![Best Current Practice [Top of Rack]
Source: SAKURA Internet Research Center 03/2014, Project THORN.
Complexity
vSW
VMVM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
SW
SW
Stacking Type
SRV
vSW
VMVM
1GbE Network
vSW
VM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
SW
SW
SW
SW
Box Type
SRV
vSW
VMVM
SW
SW
Stacking Type
SRV
vSW
VMVM
10GbE Network
vSW
VMVM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
SW
SW
SW
SW
Box Type
SRV
vSW
VMVM
40GbE Network
SW SW
Virtual Chassis Type (MLAG,Fabric...etc)
vSW
VMVM
SRV
SW SW
Virtual Chassis Type (MLAG,Fabric...etc)
vSW
VMVM
SRV
Network Capacity
Low
High VM
*SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM](https://image.slidesharecdn.com/jvum2014spring-n-matsumoto20140318v3-140318002315-phpapp01/75/UNDOCUMENTED-Vyatta-vRouter-Unbreakable-VPN-Tunneling-MEMO-9-2048.jpg)
![Best Current Practice [Performance]
Source: SAKURA Internet Research Center 03/2014, Project THORN.
Complexity
vSW
VMVM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
SW
SW
Stacking Type
SRV
1GbE Network
vSW
VM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
SW
SW
Stacking Type
SRV
10GbE Network
vSW
VMVM
SRV
SW
SW
SW
SW
Legacy Type (STP/RSTP/MSTP...etc)
40GbE Network
Virtual Chassis Type (MLAG,Fabric...etc)
SRV
Virtual Chassis Type (MLAG,Fabric...etc)
SRV
Network Capacity
Low
High VM
vSW
VMVM
vSW
VMVM
vSW
VMVM
vSW
VMVM
SW
SW
SW
SW
Box Type
SRV
vSW
VMVM
SW
SW
SW
SW
Box Type
SRV
vSW
VMVM
SW SW SW SW
*SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM](https://image.slidesharecdn.com/jvum2014spring-n-matsumoto20140318v3-140318002315-phpapp01/75/UNDOCUMENTED-Vyatta-vRouter-Unbreakable-VPN-Tunneling-MEMO-10-2048.jpg)
Uploaded byNaoto MATSUMOTO
UNDOCUMENTED Vyatta vRouter: Unbreakable VPN Tunneling (MEMO)
The document discusses advanced networking concepts relevant to virtualized environments, focusing on redundancy and recovery techniques for network components. It covers various network configurations, including 1GbE, 10GbE, and 40GbE setups, as well as VPN architecture and clustering configurations using Vyatta vRouter. The text also highlights best practices and performance considerations for setting up resilient network infrastructure.
More Related Content
![IPv4 over IPv6 Tunneling with IPSec [DRAFT]](https://cdn.slidesharecdn.com/ss_thumbnails/ipv4overipv6withipsec-20140204-n-matsumoto-140204035813-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to UNDOCUMENTED Vyatta vRouter: Unbreakable VPN Tunneling (MEMO)
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
UNDOCUMENTED Vyatta vRouter: Unbreakable VPN Tunneling (MEMO)
- 1. 23 Mar, 2014 SAKURAInternet Research Center Senior Researcher / Naoto MATSUMOTO Japan Vyatta Users Meeting Spring 2014 in Tokyo.
- 2. BASIC Networking forVMM Env
- 3.
- 4.
- 5.
- 6.
- 7.
- 8. Comparison of Fail-overmodel Source: SAKURA Internet Research Center 03/2014, Project THORN. Complexity vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW Stacking Type SRV vSW VMVM 1GbE Network vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW SW SW Box Type SRV vSW VMVM SW SW Stacking Type SRV vSW VMVM 10GbE Network vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW SW SW Box Type SRV vSW VMVM 40GbE Network SW SW Virtual Chassis Type (MLAG,Fabric...etc) vSW VMVM SRV SW SW Virtual Chassis Type (MLAG,Fabric...etc) vSW VMVM SRV Network Capacity Low High *SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM
- 9. Best Current Practice[Top of Rack] Source: SAKURA Internet Research Center 03/2014, Project THORN. Complexity vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW Stacking Type SRV vSW VMVM 1GbE Network vSW VM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW SW SW Box Type SRV vSW VMVM SW SW Stacking Type SRV vSW VMVM 10GbE Network vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW SW SW Box Type SRV vSW VMVM 40GbE Network SW SW Virtual Chassis Type (MLAG,Fabric...etc) vSW VMVM SRV SW SW Virtual Chassis Type (MLAG,Fabric...etc) vSW VMVM SRV Network Capacity Low High VM *SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM
- 10. Best Current Practice[Performance] Source: SAKURA Internet Research Center 03/2014, Project THORN. Complexity vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW Stacking Type SRV 1GbE Network vSW VM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) SW SW Stacking Type SRV 10GbE Network vSW VMVM SRV SW SW SW SW Legacy Type (STP/RSTP/MSTP...etc) 40GbE Network Virtual Chassis Type (MLAG,Fabric...etc) SRV Virtual Chassis Type (MLAG,Fabric...etc) SRV Network Capacity Low High VM vSW VMVM vSW VMVM vSW VMVM vSW VMVM SW SW SW SW Box Type SRV vSW VMVM SW SW SW SW Box Type SRV vSW VMVM SW SW SW SW *SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM
- 11. VRRP Clustering withmulticast BCP Source: SAKURA Internet Research Center 03/2014, Project THORN. SW Virtual Chassis Type (MLAG,Fabric...etc) VM SRV vSW VMVM SRV vSW VMVM SW VMSRV vSW VMVM SRV vSW VMVM SW SW Stacking Type SW SW SW SW Box Type VM SRV vSW VMVM SRV vSW VMVM 1/10GbE Network 10/40GbE Network 10/40GbE Network Multicast FlowMulticast Flow Multicast Flow *SW: Ethernet Switch, SRV: Server, vSW: Virtual Switch on VMM, VM: Virtual Maching on VMM
- 12.
- 13. BASIC Configuration forLAN Vyatta vRouterVyatta vRouter
- 14. Logical IP Networking VyattavRouterVyatta vRouter
- 15.
- 16. Logical IP Networking(MASTER) Vyatta vRouterVyatta vRouter
- 17. Logical IP Networking(SLAVE) Vyatta vRouterVyatta vRouter
- 18.
- 19.
- 20. Virtualization ＝= H/WAbstraction
- 21. Dual IPSec Tunneling VyattavRouterVyatta vRouter Vyatta vRouterVyatta vRouter
- 22. Dual IPSec Tunneling #set vpn ipsec ike-group IKE lifetime 3600 # set vpn ipsec ike-group IKE proposal 1 encryption aes256 # set vpn ipsec ike-group IKE proposal 1 hash sha1 # set vpn ipsec esp-group ESP lifetime 1800 # set vpn ipsec esp-group ESP mode tunnel # set vpn ipsec esp-group ESP pfs enable # set vpn ipsec esp-group ESP proposal 1 encryption aes256 # set vpn ipsec esp-group ESP proposal 1 hash sha1 # set vpn ipsec ipsec-interfaces interface eth0 # set vpn ipsec site-to-site peer 133.242.YYY.3 authentication mode pre-shared-secret # set vpn ipsec site-to-site peer 133.242.YYY.3 authentication pre-shared-secret XXXX # set vpn ipsec site-to-site peer 133.242.YYY.3 connection-type initiate # set vpn ipsec site-to-site peer 133.242.YYY.3 default-esp-group ESP # set vpn ipsec site-to-site peer 133.242.YYY.3 ike-group IKE # set vpn ipsec site-to-site peer 133.242.YYY.3 local-address 133.242.XXX.1 # set vpn ipsec site-to-site peer 133.242.YYY.3 tunnel 0 local prefix 10.10.10.0/24 # set vpn ipsec site-to-site peer 133.242.YYY.3 tunnel 0 remote prefix 10.20.20.0/24 IKE ESP
- 23. TCP-MSS Rewriting # setpolicy route TCP-MSS1386-ETH0 rule 1 destination address 10.20.20.0/24 # set policy route TCP-MSS1386-ETH0 rule 1 protocol tcp # set policy route TCP-MSS1386-ETH0 rule 1 set tcp-mss 1386 # set policy route TCP-MSS1386-ETH0 rule 1 tcp flags SYN # set interfaces tunnel eth0 policy route TCP-MSS1386-ETH0
- 24.
- 25. Clustering Configuration # setcluster dead-interval 1000 # set cluster group CLUSTER auto-failback true # set cluster interface eth0 # set cluster interface eth1 # set cluster keepalive-interval 200 # set cluster monitor-dead-interval 1000 # set cluster pre-shared-secret YYYYYY # set cluster group CLUSTER primary VR-1 # set cluster group CLUSTER secondary VR-2 # set cluster group CLUSTER service 10.10.10.100/24/eth1 # set cluster mcast-group 239.10.10.100
- 26.
- 27. Clustering Group Monitoring #set cluster group CLUSTER monitor 133.242.YYY.3
- 28. Logical IP Networking(MASTER)
- 29. Logical IP Networking(SLAVE) Disposal IPSec link
- 30. Firewall/QoS Rule forDoS Attack
- 31. Another solution: DMVPNTunneling DATACENTER A DATACENTER BDATACENTER C
- 32. DMVPN Tunneling withIPSec/BGP DATACENTER A DATACENTER BDATACENTER C AS65001 AS65002 AS65003 AS65005 AS65006AS65004
- 33. Thanks for yourinterest. SAKURA Internet Research Center.