White Paper. Huawei Campus Switches VXLAN Technology. White Paper

Transcription

1 White Paper Huawei Campus Switches VXLAN Technology White Paper

2 1 Terms Abbreviation VXLAN NVo3 BUM VNI VM VTEP SDN Full English Name Virtual Extensible Local Area Network Network Virtualization over L3 Broadcast, Unknown unicast and Multicast Virtual Network Instance Virtual Machine VXLAN Tunnel End Point Software Defined Networking 2 Abstract Virtual Extensible Local Area Network (VXLAN) is a Network Virtualization over L3 (NVo3) technology that is used for data center virtualization and is applied to multi-tenant access expansion and VM migration. VXLAN extends L2 networks with MAC-in-UDP encapsulation over L3 networks. Each L2 network is a VXLAN segment. VXLAN uses a 24-bit VXLAN Network Identifier (VNI) to identify a VXLAN segment, and supports a maximum of 16M VXLAN segments. 3 Background After servers are virtualized, a data center has multiple times more VMs than it previously had physical hosts, and the number of MAC addresses for virtual NICs of VMs also increases accordingly. This has a huge impact on the MAC address table of a single LSW switch. In large-scale data centers and public clouds, VLAN technology can no longer isolate tenants in data centers as required, because only 4094 VLAN IDs can be used. Moreover, VMs need to migrate within a certain area of a cloud data center while their IP and MAC addresses remain unchanged. This requires VMs to be migrated on a L2 network. If the destination physical server and VMs are not on the same network, the IP address and broadcast domains

3 of the destination network must be changed accordingly, which makes network configurations more complex. VXLAN is a tunnel encapsulation technology that enables large L2 network expansion. This technology is compliant with the RFC7348 standard, and is used as one of the mainstream network virtualization technologies. Figure 3-1 Server virtualization networking As shown in Figure 3-1, one server is virtualized into multiple VMs, each of which acts as a host. 4 Technology Overview VXLAN is an NVo3 technology that overlays L2 networks with L3 networks by encapsulating packets in the MAC in UDP format. The UDP packets serve as the tunnel, over which the original L2 data packets are transmitted as the payload. UDP encapsulation enables the payload data to be transmitted easily on a L3 network, extending L2 networks over L3 networks.

4 4.1 VXLAN packet format Figure 4-1 VXLAN packet format VXLAN header VXLAN tunnel original As shown in Figure 4-1, a VXLAN packet contains the outer encapsulation and inner original payload, with the following rules: Flags (8 bits): The I flag must be set to 1, and R flags must be set to 0. VXLAN Segment ID/VNI is a 24-bit virtual network identifier. Reserved fields (24 bits and 8 bits) must be set to 0. The destination port number of the VXLAN tunnel is 4789, which is configured for the VXLAN. VXLAN uses a 24-bit VNI to identify a virtual network. The VNI is twice as long as the 12-bit VLAN ID and supports a maximum of 16M virtual networks. 4.2 VTEP In VXLAN standards, virtual tunnel end point (VTEP), a logical entity, is used for VXLAN packet encapsulation and decapsulation. A VTEP connects to a physical network and is assigned a physical network IP address. This IP address is unrelated to virtual networks. A VTEP can be implemented with software or hardware. Specifically, it can be deployed on a vserver or a physical switch.

5 Figure 4-2 VXLAN networking 4.3 Known Unicast Traffic Forwarding Process Figure 4-3 Known unicast traffic forwarding process IP Network 1. When LSW1 receives a packet from host H1, it obtains the L2 broadcast domain of the host using the inbound interface and VLAN ID, and determines whether the destination MAC address is a known unicast MAC address. If it is, LSW1 forwards the packet following the known unicast traffic forwarding process. Otherwise, LSW1 follows the broadcast, unknown unicast, and multicast (BUM) traffic forwarding process. 2. To forward the known unicast packet, the VTEP on LSW1 encapsulates the packet into a VXLAN packet based on the VNI and remote VTEP address found in the local forwarding table. The VXLAN packet is then forwarded over the IP network between LSW1 and LSW2.

6 3. After the VTEP on LSW2 receives the VXLAN packet, it determines its validity by verifying its UDP destination port number, source and destination IP addresses, and VNI. The VTEP obtains the L2 broadcast domain based on the VNI, and then decapsulates the VXLAN packet to obtain the original L2 packet. 4. LSW2 looks up the outbound interface and encapsulation information in its MAC address table based on the destination MAC address of the L2 packet, adds a VLAN tag to the packet, and then forwards the packet to host H VXLAN BUM Traffic Forwarding Figure 4-4 VXLAN BUM traffic forwarding IP Network 1. When LSW1 receives a packet from host H1, it obtains the L2 broadcast domain of the host using the inbound interface and VLAN ID, and determines whether the destination MAC address is a BUM MAC address. If it is, LSW1 forwards the packet following the BUM traffic forwarding process. Otherwise, LSW1 follows the known unicast traffic forwarding process.

7 2. If LSW1 determines that the packet is a BUM packet, the VTEP on LSW1 obtains the ingress replication list for the VNI based on the L2 broadcast domain. The VTEP then replicates the packet based on the list, encapsulates the packet into a VXLAN packet, and forwards the packet through the outbound interface. 3. After the VTEP on LSW2/LSW3 receives the VXLAN packet, it determines its validity by verifying its UDP destination port number, source and destination IP addresses, and VNI. The VTEP obtains the L2 broadcast domain based on the VNI, and then decapsulates the VXLAN packet to obtain the original L2 packet. 4. LSW2/LSW3 forwards the original L2 packet based on its MAC address table. If the destination MAC address of the packet matches a MAC address entry, the switch encapsulates and forwards the packet through the outbound interface in the MAC address entry. If the destination MAC address matches no MAC address entry, the switch broadcasts the packet to user-side interfaces. BUM packets received from a VXLAN tunnel can only be broadcast to user-side interfaces and cannot be broadcast to the VXLAN tunnel, as this will cause a loop. 4.5 Benefits of VXLAN Technology When server virtualization is widely deployed in data centers based on physical network infrastructure, VXLAN offers the following benefits: 1. Supports up to 16M VXLAN segments with 24-bit VXLAN VNIs, allowing a data center to accommodate numerous tenants. 2. Reduces the number of MAC addresses that network devices need to learn and enhances network performance because only devices at the edge of the VXLAN network need to identify VM MAC addresses. 3. Extends L2 networks using MAC-in-UDP encapsulation and decouples physical and virtual networks. Tenants are able to plan their own virtual networks, without being limited by the physical network IP addresses or broadcast domains. In this way, cloud data centers have more flexible networking and allow easier network expansion, greatly simplifying network management.

8 5 Solution 5.1 Networking Model Currently, switches can establish a VXLAN network with or without a controller. Single-node mode: In the traditional network deployment node, you need to log in to each device to configure the devices according to the network plan. In cloud computing data centers, this mode cannot collaborate with cloud platforms in automatic network deployment. Controller mode: The controller is introduced to facilitate control and deployment on large L2 networks. A controller is a unified network control platform that orchestrates and manages network resources and functions with the cloud platform to implement automated service and network provisioning. In SDN solutions, controllers are used to deploy VXLAN networks. Figure 5-1 Networking of the AC controller + VXLAN solution Cloud platform Network controller Server Infrastructure network

9 Cloud platform: Schedules network resources, computing resources, and storage resources as per demand and provides the service management and operation and maintenance (O&M) pages. As a component of the cloud platform, Neutron provides network services. Network controller: Implements network modeling and network instantiation. The AC controller uses RESTful interfaces to receive network modeling configuration from the cloud platform and convert the configurations into related commands, and uses the NETCONF protocol to establish channels with and deliver commands to network devices in the infrastructure layer. Infrastructure network: Physical and virtual networks are uniformly planned. This layer improves service performance with the hardware VXLAN gateway, and is compatible with traditional VLANs. 5.2 VXLAN L2 Gateway Figure 5-2 VXLAN L2 gateway DIP: SIP: UDP D_P:4789 UDP S_P: HASH VXLAN VNI 200 DMAC: MAC1 SMAC: MAC2 VLAN TAG: 100 DMAC: MAC1 SMAC: MAC2 OVS VXLAN VNI 200 VTEP: VXLAN L2 GW PC 1 MAC 1 VLAN 100 DMAC: MAC2 SMAC: MAC1 VLAN TAG: 100 TOR1 VXLAN VNI 200 VTEP: DIP: SIP: VM2 MAC 2 VXLAN VNI 200 UDP D_P:4789 UDP S_P: HASH VXLAN VNI 200 DMAC: MAC2 SMAC: MAC1 VXLAN L2 gateways are used for communication between traditional Ethernet networks and VXLANs. As shown in Figure 5-2, the working process of the VXLAN L2 gateway is as follows:

10 1. When the VXLAN L2 gateway receives an Ethernet packet from a traditional network, it determines the L2 broadcast domain of the packet based on the access interface and VLAN information carried in the packet. The gateway then looks up the outbound interface and encapsulation information from the MAC table, performs VXLAN encapsulation accordingly, and forwards the packet. By default, the VXLAN L2 gateway removes the VLAN tag from the original L2 header, and adds VXLAN encapsulation with VNI in the VXLAN header, VXLAN UDP header, VXLAN tunnel header (DIP/SIP), and outer L2 header. After the packet is encapsulated, the VXLAN L2 gateway looks up the routing table to forward the packet based on the DIP in the VXLAN tunnel header. 2. After the VXLAN L2 gateway receives the VXLAN packet, it looks up the VXLAN tunnel table to determine the packet's validity by verifying its UDP destination port number, VXLAN source and destination IP addresses, and VNI. The L2 gateway obtains the L2 broadcast domain based on the VNI, decapsulates the VXLAN packet to obtain the original L2 packet, and forwards the packet based on the destination MAC address. 5.3 Centralized VXLAN L3 gateway Figure 5-3 VXLAN L3 gateway VTEP IP: IP: VNI:1000 VXLAN L3 GW IP: VNI:2000 VTEP IP: VXLAN L2 GW VxLAN IP NetWork VxLAN VTEP IP: VXLAN L2 GW H3 H1 IP: VNI:1000 H2 IP: VNI:2000

11 The VXLAN L3 gateway is used to implement communication between VXLAN networks on different network segments and between VXLAN and non-vxlan networks on different network segments. As shown in Figure 5-3, H1 and H3 are on two VXLAN networks, and communicate with each other through the VXLAN L3 gateway. The working process of the VXLAN L3 gateway is as follows: 1. After receiving a VXLAN packet, the L3 gateway decapsulates the packet to obtain the original L2 packet. Because the destination MAC address of the L2 packet is the MAC address of the L3 gateway, the L3 gateway starts the L3 forwarding process. The L3 gateway looks up the routing table to forward the packet based on its destination IP address. 2. The L3 gateway obtains the next-hop IP address from the route found in the routing table, and then looks up the ARP entry of this IP address. If the outbound interface in the ARP entry is a VXLAN tunnel, the L3 gateway encapsulates the packet based on the VXLAN tunnel information in the ARP entry, and then sends the packet out. 6 Typical Application 6.1 Communication Between Terminals on the Same Network Segment As data centers accelerate information transmission based on the Internet infrastructure, enterprises and carriers are dedicating significant resources to data center construction. Large-scale deployment, virtualization, and cloud computing are commonplace in the construction of data centers. In addition, an increasing number of data centers are using Layer 2 network and virtualization technologies to support more services while reducing maintenance costs. Currently, there is rapid development of server virtualization technology being applied to physical network infrastructure of data centers. VXLAN, a highly adaptive NVo3 technology, provides a proper virtualization solution for data centers. On the network shown in Figure 6-1, an enterprise has VMs that are deployed in different data centers and reside on the same network segment. The VMs need to communicate with each other across data centers.

12 Figure 6-1 Networking for communication between terminal users on the same network segment Feature Deployment: As shown in Figure 6-1, deploy switches as VXLAN Layer 2 gateways and establish a VXLAN tunnel between the switches to implement communication between VMs on the same network segment. 1. Control channels are set up between the controller and switches through the NETCONF protocol. 2. The administrator uses the NETCONF protocol to configure VXLAN on the controller. 3. The forwarders function as VXLAN Layer 2 gateways and establish a VXLAN tunnel based on received information. 4. The VXLAN Layer 2 gateways forward data packets over the VXLAN tunnel based on MAC entries. In this way, users (VMs) on the same network segment can communicate with each other.

13 6.2 Communication Between Terminals on Different Network Segments On the network shown in Figure 6-2, an enterprise has VMs that are deployed in different data centers and reside on different network segments. The VMs need to communicate with each other across data centers. Figure 6-2 Networking for communication between terminal users on different network segments Feature Deployment: As shown in Figure 6-2, deploy Switch_3 as a VXLAN Layer 3 gateway and other switches as VXLAN Layer 2 gateways and establish VXLAN tunnels between the switches, to implement communication between terminal users on different network segments. 1. Control channels are set up between the controller and switches through the NETCONF protocol. 2. The administrator uses the NETCONF protocol to configure VXLAN on the controller. 3. The forwarders Switch_1 and Switch_2 function as VXLAN Layer 2 gateways and establish VXLAN tunnels with Switch_3 based on received information. The forwarder Switch_3 functions as a VXLAN Layer 3 gateway based on received information. 4. On the controller, the administrator creates Layer 3 VBDIF interfaces for the VXLAN Layer 3 gateway, and configures IP addresses for the VBDIF interfaces.

14 6.3 VM Migration Enterprises configure server virtualization on data center networks to consolidate IT resources, improve efficiency of resource usage, and reduce network costs. With the wide deployment of server virtualization, an increasing number of VMs are running on physical servers and many applications are running in virtual environments, which pose great challenges on virtual networks. As shown in Figure 6-3, an enterprise has two clusters in its data center. Cluster1 serves the engineering and finance departments, and Cluster2 serves the marketing department. The computing resources on Cluster1 are inadequate, whereas computing resources on Cluster2 are not fully utilized. The network administrator wants to migrate the engineering department to Cluster2 without affecting services. Figure 6-3 Department distribution Feature Deployment: To ensure uninterrupted services during the migration of the engineering department, the IP and MAC addresses of the engineering department must remain unchanged. This requires the two clusters to belong to the same Layer 2 network. If conventional migration methods are used, the administrator may have to purchase additional physical devices to distribute traffic and reconfigure VLANs. These methods may also result in network loops and additional system and management costs.

15 VXLAN, a network virtualization technology that uses MAC-in-UDP encapsulation, can be used to migrate the engineering department to Cluster2. This technology can establish a large Layer 2 network connecting terminal users with reachable IP routes, as long as the physical network supports IP forwarding. 1. Control channels are set up between the controller and switches through the NETCONF protocol. 2. The administrator uses the NETCONF protocol to configure VXLAN on the controller. 3. The forwarders function as VXLAN Layer 3 gateways and establish a VXLAN tunnel based on received information. 4. The engineering department is migrated to Cluster2 through the VXLAN tunnel and VXLAN Layer 3 gateways. Online users are unaware of the migration. The migration process of the engineering department is as follows: 1. The engineering department is migrated from Cluster1 to Cluster2. 2. After migration, the VMs of the engineering department send gratuitous ARP or Reverse Address Resolution Protocol (RARP) packets to notify Switch_2 and other devices of the migration event. 3. Switch_2 and Switch_1 receive the packets and replace the existing MAC address table with the new MAC address table of the post-migrated VMs. 4. Switch_3 receives the packets and replaces existing MAC address and ARP tables with new MAC address and ARP tables of the post-migrated VMs. The engineering department is migrated to Cluster2 through the VXLAN tunnel. Online users are unaware of the migration. After the engineering department is migrated from Cluster1 to Cluster2, terminal tenants send gratuitous ARP or RARP packets to update all gateways' MAC addresses and ARP entries of the original VMs to those of the post-migrated VMs.

16 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademark Notice, HUAWEI, and are trademarks or registered trademarks of Huawei Technologies Co., Ltd. Other trademarks, product, service and company names mentioned are the property of their respective owners. General Disclaimer The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice. HUAWEI TECHNOLOGIES CO.,LTD. Huawei Industrial Base Bantian Longgang Shenzhen ,P.R.China Tel: