LTRDCN-2100 Cloud networking solutions with Cisco Cloud Services Router (CSR 1000V) on AWS and Azure

Transcription

1

2 LTRDCN-2100 Cloud networking solutions with Cisco Cloud Services Router (CSR 1000V) on AWS and Azure Fan Yang, Cisco, Engineer, Technical Marketing Raghavendra K S, Cisco, Engineer, Technical Marketing Nikolai Pitaev, Cisco, Engineer, Technical Marketing

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#ltrdcn Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Cisco Multi-Cloud Offering (15 mins) Lab Introduction (5 mins) Lab (220 mins)

5 Cisco Multicloud Portfolio Key Use Cases Cloud Advisory Cloud Connect Cloud Protect Cloud Consume Cloud adoption strategy with roadmap of capability & gaps Cloud onboarding with app dependency mapping strategy Definition of value case and value realization Securely extend private network to single or multiple public cloud environments Optimize for high cloud performance IaaS and SaaS performance Secured access to the internet and SaaS from branches Secure direct-to-cloud users and their devices Protect endpoints including mobile devices Secure SaaS applications and data Protect custom workloads running in the public cloud Scale applications based on end user performance and business metrics Gain visibility into application performance and to control cloud spend Manage the full application lifecycle LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 5

6 Cisco Multicloud Portfolio Products Mix Cloud Advisory Cloud Connect Cloud Advisory Cloud Protect Cloud Connect Cloud Consume Advisory Services Cloud Migration Cloud Connect Cloud Protect Cloud Consume (Delivered by AS/Cisco Partners) CSR 1000v Umbrella Multicloud vedge with Umbrella Portfolio AMP for Endpoints Meraki Systems Manager Cloudlock Tetration Cloud Cloud Consume Cloud Protect AppDynamics APM CloudCenter LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 Cisco Cloud Services Router (CSR) 1000V Cisco IOS XE Software in a Virtual Appliance Form-Factor App OS App OS CSR 1000V Software Familiar IOS XE software with ASR1000 and ISR4000 Infrastructure Agnostic Runs on x86 platforms Supported Hypervisors: VMware ESXi, Linux KVM, Citrix Xen, Microsoft Hyper-V, Cisco NFVIS and CSP2100 Supported Cloud Platforms: Amazon AWS, Microsoft Azure Virtual Switch Hypervisor Server Enterprise-class Networking with Rapid Deployment and Flexibility Performance Elasticity Available licenses range from 10 Mbps to 10 Gbps CPU footprint ranges from 1vCPU to 8vCPU License Options Term based 1 year, 3 year or 5 year Smart License enabled Programmability NetConf/Yang, RESTConf, Guest Shell and SSH/Telnet LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 Cisco CSR 1000V Cloud Platform Options IOS-XE release CSR on AWS Size CEF(Mbps) IPSEC(Mbps) T2.medium M3.Medium C4.large C4.xlarge C3.2xlarge C4.2xlarge C4.4xlarge CSR on Azure Size CEF(Mbps) IPSEC(Mbps) D2_v DS2_v D3_v DS3_v D4_v DS4_v C4.8xlarge Use Enhanced Networking Will Support Accelerated Networking in future LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 CSR 1000V use cases for all public clouds Extend Enterprise Routing Architecture to Cloud Common routing fabric securely extended to cloud DMVPN, FlexVPN, GETVPN* Support up to 1000 tunnels Remote Worker VPN Access FlexVPN IPSEC or SSLVPN via AnyConnect Flexible AAA server options for authentication Launch applications in regions near your users Across Region/Cloud Provider Interconnection Distribute applications globally Accessibility across on-prem and cloud locations Overcomes VPN tunnel limitation on AWS and Azure Extend on-prem routing architecture into Public Cloud Monitor/Analyze/Shape traffic in Public Cloud Security(ETA, vfw, VRF, AVC, Snort IPS/URL Filtering) Assurance(IP SLA, BFD, QoS) Scale to hundreds of VPC across regions/accounts (Transit VPC) Monitoring and troubleshooting with known common tools corporate office/branch VPC virtual private cloud VPC Cloud, US West Cloud, US East virtual private cloud *GETVPN supported on DX/ER only (no NAT) LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 9

10 Two deployment models Application VPC Gateway CSR deployed in application VPC Provide IPSEC gateway for entire VPC Need high availability Transit Hub Router CSR deployed in dedicated Transit Hub, not in application VPC High speed traffic routing for spoke VPC High availability is built-in natively VPC Application VPC AZ1 VPC AZ2 Transit Hub LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 10

11 Amazon AWS Concept

12 VPC(Virtual Private Cloud) 101 Logically isolated network with its own IP range, routes, security, etc. IP ranges (RFC1918) can be overlapping Internet gateway (IGW) connects outside and between VPCs Public IP or NAT for egress Security: Network ACLs Security Groups VPC /16 IGW VPC route tables directs traffic within the VPC Subnet A /24 Subnet B /24 VPC router is really an encap/decap device b/w hypervisors LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 12

13 Elastic IP Address is a routable address mapped to an instance in VPC Internet Gateway Elastic IP Mappings James VPC CIDR /16 Subnet A /24 Subnet B /24 WebApp1 Instance IP: Instances never have a publicly routable IP address directly assigned. Addresses are associated with AWS account and not the instance. Elastic IP for CSR 1000V becomes tunnel endpoint for VPN in this lab. LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 Microsoft Azure Concept

15 Azure Basic Concepts Virtual Network (VNet) A VNet logically isolates a network s own IP range, routes, security policies, etc. Each subnet created is automatically assigned a route table that contains system routes: Local VNet Rule, On-prime rule and Internet Rule System routes can be overwritten by User Defined Routes Virtual Network CIDR /16 Subnet A /24 Subnet B /24 VNets IP ranges cannot overlap Public IP NAT or Overload NAT for outbound traffic (No true public IPs) No L2 Broadcast/Multicast capability either. GRE packet is blocked within Azure. Azure system route table routes within the VNet All VNet subnets ALWAYS have a route to all other VNet subnets! LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Azure Public IP Addresses Azure Infrastructure Public IP Mappings Virtual Network CIDR /16 Subnet A /24 Subnet B /24 WebApp1 Instance IP: Azure infrastructure takes on the role of the router, allowing access from your VNet to the public Internet without the need of any configuration Public IP for CSR becomes tunnel endpoint for VPN, etc Instances never have a publicly routable IP address directly assigned LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 Cisco CSR1000V Solutions

18 Transit VPC/VNET Design Dedicated VPC: Simplifies routing by not combining with other shared services. CSR1000v Virtual Network Appliances: Provide dynamic routing and VPN network tunnels VPC Across regions, accounts/subscriptions A VPC B... Spoke VPC VPC C Redundancy: Dynamic routing combined with multi-az deployment creates a robust network infrastructure. VGW: VPC virtual gateways provide highly available connections to transit VPC virtual network appliances. VPC AZ1 CSR1 Direct Connect Or Internet Transit VPC AZ2 CSR2 Security services: Easily layer Firewall, IPS, URL Filtering and Cisco ETA (Encrypted Traffic Analysis) ASR Private DC Other Provider Networks LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 18

19 Transit VPC using DMVPN Solution Diagram High Throughput: spoke VPC scales up to 4.5Gbps with CSR, instead of 1Gbps on VGW Spoke VPC A Spoke VPC B Spoke VPC C Inter VPC Traffic: spoke VPC can talk to other spoke directly which will free up Transit CSR throughput Redundancy: two CSRs in spoke VPC acts as high availability pair to provide redundancy Application Visibility: provide application level visibility in spoke with NBAR capability on CSR AZ1 Transit VPC AZ2 Advanced Security: provide ZBFW, IPS and URL filtering with Snort IPS on CSR for inter VPC traffic. Cisco ETA (Encrypted Traffic Analysis) DMVPN LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Multi Region Deployment with Inter Region Peering! us-west us-east region1:spoke region2:spoke VPC CSR2 Tunnel Tunnel VPC CSR3 CSR1 Transit VPC Inter-Region Peering Transit VPC CSR4 DX/ER Internet ASR Private DC 1 Use different spoke tags so spoke is not connected to a different region Use different BGP ASNs for easy trouble shooting Keep localized traffic in same region DX/ER Internet ASR Private DC 2 LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 20

21 Technical comparison between AWS and Azure for CSR 1000v Feature AWS Azure IPSEC Throughput 4.5 Gbps 2 Gbps Number of vnic supported today 10 2/4/8 High Availability (Routing) Supported Supported Bootstrap User Data Custom Data (Coming) Automated Hub Spoke Solution Transit VPC Transit VNET (Coming) PAYG (Pay As You Go) Supported Coming GRE Tunnel support in VPC/VNet Supported Not supported L2 Broadcast and Multicast Not supported Not supported Add interfaces on running CSR 1000V VM Yes No (need to stop instance) LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 Lab Introduction

23 Transit VPC Lab Overview A B M1(40 Min.) Guest Shell *Optional M2(30 Min.) M1(40 Min.) AZ1 Transit VPC AZ2 DMVPN M4(40 Min.) M3(50 Min.) Azure VNet LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 PodX-Spoke-A VPC PodX-Spoke-B VPC / /16 SpokeA CSR SpokeB CSR /16 Azure VNET CSR3 CSR1 CSR /27 PodX Transit VPC DMVPN LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25 Lab Tips and Guidance

26 Before you begin Make sure, you have one page with additional lab information Make sure, that you are using assigned AWS region! All your resources created should be named in certain way. For example: P21V1 for pod21 LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27 Reload CSR Be careful about reloading CSR in the lab. Make sure to save configuration first by typing wr or copy running-config startup-config, then reload. You need to reconfigure CSR with bgp router-id interface GigabitEthernet1 after reload. It s because configuration loss due to reload which might cause BGP router-id conflict between Transit CSR and Spoke CSR. It will be fixed in later version If you reload Transit CSR, configure router bgp bgp router-id interface GigabitEthernet1 If you reload Spoke CSR, configure router bgp 7224 bgp router-id interface GigabitEthernet1 LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 27

28 Filter resources for better view This lab is in a shared environment and 5 attendees are sharing one region. You are able to see other attendees resources. Please filter resources by name to view your own resources clearly and avoid shutting down other people s instance. AWS Azure Note: Please always filter resources For example, Pod23 filter AWS with P23V1, Azure with pod23 LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 28

29 Disable IP Source/Destination Checking in the lab By default AWS blocks traffic not to/from a given instance. Toggle the Source/Dest Check option to allow a CSR instance to pass traffic for other subnets (i.e. act as a gateway). Note: Always review this setting for any new interfaces you add! LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 29

30 Adjust Azure Public IP address idle time Azure SSH session will timeout with none activity in 4 minutes by default. Change it to 30 minutes for easier usage. LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 30

31 Additional Resources Subscribe to our Youtube Channel! Over 20 technical videos! CSR 1000V Configuration Guide for AWS CSR 1000V Configuration Guide for Azure Cisco CSR1000V Transit VPC DeepDive and Best Practice Deploy CSR1000v High Availability on Microsoft Azure LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 31

32 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#ltrdcn Cisco and/or its affiliates. All rights reserved. Cisco Public

33 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

34 Continue Your Education Visit CSR1000V Multi-Cloud booth located in WoS (World of Solution) Related Session Network Function Virtualization Seminar [TECSPG-2300] (Monday, Jan 29, 02:30 p.m. - 06:45 p.m) Cisco vbng solution based on CSR1000V and XRv 9000 [BRKSPG-2063] (Thursday, Feb 01, 09:00 a.m. - 11:00 a.m) Meet the Engineer 1:1 meetings Related sessions LTRDCN Cisco and/or its affiliates. All rights reserved. Cisco Public 34

35 Thank you

36