This document provides an overview of VMware vCloud Networking and describes the different layers of networking in vCloud including external networks, network pools, organization networks, and vApp networks. It discusses how these networks are managed and set up and provides examples of portgroup-backed, VLAN-backed, and vCloud Network Isolation-backed network pools. The document also includes examples of different organization network types and use cases to demonstrate how vCloud networking can be configured and leveraged in various scenarios.

1. vCloud Networking
Deep Dive
Updated: 16 November 2010
© 2009 VMware Inc. All rights reserved

2. Agenda
 Networking Overview
 External Network
 Network Pools
 Organization Networks
 vApp Networks
 Example Use Cases
Q&A
2

3. Networking Overview
 Layers of Networking
• External
• Network Pools
• Organization
• vApp
 Managed at two layers: Consumers & Providers
 An External Network is an network that is outside of VMware
vCloud Director.
• This is set up by the Provider
 An Organization Network is contained within an organization.
• This is also set up by the Provider
 vApp Network is a contained within a vApp.
• This is set up by Consumers Note: Both organization networks and vApp networks are entirely
within VMware vCloud Director-managed infrastructure..
3

4. External Network: Overview
 a.k.a ‘Provided Network’
• Network that is external to VMware vCloud Director
• Created in vSphere/vCenter environment and consumed by VMware vCloud
Director to provide external connectivity to Organizations
• Mapped to a portgroup at the VMware vSphere layer
• vSS or vDS
• The portgroup is attached to VMware vCloud Director as an “External Network”
 Use cases
• Internet access
• Provider supplied network endpoints
• IP based storage Set up by Provider
• Backup servers
• Backhauled networking to a customer datacenter
• VPN access to a private cloud
• MPLS termination
4

5. External Networks: In vSphere
• VMware vCloud Director does NOT create portgroups when you create an External
Network
• The VI Admin must create the portgroups first, before a VMware vCloud Director
Provider Admin can map External Networks to them.
• It is recommended that you define these port groups on a dedicated “Provider” vDS vs.
creating them on a vSS on each ESX host in your cluster. (Can use Cisco Nexus 1000V)
• Below is an example of VLAN isolated External Networks:
5

6. External Networks: In VMware vCloud Director
• In VMware vCloud Director, create an External Network and attach it to one of the
portgroups
• Note if done using the VIM SDK you should create an ephemeral port group; otherwise,
you get static portgroups when created with the vCenter UI
6

7. Network Pools: Overview
 A set of pre-configured network resources that can be used for
Organization and vApp Networks
• Use to facilitate VM to VM communication
 Three Types of Network Pools in VMware vCloud Director
• Portgroup-backed
• Reference pre-created portgroups
• These have to be created in vSphere manually or through orchestration
• Do not have to be VLAN isolated (but should for L2 isolation)
• Attach a collection of them to VMware vCloud Director
• VLAN-backed
• Exactly like portgroup-backed…but VMware vCloud Director will automatically
create the portgroups as needed, and use a range of VLANs to isolate them.
• vCloud Network Isolation-backed (vCD-NI)
• VMware proprietary network isolation technology
7

8. Network Pools: Portgroup-backed
Requires
• Preconfigured portgroups at the vSphere layer
• Assign meaningful names so its obvious what is being mapped
• If using vSS portgroups, they must exist on all ESX/ESXi hosts in the cluster
How it works
• The system administrator manually creates the portgroups.
• When creating the network pool, you are given a list of unused portgroups that
exist in the cluster.
Advantages
• Works with all types of vSwitches.
Disadvantages
• Requires manual work or orchestration to create all of the portgroups
• Portgroups needs to be keep in sync on a vSS
• To ensure isolation portgroups rely on VLANs for L2 isolation
8

9. Network Pools: VLAN-backed
Requires
• A vDS that’s connected to all ESX/ESXi hosts in your cluster
• A range of unused VLANs
How it works
• vCD admin creates the network pool and chooses an “Organization” vDS to
attach it to, then provides a range of valid VLANs, for example, 10 – 15.
• When an isolated network is needed, vCD will automatically create a portgroup
on the vDS and assign it one of the unused VLAN numbers.
• Many isolated portgroups can coexist on the same vDS because they are
isolated by the VLAN tag
Advantages
• Isolated networks
• Best network performance.
Disadvantages
• Requires VLANs to exist in the physical network hardware (physical switches)
• VLANs are limited and may not be available at all
• Not compatible with Cisco Nexus 1000V
• Use portgroup-backed network pool of portgroups that happen to have VLAN tags
9

10. Network Pools: VLAN-backed in VMware vCloud Director
VLAN-backed:
• define the VLAN range for the pool and select the vDS to provision the portgoups on
10

11. Network Pools: VLAN-backed in vSphere
VLAN-backed Example:
• The VLAN-backed network pool was defined to use the range 10-15
• The External Org Network was called Emca External.
• An ephemeral port group was created for you with a vShield edge, vse-1821527865.
• Editing properties shows the switch is named with V10 matching the consumed VLAN
and the name is dvs.VC1098296841DVS1CM1-V10-Emca External
11

12. Network Pools: vCloud Network Isolation
 VMware proprietary network isolation technology
• vCD-NI “networks” span hosts and are represented as portgroups on a vDS.
• Setup:
• Designate a “Transport Network” – an actual layer 2 segment to carry the
packets for vCD-NI networks
• Decide how many networks you want in the pool
• Individual vCD-NI Networks are isolated from each other and the Transport
Network via MAC-in-MAC encapsulation
• Works with vmkernel functionality in ESX/ESXi 4.0U2 or 4.1 and above
• (vCD Beta required Service VM on older ESX/ESXi hosts)
• Technical details:
In Lab Manager, this was
• Implemented with MAC-in-MAC encapsulation
called “Cross-Host Fencing”
• Can cause frame fragmentation with default MTU
• Requires a small increase in MTU to 1524 or higher
12

13. Network Pools: vCloud Network Isolation-backed
Requires
• A vDS that’s connected to all ESX/ESXi hosts in your cluster.
How it works:
• vCD creates an overlay “transport” network for each isolated network to carry
encapsulated traffic
• Each overlay network is assigned a Network ID number.
• Encapsulation contains source and destination MAC addresses of ESX/ESXi
hosts where VM endpoints reside as well as the Network ID
• ESX/ESXi host strips the vCD-NI packet to expose the VM source and
destination MAC addressed packet that is delivered to the destination VM
Advantages:
• Does not require VLANs (can optionally set a VLAN ID for the transport
network; leaving blank defaults to 0)
• More secure than VLAN-backed
Disadvantages:
• Small performance overhead due to encapsulation (dvFilter).
• Added MAC header require an increase in MTU same as in MPLS networks
• vCD-NI is for layer 2 adjacency and not for routed networks
• vCD-NI is only for VMs and cannot be accessed by physical hosts
13

14. Network Pools: vCloud Network Isolation in vSphere
vCD-NI-backed Example:
• A vCD-NI-Backed Pool where transport VLAN is 99 was created.
• The VI portgroup does not reflect isolation, just the transport VLAN used for the vCD-NI
• The name of the portgroup gives you a hint that it’s isolated. It contains, in this instance,
with “V99-F1” meaning it’s using VLAN 99 and isolation network ID 1.
14

15. Organization Networks: Overview
Contained within an organization
Allows vApps within the organization to communicate with each
other or to outside the organization
Can be connected to External Networks as:
• Public (External Org Direct)
• Bridged connection to an External Network
• Others outside the organization can see
• Private Routed (External Org NAT-Routed)
• Connected to an External Network through a vShield Edge
• Can be configured for NAT & Firewall
…or left unconnected to external Set up by Provider
• Private Internal (Internal Org)
• No External connectivity
Backed By Network Pools
15

16. Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• Select the type of Org Network to create using the typical radio button and
dropdown box
16

17. Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• Select the Network Pool to use for the Internal Network
• Assign internal addressing for the Internal Network
17

18. Organization Networks: In VMware vCloud Director
Creating NAT-Routed and Isolated Org Networks:
• For the External Network select the External Network to attach to as well as the internal
• Also select the Network Pool to use for the Internal Network behind the vShield Edge.
• Assign internal addressing for the Inside portion of Org Network
18

19. vApp Networks: Overview
Contained within a vApp
• Inherently Private Internal
Allows VMs in a vApp to communicate with each other
or...by connecting them to Org Networks, other vApps
 Can be connected to Org Networks as
• Public (Direct)
Set up by Consumers
• Bridged connection to a organization network
• Private Routed
• Connected to a organization network through a vShield Edge
• Can be configured for NAT & Firewall
 Backed by a Network Pool
19

20. Putting it Together: vCloud Networking Options – Examples
External Network (set up by system admin)
Organization
6 5
External Organization Network (set up by system admin) External Organization Network
vApp
4 8
1 2 vApp network vApp network 3 vApp network
(set up by org admin/vApp author, internal to vApp)
7
Internal Organization network (set up by system admin)
20

21. Putting it Together: vCloud Networking Options – Examples
External Network 2
vSphere Network 2
External Network 1
vSphere Network 1
Organization
vShield Edge
(NAT/firewall)
Organization Network 3
Internal Organization Network
Internal vSphere network
(backed by Network Pool)
Organization Network 2
External Organization Network –
Internal vSphere network NAT-routed Connection
(backed by Network Pool)
Organization Network 1
.111 .112
External Organization Network –
Direct Connection
vShield Edge
vApp 1 vApp 2 vApp 3 (NAT/firewall) vApp 4
Isolated
VM
.11 .12
vApp Network vApp Network vApp Network
(Private)
Internal vSphere network Internal vSphere network Internal vSphere network
(backed by Network Pool) (backed by Network Pool) (backed by Network Pool)
Connected to Connected to Organization network Connected to Organization Network Isolated vApp Network
Organization network (vApp network with direct connection) (vApp network with NAT-routed connection
(vNICs connected to and IP masquerading defined)
Organization network)
21

22. Use Cases
22

23. Networking Use Cases – Example 1 of 4
Use Case 1: Isolated vApp
23

24. Networking Use Cases – Example 2 of 4
Use Case 2: Dev/Test
24

25. Networking Use Cases – Example 3 of 4
Use Case 3: Pre-Production with access to Internet
25

26. Networking Use Cases – Example 4 of 4
Use Case 4: Pre-Production with access to VPN
26

27. Networking Multi-tenancy
27

28. vSphere Dependencies
Network Pools: Backing for private networks in vCloud Director
• vSphere Port Group backed
• Requires vSS or vDS or N1KV Switches
• VLAN-backed
• Requires vDS and VLANs
• vCloud Director Network Isolation-backed (vCD-NI)
• Requires vDS and VLANs
• Mac-in-Mac Encapsulation (1524 bytes MTU)
External Networks: for Internet, VPN/MPLS, IP SAN connectivity
• Requires vSS or vDS or N1KV Switches
28

29. Network Security
vShield Edge
• Integrated with vCloud Director
• Network security services
• Firewall
• NAT
• DHCP
• Port forwarding
• IP masquerading
Option for internal only or connected externally
• Internal only – within vApp or within organization
29

30. Questions
30