XML File) Python Scripts Script Engine APIC Script Interface Python Scripts APIC Script Interface Policy Engine APIC Policy Manager Configuration Model (XML File) APIC provides extendable policy model through Device Package Device Package contains XML file defining Device Configuration Model Provider Administrator can upload a Device Package Device scripts translates APIC API callouts to device specific callouts BIG-IP F5 has rich programmability foundation - easier to integrate with Cisco APIC F5 Networks, Inc 9

10 Application Construct F5 Service Insertion Consume Provide Web Farm provide services to External Users; Policy Contract defines relationship between Web Farm and Users EPG EXT Ext Users EPG WEB Web Server Users assign to EPG EXT Web Farm assign to EPG WEB Users accessing the Web Servers start stage 1.. stage N end graph Service Graph Insertion at the Policy Contract Subject level inst inst. inst inst Node Service Graph contains Function Nodes, Virtual Server is a Function Node firewall ADC: Virtual Server Logical Device Cluster Concrete Device Concrete Device F5 BIG-IPs are Concrete Devices belong to a Logical Device Cluster that enables ADC as a Function Node within a Service Graph F5 Networks, Inc 11

11 F5 and Cisco ACI Integration Models

12 F5 and Cisco ACI Integration Models BIG-IP NOT managed by APIC iworkflow BIG-IP ACI Fabric Virtual Edition Appliance Chassis BIG-IP OPTION A1 EPG mode NOT using service graph OPTION B Service Insertion using F5 Static device package OPTION A2 Unmanaged mode USING service graph OPTION C Service Insertion using F5 iworkflow Dynamic device package *-F5 direction for Cisco ACI L4-L7 Service Insertion F5 Networks, Inc 13

13 F5 BIG-IP Integrate with Cisco ACI as Unmanaged Device

14 F5 and Cisco ACI Integration Models BIG-IP NOT managed by APIC iworkflow BIG-IP ACI Fabric Virtual Edition Appliance Chassis BIG-IP OPTION A1 EPG mode NOT using service graph OPTION A2 Unmanaged mode USING service graph OPTION B EPG/Unmanaged Mode (Option A1 and A2) Service Insertion using F5 Static device package Define connectivity to ACI Fabric No Service Insertion No device package OPTION C Service BIG-IP Insertion device is using not provisioned/managed F5 iworkflow Dynamic through device APIC package F5 Networks, Inc 15

15 Difference between EPG and Unmanaged Mode EPG Mode (Option A1) No service graph representation Manual binding of VLAN s, binding contracts to EPG s Manual configuration to steer traffic One Application tier -> Chain of L4-L7 service devices -> To another application tier Unmanaged Mode (Option A2) Service graph representation Automatic binding of VLAN s and contracts Automatically steer traffic One application tier -> Chain of L4-L7 service devices -> To another application tier EPG C1 C2 EPG EPG CONTRACT EPG Service Graph EPG Mode (2 Contracts ) Unmanaged Mode (1 Contract ) F5 Networks, Inc 16

16 Why Choose Option A (EPG / Unmanaged)? ACI deployment in phases, L4-L7 integration at later time Attached F5 BIG-IP as you do today, continue with existing model No feature parity ACI goes into production tomorrow, just thought of L4-L7 today What am I missing out not using ACI service insertion? L4-L7 Automation and Orchestration: agility and consistency Automatic service chaining and VLAN management Dynamic endpoints attach and detach End-to-end L2-L7 application requirements build into ACI policy Not taking full advantage of SDN programmability potential Business as usual: highly complex and error prone F5 Networks, Inc 17

17 F5 iworkflow and Cisco ACI Integration Update

18 F5 and Cisco ACI Integration Models BIG-IP NOT managed by APIC iworkflow BIG-IP ACI Fabric Virtual Edition Appliance Chassis BIG-IP OPTION A1 EPG mode NOT using service graph OPTION B Service Insertion using F5 Static device package OPTION A2 Unmanaged mode USING service graph OPTION C Service Insertion using F5 iworkflow Dynamic device package *-F5 direction for Cisco ACI L4-L7 Service Insertion F5 Networks, Inc 19

19 Differences - Option B and Option C Option B F5 Static device package Obtained from Fixed set of BIG-IP parameters configurable Does not support adding more feature functionality on BIG-IP than present in basic load balancing device package Option C F5 Dynamic device package Generated from the F5 iworkflow Customized set of BIG-IP parameters configurable Through the iapps there is support to add as many features to the BIG-IP as the iapps can support Not based on iapps templates LTM module support Based on iapps templates LTM/ASM/AFM/APM modules can be supported F5 Networks, Inc 20

20 F5 iworkflow with Cisco ACI Dynamic Device Package for ACI L4-L7 Service Insertion True alignment in Cisco ACI vision, where application requirements are built into ACI L4-L7 service functions Using F5 iworkflow and iapps technologies, administrators can customize L4-L7 parameters exposed into ACI ACI L4-L7 service insertion benefits: dynamic VLAN management, automatic traffic redirection, dynamic endpoints attach/detach Highly programmable solution that focus on workflow automation and orchestration iworkflow iapps F5 Networks, Inc 21

21 iapps Automated Deployments

22 What are iapps? An iapps is an application-centric configuration template: User answers a few questions about deploying an application iapps translates answers into a set of configuration options iapps can touch almost all BIG-IP functionality irules, profiles, monitors, security policies, and much more There are many F5-provided iapps: HTTP, Sharepoint, Exchange, VMware View, Users can build their own iapps F5 Networks, Inc 23

23 SDAS: Application Based Networking Object Based Networking VIRTUAL EXCHANGE POOLS ORACLE MONITORS PROFILES POLICES irules SERVERS VS Pool OWA Monitor ftp Profile OWA Accel HTTP Redirect vpn VS vpn Pool HTTP Monitor 1 HTTP Profile 1 SSO OWA Append intra VS intra Pool HTTP Monitor 1 HTTP Profile 2 intra sccess Weak Encrypt Redirect.com VS.www VS Oracle Monitor ftp Profile Content Type Redirect POP3 Monitor SSL Profile 1 HTTP Throttle SSL Profile 2 F5 Networks, Inc 24

24 iworkflow creates a catalog of iapp Templates ORACLE EXCHANGE vpn VS Auto generated.com VS intra VS vpn Pool Auto generated iworkflow www Pool Data Centers intra Pool Oracle Monitor SSL Profile 2 Auto generated Auto generated HTTP Monitor 1 HTTP Profile 1 HTTP Profile 2 Private or Public Cloud HTTP Profile 2 Weak Encrypt Redirect Auto generated Content Type Redirect ftp Profile Auto generated intra access Auto generated HTTP Throttle Auto generated Auto generated Auto generated F5 Networks, Inc 25

25 iworkflow creates a catalog of iapp Templates (2) F5 Networks, Inc 26

26 iapps provide different values depending on Application and Organization. A Single View App Manage all application components in one place. An Easy Button Use F5-developed iapps to rapidly deploy popular applications with verified and supported configurations. An App Lifecycle Tool Unlike other template/wizard strategies, iapps are fully reentrant, can manage the full lifecycle of the application. App Orchestration Standardize your unique application deployments using iapps, icontrol and iworkflow. Standards Enforcement iapps with strict updates, enforce standards, reducing training and operational risk. F5 Networks, Inc 27

27 iworkflow in Practise

28 Deploy F5 iworkflow Dynamic Device Package in ACI 1. Import iapps template into BIG-IP 2. BIG-IP expose iapps to iworkflow during device discovery by iworkflow 3. In iworkflow Cloud Catalog, Admin create application template based on iapps 4. iworkflow create custom device package based on Catalog 5. Admin import BIG-IQ device package to APIC 6. When graph is deployed, APIC sends iapps config to iworkflow, iworkflow deploy iapps virtual server on BIG-IP F5 iapps Config {'state': 1, 'transaction': 0, 'ackedstate': 0, 'value': {(5, 'DestinationNetmask', 'Netmask1'): {'state': 1, 'transaction': 0, 'ackedstate': 0, 'value': ' '}, (5, 'DestinationPort', 'port1'): {'state': 1, 'transaction': 0, 'ackedstate': 0, 'value': '80' Dynamic Device Package ACI Fabric Virtual Edition Appliance Chassis F5 Synthesis Fabric F5 Networks, Inc 29

29 F5 iworkflow Device Package Supported Features Operational Supports any BIG-IP physical and virtual form factor running Does not require any new module installation on the BIG-IP BIG-IP is licensed and OOB management configured prior to APIC integration Supports BIG-IP Active / Standby High Availability model per APIC logical device cluster Features Chassis Manager - vcmp (Virtualized Clustered Multiprocessing) HA Pre-requisite: vcmp guests already deployed Allow user to specify unique vcmp host for each vcmp guest vcmp guests - Active / Standby Supports Dynamic endpoint attach and detach notifications True multi- tenancy Tenant + VRF on ACI => Partition + Route Domain on BIG-IP Service Graph on ACI => Virtual Server on the BIG-IP Device Package dynamically generated by iworkflow Device Manager F5 iworkflow HA Pre-requisite: iworkflow already in HA (Active/Active/Active) Allow user to specify 3 iworkflow through APIC Support iworkflow validated workflows using iapps F5 Networks, Inc 30

30 iworkflow HA Device Manager Workflow 1 Create Device Manager Type 2 Create Device Manager 3 Associate Device Manager to Cluster inside LDev Cluster F5 Networks, Inc 31

31 Deploy F5 Virtual Server using iapps in ACI using iworkflow True Application Centric Approach align with Cisco ACI Vision F5 iworkflow can templatize F5 Virtual Server configuration using iapps based on Application specific requirements F5 Virtual Server Template is shown in ACI as L4-L7 Service Function, only Tenant Editable parameters are exposed in ACI Full Feature F5 Virtual Server deployed in BIG-IP thru ACI by iworkflow that based on application specific requirements iworkflow Cisco ACI F5 BIG-IP Custom Default F5 Default Tenant Editable F5 iworkflow focus on Workflow Automation in Applications Deployment F5 Networks, Inc 32

32 F5 supports TRUE Multiple Graph Multiple Tenancy Multiple Virtual Servers for different applications in the different BIG-IP partitions/apic Tenants, sharing the same device Tenant N APIC partition: apic7890 Route Domain N Partition created by APIC inside BIG-IP is prefixed by the apic, _ tenant-id to represent the partition in F5 (for ex : apic_5437) F5 demonstrate true multi-tenancy using different partitions for each tenant in APIC Each partition has been assigned individual route domain for L3 separation Tenant B Tenant A Client EPG Client EPG Client EPG APIC partition: Virtual apic2345 Server 1 Route Domain B Virtual APIC partition: Virtual Server Server 1 2 apic1234 Route Domain A Virtual Server Virtual 1 Server 2 App EPG 1 App App EPG 1 EPG 2 App App EPG 1 EPG 2 Virtual Servers created by APIC inside BIG-IP is prefixed by the apic, _ tenant_id _ graph (for ex : apic_5437_3456) Virtual Server 2 App EPG 2 Single BIG-IP physical F5 Networks, Inc 33

33

34 F5 iworkflow Software Compatibility Matrix F5 iworkflow F5 BIG-IP Release Compatibility Supported Supported HF6 Supported HF1 Supported HF2 Supported Cisco APIC Release 1.2(3h) Compatibility Supported F5 Networks, Inc 35