Session objectives and takeaways Objectives Explain SDN Core Concepts Deploy SDN Fabric with SCVMM 2016 Takeaways: Deploying SDN Fabric components with SCVMM requires planning Deploying Tenant Resources is simple
SDN Overview in WS2016 Complete new SDN Stack Data plane using Azure Virtual Filtering Platform (VFP) HNVv2 in WS2016 is incompatible with HNVv1 in WS2012R2 New Server Roles in WS2016 Azure inspired Network Controller and Software Load Balancer VXLAN encapsulation support Existing HNVv1 SDN Stack will continue to work and will be supported No additional features added/planned
SDN Abstraction Layers Management Plane Control Plane Data Plane Example: ACLs Management Plane ARM, SCVMM, Scripts Network Controller Management plane Control plane Data plane Create a tenant ACL Plumb these tenant ACLs to the virtual switches Apply these ACLs to these flows Control Plane Switch (Host)
SDN Management Path System Center 2016 Virtual Machine Manager Service templates Microsoft Azure Stack Integrated into installation process PowerShell / Scripts Choose your management path!
SDN Control Plane Network Controller Centralized, programmable point of automation to manage, configure, monitor, and troubleshoot virtual and physical network infrastructure in your datacenter.
SDN Building Blocks Network Controller Virtual Machines running the Network Controller Microservices on top of Azure Service Fabric Cluster Software Load Balancer Virtual Machines running the Virtual Networks load balancer rules Gateways Virtual Machines running the Virtual Networks Gateways
SDN Deployment Options SCVMM Console (GUI) Service Template Deployment and Configuration this Session 'VMMExpress' PowerShell scripts 'SDNExpress' PowerShell scripts https://github.com/microsoft/sdn
Start with the physical network Subnets with VLANs: Management for management VM and host HNV PA for virtual network traffic Transit for inbound/outbound gateway traffic Subnets without VLANs: Private VIPs stay within datacenter Public VIPs externally routable Storage may require additional networks
Sample Network Topology Network Name Subnet Mask VLAN ID on trunk Gateway Reservations (examples) Management 10.184.108.0 24 7 10.184.108.1 10.184.108.1 - Router 10.184.108.4 - Network Controller 10.184.108.10 - Compute host 1 10.184.108.11 - Compute host 2 10.184.108.X - Compute host X HNV Provider 10.10.56.0 23 11 10.10.56.1 10.10.56.1 - Router 10.10.56.2 - SLB/MUX1 Transit 10.10.10.0 24 10 10.10.10.1 10.10.10.1 - router Public VIP 41.40.40.0 27 NA 41.40.40.1 41.40.40.1 - router 41.40.40.2 - SLB/MUX VIP 41.40.40.3 - IPSec S2S VPN VIP Private VIP 20.20.20.0 27 NA 20.20.20.1 20.20.20.1 - default GW (router) GRE VIP 31.30.30.0 24 NA 31.30.30.1 31.30.30.1 - default GW
Sample SDN Fabric Deployment
Review the Physical Network Plan Network Name Subnet Mask VLAN ID on trunk Gateway Reservations (examples) Management 10.184.108.0 24 7 10.184.108.1 10.184.108.1 - Router 10.184.108.4 - Network Controller 10.184.108.10 - Compute host 1 10.184.108.11 - Compute host 2 10.184.108.X - Compute host X HNV Provider 10.10.56.0 23 11 10.10.56.1 10.10.56.1 - Router 10.10.56.2 - SLB/MUX1 One Management IP Address per Host (Static or DHCP) Two HNV Provider IP Addresses per Host (Assigned by Network Controller)
Deploy NC Service Template Prepare Infrastructure Active Directory Groups Management Logical Network Create and Export Certificates Self-Signed or CA-Signed Network Controller Service Template Import, Configure, Deploy
NC Service Template - Sample Standalone Template Single-Node Deployment of Gen 1 or Gen 2 VMs Production Template Three-Node Deployment of Gen 1 or Gen 2 VMs
Network Controller Onboarding Add Network Controller Service to VMM Create HNV Provider Logical Network Managed by Network Controller Create Tenant Virtual Network Validate Deployment
Deploy SLB Service Template Create Logical Networks and IP Pools Transit Public VIP Private VIP Re-use NC Certificates SLB Service Template Import, Configure, Deploy
SLB Service Template - Sample Three-Node Deployment Scale-In/-Out
Configure SLB Service Instance Associate SLB Instance Configure BGP Peering Local ASN of SLB Instance BGP Peer Information Routing information exchanged for Public VIP reachability only
Deploy Gateway Service Template Create Logical Networks and IP Pools GRE VIP Gateway Service Template Import, Configure, Deploy
Gateway Service Template - Sample Three-Node Deployment Scale-In/-Out
Configure Gateway Service Instance Associate GW Instance Specify GRE VIP Subnet Specify Public IP Pool GW VIP Configure BGP Peering Local ASN of GW Instance BGP Peer Information
Review: Session objectives and takeaways Objectives Explain SDN Core Concepts Deploy SDN Fabric with SCVMM 2016 Takeaways: Deploying SDN Fabric components with SCVMM requires planning Deploying Tenant Resources is simple
SDN Capabilities in WS2016 Network controller Central control plane Fault tolerant Virtual Networking BYO address space Distributed routing VXLAN and NVGRE Network Security Distributed Firewall Network Security Groups BYO Virtual Appliances Robust Gateways M:N availability model Multi-tenancy for all modes of operation BGP Transit Routing Software Load Balancing L4 load balancing (N-S and E-W) with DSR NAT For tenants and cloud based infrastructure Data Plane Advancements Performance: 10G, 40G and beyond! RDMA over Virtual Switch Consistency with Azure in UI, API and Services
Azure Virtual Filtering Platform (VFP) Acts as a virtual switch inside Hyper- V VMSwitch Provides core SDN functionality, including: Address Virtualization for VNET VIP -> DIP Translation for SLB ACLs, Metering, QoS, Security Guards Uses programmable rule/flow tables to perform per-packet actions Supports all data plane policy at 40GbE+ with offloads NIC vnic vnic VM Switch VM VM VFP ACLs, Metering, Security VNET SLB (NAT)
Flow Tables: Right Abstraction for the Host VMSwitch exposes a typed Match- Action-Table API to the controller Controllers define policy One table per policy