HP FlexFabric Virtual Switch 5900v Technology White Paper Part number: 5998-4548 Document version: 6W100-20131220 Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
Contents Overview 1 Technical background 1 Benefits 1 5900v virtual switch implementation 2 5900v virtual switch components 2 Virtual Forwarding Engine (VFE) 2 Virtual Control Engine (VCE) 3 3 5900v virtual switch deployment flow 3 VCE deployment 3 VFE deployment 4 deployment 5 Workflow 5 Port-group based connections 6 Automatic deployment of network policies for migration 7 Clear boundary between virtual computing and network control 8 Application scenarios 9 i
Overview The HP FlexFabric virtual switch 5900v (5900v virtual switch) is designed for virtualized environments such as data centers. It is applicable to the ware vsphere ESXi Enterprise Plus Edition. The 5900v virtual switch integrates with ware vcenter Server and ware ESXi to provide the enhanced distributed virtual bridging function. Technical background The fast development of server virtualization brings more and more virtual machines (s) to deployment. With the virtualization software Virtual Machine Monitor (M) installed on a physical server, the server can create at least one. M includes ware vsphere and Microsoft Hyper-V. Each operates independently and has its own operating system, applications, and virtual hardware environments. The virtual hardware environments include virtual CPUs, memories, storage media, IO devices (virtual NICs, for example), and Ethernet switches (bridges), as shown in Figure 1. Figure 1 Server virtualization Benefits s on a physical server communicate with each other or with the outside network through a Virtual Ethernet Bridge (VEB). Each is assigned a virtual NIC with a unique MAC address for the VEB to implement packet forwarding. The 5900v virtual switch operates on the ware ESXi management program and supports the IEEE 802.1Qbg (EVB) standard and the OpenFlow framework. It has the following advantages: 1
Port-group based connections. Automatic deployment of network service policies for s after a migration. Clear boundary between virtual computing and network control. 5900v virtual switch implementation 5900v virtual switch components The 5900v virtual switch complies with the OpenFlow framework and implements the programmable network technology that separates the control plane and forwarding plane. It has three components, including the VCE, VFE, and plug-in, as shown in Figure 2. Figure 2 5900v virtual switch system framework Station 1 Station 2 Station 3 #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 #11 #12 VFE VFE VFE ware ESXi ware ESXi ware ESXi VFE (Virtual Forwarding Engine) Operates on ware ESXi, and can be used as a virtual switch in the ware environment. Serves as the forwarding plane to implement the traffic control and forwarding for the virtual ports. Multiple VFEs serve a distributed virtual switch. vcenter Server VCE (Virtual Control Engine) Operates on s. Serves as the OpenFlow controller, and implements unified VFE management and configuration Closely related to ware vcenter Server. EVB Switch 5900v Installed and operates in the vcenter Server through VCE. Enhances the network control capability (such as VCE PVLAN, VEPA, and link aggregation) of vnic ports. Virtual Forwarding Engine (VFE) Operating on the ESXi host, a VFE is part of the ware ESXi kernel. The VFE can be used as a virtual switch in the ware environment. The VFE serves as the forwarding plane to implement traffic control and forwarding for the virtual ports. After receiving data, the VFE searches the local flow entries for the destination port. If no port is matched, it forwards the data to the VCE, which determines the forwarding policy and destination port. VFEs deployed on multiple ESXi hosts serve as a distributed virtual switch. When a migrates to other ESXi hosts, the network policies on the virtual NIC can be synchronized to all these hosts, under the supervision of both the VCE and IMC. 2
Virtual Control Engine (VCE) A VCE is installed on a separate through the open virtualization format (OVF) template deployment function provided by the ware vcenter Server. The VCE implements unified VFE management and configuration. A plug-in is a third-party management interface that the 5900v virtual switch customizes for ware. It operates on the ware vcenter Server and mainly provides a configuration interface for port groups. 5900v virtual switch deployment flow The 5900v virtual switch components operate on different physical or virtual entities. Figure 3 shows the deployment flow and method for each component. Figure 3 Deployment flow for 5900v virtual switch components Station 1 Station 2 Station 3 #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 #11 #12 VFE VFE VFE ware ESXi Install a VFE: 1. Log in to the vcenter Server through the vsphere client, and enter the HP 5900v configuration page. 2. Click VFE Configuration. 3. Select the ESXi host where the VFE is to be installed, and click Install. H3C imc 3 ware ESXi ware ESXi Install a VCE: 1. Log in to the vcenter Server. 2. Click File, and select Deploy OVF Template from the shortcut menu. 3. Specify an ESXi host on which the VCE resides. 4. Configure the IP address, username, and password for accessing the vcenter Server. 5. Configure the IP address, username, and password for accessing the HP IMC. 1 vcenter server Install a plug-in: 5900v The plug-in is automatically installed to the vcenter Server after the VCE is installed. VCE 2 VCE deployment To deploy a VCE: 1. Log in to ware vsphere Client. 2. In the toolbar of ware vsphere Client, select Deploy OVF Template from the File menu. 3. Select a VCE file path from the list to deploy the OVF template from the file. 4. Accept the end user license agreements. 3
5. Specify a name (the on which the VCE resides) and location (the cluster or data center on which the VCE resides) for the deployed template. 6. Specify an ESXi host on which you want to run the deployed template, and a destination storage location and disk format for the files. 7. Configure properties (such as IP address, subnet mask, and default gateway) for the VCE. 8. Click Finish after verifying the configurations to complete VCE deployment. VCE is based on the standard B/S framework. To enter the VCE configuration page (as shown in Figure 4), log in to http://ip:8080/gui, where IP is the IP address or domain name of a with a VCE installed. Figure 4 VCE configuration page The VCE configuration is performed on a Web browser. The following browsers are supported: IE 8.0 and later versions. Firefox 3.6 and later versions. Google Chrome 9.0 and later versions. VFE deployment To deploy a VFE: 1. Launch the ware vsphere Client, connect your ware vcenter Server, and click the HP VDS tab. 2. Click VFE Configuration in the VFE area. 3. As shown in Figure 5, select a host on which you want to install a VFE, and click Install. Figure 5 VFE installation page 4
deployment A plug-in is integrated into the vcenter Server, and it provides configurations and management for port groups. You can add the plug-in to the vcenter Server on the global configuration page. To deploy a plug-in: 1. Log in to http://ip:8080/gui, where IP is the IP address or domain name of a with a VCE installed. 2. Configure the IP address, username, and password for accessing the vcenter Server. 3. Click the icons for connecting the vcenter Server and installing the plug-in. 4. Log in to ware vsphere Client after the plug-in is installed, and select datacenter from the navigation tree. The HP 5900v VDS tab appears on the page, as shown in Figure 6. Figure 6 configuration page For the installation procedures of the HP 5900v virtual switch, see HP FlexFabric Virtual Switch 5900v Installation Guide. Workflow As shown in Figure 7, the 5900v virtual switch workflow is as follows: 1. The network administrator logs in to HP IMC VCM to configure VSI type and VLAN attributes. 2. The server administrator creates and configures a port group by using the 5900v virtual switch plug-in in ware vcenter Server. The plug-in communicates with HP IMC VCM through the REST interface to obtain the VSI type of the VLAN to which the port group belongs. 3. The server administrator does the following: Creates a through ware vcenter Server. Specifies a virtual NIC for the. Applies the port group to the virtual NIC. 4. VCE initiates the VDP negotiation to the physical switch (EVB bridge) to associate VSIs on the with the ports on the physical switch after the is powered on. 5
5. The physical switch does the following: Requests network policy configurations for the VSI type from IMC through HTTP or HTTPS. Applies the configurations to the ports. 6. After receiving the data, the VFE searches the local OpenFlow flow entries for the destination port for data forwarding. If no port is matched, it forwards the data to the VCE component, which determines the forwarding policy and destination port. 7. When a migrates, the physical switch does the following: Obtains the network policies from the NMS according to and VSI type information obtained through VDP. Deploys the network policies to the VSI. Figure 7 5900v virtual switch workflow Create and configure a port group by using the 5900v virtual switch plug in 5900v virtual switch VCE The VFE sends a packet without matched entries to in ware vcenter. the VCE. The VCE generates flow entries according VCE initiates the VDP 2 to the packet, and applies the flow entries to the negotiation to the physical 7 Server administrator VFE. switch (EVB bridge) after the Physical server Physical server 3 is powered on. 4 App App App App App Create a through ware vcenter Server ware vcenter, 5 specify a virtual NIC for the, and apply the 5900v virtual switch VDP negotiation. 5900v virtual switch VFE 5900v virtual switch VFE port group to the virtual NIC. Network administrator CaaS Designer VTDB 2 Query available VSI types through the REST interface. Request network policy configurations for the VSI type, and apply the configurations to the ports. 6 1 Configure VSI type and VLAN attributes. HP IMC VCM Connection Mgmt. The physical switch obtains the network policies from the NMS according to and VSI type information through VDP, and deploys the network policies to the VSI. Physical switch(evb bridge) Layer 2 network Port-group based connections A port group in the 5900v virtual switch is defined as a group of network policy attributes, such as VLAN, PVLAN, VEPA, and link aggregation. A port group allows for defining the same network policies for s in the same service, and applying the port group to the virtual NICs on the s through ware vcenter Server. If a network policy in the port group changes, the new policy takes effect immediately without reboot. Service continuity and high availability of the system are ensured in this way. 6
Figure 8 Port-group based connections Station 1 Station 2 #1 #2 #3 #4 #5 #6 #7 #8 HP 5900v VDS ware ESXi ware ESXi Port group: Web Emails Authentication Database HP imc vcenter Server Network policies applied to s 5900v VCE Automatic deployment of network policies for migration In a virtualization environment, failures, dynamic resource scheduling (DRS), server failures, or planned server stoppage might result in migration. To ensure service continuity: Network policies for virtual NICs must be migrated. Network policies for ToR access switch ports that connect to the servers must be migrated. Network policies for virtual NICs are stored on the local disk of a server, and they can be copied to the target server when a migration occurs. Network policies for a ToR access switch port that connects to the server are stored on the ToR access switch. It is difficult to migrate network policies for a ToR access switch port to another ToR access switch port when a on a server migrates to another server. To enable migration of network policies for ToR access switch ports, the IEEE 802.1 working group has drafted a standard called 802.1Qbg Edge Virtual Bridging (EVB) for data center virtualization. It includes the following: Formats and requirements for forwarding inter- traffic and traffic between s and the external network. A group of control and management protocols for the network with s and I/O virtualization environments. EVB becomes the pipeline that connects computing resource scheduling and automatic network connection migration. EVB also passes the network traffic created in s to a physical switch attached to the server for processing. This greatly reduces costs for CPU usage and storage consumption, and provides more computing resources for services. EVB is compliant with 802.1Qbg, which is drafted by HP. EVB includes VEB, VEPA, multichannel, and remote copy of broadcast or multicast traffic by the physical switch. 7
Figure 9 Automatic deployment of network policies for migration Station 1 #1 #2 #3 Station 2 #1 #5 #4 #2 #6 #3 #7 #4 #8 HP 5900v VDS ware ESXi Network policy migration: ware ESXi Maintains network Reasons for migration: policies for ports through failures EVB protocol negotiation VEPA traffic forwarding SOAP/REST interface obtains network policies for ports Dynamic resource the 802.1 Qbg standard. Makes sure network scheduling (DRS) policies remain the same Hardware maintenance HP imc before and after Hardware failures migration. 5900v vcenter Server Ensures service continuity. VCE Clear boundary between virtual computing and network control In a virtualized environment, vswitch runs in stations to control inter- traffic. However, it is managed by the server administrator, which results in difficult vswitch configuration management. Figure 10 Clear boundary between virtual computing and network control Station 1 #1 #2 #3 Station 2 #5 #4 #6 #7 #8 5900v virtual switch VDS ware ESXi ware ESXi Server administrator Network administrator Manages computing Manages virtual resource virtualization switching policies HP imc vcenter Server 5900v VCE As shown in Figure 10, when the 5900v virtual switch is integrated with ware vcenter Server, it allows the server administrator to use the ware tools for managing s. It also enables the network administrator to use the Web configuration tools for managing the network. Although server administration and network administration work independently, the 5900v virtual switch can implement the same configurations and policies in the virtualization environment on the EVB stations. This clarifies the boundary between virtual computing and network control. 8
Application scenarios The 5900v virtual switch provides granular control and management of traffic in virtualized environments, such as data centers deployed with the ware ESXi Enterprise Plus Edition. The VEPA forwarding and traffic monitoring and management provided by the 5900v virtual switch enable you to implement automatic deployment of a network. To deploy a network: Install an EVB bridge (such as an HP 5900 switch) on top of a standard 42U server rack. Connect a rack or blade server that supports hardware-assisted virtualization (Intel VT or AMD-V) to the EVB bridge through a standard Ethernet network cable. Connect the EVB bridge to an aggregation switch or core switch in the network through a copper cable or an optical fiber. Install the ware vsphere 5.0 or later version on each EVB station, and manage EVB stations as a cluster, so they can share the iscsi or FC storage. Deploy the virtualized management platform ware vcenter Server, distributed vswitch controller 5900v virtual switch VCE, and network management platform IMC VCE in the management center. Figure 11 5900v virtual switch network topology Service systemservice systemservice system OS OS OS network control through ACLs, QoS, Netstream, and mirroring Internet Server access HP 5900 Internet access Core HP 12500 Hardware virtualization OpenFlow traffic forwarding Server administrator Network administrator Management center Storage access HP 5900 ware vcenter Server 5900v virtual switch plug-in iscsi storage array HP P4500 Unified management of server virtualization Port group configuration management HP imc VCM 5900v virtual switch VCE VDP negotiation OpenFlow flow entry control As shown in Figure 11, the traffic control and management process by the 5900v virtual switch is as follows: 1. The server administrator logs in to the virtualized management platform ware vcenter Server (the network must be reachable). 2. The server administrator manages and monitors the data center infrastructure (including cluster management, creation, deletion, startup, shutdown, clone, or migration for a ) and port group configuration management. 3. The network administrator does the following: { Creates VSI type and network policy resources on IMC VCM. 9
Saves the network resource configurations to the VTDB database. 4. When a is created, started, or migrated, VDP negotiation is performed between the HP 5900 switch (EVB bridge) and the 5900v virtual switch VCE. 5. The HP 5900 switch does the following: Obtains network policy configurations for the VSIs on the from IMC VCM through HTTP. Applies the configurations to its ports. 6. The VFE that is integrated in ware vsphere forwards traffic from the s. For traffic that cannot match any destination port, the VFE delivers it to the VCE, which determines the forwarding policy and destination port. 7. The HP 5900 switch does the following: Controls the service traffic of s through ACLs, VLAN, DHCP snooping, and ARP detection. Forwards the data to the destination. 10