Downloaded 85 times
Uploaded byShapeBlue
Introduction to cloudstack 4.3 networking
Geoff Higginbottom is a cloud architect and CTO of ShapeBlue who specializes in designing and building clouds based on Apache CloudStack. He has experience implementing CloudStack for various companies and is a committer for CloudStack. The document provides an overview of networking in CloudStack, including basic and advanced networking options, security groups, virtual private clouds, and the different network components and providers that can be used.
More Related Content
Similar to Introduction to cloudstack 4.3 networking
Introduction to cloudstack 4.3 networking
- 1. Introduction to CloudStack4.3 Networking Geoff Higginbottom CTO ShapeBlue geoff.higginbottom@shapeblue.com Twitter: @CloudStackGuru
- 2. www.shapeblue.com @CloudStackGuru CloudArchitect & ShapeBlue CTO Specialise in…. Designing & Building Clouds based on Apache CloudStack / Citrix CloudPlatform Developing CloudStack training Blogging and sharing CloudStack knowledge Involved with CloudStack before donation to Apache Designed Clouds for SunGard, Ascenty, BskyB, Trader Media, M5 Hosting, Team Cymru, Interoute, University of Pennsylvania.… CloudStack Committer (non-developer) About Me
- 3. www.shapeblue.com @CloudStackGuru Why NaaS– The Use Cases VPS Cloud
- 4. www.shapeblue.com @CloudStackGuru Why NaaS– The Use Cases
- 5. www.shapeblue.com @CloudStackGuru AWSStyle L3 isolation – Massive Scale Simple Flat Network Each POD has a unique CIDR Optional Guest Isolation via Security Groups Optional NetScaler Integration - Elastic IPs and Elastic LB Optional Nicira NVP Integration Basic Networking
- 6. www.shapeblue.com @CloudStackGuru Isolatetraffic between VMs Available for both Basic and Advanced Networking Only supported on XenServer 6.x and KVM XenServer 6.0.x requires the Cloud Support Package XenServer must use Linux Bridge and not Open vSwitch xe-switch-network-backend bridge Must be implemented before adding to CloudStack Security Groups
- 7. www.shapeblue.com @CloudStackGuru Security Groups Rules can be mapped to CIDR or another Account/Security Group
- 8. www.shapeblue.com @CloudStackGuru Thisnetwork model provides the most flexibility in defining guest networks and providing custom network offerings such as firewall, VPN, Load Balancer & VPC functionality. Guest isolation is provided through layer-2 means such as VLANs or SDN technologies Advanced Networking
- 9. www.shapeblue.com @CloudStackGuru Privateand Shared Guest Networks Multiple Physical Networks Virtual Router for each Network providing: DNS & DHCP Firewall Client VPN Load Balancing Source / Static NAT Port Forwarding Advanced Networking
- 10. www.shapeblue.com @CloudStackGuru Effectivelyenables the deployment of multiple ‘Basic’ style networks which use Security Groups for isolation of VMs, but with each Network encapsulated within a unique VLAN. Advanced Networking & Security Groups
- 11.
- 12. www.shapeblue.com @CloudStackGuru Guest Network– Basic & Advanced
- 13. www.shapeblue.com @CloudStackGuru Guest Network– Basic Zone EIP / ELB
- 14. www.shapeblue.com @CloudStackGuru Public Network– Basic & Advanced
- 15. www.shapeblue.com @CloudStackGuru Public Network– System VMs CPVM & SSVM both have a connection to the Public Network
- 16.
- 17.
- 18. www.shapeblue.com @CloudStackGuru Basic Zone– Example IP Schema
- 19. www.shapeblue.com @CloudStackGuru Advanced Zone– Example IP Schema
- 20. www.shapeblue.com @CloudStackGuru AHardware or Virtual Appliance that provide Network Services to CloudStack e.g. Network Service Providers Virtual Router VPC Virtual Router Internal LBVM Citrix NetScaler F5 Load Balancer Juniper SRX Firewall Nicira Nvp Midokura Midonet BigSwitch Vns Cisco VNMC Baremetal DHCP* Baremetal PXE* Palo Alto* Ovs* *new in 4.3
- 21. www.shapeblue.com @CloudStackGuru Privatemulti-tiered Virtual Networks ACLs to control traffic isolation Inter VLAN Routing Site-2-Site VPN Private Gateway VPC-2-VPC VPN* User VPN* Virtual Private Clouds (VPC) *new in 4.3
- 22. www.shapeblue.com @CloudStackGuru VPC Components VirtualRouter – Connects all the VPC Components Network Tiers – Isolated Networks, each with unique VLAN and CIDR
- 23.
- 24. www.shapeblue.com @CloudStackGuru VPC Components Site-2-SiteVPN Linked to Public Gateway
- 25. www.shapeblue.com @CloudStackGuru VPC Components UserVPN Linked to Public Gateway
- 26. www.shapeblue.com @CloudStackGuru VPC Components VPC-2-VPCVPN Linked to Public Gateway
- 27. www.shapeblue.com @CloudStackGuru Private Gateway Createdby Root Admins Configured by Users (Static Routes) VPC Components
- 28.
- 29.
- 30.
- 31.
- 32. www.shapeblue.com @CloudStackGuru Lotsof great technical info on http://shapeblue.com/blog/ These slides can be found at www.slideshare.net/shapeblue geoff.higginbottom@shapeblue.com @CloudStackGuru Further Information
Editor's Notes
- #2 eSkyCityBroker BinSunGardCiscoOrangeT-Mobile
- #8 Guest VMs and Hosts can be on different VLANs even though Admin Guide states they cannot
- #9 XenServer requires the CloudStack Support Package to be installed BEFORE adding to CloudStack in order to use Security GroupsSecurity Groups - Guest VM will be assigned to ‘default’ security Group if none is specified – Denies all inbound but allows all outbound. VMs can belong to multiple security groups but not the Default SG and another SG. Ingress and Egress rules control the flow of traffic into and out of Security Groups. If no Egress rules have been specified all outbound traffic is allowed, however once an Egress Rule has been created, only traffic specified by Egress Rules, in response to an Ingress Rule or related to DHCP & DNS queries is allowed out.
- #11 A Zone can be either Basic OR Advanced
- #12 Private – limited to one accountShared – Accessible to either the whole Zone, a Domain (with or without subdomains), an Account or Project
- #13 A Zone can be either Basic OR Advanced
- #14 Traffic between CloudStack Management Servers and the various cloud componentsSecondary Storage also uses the Management Network of the optional ‘Storage’ network has not been configured.
- #15 Traffic between VMs within an Account, and their Virtual Router, Physical Load Balancer or Physical Firewall
- #16 Traffic between VMs and the Internal Interface of the NetScaler
- #17 Traffic between the Virtual Router and the Internet GatewayBasic Zone but only when using a NetScaler for EIP/ELB
- #18 SSVM & CPVM each have a Public Interface
- #19 Traffic between SSVM and the Secondary StorageOptional Network, traffic will use the Management Network if not configured. If configured, there must be a route between Management and Storage NetworksIt is NOT for Primary Storage Traffic
- #23 Virtual RouterVPC Virtual RouterInternal Load Balancer VMCitrix NetScalerF5 Load BalancerJuniper SRX FirewallNicira Network Virtualization PlatformMidokuraMidonetBigSwitch Virtual Network SegmentsCisco Virtual Network Management Center
- #24 23 min