Scaling Your Cloud with Nexus 1000V

VM VM VM VM • Industry’s only 3rd-party vNetwork Distributed Switch Nexus 1000V 1000V • Built on Cisco NX-OS vSphere • Compatible with all switching platforms Nexus 1000V Policy- Policy-Based Mobility of Network & Non- Non-Disruptive VM Connectivity Security Properties Operational Model© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

Virtual Security • Cisco vPath for virtualized VM VM Gateway network services VM VM • No need for service VM on 4 every server Nexus 1000V vPath • Virtual Security Gateway 3 Decision • Nexus 1010: Virtualized Initial Packet Caching 1 Services Appliance Flow 2 Flow Access Control (policy evaluation)© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4

Virtual Appliance Nexus 1010 VSM-A1 VSM-A4 VSM-B1 VSM-B4 Modular Switch Supervisor-1 VEM-N VSM1 Supervisor-2 Back Plane L2 Mode L3 Mode VEM-1 Linecard-1 VSM2 Linecard-2 … VEM-2 Linecard-N• 200+ vEth ports per VEM• 64 VEMs per 1000V• 2K vEths per 1000V• Multiple 1000Vs can be created per vCenter ESX ESX ESXVSM: Virtual Supervisor ModuleVEM: Virtual Ethernet Module © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

Virtual Appliance Nexus 1010 vWAAS VSG VSM VSM-A1 VSM-A4 NAM VSG VSM-B1 VSM-B4 NAM VSG vPath • Virtual Service Datapath L2 Mode L3 Mode VSG • Virtual Security Gateway for 1000v vWAAS • Virtual WAAS VEM-1 VEM-2 vPath vPath ESX ESX© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6

VM VM VM VM VM VM VM VM VM VM VM VM Nexus Nexus Nexus 1000V 1000V 1000V VEM VEM VEM Virtual Supervisor Module (VSM) • Virtual or Physical appliance running VirtualNXOS (supports HA) (VEM) Cisco Ethernet Module • Enables advanced networking Cisco Nexus 1000V Installation • Performs management, monitoring, capability on the hypervisor Nexus 1000V VSM and configuration • ESX and each VM with dedicated • Provides ESXi with VMware vCenter • Tight integration • “switch port” VUM and manual installation • Collection of VEMs = 1 vNetwork VEM is installed/upgraded like an Distributed Switch ESX patch vCenter© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7

Virtualized Data Center Desktop Applications Applications Desktop OS 1000V Security Features for VDI Desktop Virtualization Software • Access Control List • Port Security Hypervisor Nexus • Private VLAN WAAS 1000V • DHCP Snooping • Dynamic ARP Inspection • IP Source Guard Nexus Switch ACE WAAS: Wide Area Application Service ACE: Application Control Engine© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8

VMK NIC VM VM VM vMotion Nexus • Class-based Weighted Fair 1000V VEM Queuing (CB-WFQ) • Provide bandwidth vMotion guarantee for up to 16 queues on uplinks 15% VM_Platinum 20% • User defined Queues VM_Gold 15% • 8 Predefined traffic classes 5% For VMware and 1000V Default 30% protocol traffic 15% ESX_Mgmt • Queuing configured via modular QoS CLI (MQC) N1K_Control, N1K_Packet QoS White Paper Available© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9

• Starts with the PCI 2.0 specification and shows you how Cisco Smart + Connected Retail to achieve compliance Reference Architecture• Based on complete architecture for Cisco Smart + Connected Retail, securing POS in store to data center• Includes Nexus 1000V and Virtual Security Gateway• Complete Design and Implementation Guide with detailed configurations© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10

• Network integrity is critical to long distance vMotion Nexus 1000V • Security vSphere • Quality of Service Layer-2 extension across • Network Monitoring DCs with Nexus 7K OTV Cisco Nexus • Troubleshooting 7000 Series • Nexus 1000V provides these critical network functions across data centers Nexus 1000V • VSG enforces security O T V vSphere across data centers Cisco Nexus 7000 Series Reference Implementation: • Includes: 1000V, VSGOTV: Overlay Transport Virtualization • Storage: EMC, NetApp © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11

Cisco’s network-centric virtualized data center is best positioned to enable the journey to the networked cloud 1000V 1000V Vblocks R Virtual Multi- R Imagine: tenant DC 30 racks reduced down to 3 racks Provisioning applications in hours Imagine: instead of weeks Securely sharing servers between multiple users/groups without having to add another server 1000V Flexpod 1010 VSG Virtual 1000V VSG Imagine: R Desktop R Predesigned, validated, Flexible infrastructure that can grow and Imagine: scale to meet cloud computing Over 4000 desktops in a single rack! requirements Savings up to 60+% per PC per year Significant savings in operations© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12

• Nexus 1000V: Over 4,000 Customers• Multiple customers buying 1000+ CPU licenses• Virtual Security Gateway: In Production in 1st Q of shipping VSM VSM VSG NAM VSM DCNM© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13

New Workload Elastic Virtual Exceeding Capacity Workload VM VM VM VM VM VM VM VM VM VM VM VM VM Subnet B Mobility Across Layer 3? Subnet A On Physical Server & How to Optimally Network Infrastructure Leverage Physical Infrastructure?© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14

• Traditional servers have Duplicate MAC & IP Address unique MAC and IP Addresses vApp1 vApp2• vCloud Director duplicates Web VM Web VM VM’s MAC and IP Addresses in vApps Bus VM Bus VM• Another instance of VMs DB with same duplicate VM DB VM network addresses lead to application error• Need to provide network isolation© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15

Cannot Monitor on Cannot Cross Physical Network Layer 3 Layer 2 Layer 2 Web Bus DB VM VM VM Poor Link Utilization MAC-in-MAC Encapsulation© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16

Similar Network Challenges to Server Virtualization• vCloud Duplicates MAC & IP Address for each vApp Duplicate MAC & IP Address• Each vApp Requires Dedicated Secure Channels Same Subnet Only 4096 VLANs in IEEE 802.1Q Web vApp1 vApp2 Web VM VM• Hard for Server & Network Administrators to Collaborate Bus Bus Especially w/ vCloud Director Network VM VM Isolation (vCDNI)• Difficult to Monitor with Existing DB DB VM VM Network Tools For Regulatory Compliance Difficult with vCDNI• Cannot Expand beyond Layer 2 Domains VLAN and vCDNI Restricted to Same Layer 2© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17

• Ethernet in IP overlay • Tunnel between VEMs network VM attach to access ports Entire L2 frame encapsulated in VM do NOT see Network ID UDP • VXLAN can cross Layer 3 50 bytes of overhead Common format between Cisco • IP multicast used for L2 and VMware broadcast/multicast, unknown unicast• Include 24 bit VXLAN Network Identifier • Technology submitted to IETF 16 M logical networks for standardization Mapped into local bridge domains© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18

Web DB DB Web VM VM VM VM• Encapsulate with Blue Logical • Encapsulate with Red Logical NetwrkNetwork ID ID• Multicast to Servers Registered for • Multicast to Servers Registered forBlue Logical Network Red Logical Network © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20

• Blue & Red Logical Network Share GREEN Multicast Group • All 3 Servers in GREEN Multicast Group Web DB DB Web VM VM VM VM• Encapsulate with Blue Logical Discarded Since No VM withNetwork ID Blue Logical Network ID• Multicast to Servers Registered forGREEN Multicast Group Broadcast Sent to More Servers But Broadcast Domain Respected Within Logical Network © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21

• VM broadcast traffic is sent as multicast• VEM learn VM’s Source (MAC, VEM IP) tuple• Unicast packets are VM VM VM VM encapsulated and sent directly (not via multicast)• MAC learning and switching within logical network© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22

VM Connected to VLAN: VM connected with ONLYRestricted Migration in Layer 2 VXLAN: Migrate Across Layer 3 Migrate in L2 Migrate Across L3 VM VM VXLAN VXLAN VLAN Layer 2 Layer 2 Layer 3© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24

Logical Nework Spanning Across Layer 3 VM VM vApp 1 VM VM VM vApp 2 VM Utilize All Links in Scale with Port Channel w/ UDP Repeatable Pods© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26

Service Level Agreement Template Option A: Fully Automated: Every Tenant port-profile Gold-SLA Use Generic SLA service-policy input p-map-1 service-policy output p-map-1 ip port access-group ag-1 in no shutdown state enabled Option B: network-segment policy abc-inc Custom Tenant id 59454326-f9e6-409e-a1ea-8908b0d3f60a Network Policy. type segmentation Script available to import port-profile Gold-SLAAutomate Customer Portal for Custom policy Network Segment Policy: Network policy instance for ABC Inc.© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32

• Management VNICs VMkernel VM VM• Production VM VNICs vCloud Director automatically configures VNIC to appropriate Port Group VMkernel• VXLAN VMKNIC VXLAN VMKNIC With its own IP address• Recommend port channels for PNICs LACP or Virtual Port Channel-Host Mode 5 Tuple Hashing for optimal load balancing© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34

• Switches supporting multicast are required More multicast groups are better Multiple logical networks can be mapped to a single multicast group• Turn on 5 tuple hash distribution for uplink LACP Encapsulation will generate a source UDP port based on a hash of inner packet 5-tuple© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35

Complimentary Advanced Networking Capabilities• VXLAN: For scaling logical networks and crosses L3 LISP site boundaries within a data center xTR• Overlay Transport Virtualization (OTV): Data Center Interconnect for extending Layer IP Network 2 domains between data centers Multicast not required LAN Extension Maintain L2 domain isolation L2 extension for non virtualized workload West-DC East-DC• Locator ID Separation Protocol (LISP): Dynamically reroute IP address based on location of VM VXLAN© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36

• Extends physical server/network • Security operational model into the cloud Port Security• Troubleshooting within a logical Access Control List network • Virtualized Network Services Port statistics with vPath, ERSPAN Virtual Security Gateway, vWAAS Netflow • Network Customization• Quality of Service Tenant-specific network policy IEEE 802.1p including DSCP for VXLAN Differentiated Service Code Point • XML API for Customization & Marking (DSCP) Integration Rate Limiting Class Based Weighted Fair Queuing • Supports vSphere 4.1 and 5.0© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37

• Industry support for VXLAN scalable • Monitor & troubleshoot vApp with cloud network isolation existing network monitoring tools VMware using same frame format • Deploy tier 1 applications in the Submitted for standardization cloud with regulatory compliance• Scalable network isolation: 24-bit • Differentiate with tenant-specific VXLAN Network Identifier over IP network policy• Grow cloud with repeatable server • Nexus 1000V version 1.5 Beta to pods in different subnets start in September• VM with only VXLAN can migrate • For more information: across Layer 3 tinyurl.com/N1k-Resources• Fully integrated with vCloud Director 1.5 for on-demand provisioning QR Code to Scan URL© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38

Thank you.

Scaling Your Cloud with Nexus 1000V

by Cisco Data Center

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Scaling Your Cloud with Nexus 1000V Presentation Transcript