Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Transcription

1 NET2415BU Utilizing NSX load balancing for scalability, reliability, and security: Overview, best practices, and customer case study Luke Hoffer Sr. Systems Engineer, VMware Rush Maniar Sr. Product Manger, VMware Luke Sipple IT Engineering Manager, Self Esteem Brands LLC #VMworld #NET2415BU

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. 2

3 Agenda 1 Load balancing overview 2 NSX load balancing for scalability 3 NSX load balancing for availability 4 NSX load balancing as a security layer 5 Customer case study: SE Brands, LLC 3

4 IT Challenges AVAILABILITY SCALIBILITY SECURITY 4

5 Increasing Demands Being Placed on IT Today 5

6 Evolution of Server Load Balancing Form Factors 1996 OS-based Server Load Balancing 1997 Physical Server Load Balancer (SLB) 2006 Virtual Contexts 2010 Virtual Appliances NSX Logical Load Balancing 2013 SLB integrated into Network Platform 6

7 What Is SLB? Client 1 Client 2 Client Client 1 Server 3 Client 2 Server 4 Persistence Table Active SLB VIP Server Standby SLB Server 1 Server 2 Server 3 Server 4 Server 5 Server Pool A Server Pool B 7

8 The Emerging SLB Deployments (Hardware vs Software LB) Application 1 WAN NSX SLB NSX SLB Application 2 NSX SLB Per-application SLB (vs. per environment) Scale-out model (vs. scale-up) Low costs and/or usage-based pricing Ops intelligence into application Application 3 Automation 8

9 What Does NSX LB Do? Edge Load Balancer NSX Edge VMworld 2017 web-01 web-02 app-01 app-02 db-01 Server Load Balancing High Speed L4 Load Balancing L7 Load Balancing and Manipulation ADC Features SSL Offload TCP Multiplexing Automation Content: Not for publication Inbuilt Programming Support vra and Openstack Integrated Integration with 3rd party Load Balancer 9

10 NSX Load Balancer Customers Momentum

11 NSX Load Balancer Customers Momentum Service Providers Global Financials Retail Healthcare Integrators Media & Communications Transportation Government Education 11

12 Why Customers Are Deploying NSX Logical Load Balancer? NSX LB Benefits VMworld 2017 Simple licensing model Better capacity planning Automation Content: Not for publication Speed up of delivery It s part of NSX Platform Reducing capex cost 12

13 NSX LB Vision: Driving NSX Everywhere Internet of things On-premises data center Service Provider /Partners Public clouds Virtual Desktop (VDI) New app frameworks or distribution Mobile devices Availability Delivering high availability for applications Scalability Providing scalability of applications Security Inherently Secure Infrastructure 13

14 NSX LB Main Ingredient: Edge Services Gateway VPN Form Factor vcpu RAM GB VIPs per ESG Pools per ESG Servers per Pool Compact Large Quad-Large X-Large

15 Inline (Transparent) Deployment Topology Client Address Virtual Server Address VM 1 Address VM 2 Address VM 3 Address

16 One-Armed (Proxy) Deployment Topology Client Address Virtual Server Address VM 1 Address VM 2 Address VM 3 Address

17 Agenda 1 Load balancing overview 2 NSX load balancing for scalability 3 NSX load balancing for availability 4 NSX load balancing as a security layer 5 Customer case study: SE Brands, LLC 17

18 Requirement 1: Distribute Connections to Multiple Servers Response Time!!! Overload!!! Concurrent Connections 18

19 Solution: Configure Algorithm on Server Pool VMworld 2017 ROUND-ROBIN Each server is used in turn according to the assigned weight. LEASTCONN All traffic from a specific client IP address routed to the same server. Hashing Content: Not for publication IP-HASH: Selects server based on hash of source IP. URI/URL: Hash of URI/URL respectively as defined in algorithm parameters. HTTPHEADER: Hash of HTTP header item specified in algorithm parameters. 19

20 Requirement 2: Session Persistence Client A Client B Client C Persistence Table Client A VM 1 Client B VM 2 Client C VM 3 VM 1 VM 2 VM 3 20

21 Solution: Define Persistence Method in Application Profile VMworld 2017 Content: Not for Cookie Based Insert: New cookie is added to client session in addition to those sent by the server. Prefix: Edge adds its cookie info to the cookie sent by the server (and removes for return traffic prior to sending to the server). Use when client can t support multiple cookies. App Session: Edge looks for session ID in the URL. i.e abcd where xsessionid is the session ID. publication Source IP All traffic from a specific client IP address routed to the same server. 21

22 Agenda 1 Load balancing overview 2 NSX load balancing for scalability 3 NSX load balancing for availability 4 NSX load balancing as a security layer 5 Customer case study: SE Brands, LLC 22

23 Requirement: Application Monitoring/Availability VM 1 VM 2 VM 3 23

24 Solution: Define/Assign Service Monitors to Pool VMworld 2017 Content: Not for Service Monitors available ICMP: Pings pool members and marks down if no ICMP echo after specified number of retries. TCP/UDP: Attempts to open a connection on the specified socket with option to send/receive configured string and/or TCP extensions once connection is established. publication HTTP/S: Sends HTTP/S get requests to pool members and looks for 200 OK response. Can optionally specify URL, alternate HTTP methods, and/or expected response codes other than 200 OK. 24

25 Agenda 1 Load balancing overview 2 NSX load balancing for scalability 3 NSX load balancing for availability 4 NSX load balancing as a security layer 5 Customer case study: SE Brands, LLC 6 Product roadmap update with VMware Product Management 25

26 Requirement: Stop Some of the Bad Stuff that My Firewall Can t!!! Slowloris, Brute Force, etc. Reconnaissance Apps/Infrastructure unable to support TLS VM 1 VM 2 VM 3 26

27 SSL Offloading Part 1: Install/Assign Certificate VMworld 2017 Content: Not for Install Certificate on ESG Manage > Settings > Certificates to add existing certificate or Actions to generate CSR and import. Assign certificate to app profile publication Optionally specify cipher and/or client authentication 27

28 SSL Offloading Part 2: Create Virtual Server TLS Encrypted Virtual Server creation Select Previously created app profile Select HTTPS protocol Specify standard HTTP pool Plain old HTTP 28

29 Server Masking: Application Rule Applied to Virtual Server Server: SuperSecret VMworld 2017 Content: Not for Create application rule Select Previously created application rule from advanced tab. Virtual Server creation Select Previously created application rule from advanced tab. publication 29

30 Filter on UserAgent: Application Rule Applied to Virtual Server 30

31 Other Security Application Rule Examples Rule tcp-request content reject if!http acl Brute_Force fe_sess_rate ge 5 tcp-request connection reject if Brute_Force VMworld 2017 acl Naughty_IP src tcp-request connection reject if Naughty_IP Description Deny requests on the virtual server that are not HTTP (i.e. other protocols attempting to use port 80, etc.) Deny requests from clients sending more than 5 connections per second to the Virtual Server Content: Not for publication Deny requests from

32 Agenda 1 Load balancing overview 2 NSX load balancing for scalability 3 NSX load balancing for reliability 4 NSX load balancing as a security layer 5 Customer case study: SE Brands, LLC 32

33 Customer case study Luke Sipple IT Engineering Manager

34 From old school to SDDC in 18 months We are in a bad place. Let s re-architect the entire infrastructure. Ready, Go! Drivers for the project: DDoS misfires Full rack No control and slow response to change requests Weekend trips to the data center Physical SQL servers Goals for the project: OpEx No physical hands-on Scalability Enhanced security! CONFIDENTIAL 34

35 Our environment Started on NSX 6.2 in mid-2015 in a Rackspace greenfield environment Went full production on in October 2016 Now on NSX in two production environments and one development environment production VMs, not counting NSX Our API pool: Average of 10K requests per minute 22K peak Our ClubHub pool: Average of 12.5K RPM 17.5K peak SQL cluster handles 40 million statements per day with 158 million transactions per day CONFIDENTIAL 35

36 Micro-segmentation and ESGs 127 rules where was vrni when I needed it?! Separate edge HA pair for each major service CONFIDENTIAL 36

37 One-armed design VMworld 2017 Content: Not for publication Servers are still directly accessible where needed (testing purposes), but public NAT and internal DNS all point at the load-balancer to handle inbound traffic. CONFIDENTIAL 37

38 Minimal overhead Traffic average ~200 Mbps and 1100 concurrent connections NSX load-balancer VM uses 700 MHz of CPU, 540 MB of RAM, & 2GB of disk space CONFIDENTIAL 38

39 Issues encountered along the way vmxnet3 performance bug Had to manually edit ring buffers and edit some offload settings to regain performance VMware resolved this in an ESXi hotfix shortly after DFW global address set issue We were one of the first few companies to report this VMware had to pull the version and release hotfix Thankfully we were not in full production yet HA edge services gateways in split-brain Happened on a few occasions where traffic would not pass. Quick fix is to reboot the active member and allow the failover. VMware now recommends a dedicated HA link. We have not had this issue for a couple versions. ARP failures VMs on a specific host will not hold ARP. Rebooting the hypervisor resolves the issue. CONFIDENTIAL 39

40 API Allow non-nsx admins to monitor health Patch and test safely Build into automated deployments CONFIDENTIAL 40

41 TL;DR We were early adopters and accepted the risk learned a ton along the way NSX 6.3 has been very stable Our Rackspace data center is currently at 100% uptime for 2017 (knock on wood) VMware is pouring resources into the product If you don t have any outlandish layer-7 rule needs, NSX load-balancing can most likely fit your needs CONFIDENTIAL 41

42 Where to get started Engage and Learn Join VMUG for exclusive access to NSX vmug.com/vmug-join/vmug-advantage Connect with your peers communities.vmware.com Find NSX Resources vmware.com/products/nsx Network Virtualization Blog blogs.vmware.com/networkvirtualization Try VMworld 2017 Experience Dozens of Unique NSX Sessions Spotlights, breakouts, quick talks & group discussions Visit the VMware Booth Product overview, use-case demos Visit Technical Partner Booths Integration demos Infrastructure, security, operations, visibility, and more Content: Not for publication Meet the Experts Join our Experts in an intimate roundtable discussion Take Free Hands-on Labs Test drive NSX yourself with expert-led or self-paces hands-on labs labs.hol.vmware.com Training and Certification Several paths to professional certifications. Learn more at the Education & Certification Lounge. vmware.com/go/nsxtraining 42

43

44