Virtuální firewall v ukázkách a příkladech
|
|
|
- Hector Bates
- 5 years ago
- Views:
Transcription
1 Praha, hotel Clarion dubna 2013 Virtuální firewall v ukázkách a příkladech T-SEC3 / L2 Tomáš Michaeli Cisco Cisco and/or its affiliates. All rights reserved. Cisco Connect 1
2 Agenda VXLAN in Nexus 1000V 2.2 VXLAN Gateway ASA 1000V and VSG demo
3 New in Nexus 1000V 2.2 Evolve the virtual network In Beta! SCALE Evolution of VXLAN VXLAN Gateway Increased Scale 128 hosts 300 ports per host ports per VSM VXLAN Unicast Mode No Multicast configuration No flood and learn Mac-address distribution VXLAN to VLAN Seamless integration with Physical network Scale the Datacenter
4 Evolution of VXLAN Unicast mode Simplifies VXLAN deployment Provides better performance Reduces network dependency Easier troubleshooting No Flood and Learn Improved switching performance Reduced latency Lesser lookup cycles Increased security Unknown broadcast suppressed Mac-address Distribution Faster response time Efficient switching
5 VXLAN Gateway What? When? A Layer 2 Gateway that extends the VXLAN Layer 2 domain to physical servers and services deployed on a VLAN Created when a Layer 2 adjacency is required between VMs on a VXLAN and physical servers / services on a VLAN How? The VXLAN gateway is managed as a VEM from the Nexus 1000V VSM VXLAN Gateway is a feature of the Advanced Edition, no additional cost Define a mapping between a VXLAN and VLAN on VSM
6 Nexus 1000V VXLAN Gateway Physical (VLAN) Network VSG VMware vsphere vwaas Tenant 1 Tenant 2 Tenant 3 Tenant 1: virtual workloads protected by virtual firewall Tenant 2: virtual workloads protected by physical firewall (via VXLAN GW) Tenant 3: virtual & physical workloads in same L2 domain (via VXLAN GW 2012 Cisco and/or its affiliates. All rights reserved. 6
7 2010 Cisco and/or its affiliates. All rights reserved. 7
8 Layer 2 (Pod 1) Layer 2 (Pod 2) VLAN 10 VM 1 VM 2 VM 3 VLAN 10 VLAN 10 Layer Cisco and/or its affiliates. All rights reserved. 8
9 Ethernet in IP overlay network Entire L2 frame encapsulated in UDP 50 bytes of overhead Include 24 bit VXLAN Identifier 16 M logical networks Mapped into local bridge domains VXLAN can cross Layer 3 Tunnel between VEMs VMs do NOT see VXLAN ID IP multicast used for L2 broadcast/multicast, unknown unicast Technology submitted to IETF for standardization With VMware, Citrix, Red Hat and Others Outer MAC DA Outer MAC SA Outer 802.1Q Outer IP DA Outer IP SA Outer UDP VXLAN ID (24 bits) Inner MAC DA Inner MAC SA Optional Inner 802.1Q Original Ethernet Payload CRC VXLAN Encapsulation Original Ethernet Frame 2012 Cisco and/or its affiliates. All rights reserved. 9
10 Layer 2 (Pod 1) Layer 2 (Pod 2) VXLAN 5500 VM 1 VXLAN 5500 VM 2 VM 3 Layer Cisco and/or its affiliates. All rights reserved. 10
11 VXLAN Multicast Mode Forwarding Forwarding mechanisms similar to Layer 2 bridge: Flood & Learn VEM learns VM s Source (MAC, Host VXLAN IP) tuple Broadcast, Multicast, and Unknown Unicast Traffic VM VM VM VM VM broadcast & unknown unicast traffic are sent as multicast Unicast Traffic Unicast packets are encapsulated and sent directly (not via multicast) to destination host VXLAN IP (Destination VEM) VEM 1 VEM 2
12 Broadcast, Multicast and Unknown Unicast sent on Multicast group VM VM VM VM VM VM Multicast in Physical Network Flood and Learn 2012 Cisco and/or its affiliates. All rights reserved. 12
13 2010 Cisco and/or its affiliates. All rights reserved. 13
14 Evolutionary approach - defines a Layer 2 domain without relying on IP Multicast. Multicast Configuration Avoided VSM distributes (VXLAN, VTEP IP1, VTEP IP2,.VTEP IP n) list to all VEMs Flooding Avoided using MAC Distribution. Each VEM knows all other VM MACs in a VXLAN segment. VM VM VM VM Broadcast and Multicast VM broadcast and Multicast traffic is ingress replicated for each host having VMs in same VXLAN. Packet is encapsulated with destination IP set to host s VXLAN IP. Unicast Traffic Unicast packets are encapsulated and sent directly (not via multicast) to destination host VXLAN IP (Destination VEM) VEM 1 VEM Cisco and/or its affiliates. All rights reserved. 14
15 Bcast VM VM VM VM VM VM VM (VTEP A) (VTEP B) (VTEP C) (VTEP D) VEM performs Ingress Replication to VTEP with Blue VXLAN No Multicast Needed 2012 Cisco and/or its affiliates. All rights reserved. 15
16 VM VM Bcast/ARP Req VEM VXLAN-VTEP Table VXLAN VTEP (VTEP A) (VTEP B) VXLAN VTEP VEM learns VXLAN/VTEP VM Data Center Network VSM distributes Encapsulated VEM VXLAN/VTEP has packet VXLAN sent to all VTEPs list with VXLAN 5000 VEM VXLAN-VTEP Table (VTEP C) 1000V VSM VSM VXLAN-VTEP Table VXLAN VTEP VSM learns VXLAN/VTEP from VEMs VXLAN VTEP Cisco and/or its affiliates. All rights reserved. 16
17 Enhancement that reduces unknown unicast Flooding. VEM learns all VM MAC addresses in a VXLAN from VSM. When VEM receives a MAC from VM in a VXLAN, if MAC is not found in the MAC table the frame is dropped. Security from Malicious VMs sending continuous stream of Unknown Unicast traffic Cisco and/or its affiliates. All rights reserved. 17
18 VXLAN / MAC Table VXLAN 5000 IP/MAC a.a.a b.b.b c.c.c d.d.d VM1 VEM learns VXLAN/MAC VM (VTEP A) VM3 VM4 a.a.a b.b.b c.c.c d.d.d Data Center Network (VTEP B) VM4 sends unicast frame to MAC_X VXLAN / MAC Table VXLAN 5000 IP/MAC a.a.a b.b.b c.c..c d.d.d MAC_X VSM not distributes found in table. Packet VXLAN/MAC dropped. VXLAN / MAC Table Unknown Unicast Flood Prevented 1000V VSM VXLAN 5000 IP/MAC a.a.a b.b.b 2012 Cisco and/or its affiliates. All rights reserved. VSM learns VXLAN/MAC c.c.c d.d.d 18
19 Packet VXLAN Mode VXLAN Multicast Mode VXLAN Unicast Mode MAC Distribution (available when VXLAN is in Unicast mode) For Your Reference Broadcast / Multicast Multicast Encap Replication + Unicast Encap Replication + Unicast Encap Unknown Unicast Multicast Encap Replication + Unicast Encap Drop Known Unicast Unicast Encap Unicast Encap Unicast Encap ARP Multicast Encap Replication + Unicast Encap Replication + Unicast Encap 2012 Cisco and/or its affiliates. All rights reserved. 19
20 1 Turn on VXLAN feature on N1KV 2 Configure global segment mode and mac distribution mode 3 Create Bridge Domain on N1KV VM VM VM VM VXLAN 4 VXLAN VMKNIC VEM 1 VEM 2 VXLAN VMKNIC LACP or VPC Host Mode 2012 Cisco and/or its affiliates. All rights reserved. 20
21 1 N1KV(config)# feature segmentation! 2 N1KV(config)# segment mode unicast-only! 3 N1KV(config)# segment distribution mac! 4 N1KV(config)# bridge-domain Segment5000! N1KV(config-bd)# segment id 5000! N1KV(config-bd)# segment mode unicast-only! N1KV(config-bd)# segment distribution mac!! 2012 Cisco and/or its affiliates. All rights reserved. 21
22 2010 Cisco and/or its affiliates. All rights reserved. 22
23 What? When? A Layer 2 Gateway that extends the VXLAN Segment / Layer 2 domain to physical servers and services deployed on a VLAN Created when a Layer 2 adjacency is required between VMs on a VXLAN and physical servers / services on a VLAN How? The VXLAN gateway is managed as a VEM from the Nexus 1000V VSM VXLAN Gateway is a feature of the Advanced Edition, no additional cost Defines a mapping between a VXLAN and VLAN on VSM 2012 Cisco and/or its affiliates. All rights reserved. 23
24 Defines a mapping between VXLAN and VLAN VTEP on the Overlay Network - Encapsulates packets received on VLAN with VXLAN encapsulation and forwards to VTEPs - Decapusulates packets received on VXLAN network and floods on VLAN Forwarding Publish Incapable VTEP Unlike VTEPs on ESX hosts, Gateway cannot publish MAC addresses of physical hosts to VSM Supports both VXLAN Multicast and Unicast Mode VXLAN Gateway can act as a VTEP in both VXLAN Multicast Mode and Unicast Mode Cisco and/or its affiliates. All rights reserved. 24
25 WAN Edge / DCI Core Aggregation/ Access Services MEC MEC MEC MEC vpc vpc vpc vpc vpc vpc Compute GW GW N1000v N1000v N1000v N1000v N1000v N1000v 2012 Cisco and/or its affiliates. All rights reserved. 25
26 VXLAN VLAN 100 VXLAN VXV Gateway VLAN 200 Bridge between VXLAN and VLAN 2012 Cisco and/or its affiliates. All rights reserved. 26
27 VEM VXLAN-VTEP Table VM VM VXLAN VTEP VEM VXLAN-VTEP Table VXLAN VTEP (VTEP A) (VTEP B) Broadcast Packet from Vlan 20 a.b.c GW (VTEP C) GW VXLAN- VLAN-VTEP Table Data Center Network V VSM VXLAN 5000 VLAN 20 Mapping VSM VXLAN-VTEP Table VXLAN VLAN VTEP VXLAN VTEP Cisco and/or its affiliates. All rights reserved. 27
28 VXLAN / MAC Table VXLAN 5000 IP/MAC a.a.a b.b.b c.c.c d.d.d VM1 VM (VTEP A) VM3 VM4 a.a.a b.b.b c.c.c d.d.d (VTEP B) VM4 sends unicast frame to a.b.c VXLAN / MAC Table VXLAN 5000 IP/MAC a.a.a b.b.b c.c..c d.d.d Data Center Network a.b.c VXLAN / MAC Table VXLAN Gateway (VTEP C) 1000V VSM VXLAN 5000 IP/MAC a.a.a b.b.b c.c.c d.d.d 2012 Cisco and/or its affiliates. All rights reserved. 28
29 1 Enable Feature vxlan-gateway! 2 Create Port Profiles on VSM for Gateway VTEP Port! 3 Create Port Profile on VSM for Gateway Data Uplink! 2012 Cisco and/or its affiliates. All rights reserved. 29
30 4 Configure VXLAN Gateway! VXLAN-GY Mgmt IP VSM Mgmt IP Port Profiles for VSB 2012 Cisco and/or its affiliates. All rights reserved. 30
31 5 Gateway shows up as a Service Module! VSB as a Service Module 6 Create VXLAN-VLAN mappings! 2012 Cisco and/or its affiliates. All rights reserved. 31
32 Two gateways can be configured in an active standby configuration Active/standby have distinct management IP addresses Active/standby share a virtual VTEP address Active/standby synchronize configuration, MAC table and VTEP table. Heartbeats are exchanged in the management network Each VSM can support 4 VXLAN Gateway modules 2012 Cisco and/or its affiliates. All rights reserved. 32
33 2010 Cisco and/or its affiliates. All rights reserved. 33
34 1 Virtualized WebServer VM communicating to Bare Metal DB Server 2 Data Center Services such as Firewall, WAN Accelerator deployed as Physical Boxes or Service Modules on Aggregation Switch 2012 Cisco and/or its affiliates. All rights reserved. 34
35 The Internet Web - VM Client- VM DB Server Physical Workload VLAN 33 VTEP: VXLAN Gateway VTEP: VXLAN VEM 1 VE M 2 VTEP: Cisco and/or its affiliates. All rights reserved. 35
36 The Internet Web - VM Client- VM DB Server Physical Workload VLAN 33 VTEP: VXLAN Gateway VXLAN VEM 1 VE M 2 VTEP: No Multicast Required VTEP: Cisco and/or its affiliates. All rights reserved. 36
37 VXLAN Unicast-Only Mode allows network administrators to deploy VXLAN without implementing Multicast in the Physical Network. Supports co-existence of both Multicast and Unicast Mode i.e. some VXLANs in multicast mode and some VXLANs in Unicast Mode. VXLAN Unicast-Only mode is a single VSM solution. VEMs can be in local or remote datacenter. MAC Distribution helps prevent Unknown Unicast Flood. VXLAN Gateway allows the VXLAN layer 2 domain to be extended to physical servers and services Cisco and/or its affiliates. All rights reserved. 37
38 Evolve the virtual network In Beta! Improved Scale 128 Hosts 300 ports per host ports per VSM Evolution of VXLAN VXLAN Unicast Mode Multicast-less mode No flood and learn Mac-distribution VXLAN Gateway Available in Advanced Edition Enhanced upgrade process Available soon on CCO (Q2CY13) 2012 Cisco and/or its affiliates. All rights reserved. 38 Cisco Public
39 2010 Cisco and/or its affiliates. All rights reserved. 39
40 1) Install VNMC 2) Connect VNMC to vcenter VMWare vcenter 3) Connect VSM to VNMC 4) Connect VSG to VNMC 5) Connect ASA1000V to VNMC Virtual Network Management Center (VNMC) VSM VSG ASA1000V 2012 Cisco and/or its affiliates. All rights reserved. 40
41 Install VNMC as a Virtual Appliance in vcenter using OVA or ISO image Power on the VNMC virtual appliance after the OVA is deployed Access VNMC WebUI using: qualified VNMC hostname or IP Address Username admin Password whatever set during installation 2012 Cisco and/or its affiliates. All rights reserved. 41
42 Connection to the vcenter is certificate based (no password) Click on Export vcenter Extension and save extension to a file Using vcenter Plug-ins à Manage Plug-ins wizard create a new plug-in using the extension file Click on Add VM Manager to add a vcenter server to VNMC 2012 Cisco and/or its affiliates. All rights reserved. 42
43 Login to Nexus 1000V Virtual Supervisor Module (VSM) Configure vnm-policy-agent using VNMC IP address, shared secret and policy agent image 2012 Cisco and/or its affiliates. All rights reserved. 43
44 2012 Cisco and/or its affiliates. All rights reserved. 44
45 As part of VSG OVA deployment specify the VNMC IP address, shared secret and policy agent information 2012 Cisco and/or its affiliates. All rights reserved. 45
46 Once the VSG is powered ON, it will register with VNMC 2012 Cisco and/or its affiliates. All rights reserved. 46
47 Login to ASA1000V Configure VNMC IP address and shared-secret 2012 Cisco and/or its affiliates. All rights reserved. 47
48 Verify ASA1000V registered with VNMC 2012 Cisco and/or its affiliates. All rights reserved. 48
49 2010 Cisco and/or its affiliates. All rights reserved. 49
50 Compute Firewall controls Inter-VM (East-West) traffic VLAN-agnostic policy based operation 2012 Cisco and/or its affiliates. All rights reserved. 50
51 2012 Cisco and/or its affiliates. All rights reserved. 51
52 Rule þ þ Source Condition Destination Condition Action Condition Attribute Type Network VM User Defined vzone VM Attributes VM Name Guest OS full name Zone Name Parent App Name Port Profile Name Cluster Name Hypervisor Name Network Attributes IP Address Network Port Operator eq neq gt lt range Not-in-range Operator member Not-member Contains VM DNS Name Prefix 2012 Cisco and/or its affiliates. All rights reserved. 52
53 Access Policy Network Attributes Allow Ping Server A! Server B! VSG Source Condition Destination Condition Action 2012 Cisco and/or its affiliates. All rights reserved. 53
54 Access Policy VM Attributes Allow Ping Server A! Server B! Web Server VSG Database Server Source Condition Destination Condition Action 2012 Cisco and/or its affiliates. All rights reserved. 54
55 Zones are defined by a condition leveraging the attributes e.g. Network, VM or User Defined Attributes 2012 Cisco and/or its affiliates. All rights reserved. 55
56 Access Policy Zone Based Policy Allow Ping Server Server A! A! Server Server B! B! Web Server Zone VSG Database Server Zone Source Condition Destination Condition Action 2012 Cisco and/or its affiliates. All rights reserved. 56
57 Web! Client! Permit Only Port 80(HTTP) of Web Servers Permit Only Port 22 (SSH) to application servers Block all external access to database servers Web! Server! Web! Server! App! Server! App" Server! DB! server! DB! server! Web-zone Application-zone Database-zone Only Permit Web servers access to Application servers Only Permit Application servers access to Database servers Policy Content Hosting 2012 Cisco and/or its affiliates. All rights reserved. 57
58 Leveraging Zones in Rule Conditions 2012 Cisco and/or its affiliates. All rights reserved. 58
59 Define the service node using Nexus 1000V VSM Define the Service Chain using Nexus 1000V VSM Enable the Service Chain on Port-Profile using Nexus 1000V VSM 2012 Cisco and/or its affiliates. All rights reserved. 59
60 2010 Cisco and/or its affiliates. All rights reserved. 60
61 Cisco ASA 1000V Edge Firewall complements Cisco VSG to provide multitenant edge security and default gateway functionality, and protects against network-based attacks Cisco and/or its affiliates. All rights reserved. 61
62 Outside Client TenantA Outside: ASA 1000V Static NAT Inside: VSG Inside Client Web Server Db Server Cisco and/or its affiliates. All rights reserved. 62
63 2012 Cisco and/or its affiliates. All rights reserved. 63
64 2012 Cisco and/or its affiliates. All rights reserved. 64
65 2012 Cisco and/or its affiliates. All rights reserved. 65
66 2012 Cisco and/or its affiliates. All rights reserved. 66
67 2012 Cisco and/or its affiliates. All rights reserved. 67
68 Define the service node in Nexus 1000V for ASA1000V Define the Service Chain (Order is inside to outside) Enable the Service Chain on Port-Profile 2012 Cisco and/or its affiliates. All rights reserved. 68
69 Syslog Messages Verify NAT on ASA 1000V 2012 Cisco and/or its affiliates. All rights reserved. 69
70 N1KV 1.4 N1KV 1.4a N1KV 1.4b N1KV N1KV VSG 1.0 VNMC 1.0 VSM PA 1.0 VSG PA 1.0 VNMC 1.0 VSM PA 1.0 VSG PA 1.0 VSG 1.2 VNMC 1.2 VSM PA 1.2 VSG PA 1.2 VNMC 1.3 VSM PA 1.2 VSG PA 1.2 VSG 1.3 VNMC 1.3 VSM PA 1.2 VSG PA 1.3 VNMC 1.3 VSMPA 1.3 VSG PA 1.3 VSG 1.3a VNMC 1.3 VSM PA 1.2 VSG PA 1.3 VNMC 1.3 VSM PA 1.2 VSG PA 1.3 VNMC 1.3 VSM PA 1.3 VSG PA 1.3 VNMC 2.0 VSM PA 2.0 VSG PA 1.3 VSG 1.4 VNMC 2.0 VSM PA 1.2 VSG PA 2.0 VNMC 2.0 VSM PA 1.2 VSG PA 2.0 VNMC 2.0 VSM PA 1.3 VSG PA 2.0 VNMC 2.0 VSM PA 2.0 VSG PA Cisco and/or its affiliates. All rights reserved. 70
71 N1KV 1.4 N1KV 1.4a N1KV 1.4b N1KV N1KV ASA 1000V Service chain (VSG 1.4 & ASA 1000V 8.7.1) VNMC 2.0 VSM PA 2.0 VNMC 2.0 VSM PA 2.0 VSG PA Cisco and/or its affiliates. All rights reserved. 71
72 Otázky a odpovědi Zodpovíme též v Ptali jste se v sále LEO v 17:45 18:30 connect-cz@cisco.com Cisco and/or its affiliates. All rights reserved. Cisco Connect 72
73 Prosíme, ohodnoťte tuto přednášku Cisco and/or its affiliates. All rights reserved. Cisco Connect 73
74 Děkujeme za pozornost Cisco and/or its affiliates. All rights reserved. Cisco Connect 74
Network Services in Virtualized Data Center
Network Services in Virtualized Data Center Tomáš Michaeli Consulting Systems Engineer, DCV Central / Czech republic 21 Mar 2012 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 1 Almost
Cisco Virtual Security Gateway (VSG) Mohammad Salaheldin
Cisco Virtual Security Gateway (VSG) Mohammad Salaheldin Virtual Security Gateway (VSG) Overview VSG Packet Flow VSG Policy Model Use Case Example ASA on 1000V Summary 2011 Cisco and/or its affiliates.
Cisco Virtual Networking Solution Nexus 1000v and Virtual Services. Abhishek Mande Engineer
Cisco Virtual Networking Solution Nexus 1000v and Virtual Services Abhishek Mande Engineer mailme@cisco.com Agenda Application requirements in virtualized DC The Anatomy of Nexus 1000V Virtual Services
Nexus 1000V in Context of SDN. Martin Divis, CSE,
Nexus 1000V in Context of SDN Martin Divis, CSE, mdivis@cisco.com Why Cisco Nexus 1000V Losing the Edge Server Admin Host Host Host Host Server Admin manages virtual switching! vswitch vswitch vswitch
VXLAN Overview: Cisco Nexus 9000 Series Switches
White Paper VXLAN Overview: Cisco Nexus 9000 Series Switches What You Will Learn Traditional network segmentation has been provided by VLANs that are standardized under the IEEE 802.1Q group. VLANs provide
Architecting Scalable Clouds using VXLAN and Nexus 1000V
Architecting Scalable Clouds using VXLAN and Nexus 1000V Lawrence Kreeger Principal Engineer Agenda Session Is Broken Into 3 Main Parts Part 1: VXLAN Overview What is a VXLAN? Why VXLANs? What is VMware
Virtual Security Gateway Overview
This chapter contains the following sections: Information About the Cisco Virtual Security Gateway, page 1 Cisco Virtual Security Gateway Configuration for the Network, page 10 Feature History for Overview,
Cisco Virtual Security Gateway Deployment Guide VSG 1.4
Deployment Guide Cisco Virtual Security Gateway Deployment Guide VSG 1.4 Deployment Guide 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 33
Table of Contents HOL-PRT-1305
Table of Contents Lab Overview... 2 - Abstract... 3 Overview of Cisco Nexus 1000V series Enhanced-VXLAN... 5 vcloud Director Networking and Cisco Nexus 1000V... 7 Solution Architecture... 9 Verify Cisco
Cisco Virtual Networking Solution for OpenStack
Data Sheet Cisco Virtual Networking Solution for OpenStack Product Overview Extend enterprise-class networking features to OpenStack cloud environments. A reliable virtual network infrastructure that provides
Deploying Cloud Network Services Prime Network Services Controller (formerly VNMC)
Deploying Cloud Network Services Prime Network Services Controller (formerly VNMC) Dedi Shindler - Sr. Manager Product Management Cloud System Management Technology Group Cisco Agenda Trends Influencing
Deploying the Cisco ASA 1000V
CHAPTER 2 This chapter includes the following sections: Information About the ASA 1000V Deployment, page 2-1 Downloading the ASA 1000V OVA File, page 2-7 Deploying the ASA 1000V Using the VMware vsphere
MP-BGP VxLAN, ACI & Demo. Brian Kvisgaard System Engineer, CCIE SP #41039 November 2017
MP-BGP VxLAN, ACI & Demo Brian Kvisgaard System Engineer, CCIE SP #41039 November 2017 Datacenter solutions Programmable Fabric Classic Ethernet VxLAN-BGP EVPN standard-based Cisco DCNM Automation Modern
NSX-T Data Center Migration Coordinator Guide. 5 APR 2019 VMware NSX-T Data Center 2.4
NSX-T Data Center Migration Coordinator Guide 5 APR 2019 VMware NSX-T Data Center 2.4 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you
Cisco Nexus 1000V InterCloud
Deployment Guide Cisco Nexus 1000V InterCloud Deployment Guide (Draft) June 2013 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 49 Contents
Implementing VXLAN in DataCenter
Implementing VXLAN in DataCenter LTRDCT-1223 Lilian Quan Technical Marketing Engineering, INSBU Erum Frahim Technical Leader, ecats John Weston Technical Leader, ecats Why Overlays? Robust Underlay/Fabric
Installing the Cisco Virtual Network Management Center
CHAPTER 4 Installing the Cisco Virtual Network Management Center This chapter provides procedures for installing the Cisco Virtual Network Management Center (VNMC). This chapter includes the following
Cisco ACI and Cisco AVS
This chapter includes the following sections: Cisco AVS Overview, page 1 Installing the Cisco AVS, page 5 Key Post-Installation Configuration Tasks for the Cisco AVS, page 14 Distributed Firewall, page
Installing and Configuring VXLAN Gateway
Installing and Configuring VXLAN Gateway This chapter contains the following sections: Information About the VXLAN Gateway Deployment, page 1 Guidelines and Limitations, page 2 Configuring VSMs, page 3
Securing Containers Using a PNSC and a Cisco VSG
Securing Containers Using a PNSC and a Cisco VSG This chapter contains the following sections: About Prime Network Service Controllers, page 1 Integrating a VSG into an Application Container, page 4 About
Cisco ACI with Cisco AVS
This chapter includes the following sections: Cisco AVS Overview, page 1 Cisco AVS Installation, page 6 Key Post-Installation Configuration Tasks for the Cisco AVS, page 43 Distributed Firewall, page 62
QUICK START GUIDE Cisco Virtual Network Management Center 2.0 Quick Start Guide
QUICK START GUIDE Cisco Virtual Network Management Center 2.0 Quick Start Guide 1 Preface 2 Installation Prerequisites 3 Installing VNMC 4 Configuring VNMC 5 Troubleshooting VNMC Installation and Configuration
Service Graph Design with Cisco Application Centric Infrastructure
White Paper Service Graph Design with Cisco Application Centric Infrastructure 2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 101 Contents Introduction...
Enterprise. Nexus 1000V. L2/L3 Fabric WAN/PE. Customer VRF. MPLS Backbone. Service Provider Data Center-1 Customer VRF WAN/PE OTV OTV.
2 CHAPTER Cisco's Disaster Recovery as a Service (DRaaS) architecture supports virtual data centers that consist of a collection of geographically-dispersed data center locations. Since data centers are
VXLAN Design with Cisco Nexus 9300 Platform Switches
Guide VXLAN Design with Cisco Nexus 9300 Platform Switches Guide October 2014 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 39 Contents What
Migration from Classic DC Network to Application Centric Infrastructure
Migration from Classic DC Network to Application Centric Infrastructure Kannan Ponnuswamy, Solution Architect, Cisco Advanced Services Acronyms IOS vpc VDC AAA VRF STP ISE FTP ToR UCS FEX OTV QoS BGP PIM
VXLAN Deployment Use Cases and Best Practices
VXLAN Deployment Use Cases and Best Practices Azeem Suleman Solutions Architect Cisco Advanced Services Contributions Thanks to the team: Abhishek Saxena Mehak Mahajan Lilian Quan Bradley Wong Mike Herbert
Cisco ACI Multi-Pod/Multi-Site Deployment Options Max Ardica Principal Engineer BRKACI-2003
Cisco ACI Multi-Pod/Multi-Site Deployment Options Max Ardica Principal Engineer BRKACI-2003 Agenda ACI Introduction and Multi-Fabric Use Cases ACI Multi-Fabric Design Options ACI Stretched Fabric Overview
HW virtualizace a podpora hypervizorů různých výrobců
Cisco Expo 2012 HW virtualizace a podpora hypervizorů různých výrobců René Raeber Datacenter Architect IEEE 802.1DCB Architect Cisco Expo 2012 Cisco and/or its affiliates. All rights reserved. 1 Twitter
Securing Containers Using a PNSC and a Cisco VSG
Securing Containers Using a PNSC and a Cisco VSG This chapter contains the following sections: About Prime Network Service Controllers, page 1 Integrating a VSG into an Application Container, page 3 About
Cisco Virtual Application Container Services 2.0 Lab v1
Cisco Virtual Application Container Services 2.0 Lab v1 Last Updated: 02-SEP-2015 About This Solution Cisco Virtual Application Container Services (VACS) enables simplified deployment of Secure Application
Access Policies configured and interfaces up and in service EPG, Bridge Domain (BD) and Virtual Routing and Forwarding (VRF) already configured
Contents Introduction Prerequisites Requirements Components Used Configure Network Diagram Configurations Verify Troubleshoot Related Information Introduction This document decribes how to deploy an Application
Provisioning Overlay Networks
This chapter has the following sections: Using Cisco Virtual Topology System, page 1 Creating Overlays, page 2 Creating Network using VMware, page 3 Creating Subnetwork using VMware, page 4 Creating Routers
Integration of Hypervisors and L4-7 Services into an ACI Fabric. Azeem Suleman, Principal Engineer, Insieme Business Unit
Integration of Hypervisors and L4-7 Services into an ACI Fabric Azeem Suleman, Principal Engineer, Insieme Business Unit Agenda Introduction to ACI Review of ACI Policy Model Hypervisor Integration Layer
Higher scalability to address more Layer 2 segments: up to 16 million VXLAN segments.
This chapter tells how to configure Virtual extensible LAN (VXLAN) interfaces. VXLANs act as Layer 2 virtual networks over Layer 3 physical networks to stretch Layer 2 networks. About VXLAN Encapsulation
Nevrijeme u oblacima i kako se zaštititi
Nevrijeme u oblacima i kako se zaštititi Goran Peteh Enterprise Systems Engineer Zagreb, 0.2.20. Agenda Internet trends MorganStanley Identity-aware infrastructure Physical and virtual security Cumulus
Provisioning Overlay Networks
This chapter has the following sections: Using Cisco Virtual Topology System, page 1 Creating Overlays, page 2 Creating Network using VMware, page 4 Creating Subnetwork using VMware, page 4 Creating Routers
Network Configuration Example
Network Configuration Example MetaFabric Architecture 2.0: Configuring Virtual Chassis Fabric and VMware NSX Modified: 2017-04-14 Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089
Cisco Nexus 1000V Switch for Microsoft Hyper-V
Q&A Cisco Nexus 1000V Switch for Microsoft Hyper-V Overview Q. What are Cisco Nexus 1000V Switches? A. Cisco Nexus 1000V Switches provide a comprehensive and extensible architectural platform for virtual
Flexible Data Centre Fabric - FabricPath/TRILL, OTV, LISP and VXLAN
Flexible Data Centre Fabric - FabricPath/TRILL, OTV, LISP and VXLAN Ron Fuller CCIE #5851 (R&S/Storage) Technical Marketing Engineer, Nexus 7000 rfuller@cisco.com Agenda The Evolving Data Centre Fabric
Cisco HyperFlex Systems
White Paper Cisco HyperFlex Systems Converting to Cisco Nexus 1000V Distributed Switches for Cisco HyperFlex Virtual Machine Guest and VMware vmotion Networks Author: Hui Chen October 2016 2016 Cisco and/or
Data Center 3.0 Technology Evolution. Session ID 20PT
Data Center 3.0 Technology Evolution Session ID 20PT Session Goal The focus of this seminar is on the latest technologies some of which can already be used in today's deployments and some that will become
Cisco Virtual Security Gateway, Rel. 4.2(1)VSG1(3.1) and Cisco Virtual Network Management Center, Rel. 1.3 Installation and Upgrade Guide
Cisco Virtual Security Gateway, Rel. 4.2(1)VSG1(3.1) and Cisco Virtual Network Management Center, Rel. 1.3 Installation and Upgrade Guide February 16, 2012 Americas Headquarters Cisco Systems, Inc. 170
Cisco Prime Network Services Controller 3.0 CLI Configuration Guide
Cisco Prime Network Services Controller 3.0 Configuration Guide January 29 2014 Chapter 1 Overview... 4 Information About Prime Network Services Controller... 4 Information About the Prime Network Services
VMware vsphere 5.5 VXLAN Networking and Emulex OneConnect OCe14000 Ethernet Adapters
VMware vsphere 5.5 VXLAN Networking and Emulex OneConnect OCe14000 Ethernet Adapters Configuring VXLAN with Emulex OneConnect OCe14000 Adapters Emulex OneConnect Network Adapters Table of contents 1.0
Hybrid Clouds: Integrating the Enterprise Data Center and the Public Cloud
Hybrid Clouds: Integrating the Enterprise Data Center and the Public Cloud Usha Ramachandran, Technical Marketing Engineer Session Abstract In this session, participants will learn how to create hybrid
Data Center Configuration. 1. Configuring VXLAN
Data Center Configuration 1. 1 1.1 Overview Virtual Extensible Local Area Network (VXLAN) is a virtual Ethernet based on the physical IP (overlay) network. It is a technology that encapsulates layer 2
Cisco Nexus 1000V InterCloud based Hybrid Cloud Architectures and Approaches
Cisco Nexus 1000V InterCloud based Hybrid Cloud Architectures and Approaches Kapil Bakshi Solutions Architect Session Details - Session Title: Cisco Nexus 1000V InterCloud-based Hybrid Cloud Architectures
Mobility and Virtualization in the Data Center with LISP and OTV
Cisco Expo 2012 Mobility and Virtualization in the Data Center with LISP and OTV Tech DC2 Martin Diviš Cisco, CSE, mdivis@cisco.com Cisco Expo 2012 Cisco and/or its affiliates. All rights reserved. 1 Twitter
Configuring the Software Using the GUI
CHAPTER 3 This chapter describes how to use the GUI application to complete the Cisco Nexus 1000V configuration, and includes the following sections. GUI Software Configuration Process, page 3-2 Guidelines
Cisco Nexus 1000V for VMware vsphere VDP Configuration Guide, Release 5.x
Cisco Nexus 1000V for VMware vsphere VDP Configuration Guide, Release 5.x First Published: August 12, 2014 Last Modified: November 10, 2014 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive
Segmentation. Threat Defense. Visibility
Segmentation Threat Defense Visibility Establish boundaries: network, compute, virtual Enforce policy by functions, devices, organizations, compliance Control and prevent unauthorized access to networks,
Cisco VTS. Enabling the Software Defined Data Center. Jim Triestman CSE Datacenter USSP Cisco Virtual Topology System
Cisco Virtual Topology System Cisco VTS Enabling the Software Defined Data Center Jim Triestman CSE Datacenter USSP jtriestm@cisco.com VXLAN Fabric: Choice of Automation and Programmability Application
Implementing VXLAN. Prerequisites for implementing VXLANs. Information about Implementing VXLAN
This module provides conceptual information for VXLAN in general and configuration information for layer 2 VXLAN on Cisco ASR 9000 Series Router. For configuration information of layer 3 VXLAN, see Implementing
Multi-Site Use Cases. Cisco ACI Multi-Site Service Integration. Supported Use Cases. East-West Intra-VRF/Non-Shared Service
Cisco ACI Multi-Site Service Integration, on page 1 Cisco ACI Multi-Site Back-to-Back Spine Connectivity Across Sites Without IPN, on page 8 Bridge Domain with Layer 2 Broadcast Extension, on page 9 Bridge
Real World ACI Deployment and Migration Kannan Ponnuswamy, Solutions Architect BRKACI-2601
Real World ACI Deployment and Migration Kannan Ponnuswamy, Solutions Architect BRKACI-2601 Icons and Terms APIC Application Policy Infrastructure Controller (APIC) Cisco Nexus 9500 Cisco Nexus 9300 Nexus
Ordering and deleting Single-node Trial for VMware vcenter Server on IBM Cloud instances
Ordering and deleting Single-node Trial for VMware vcenter Server on IBM Cloud instances The Single-node Trial for VMware vcenter Server on IBM Cloud is a single-tenant hosted private cloud that delivers
5 days lecture course and hands-on lab $3,295 USD 33 Digital Version
Course: Duration: Fees: Cisco Learning Credits: Kit: DCAC9K v1.1 Cisco Data Center Application Centric Infrastructure 5 days lecture course and hands-on lab $3,295 USD 33 Digital Version Course Details
Vmware VCXN610. VMware Certified Implementation Expert (R) Network Virtualization.
Vmware VCXN610 VMware Certified Implementation Expert (R) Network Virtualization http://killexams.com/exam-detail/vcxn610 QUESTION: 169 A company wants to deploy VMware NSX for vsphere with no PIM and
Preparing for Installation
This chapter contains the following sections: Preparing the Configuration and Mapping Files, page 1 OpenStack Charm s, page 1 Cisco Nexus 1000V for KVM VSM Charm s, page 3 Cisco Nexus 1000V for KVM VEM
Configuring Policy-Based Redirect
About Policy-Based Redirect, page 1 About Symmetric Policy-Based Redirect, page 8 Using the GUI, page 8 Using the NX-OS-Style CLI, page 10 Verifying a Policy-Based Redirect Configuration Using the NX-OS-Style
Cisco Cloud Services Router 1000V with Cisco IOS XE Software Release 3.13
Q&A Cisco Cloud Services Router 1000V with Cisco IOS XE Software Release 3.13 Q. What is the Cisco Cloud Services Router 1000V? A. The Cisco Cloud Services Router 1000V (CSR 1000V) is a router in virtual
Lecture 8 Advanced Networking Virtual LAN. Antonio Cianfrani DIET Department Networking Group netlab.uniroma1.it
Lecture 8 Advanced Networking Virtual LAN Antonio Cianfrani DIET Department Networking Group netlab.uniroma1.it Advanced Networking Scenario: Data Center Network Single Multiple, interconnected via Internet
Cisco Nexus 1000V Series Switches
Data Sheet Cisco Nexus 1000V Series Switches Product Overview Cisco Nexus 1000V Series Switches provide a comprehensive and extensible architectural platform for virtual machine and cloud networking. The
Mobility and Virtualization in the Data Center with LISP and OTV
Mobility and Virtualization in the Data Center with LISP and OTV Agenda Mobility and Virtualization in the Data Center Introduction to LISP LISP Data Center Use Cases LAN Extensions: OTV LISP + OTV Deployment
Cisco Nexus 1100 Series Virtual Services Appliances
Deployment Guide Cisco Nexus 1100 Series Virtual Services Appliances Deployment Guide Version 1.0 June 2013 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
vshield Administration Guide
vshield Manager 5.1 vshield App 5.1 vshield Edge 5.1 vshield Endpoint 5.1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by
Installing the Cisco Nexus 1000V Software Using ISO or OVA Files
Installing the Cisco Nexus 1000V Software Using ISO or OVA Files This chapter contains the following sections: Installing the VSM Software, page 1 Installing the VSM Software Installing the Software from
Real World ACI Deployment and Migration
Real World ACI Deployment and Migration #clmel Kannan Ponnuswamy Solution Architect Cisco Advanced Services Icons and Terms APIC Application Policy Infrastructure Controller (APIC) Cisco Nexus 9500 Cisco
ANALYSIS OF VIRTUAL NETWORKS IN DATA CENTERS.
ANALYSIS OF VIRTUAL NETWORKS IN DATA CENTERS. Ionka Gancheva, PhD student 45 Abstract: The article contains an analysis of virtual networks and technologies that are used at data centers nowadays. Many
Exam Name: VMware Certified Associate Network Virtualization
Vendor: VMware Exam Code: VCAN610 Exam Name: VMware Certified Associate Network Virtualization Version: DEMO QUESTION 1 What is determined when an NSX Administrator creates a Segment ID Pool? A. The range
Integrating Juniper Networks QFX5100 Switches and Junos Space into VMware NSX Environments
Integrating Juniper Networks QFX5100 Switches and Junos Space into VMware NSX Environments Implementing an NSX vsphere Version 6.3 Overlay with a QFX5100 Underlay Implementation Guide July 2017 Juniper
Creating Application Containers
This chapter contains the following sections: General Application Container Creation Process, page 1 Creating Application Container Policies, page 2 About Application Container Templates, page 5 Creating
Cross-vCenter NSX Installation Guide. Update 3 Modified on 20 NOV 2017 VMware NSX for vsphere 6.2
Cross-vCenter NSX Installation Guide Update 3 Modified on 20 NOV 2017 VMware NSX for vsphere 6.2 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/
Cisco Dynamic Fabric Automation Architecture. Miroslav Brzek, Systems Engineer
Cisco Dynamic Fabric Automation Architecture Miroslav Brzek, Systems Engineer mibrzek@cisco.com Agenda DFA Overview Optimized Networking Fabric Properties Control Plane Forwarding Plane Virtual Fabrics
IBM Cloud for VMware Solutions NSX Edge Services Gateway Solution Architecture
IBM Cloud for VMware Solutions NSX Edge Services Gateway Solution Architecture Date: 2017-03-29 Version: 1.0 Copyright IBM Corporation 2017 Page 1 of 16 Table of Contents 1 Introduction... 4 1.1 About
Cross-vCenter NSX Installation Guide. Update 6 Modified on 16 NOV 2017 VMware NSX for vsphere 6.3
Cross-vCenter NSX Installation Guide Update 6 Modified on 16 NOV 2017 VMware NSX for vsphere 6.3 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/
Send document comments to
CHAPTER 3 This chapter describes how to identify and resolve installation problems, and includes the following topics: Isolating Problems, page 3-1 Improving Performance, page 3-4 Verifying the Domain
Cisco ACI Multi-Pod and Service Node Integration
White Paper Cisco ACI Multi-Pod and Service Node Integration 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 68 Contents Introduction... 3 Prerequisites...
Configuring Policy-Based Redirect
About Policy-Based Redirect, page 1 About Symmetric Policy-Based Redirect, page 8 Policy Based Redirect and Hashing Algorithms, page 8 Using the GUI, page 9 Using the NX-OS-Style CLI, page 10 Verifying
White Paper. Huawei Campus Switches VXLAN Technology. White Paper
White Paper Huawei Campus Switches VXLAN Technology White Paper 1 Terms Abbreviation VXLAN NVo3 BUM VNI VM VTEP SDN Full English Name Virtual Extensible Local Area Network Network Virtualization over L3
Weiterentwicklung von OpenStack Netzen 25G/50G/100G, FW-Integration, umfassende Einbindung. Alexei Agueev, Systems Engineer
Weiterentwicklung von OpenStack Netzen 25G/50G/100G, FW-Integration, umfassende Einbindung Alexei Agueev, Systems Engineer ETHERNET MIGRATION 10G/40G à 25G/50G/100G Interface Parallelism Parallelism increases
Configuring Administrative Operations
This section includes the following topics: Administrative Operation Conventions, page 1 Managing Backup Operations, page 1 Restoring a Backup Configuration, page 6 Managing Export Operations, page 10
Contents. EVPN overview 1
Contents EVPN overview 1 EVPN network model 1 MP-BGP extension for EVPN 2 Configuration automation 3 Assignment of traffic to VXLANs 3 Traffic from the local site to a remote site 3 Traffic from a remote
Introduction to External Connectivity
Before you begin Ensure you know about Programmable Fabric. Conceptual information is covered in the Introduction to Cisco Programmable Fabric and Introducing Cisco Programmable Fabric (VXLAN/EVPN) chapters.
HOW TO BUILD A NESTED NSX-T 2.3 LAB
TECHNICAL WHITE PAPER -FEBRUARY 2019 HOW TO BUILD A NESTED NSX-T 2.3 LAB Explore the features and capabilities of VMware NSX-T Jim Streit, VCIX-NV NSX Senior Technical Account Specialist (TAS) VMware Professional
21CTL Disaster Recovery, Workload Mobility and Infrastructure as a Service Proposal. By Adeyemi Ademola E. Cloud Engineer
21CTL Disaster Recovery, Workload Mobility and Infrastructure as a Service Proposal By Adeyemi Ademola E. Cloud Engineer 1 Contents Introduction... 5 1.2 Document Purpose and Scope...5 Service Definition...
NSX Administration Guide. Update 3 Modified on 20 NOV 2017 VMware NSX for vsphere 6.2
NSX Administration Guide Update 3 Modified on 20 NOV 2017 VMware NSX for vsphere 6.2 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you have
Hierarchical Fabric Designs The Journey to Multisite. Lukas Krattiger Principal Engineer September 2017
Hierarchical Fabric Designs The Journey to Multisite Lukas Krattiger Principal Engineer September 2017 A Single Fabric, a Single Data Center External Layer-3 Network Pod 1 Leaf/ Topologies (aka Folded
Creating Application Containers
This chapter contains the following sections: General Application Container Creation Process, page 1 Creating Application Container Policies, page 3 About Application Container Templates, page 5 Creating
Configuring Administrative Operations
Configuring Administrative Operations This section includes the following topics: Administrative Operation Conventions, page 1 Configuring Backup Operations, page 1 Restoring a Backup Configuration, page
2V0-642 vmware. Number: 2V0-642 Passing Score: 800 Time Limit: 120 min.
2V0-642 vmware Number: 2V0-642 Passing Score: 800 Time Limit: 120 min Exam A QUESTION 1 A network administrator has been tasked with deploying a 3-tier application across two data centers. Tier-1 and tier-2
VMware Integrated OpenStack Quick Start Guide
VMware Integrated OpenStack Quick Start Guide VMware Integrated OpenStack 1.0.1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced
Cisco IT Compute at Scale on Cisco ACI
Cisco IT ACI Deployment White Papers Cisco IT Compute at Scale on Cisco ACI This is the fourth white paper in a series of case studies that explain how Cisco IT deployed ACI to deliver improved business
Optimizing your virtual switch for VXLAN. Ron Fuller, VCP-NV, CCIE#5851 (R&S/Storage) Staff Systems Engineer NSBU
Optimizing your virtual switch for VXLAN Ron Fuller, VCP-NV, CCIE#5851 (R&S/Storage) Staff Systems Engineer NSBU fuller@vmware.com VXLAN Protocol Overview Ethernet in IP overlay network Entire L2 frame
vshield Quick Start Guide
vshield Manager 4.1.0 Update 1 vshield Zones 4.1.0 Update 1 vshield Edge 1.0.0 Update 1 vshield App 1.0.0 Update 1 vshield Endpoint 1.0.0 Update 1 This document supports the version of each product listed
ACI Multi-Site Architecture and Deployment. Max Ardica Principal Engineer - INSBU
ACI Multi-Site Architecture and Deployment Max Ardica Principal Engineer - INSBU Agenda ACI Network and Policy Domain Evolution ACI Multi-Site Deep Dive Overview and Use Cases Introducing ACI Multi-Site
NetScaler Analysis and Reporting. Goliath for NetScaler Installation Guide v4.0 For Deployment on VMware ESX/ESXi
NetScaler Analysis and Reporting Goliath for NetScaler Installation Guide v4.0 For Deployment on VMware ESX/ESXi (v4.0) Document Date: October 2016 www.goliathtechnologies.com 1 Legal Notices Goliath for
VXLAN Functionality Cubro EXA48600 & EXA32100
VXLAN Functionality Cubro EXA48600 & EXA32100 June 2018 www.cubro.com Purpose of this presentation This presentation consists of two parts. Part one contains technical background information about VXLAN.
Cisco HyperFlex Systems
White Paper Cisco HyperFlex Systems Install and Manage Cisco HyperFlex Systems in a Cisco ACI Environment Original Update: January 2017 Updated: March 2018 Note: This document contains material and data