Lecture 8 Advanced Networking Virtual LAN Antonio Cianfrani DIET Department Networking Group netlab.uniroma1.it
Advanced Networking Scenario: Data Center Network Single Multiple, interconnected via Internet Drawbacks of legacy solutions New protocols to support the management of a Data Center providing intensive data processing: Ethernet: VLAN and VXLAN IP addressing : LISP Novel network principles/architectures: Software Defined Networking (SDN) Network Function Virtualization (NFV)
Devices Data Center (1/2) High performance servers organized in racks (thousands of racks, 20-40 servers per rack) Switches (many) Routers (few) Google Data Center: http://webodysseum.com/technologyscience/visit-the-googles-data-centers/
Data Center (2/2) Topology Hierarchical (more in the third part of the course) Virtualization Tenants: a group of users asking for dedicated Virtual Machines (VMs) where to execute specific jobs Core Switches Aggregation Switches Access Switches
Layer 2 networks Basic principles of an Ethernet (Layer 2) network: MAC Addresses ARP Switch plug and play device MAC Forwarding Table MAC Learning Drawback in a Data Center infrastructure with thousand of end devices (VM): Isolation of network portions (Security) Broadcast storm
Virtual LAN Separation of a physical network in different logical networks: Virtual LAN (VLAN) A VLAN is identified by means of a VLAN ID Each virtual LAN has its own IP address space Communication possible only inside the VLAN H1 H2 H3 H4 H5 H6 H7 H8 H9
Virtual LAN Separation of a physical network in different logical networks: Virtual LAN (VLAN) A VLAN is identified by means of a VLAN ID Each virtual LAN has its own IP address space Communication possible only inside the VLAN VLAN 1 VLAN 2 VLAN 3 H1 H2 H3 H4 H5 H6 H7 H8 H9
Switch configuration The introduction of VLAN requires the complexity increase of switches. Switches must: know the used VLAN associate each interface to the proper VLAN identify packets belonging to different VLANs maintain a MAC forwarding table for each VLAN Interfaces are classified in: Access port (to host) Trunk port (to switch)
Access and Trunk ports Trunk port Access port H1 H2 H3 H4 H5 H6 H7 H8 H9
Access port Static association Location-based Each access interface is statically associated to a specific VLAN Configured by the network administrator in the switch Dynamic association MAC address based Each host is associated to a specific VLAN The switch has to query a server to know the VLAN of the host (for the first time it send a frame in the network)
Trunk port The interface must be able to detect the VLAN each received frame belongs to. Each frame must have a VLAN identifier in its L2 header Ethernet extension: 802.3Q VLAN ID 802.3 (Ethernet) frame 802.3Q frame VLAN ID (12 bit) about 4K different VLANs
VLAN and Data Center A tenant request (i.e. a job execution): Job partitioned in tasks A VM for each task (or set of tasks) exploiting parallel and distributed algorithms (Map and Reduce) The VMs will exchange data (bit/rate impact the performance) A VLAN is dedicated to each tenant: VM belonging to same VLAN IP address space Switches configuration Path computation (loop problem, more in the third part of the course)
VLANs communication VLANs are isolated To make possible the communication among devices belonging to different VLAN,, a router (L3 device) must be inserted. It is possible to connect a subset of available VLANs H1 H2 H3 H4 H5 H6 H7 H8 H9
Virtual extensible LAN (VXLAN)
Network scenario Multiple Data Centers: Remote Layer 2 networks Same company Interconnected by Internet DC 1 INTERNET DC n DC 2.
Physical infrastructure Network devices: Servers: Virtual Machines (VMs) Switches: inside the DC Routers: among the DC and Internet DC1 DC2 INTERNET
A single LAN! The VMs of all Data Centers belong to the same L2 network! How is it possible? Internet (Layer 3) is required for the communication among VMs of different Data Centers DC1 DC2 INTERNET
A single LAN! DC LAN DC1 DC2 INTERNET
VXLAN: the idea Virtual extensible LAN (VXLAN) The idea is to create a logical direct connection among the DCs: H1 will be able to send a frame to H9 directly, i.e. like they were in the same L2 network MAC(H1) MAC(H9) H1 DC1 TUNNEL DC2 H9 VTEP (VXLAN Tunnel End Point) VTEP
VXLAN: the overlay network The Ethernet frame is encapsulated into an UDP packet from Router A to Router B (MAC-in-UDP encapsulation) IP header UDP header VXLAN header Original frame 8 byte IP source and destination addresses of the VTEPs VNI (24 bit): identifier of the VXLAN the frame belongs to UDP destination port: a port number assigned to VXLAN (4789)
VTEP Maintains servers to VXLAN mapping Perform encapsulation/decapsulation A VTEP has two interfaces: One (or more) toward the local LAN the other one toward the IP network (with a unique IP address) The communication among VTEPs is performed using multicast (an IP technology to create groups): a multicast group for each VXLAN Learning and broadcast: when a VTEP receive a frame directed to an unknown MAC address, it sends it to all VTEPs belonging to the same VXLAN group
VXLAN: the number of LAN segments Data center: thousand of tenants thousand of VLANs VLAN ID: 12 bit about 4K different LAN segments (VLANs) VXLAN ID: 24 bit about 16M different LAN segments (VXLANs) Virtualized environment: about 32 VMs running on the same server each VM requires a MAC and an IP address (overlapping IP and MAC) Virtualized environment: the VTEP functionality can be performed directly at access-level
VXLAN: the real implementation The VTEP functionality are performed directly at access-level VTEP VTEP DC1 DC2 INTERNET
VXLAN: the advantages Flexibility: the workloads of a tenant can be placed across different physical locations (to minimize a specific objective function) Scalability: up to 16 M different tenants (each with a dedicated LAN segment) can be supported Paths availability: Layer 3 paths computation strategies, such as Equal Cost Multi Path (ECMP), can be exploited, providing better resource utilization with respect to Layer 2 ones. VXLAN can be used also in a single DC scenario
VXLAN and NVGRE VXLAN: defined and proposed by Cisco, VMware, Citrix, Red Hat, Arista and Broadcom. NVGRE: defined and proposed by Microsoft, Arista Networks, Intel, Dell, Hewlett Packard, Broadcom and Emulex NVGRE (Network Virtualization using Generic Routing Encapsulation): TNI (Tenant Network Identifier): 24 bit GRE: encapsulation mechanism (anything into anything) IP header GRE header Original frame