Avi v20.1 — What’s New in Scalable, Multi-Cloud Load Balancing

©2020 VMware, Inc.
VMware NSX Advanced
Load Balancer
(Avi Networks) v20.1
Avi Networks Team
Ashish Shah, Chandra Sekar
What’s New in Scalable, Multi-Cloud
Load Balancing

©2020 VMware, Inc.
Agenda
2
Introduction
Market drivers and challenges of traditional load balancers
Avi Networks vision
v20.1 update summary
Short demo
Q&A

©2020 VMware, Inc. 3
VMware Networking and Security: A Brief History
Customers
6500+
2012 2020
15,000+
2013 2017 2018 20192016
VCN
2020
Avi Acquisition
(A Complete Stack)
NSX Intelligence/
Service-defined
Firewall
Nyansa Acquisition
Veriflow Acquisition
NSX with
Intrinsic Security
VCN
2018VeloCloud
Acquisition
NSX-T
VMs, Containers,
Bare Metal
vRealize Network
Insight
Nicira
SDN Acquisition

ONE YEAR LATER

6/10Top US Financials Are
Customers
47%Lower Cost of Operations
97%
Faster to Scale
Capacity
1M+Transactions per
Second
7000+
Appliance Load
Balancers Replaced
70%Customer Growth in
One Year

Consistent application services for non-VMware and VMware environments
What is the NSX Advanced Load Balancer (Avi Platform)?
Enterprise-grade Load
Balancing
Kubernetes Ingress Services
App Analytics / Insights
Web Application Firewall
(WAF) and App Security
DNS and IPAM
Global Server Load
Balancing (GSLB)
NSX
Horizon(VDI)
vSphere/vCenter
Deliver
Any App
on
Any Cloud
with
One Platform
VCF
VMC
Tanzu
vRO/vRA

What Businesses and IT are Facing Today
$
By Supporting
Remote Workers
To Doing More At
Lower Costs
The old approach to network infrastructure simply won’t work
Digital Initiatives
and Modern Apps
Respond Adapt Accelerate

Hardware / Virtual Load Balancer Challenges
Active
15%
Standby
0%

Islands of capacity

Capacity management – manual VIP
placement, costly overprovisioning, no
capacity pooling
No capacity pooling
?
?
?
?
?
?
?

Capacity management – manual VIP
placement, costly overprovisioning, no
capacity pooling
Separate control points –
operational complexity, hard
to automate, painful upgrades
Not designed for modern
new environments like
on-premises, cloud and container

Can I have the Best of Both Worlds?
The legacy VEs and cloud provider solutions are an unacceptable compromise
Load Balancing Challenges/Tradeoffs in the Public Cloud
Legacy
Virtual
LB
offers
features
Cloud
Provider
LB
offers
automation
& elasticity
?Tradeoff operational simplicity,
automation, and cloud-native
capabilities
Tradeoff features, multi-cloud
consistency, and portability

Use load balancer’s inline location to deliver comprehensive application services
Our Vision for Application Services
Application trafficApplication traffic
ElasticityUniversality Multi-cloud Central Mgmt. Deployment
Platform
Scale Out Scale In

Use load balancer’s inline location to deliver comprehensive application services
Our Vision for Application Services
Application trafficApplication traffic
ElasticityUniversality Multi-cloud Central Mgmt. Deployment
Platform
Scale Out Scale In
Services
Traffic
Mgmt.
App
Security
Analytics
Visibility
• Local and global load balancing
• Path-based routing
• Health monitoring
• TLS termination, Cert mgmt. & automation
• CI/CD, Canary deployments
• DNS
• Application policies
• Authentication
• Whitelist/Blacklist
• IP Reputation
• Bot detection*
• Rate limiting
• DOS detection/mitigation
• WAF
• Application and infra
performance metrics
• Transaction logging
• Transaction tracing
• Security insights
• End-user insights

Delivers load balancing as a dynamic application services fabric
Modern Distributed Architecture
Centralized Policies and Full Life Cycle Management
App Services
Control Plane
Data Plane
Software Load Balancer Intelligent WAF Container Ingress
Avi Controller
Bare Metal Virtualized Containers
ON PREMISES PUBLIC CLOUD
SEPARATE CONTROL &
DATA PLANE
ELASTICITY
Application Services Fabric
MULTI-CLOUD
ANALYTICS AUTOMATION

Cloud Native
With automation across heterogeneous infrastructure
Comprehensive Application Services Platform
Load
Balancing
Security Analytics Platform
Central Management
100% REST API / SDK
Self-Service
Multi-Tenancy
Service Discovery
IPAM/DNS
Application Map
Service Health Score
Network Performance
App Performance
Request Logging
Security Insights
Web App Firewall
SSL Termination
DDoS Protection
L3-4 ACLs
L7 Rules/Policies
Rate Limiting
Client Auth / SSO
L7 (HTTP) LB
L4 (TCP/UDP) LB
Global Load Balancing
Content Switching
Caching/Compression
Autoscaling
Enterprise Grade

NSX
VCF
vCenter
Bare Metal
OpenStack
VMC on AWS
AWS
Azure
GCP
Kubernetes
OpenShift
VMware Tanzu
PKS
AKS, GKE, EKS
Customer Use Cases – Every Application Needs a Load Balancer
SDDC / On-prem
LB Refresh
Public Cloud Containers
GSLB / Local LB App Security, DDoS, WAF
Platform Use Cases
EUC
Horizon VDI
Horizon Cloud on
Azure

Introducing NSX Advanced Load Balancer v20.1
• Wildcard VIP
• BGP Enhancements
• GSLB, DNS, IPAM
canary updates
• Full integration for
Google Cloud Platform
• PULSE cloud services and
proactive case
management
• WAF threat feeds, rate
limiting enhancements
• OCSP Stapling for certs
• SAML 2.0 updates
• VCF (VVDs)
• vRO/vRA plugin
• NSX-T full access
LB and WAF
• Ingress services
architecture for highly
scalable, multi-cluster, multi-
site K8S/OpenShift
networking services
Consolidate with
Integrated VMware
Solutions
Accelerate to
Multi-cloud
Secure Web Applications,
Proactive Support
Deliver
Scalable
Modern Apps

21©2020 VMware, Inc.
Wildcard VIP

Wildcard VIP for Firewall(VNF) Load Balancing Use Cases
Firewall Sandwich Firewall On-a-stick
I
P
S
1
I
P
S
2
I
P
S
3
Internal
10.10.0.0/8
10.2.1.10/24
10.2.1.21/24 10.2.1.23/24
10.2.2.10/24
10.2.2.21/24 10.2.2.23/24
10.2.0.2/24
10.2.3.2/24
10.2.0.1/24
10.2.3.1/24
Internet
Internal
10.10.0.0/8
10.2.0.2/24
10.2.3.2/24
10.2.0.1/24
10.2.3.1/24
10.2.1.10/24
10.2.1.21/24
10.2.1.23/24
10.2.1.22/24
IPS 1
Avi SE-1
Avi SE-1
Avi SE-2
Internet
IPS 2
IPS 3

Canary GSLB Updates

Traditional GSLB Challenges with Large Fault Domain
Default behavior- Attempts to keep all the site
up-to-date with the leader.
GSLB Config change
Leader Site
Follower - 1 Site Follower - 2 Site
Admin
Instant replicationInstant replication
Replication of faulty configuration can lead
to application break down across sites
Faulty configuration
Config -C1
Config -C1 Config -C1
Application
breakdown
Application
breakdown
Application
breakdown

Verify before propagation
NSX Advanced LB Approach: Canary GSLB Updates
Leader Site
Objectives
• DNS service cannot be down
• Intelligent sync of configs to followers
• Avoid faulty configs from breaking apps
globallyFollower - 1 Site Follower - 2 Site
1. Configuration change – C1
1
Config -C1 Config -C1
4. Replication is triggered for individual sites
4 4
Config -C1
2. Leader processes the new config but
does not replicate instantly
2
Deployed
3. Once configuration is deployed and verified;
replication policies are propagated.
3

PULSE Cloud Services
Product, User, License, and Support Experience.

Cloud Services to Deliver Timely Support, Security, Updates
Secure – Agile – Programmable
Proactive and
integrated support
operations
Live security threat
with intelligence feed
Simplified customer
license experience
End User / Customer Release Development Avi Controller
Avi PULSE API
Customer
Portal
Tech
Support
Integrated Case
Management
App Security
Signatures
IP Reputation Live
Updates
Central
LicensingSaaS Portal
Proactive
Support
WAF CRS
Signatures
Avi (legacy)
License
Portal
Software &
Patch
Downloads
Controller
Deployments
Customer Support Database
Avi PULSE Cloud Services

NSX-T Integration

NSX Advanced Load Balancer and NSX-T Integration
NSX-T Manager
Avi management traffic
over secure channel API
vCenter
Avi Controller
Avi UI
API
REST API
ESXI
API
ESXI
Deploy SEs
on ESXi
ESXI
Notifications
Full LB and Security Automation for
App Deployments
• Lifecycle of LBs and elastic scale
• Puts LBs in the right network
• Automates Virtual IP allocation via IPAM
and registers FQDN in DNS
• Automatically programs NSX for scale
out
• Creates the right security policies for
traffic flow with Distribute Firewall rules

NSX Advanced LB Kubernetes
Ingress Services

Traffic Management & Service Discovery
What are Ingress Services for Kubernetes?
CISO
Developers
Operators
Security
• Local and global
load balancing
• Routing
• Health Monitoring
• TLS termination, Cert
management/automation
• CI/CD, Canary
• DNS
• Network policies
• Authentication
• Whitelist/Blacklist
• Rate limiting
• DOS detection/mitigation
• WAF
• Application and infra
performance metrics
• Transaction logging
• Transaction tracing
Observability

Challenges with Ingress Services for Kubernetes
Pod Pod Pod Pod Pod Pod
Node 1 Node N
Cluster 1:
Active Standby
Traffic to other
clusters/sites
IPAMDNS
…
• Multiple discrete solutions
Disparate partial LB, Ingress, GSLB, DNS,
IPAM and WAF products
• Complex operations
Difficult to manage and troubleshoot
independent components
• Lack of observability
Stitch together multiple products with little
analytics and no end-to-end visibility
• Limited automation
Lack of end-to-end automation
GSLBF5
L4 LB L4 LBF5 WAFImperva
Ingress Controller
Open
Source Ingress Controller
Open
Source

Architectural advantage - single platform and converged app services for K8S
NSX Advanced LB Consolidates Kubernetes Services
• Integrated solution
Comprehensive LB, Ingress,
intrinsic security, WAF, GSLB, DNS, and
IPAM
• Operational simplicity
A single solution with central control and
ease of troubleshooting
• Rich observability
Real-time telemetry with application
insights across all components
• Cloud-native automation
Elastic autoscaling based on closed-loop
analytics and decision automation
Avi Consolidated Application Services
GSLB / DNS / IPAM
+
WAF
+
Ingress + LB

Demo
A single application
services fabric across
multiple clouds
Virtualized Containers
Bare Metal Virtualized Containers
Virtualized Containers
On-premises

• Highly automated load balancing for to
provide self-service to application teams
• Can shorten time-to-market from 12 months to
3 weeks from inception to production
• Best-in-class solution for OpenShift –
automates system changes in seconds
• High availability and resiliency simplifies
operations and patching of infrastructure
Transforming IT with a modern PaaS platform using Avi Networks
Deutsche Bank Delivers “Everything-as-a-Service”
Avi is completely agnostic
and polyglot. It really doesn’t
matter which environment
you want to run; you can run
Avi on it.
Adam Spencer
Product Owner for Fabric
“
https://avinetworks.com/customers/

• Migrate the Adobe Experience Cloud to the Azure
with enterprise-grade support
• Deliver thousands of SSL transactions per second,
and elastic scale of load balancers and app
servers based on real-time traffic
• Improve operations with app insights and central
management of all load balancers
Delivering applications reliably and securely both on-premises and in the cloud
Adobe Accelerates Cloud Initiatives with Microsoft Azure
By reliably and securely
delivering our applications,
Avi Networks has become a
key partner for our adoption
of Azure.
Brandon Pulsipher
Vice President, Product Technical Operations
“

NSX Advanced Load Balancer – Proof Points
Enterprise-grade, multi-cloud application services
Simplifies root cause
analysis and
automates decisions
Automates
provisioning and
enables self-service
Scales elastically, on
demand, based on
real-time traffic
Reduces
operational
complexity
30+%
Lower TCO
41%
Less Time
Troubleshooting
90%
Faster
Provisioning
1M+
SSL TPS

Learn More
https://avinetworks.com/workshops
https://avinetworks.com/docs/20.1/release-notes/

Avi v20.1 — What’s New in Scalable, Multi-Cloud Load Balancing

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Avi v20.1 — What’s New in Scalable, Multi-Cloud Load Balancing

Similar to Avi v20.1 — What’s New in Scalable, Multi-Cloud Load Balancing (20)

Recently uploaded

Recently uploaded (20)

Avi v20.1 — What’s New in Scalable, Multi-Cloud Load Balancing