Real World ACI Deployment and Migration Kannan Ponnuswamy, Solutions Architect BRKACI-2601

Similar documents
Real World ACI Deployment and Migration

Migration from Classic DC Network to Application Centric Infrastructure

Intuit Application Centric ACI Deployment Case Study

Cisco ACI Multi-Pod/Multi-Site Deployment Options Max Ardica Principal Engineer BRKACI-2003

MP-BGP VxLAN, ACI & Demo. Brian Kvisgaard System Engineer, CCIE SP #41039 November 2017

Multi-Site Use Cases. Cisco ACI Multi-Site Service Integration. Supported Use Cases. East-West Intra-VRF/Non-Shared Service

Cisco UCS Director and ACI Advanced Deployment Lab

Implementing VXLAN in DataCenter

Cisco HyperFlex Systems

Service Graph Design with Cisco Application Centric Infrastructure

Verified Scalability Guide for Cisco APIC, Release 3.0(1k) and Cisco Nexus 9000 Series ACI-Mode Switches, Release 13.0(1k)

Integration of Hypervisors and L4-7 Services into an ACI Fabric. Azeem Suleman, Principal Engineer, Insieme Business Unit

Cisco Application Centric Infrastructure and Microsoft SCVMM and Azure Pack

Verified Scalability Guide for Cisco APIC, Release 3.0(1k) and Cisco Nexus 9000 Series ACI-Mode Switches, Release 13.0(1k)

5 days lecture course and hands-on lab $3,295 USD 33 Digital Version

Building NFV Solutions with OpenStack and Cisco ACI

Page 2

Cisco ACI Virtual Machine Networking

New and Changed Information

Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Automation of Application Centric Infrastructure (ACI) with Cisco UCS Director

Cisco ACI Multi-Site Fundamentals Guide

Cisco Application Centric Infrastructure (ACI) - Endpoint Groups (EPG) Usage and Design

Cisco ACI and Cisco AVS

Layer 4 to Layer 7 Design

Cisco ACI Virtual Machine Networking

ACI Multi-Site Architecture and Deployment. Max Ardica Principal Engineer - INSBU

Virtual Machine Manager Domains

Configuring APIC Accounts

Cisco ACI Virtual Machine Networking

Segmentation. Threat Defense. Visibility

Integrating Cisco UCS with Cisco ACI

VXLAN Deployment Use Cases and Best Practices

Cisco Cloud Architecture with Microsoft Cloud Platform Peter Lackey Technical Solutions Architect PSOSPG-1002

Cisco ACI with Cisco AVS

Cisco ACI Virtual Machine Networking

Cisco ACI Virtual Machine Networking

LTRDCT-2781 Building and operating VXLAN BGP EVPN Fabrics with Data Center Network Manager

Question No: 3 Which configuration is needed to extend the EPG out of the Cisco ACI fabric?

Modeling an Application with Cisco ACI Multi-Site Policy Manager

believe in more SDN for Datacenter A Simple Approach

Integration of Hypervisors & L4-7 Services with ACI

ACI Terminology. This chapter contains the following sections: ACI Terminology, on page 1. Cisco ACI Term. (Approximation)

ACI Fabric Endpoint Learning

Provisioning Overlay Networks

Hybrid Cloud Solutions

Quick Start Guide (SDN)

Enterprise. Nexus 1000V. L2/L3 Fabric WAN/PE. Customer VRF. MPLS Backbone. Service Provider Data Center-1 Customer VRF WAN/PE OTV OTV.

Integration of Multi-Hypervisors with Application Centric Infrastructure

Integration of Hypervisors and L4-7 Services into an ACI Fabric

Introduction to Cisco Virtual Topology System DP Ayyadevara, Product Manager, Cloud Virtualization Cisco PSOSDN-1050

Provisioning Overlay Networks

Quick Start Guide (SDN)

Cisco SDN 解决方案 ACI 的基本概念

Cisco UCS Director Tech Module Cisco Application Centric Infrastructure (ACI)

Cisco ACI Multi-Site, Release 1.1(1), Release Notes

Running RHV integrated with Cisco ACI. JuanLage Principal Engineer - Cisco May 2018

Policy Driven Data Centre with ACI

Architecting Scalable Clouds using VXLAN and Nexus 1000V

Cisco VTS. Enabling the Software Defined Data Center. Jim Triestman CSE Datacenter USSP Cisco Virtual Topology System

Cisco ACI Terminology ACI Terminology 2

DevNet Technical Breakout: Introduction to ACI Programming and APIs.

with ACI Any workload anywhere.

Virtual Security Gateway Overview

VXLAN Overview: Cisco Nexus 9000 Series Switches

Use Case: Three-Tier Application with Transit Topology

Cisco Application Centric Infrastructure Release 2.3 Design Guide

Virtualization Design

PSOACI Why ACI: An overview and a customer (BBVA) perspective. Technology Officer DC EMEAR Cisco

Cisco IT Compute at Scale on Cisco ACI

Virtuální firewall v ukázkách a příkladech

Intra-EPG Isolation Enforcement and Cisco ACI

Toggling Between Basic and Advanced GUI Modes

Deploying Cloud Network Services Prime Network Services Controller (formerly VNMC)

Cisco ACI Virtualization Guide, Release 2.2(1)

Cisco ACI Multi-Pod and Service Node Integration

Cisco Dynamic Fabric Automation Architecture. Miroslav Brzek, Systems Engineer

Cisco ACI Virtualization Guide, Release 2.2(2)

Evolution with End-to-End Data Center Virtualization

Cisco ACI Multi-Pod Design and Deployment

Hierarchical Fabric Designs The Journey to Multisite. Lukas Krattiger Principal Engineer September 2017

The Next Opportunity in the Data Centre

Configuring Fabric and Interfaces

PSOACI Tetration Overview. Mike Herbert

Extending ACI to Multiple Sites: Dual Site Deployment Deep Dive

Cisco ACI vpod. One intent: Any workload, Any location, Any cloud. Introduction

Nexus 7000 F3 or Mx/F2e VDC Migration Use Cases

Cisco ACI Virtualization Guide, Release 2.1(1)

Customer s journey into the private cloud with Cisco Enterprise Cloud Suite

Actual4Test. Actual4test - actual test exam dumps-pass for IT exams

Design Guide: Deploying NSX for vsphere with Cisco ACI as Underlay

Microsegmentation with Cisco ACI

Exam Questions

Design Guide for Cisco ACI with Avi Vantage

ACI Transit Routing, Route Peering, and EIGRP Support

Deploying LISP Host Mobility with an Extended Subnet

Cisco Tetration Analytics

Cisco ACI for Red Hat Virtualization Environments

Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Migrate from Cisco Catalyst 6500 Series Switches to Cisco Nexus 9000 Series Switches

Transcription:

Real World ACI Deployment and Migration Kannan Ponnuswamy, Solutions Architect BRKACI-2601

Icons and Terms APIC Application Policy Infrastructure Controller (APIC) Cisco Nexus 9500 Cisco Nexus 9300 Nexus 7000 Nexus 5000 Nexus 2000 / FEX Nexus 1000 Router Load Balancer Firewall Storage Virtual Machine VMware vcenter

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

Nexus 9000 Series Network Ops Driven, Switch Automation User Driven, Policy Based Fabric Automation Per-Box Programmability Open, Flexible, & Choice of Programmability Modes Policy Controller, Centralized Fabric Programmability NX-API 1/10/40/100GE Common Platform APIC

Policy Driven Merchant+ ACI Overview External Network POLICY WEB POLICY APP POLICY DB Application Virtualization APIC Networking Physical HYPERVISOR HYPERVISOR HYPERVISOR

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

ACI Fabric Initialization ACI Fabric supports discovery, boot, inventory and systems maintenance processes via the APIC Fabric Discovery and Addressing: Fabric Discovery is through LLDP and is done automatically and progresses as administrator registers the switches to join the fabric. Once a switch is registered, its LLDP neighbors are now visible for the admin to approve for them to join the fabric. Commissioning, Decommissioning, Image Management Lifecycle management of switches Topology validation through wiring diagram and systems checks ACI Fabric APIC APIC APIC

ACI Forwarding Model Tenant VRF_Context_One Bridge Domain One EPG_1 VRF_Context_N EPG1A 10.10.0.0/16 Bridge Domain One 192.168.1.0/24 10.10.0.0/16 Bridge Domain N EPG_N EPGNA Non-IP, L2 forwarding only EPG_Legacy A Tenant may be referred to by one or more VRFs/Contexts A Context/VRF is referred to by one or more Bridge Domains (BD) Bridge Domains identify properties influencing forwarding behavior. One or more subnets, ARP handling, Multicast etc. A collection of end-points form an end-point group(epg). EPG associates to a BD. EndPoint Groups Identified by: Physical or Virtual Switch ports, VLAN ID, VNID Future - NVGRE (VSID), DNS hostname, IP address

L3 Sub-Interfaces Key concept to understand In the following valid topology, N9KA L3 sub-interface is treating 802.1Q as just a tag to identify the L3 IP interface, while on the N9KB side, the tags correspond to the L2 VLANs. Interface e1/1.10 ip 10.1.1.1/24 encapsulation dot1q 10! Interface e1/1.20 ip 20.1.1.1/24 encapsulation dot1q 20 Nexus 9KA L3 802.1Q L2 802.1Q Nexus 9KB Vlan 10 name l2 vlan 10! Vlan 20 name l2 vlan 20! Interface e1/1 switchport mode trunk switchport trunk allowed vlan 10,20

L3 Sub-Interfaces Key concept to understand Vlan10! Interface vlan10 ip address 10.1.1.1/24! Interface e1/1 switchport mode trunk switchport trunk allowed vlan 10 Nexus 9KA L2 802.1Q L3 802.1Q Vlan 10! Interface vlan10 ip address 10.1.1.2/24! Interface e1/1 switchport mode trunk switchport trunk allowed vlan 10 Nexus 9KB Interface e1/2.10 ip 10.1.2.1/30 encapsulation dot1q 10 Interface e1/2.10 ip 10.1.2.2/30 encapsulation dot1q 10 When configuring L3 Sub-interfaces on a Nexus Switch, The 802.1Q tag is local to the interface and has no relevance to a VLAN with same number on the same switch. Eventhough L3 subinterface uses 802.1Q, the 802.1q tag determines the IP L3 interface and not the L2 vlan.

EPG identification example vlan101 VM1...VM10 ACI Fabric Leaf Bridge Domain 100 10.1.1.1/24 EPG1 EPG2 EPG3 EPG4 vlan101 vlan102 vlan103 ESXi Host w/vswitch vlan102 vlan103 vlan104 vlan104 VM31..VM40 VLANs outside the ACI Fabric, map to EPGs inside the fabric EPGs then map to a BD where the gateway addresses are defined Policies are applied to let the VMs communicate VM11..VM20 VM21..VM30

Cisco ACI Hypervisor Integration VMWare DVS APIC 5 Create Application Policy F/W Application Network Profile EPG WEB L/B EPGAPP EPG DB APIC Admin 9 Push Policy ACI Fabric 1 Cisco APIC and VMware vcenter Initial Handshake 6 Automatically Map EPG To Port Groups 4 Learn location of ESX Host through LLDP 2 Create VDS VIRTUAL DISTRIBUTED SWITCH VI/Server Admin vcenter Server 8 Instantiate VMs, Assign to Port Groups 7 3 Create Port Groups Attach Hypervisor to VDS WEB PORT GROUP APP PORT GROUP DB PORT GROUP Web App HYPERVISOR DB Web Web HYPERVISOR DB

ACI Policy Model C Contracts define what an EPG exposes to other app tiers and how EPG MGMT C Tenant Application Profile C EPG Web C EPG App C EPG DB C EPG NFS Contracts are reusable for multiple EPGs and EPGs can inherit multiple contracts

ACI Policy Model What is a Contract C filter action Allows to specify rules and policies on groups of physical or virtual end-points without understanding of specific identifiers and regardless of physical location. filter identifier to which actions filter will be applied L4 port ranges TCP options filter action identifies actions to be applied action Permit QoS Log Redirect to Services action defined bi-directionally in the provider centric way

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

Building the Application Profile Oracle Internet Expenses

Application Profile - iexpenses Other Applications: Payroll, email.. Intranet EPG @ Border Leaf TCP: *,443 C C C Active Directory

iexpenses Application Profile C Intranet EPG @ Border Leaf C C Expenses EPG C Extranet EPG @ Border Leaf C Oracle RAC DB

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

Migration Paths to ACI Classic mode Growth Addition Network refresh Current DC Infrastructure ACI Integration New environments Service Chaining Dev, Test ACI Migration Business drivers Security, Compliance, TCO, Programmability, Operations etc. ACI Fabric

ACI Migration Methodology Deployment Design and deploy new ACI POD Integration Connecting ACI to your current infrastructure Migration Migrate workloads to use new ACI POD

ACI Adoption Strategies ACI Fabric Model = New OPERATIONS Model + DESIGN Model Leverage Known APPLICATIONS Constructs (decoupled from Network) Leverage Known NETWORKING Constructs OPERATIONS DESIGN HYBRID: Leverage BOTH APPLICATIONS & NETWORKING Centric Constructs OPERATIONS DESIGN OPERATIONS DESIGN ACI Fabric New ACI Fabric Operational Model

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

1.1.1.0/30 1.1.1.12/30 1.1.1.0/30 1.1.1.12/30 Network Centric Deployment example 1 VRF + 1 VLAN Classic mode shown here for Reference ACI Fabric APIC Blue Tenant and Context Policies.2 10.10.10.1/24.3 VRF Blue Routing VLAN 10 HSRP Access List QoS etc..101 Bridge Domain Blue_1 10.10.10.1/24 EPG blue_1 External EPG Exchange Routes (Blue).101 VLAN 10.102 Access or Virtual Switch Tag 2101.102 Tag could be VLAN ID or VNID

1.1.1.0/30 1.1.1.12/30 1.1.1.0/30 1.1.1.12/30 Network Centric Deployment Example 1 VRF + 2 VLANs Option 1 Classic mode shown here for Reference ACI Fabric APIC Vlan 10,11 Blue Tenant and Context BD Blue_1 (10.10.10.1/24) EPG blue_1 BD Blue_2 (10.10.11.1/24) EPG blue_2 Policies External EPG Exchange Routes (Blue) VLAN 10 (10.10.10.0/24) VLAN 11 (10.10.11.0/24) Access or Virtual Switch Tag 2101 Tag 2102

1.1.1.0/30 1.1.1.12/30 1.1.1.0/30 1.1.1.12/30 Network Centric Deployment Example 1 VRF + 2 VLANs FW is the Def. GW Classic mode shown here for Reference ACI Fabric APIC Vlan 10,11 Blue Tenant and Context BD Blue_1 EPG blue_1 BD Blue_2 EPG blue_2 External EPG Exchange Routes (Blue) VLAN 10 (10.10.10.0/24) VLAN 11 (10.10.11.0/24) Tag 2101 Classic Access Tag 2102

Network Centric Configuration

Configuring ACI Forwarding Unicast Routing: Enable both L3 and L2 Forwarding (IP or MAC address). Enabled by default. L2 Unknown Unicast: forwarding method for unknown layer 2 destinations. The method can be flood or proxy (default) ARP Flooding: Specifies whether ARP flooding is enabled. If flooding is disabled, unicast routing will be performed on the target IP address. Can be on or off (default) Traditional VLAN ACI Innovations

1.1.1.0/30 1.1.1.12/30 1.1.1.0/30 1.1.1.12/30 Network Centric Deployment Example 1 VRF + 2 VLANs Option 2 Classic mode shown here for Reference What if different policies between two groups mandated separate VLANs in Classic Networks. 1. Policies are based on EPG 2. Forwarding is based on BD attributes APIC ACI Fabric Vlan 10,11 Blue Tenant and Context EPG blue_1 BD Blue_1 10.10.10.1/24 10.10.11.1/24 X EPG blue_2 Policies External EPG Exchange Routes (Blue) Classic Access VLAN 10 (10.10.10.0/24) Tag 2101 Tag 2102 VLAN 11 (10.10.11.0/24)

1.1.1.0/30 1.1.1.12/30 1.1.1.0/30 1.1.1.12/30 Network Centric Deployment Example 1 VRF + 2 VLANs Option 3 Classic mode shown here for Reference Hardware based directed ARP forwarding ACI Fabric What if two VLANs was only due to ARP broadcast concerns. APIC Vlan 10,11 Blue Tenant and Context BD Blue_1 10.10.10.1/24 10.10.11.1/24 EPG blue_1 Policies External EPG Exchange Routes (Blue) Classic Access VLAN 10 (10.10.10.0/24) Tag 2101 VLAN 11 (10.10.11.0/24)

Network Centric - ACI Deployment as a L2 Fabric

ACI as a Layer 2 Fabric (L2Context, BD200, EPG200), No IP Def. GW, No Contracts Vlan-200 Maps to EPG200 200.1.1.11/24 200.1.1.12/24 VM VMOne_on_EPG200 on Host1 DVS VM VMTwo_on_EPG200 on Host2 DVS N7K1 Def. GW: 200.1.1.1,.2,.3 vpc, SVI200 N7K2

Extending current infrastructure with Layer 2 ACI Fabric Internet WAN / DCI vpc/stp based Current Infrastructure L3 L2 N7K N7K ACI L2 Fabric N9K N9K APIC N9300 N9300 N9300 N9300 N9300 N9300 N9300 N9300 V Integrated L4-L7 Services Physical & Virtual

Layer 2 Fabric STP Containment Tenant(TraditionalDC) Context(CtxtForL2VLANs) BridgeDomain(BD202) EPG(EPG202, EPG1202) If Context is in enforced mode, Contracts are needed to communicate between EPG202 and 1202 even though they are on same Subnet. TraditionalDC(Tenant) EPG1202 BD202 ; No IP Addr CtxtForL2VLANs (Context) EPG 202 (or L2 Out) VLAN 502 VLAN 102 VLAN 202 202.1.1.11/24 DVS VM VMOne_on_EPG1202 on Host1 DVS 202.1.1.12/24 vswitch1 VM VMTwo_on_EPG1202 on Host2 DVS N7K1 202.1.1.1,.2,.3 vpc, SVI202 N7K2 STP BPDUs from the N7Ks are limited to EPG202 and does not unnecessarily flood into the fabric and EPG1202.

Layer 2 ACI Fabric with External GW Internet WAN / DCI L3 L2 N7K N7K ACI L2 Fabric Spine APIC N9K N9K Leaf N9300 N9300 N9300 N9300 N9300 N9300 N9300 N9300 Integrated L4-L7 Services Physical & Virtual

ACI as L2 Fabric With Services Three-Tiered Applications: Load Balancer as gateway non-automated insertion GW LB Context 1 (Routed Mode) GW GW Firewall Context 1 (Routed Mode) ASR 9000 VLAN A VLAN B VLAN C VLAN D OSPF / ibgp / Static VLAN D VLAN E OSPF / ibgp VLAN E EPG Web1 EPG App EPG DB EPG LB_Out EPG LB_Out EPG FW_Out EPG FW_Out No contract necessary for host to LB communication BD Web BD App BD DB BD LB_out BD FW_out EPG Web EPG App EPG DB ACI Fabric Bridge Domain Settings (all BDs): ARP Flooding: enabled Unicast Routing: disabled L2 Unknown Unicast: flood Web Server App Server DB Server

Layer 2 ACI Fabric (BD One, EPG One), No IP Def. GW, No Contracts (BD Two, EPG Two), No IP Def. GW, No Contracts. (BD 3500, EPG 3500), No IP Def. GW, No Contracts How? 1 BD and 1EPG per Current Infrastructure VLAN Also available is BD in legacy mode which preserves VLAN resources to allow for 3500 BDs per Leaf. Who are deploying? Customers who want to slowly introduce ACI NFV or Virtual Overlay Use Case Benefits: Network Operations, Network Automation Any VLAN, Any Workload, Any Where Network Capacity and Bandwidth

Network Centric - ACI Deployment as a L3 Fabric

ACI as a Layer 3 Fabric SubnetOne (BD) Def GW 210.1.1.1 ZoneOne (EPG) CtxtForL3VLANs (Context) VLAN 234 VXLAN 8814592 VLAN 2100 DVS AVS ESX Host 1 vswitch1 DVS AVS ESX Host 2 vswitch1 210.1.1.11/24 VM VMOne_on_ZoneOne 210.1.1.12/24 VM VMTwo_on_ZoneOne VM 210.1.1.13/24 VMThree_on_ZoneOne

Layer 3 Fabric: PXE Booting Aggregation Spines dhcp relay APIC Access Leafs LACP Individual State LACP Individual State DHCP, PXE Server Traditional Nexus Infrastructure [no] lacp suspend-individual: LACP sets a port to the individual (I) state if it does not receive an LACP protocol data unit (PDU) from the peer DHCP, PXE Server ACI Fabric Disable LACP suspend-individual Set Untagged packets to belong to dedicated BD Set the BD dhcp relay to point to PXE/DHCP Server DHCP Option 82 support

Multi-Tenancy with services ACI Fabric RegularSoda (BD) EPGAppOne VLAN VXLAN DietSoda (BD) EPGAppOne VLAN VXLAN DVS AVS External Stateful Firewall DVS AVS 3.3.2.11/24 VM VMOne_on_ RegSodaAppOne VM 3.3.2.12/24 VMTwo_on_ RegSodaAppOne Tenant RegularSoda 4.4.2.11/24 VM VMOne_on_ DietSodaAppOne Tenant DietSoda VM 4.4.2.12/24 VMTwo_on_ DietSodaAppOne

Multi-Tenancy: shared external routes example Internet Routes 1.1.1.0, 2.2.2.0 N7K1 N7K2 ACI Fabric: Tenant Common PubForRegularSoda (BD) EPGWebOne VLAN VXLAN OSPF and ibgp Over VLAN 300 C C PubForDietSoda (BD) SharedContext (Context) VLAN EPGWebOne VXLAN DVS AVS DVS AVS 3.3.3.11/24 VM VMOne_on_ RegSodaWebOne VM Tenant RegularSoda 3.3.3.12/24 VMTwo_on_ RegSodaWebOne 4.4.4.11/24 VM VMOne_on_ DietSodaWebOne VM 4.4.4.12/24 VMTwo_on_ DietSodaWebOne Tenant DietSoda

Layer 3 ACI Fabric (BD One, EPG One), IP Def. GW, Optional Contracts (BD Two, EPG Two), IP Def. GW, Optional Contracts. (BD 1750, EPG 1750), IP Def. GW, Optional Contracts How? 1 BD and 1EPG per Current Infrastructure VLAN Fabric as default gateway with or without policy enforcement. Who are deploying? Customers who want basic L3 ACI Features, and adopt ACI Fabric as a single DC switching system Benefits: Pervasive Gateway, Directed ARP and other features Network Operations, Network Automation Any VLAN, Any Workload, Any Where Network Capacity and Bandwidth

Network Centric ACI Migration

Network Centric Migration Example VRF + 2 VLANs 1.1.1.0/30 1.1.1.12/30 Layer 3 Routing Static, OSPF, BGP APIC Vlan 10,11 Migration Layer 2 vpc Trunk Blue Tenant and Context L2_ Out BD Blue_1 EPG blue_1 BD Blue_2 10.10.11.1/24 EPG blue_2 Policies L2_ Out L3Out.101 VLAN 10 (10.10.10.0/24) VLAN 11 (10.10.11.0/24).102 STP compatibility with Classic Network VLAN 10 maps to BD Blue_1 VLAN 11 maps to BD Blue_2 Classic Devices are still the Default Gateway Equally applicable to L4-7 services (FW/LB) in the Classic Network Flooding enabled on ACI BDs during migration Once migration completed, insert needed services and move Default Gateway ACI BDs Access Tag 2101 Tag 2102 Tag could be VLAN ID or VNID.

ACI Integration and Migration Forwarding Flow ACI Fabric L3 L2 Default Gateway moves to ACI Leaf layer EPG = VLAN / Subnet (initial step) Host / FEX can migrate to Leaf (overtime) Migration Path 10G/40G to ACI Layer 3 Layer 2-1GE Layer 2-10GE 10 GE DCB 10 GE FCoE/DCB 4/8 Gb FC

Nexus 9000 Migration from Standalone to ACI mode

Nexus 9000 Standalone to ACI mode migration non vpc L2 and L3 Connectivity Aggregation Spines APIC Load ACI software Access X X X X Load ACI software Leafs X X Active Standby Standby Active Standby Standalone Mode Nexus 9000 ACI Fabric

Nexus 9000 Standalone to ACI mode migration : vpc L2 and L3 Connectivity Aggregation Spines APIC Load ACI software Access X X X X Load ACI software Leafs X X Individual Standalone Mode Nexus 9000 ACI Fabric

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

Deployment Example Hybrid Approach Classic mode shown here for Reference External Network APIC.2.3 Blue Tenant and Context BD Blue_2 10.10.11.1/24 EPG 11 EPG One-web BD Blue_1 10.10.10.1/24 EPG Two-web Policies EPG Three-web External EPG Exchange Routes (Blue) VLAN 11 Access (10.10.11.0/24 Tag 2011 VLAN 10 (10.10.10.0/24) Tag 100 Tag 101 Tag 102 AppOne s WebServer AppTwo s WebServer AppThree s WebServer AppOne s WebServer AppTwo s WebServer AppThree s WebServer External Network

Hybrid (Network and Application Centric) ACI Migration

ACI Migration for Hybrid Approach Exchange Routes (Blue) APIC External EPG BD Blue_2 Policies Blue Tenant and Context Classic L2 Extension. EPG 11 EPG One-web BD Blue_1 EPG Two-web EPG Three-web VLAN 11 (10.10.11.0/24 VLAN 10 (10.10.10.0/24) AppOne s WebServer AppTwo s WebServer AppThree s WebServer STP compatibility with Classic Network VLAN 10 maps to BD Blue_1 VLAN 11 maps to BD Blue_2 Classic Devices are still the Default Gateway Flooding enabled on ACI BDs during migration Equally applicable to L4-7 services (FW/LB) in the Classic Network Once migration completed, insert needed services and move Default Gateway ACI BDs Access Tag 2011 Tag 100 Tag 101 Tag 102

Virtual Environment Migration Example L3 L2 L3 vcenter vshield L3 N7K N7K ACI Fabric N5500 N5500 L2 L2 L3 L2 L2 L3 VMware vswitch, DVS, N1kV APIC Created VMware DVS / Cisco AVS APIC Created VMware DVS / Cisco AVS vmotion / Cold Migration

ACI Virtual Migration Assistant User and Workflow driven Multiple scenarios vswitch ACI DVS ACI N1kv ACI Any Combination ACI Cisco Advanced Services

Agenda Application Centric Infrastructure (ACI) Overview ACI Design Parameters Building an Application Profile Real World ACI Adoption and Migration Network Centric Hybrid Approach Application Centric

Application Centric - iexpenses C Intranet EPG @ Border Leaf C C Expenses EPG C Extranet EPG @ Border Leaf C Oracle RAC DB

App Profiles - Exchange 2013 Architecture

ACI Deployments for Known Application Profiles Internet WAN / DCI ACI POD for Greenfield or well understood applications Spine L3 L2 N7K N7K ACI Introduction N9K N9K Leaf N9300 N9300 N9300 N9300 N9300 N9300 N9300 N9300 V Integrated L4-L7 Services Physical & Virtual

Application Centric ACI Migration

ACI Approach to Applications Traditional Data Center Design Web Tier Application Tier Database Tier Firewall Load Balancing Firewall Load Balancing ACI Approach Application Profile 1 FW LB WEB 1 FW APP 1 DB 1 LB Application Profile 2 FW LB WEB 2 FW APP 2 DB 2 LB Application Profile 3 FW LB WEB 3 FW APP 3 DB 3 LB

Operational Operational Challenges Challenges 1 Lack of Confidence in Existing Information CMDB SSOT IPAM 2 No Endpoint Details Identification Layer 4 Ports App Host Association Endpoint Classification Application Grouping 3 Classify and Group

Application Profiling Methodology Application Dependency Analysis Network and Server Data Correlation, Application Fingerprinting, Customer Input Network Discovery Device Configurations, Protocols, Traffic Server Discovery Collect and Analyze Servers, Processes, Network Statistics

Proposal for iexpenses 100111001010100011010 100101111011101101111 100111001010100011010 100101111011101101111 100111001010100011010 100101111011101101111 100111001010100011011111111101001100 100101111011101101111100110100001110 Contract Authentication (Single Sign On) User Access 10011100101010001101111111110100 10010111101110110111110011010000 Contract Financial Web Portal Provider 100111001010100011011111111101001100 100101111011101101111100110100001110 Contract 10011100101010001101100111001010100011011001110010101000110110011100101010001101001101000111001 1001011110111011011100000110101000000000001111110000101010101000000110000011100001001101111001 Contract 1001110010101000110111111 1001011110111011011111001 Business Intelligence 100111001010100011011111111101001100 100101111011101101111100110100001110 Contract 10011100101010001101 10010111101110110111 Oracle DB

Advanced Services: Application Profiling for ACI Comprehensive application dependencies Multiple application network policies Application, compute, network, and storage mapping Automate physical and virtual migration APIC Traditional 3-Tier Application App Profile HYPERVISOR HYPERVISOR HYPERVISOR Cisco Advanced Services

Multi-POD ACI Deployments

Connecting Two ACI Fabrics ACI Fabric 1 ACI Fabric 2 Anycast GW IP 1.1.1.1 2.2.2.1 MAC: MAC-A APIC vcenter Server Anycast GW IP 1.1.1.1 2.2.2.1 MAC: MAC-B APIC vcenter Server ESX ESX ESX ESX 1.1.1.10 2.2.2.10 1.1.1.20 2.2.2.20

Single Fabric Scenarios Multi-Site (Stretched) Fabric Site/Room A Site/Room B Interconnect Leaf Nodes HYPERVISOR HYPERVISOR HYPERVISOR Single Fabric + Multi-Site Single Operational Zone (VMM, Storage, FW/LB are all treated as if it is one zone) e.g. Single vcenter with Synchronized Storage Interconnect between sites Direct Fiber (40G), DWDM (40G or multiple 10G), Pseudo Wire (10G or 40G)

Multi-Fabrics Current Options Synchronization of Fabric Policy Site A Site B H Y P E R V I S O R H Y P E R V I S O R H Y P E R V I S O R H Y P E R V I S O R H Y P E R V I S O R H Y P E R V I S O R Symmetrical XML Configuration will maintain consistent operation between fabrics Externally triggered Export and Import between Fabrics is another option to maintain consistency

ACI Migration Summary ACI designed from the ground-up to be Application Centric Flexible and customizable to fit your business needs A phased approach: Grow, Integrate, Migrate Solution flexible to be Network Centric, Application Centric or a Hybrid approach Help - Cisco Data Center Services Design Clinic @ World Of Solutions Thank You!!

Call to Action Visit the World of Solutions for Cisco Campus DataCenter, ACI Booths with Advanced Services Tools Demo Walk in Labs Technical Solution Clinics Follow-up Breakout Sessions BRKACI-2001 - Integration and Interoperation of Existing Nexus Networks into an ACI Architecture BRKACI-2006 - Integration of Hypervisors and L4-7 Services into an ACI Fabric BRKACI-2102 - ACI Troubleshooting Tools and Best Practices BRKDEV-2971 - Introduction to ACI Programming and APIs Meet the Engineer Lunch time Table Topics DevNet zone related labs and sessions

Complete Your Online Session Evaluation Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 Amazon gift card. Complete your session surveys though the Cisco Live mobile app or your computer on Cisco Live Connect. Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online

Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Table Topics Meet the Engineer 1:1 meetings Related sessions

Thank you