DOCSLIB.ORG

Vmware NSX® Network Virtualization Fundamentals

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Vmware NSX® Network Virtualization Fundamentals VMware NSX® Network Virtualization Fundamentals Gustavo A. A. Santana, VCIX-NV® and CCIE® 8806 Foreword by Pat Gelsinger VMware NSX® Network Virtualization Fundamentals Gustavo A. A. Santana, VCIX-NV® and CCIE® 8806 Foreword by Pat Gelsinger VMWARE PRESS Program Managers Katie Holms Shinie Shaw Technical Writer Rob Greanias Graphics Manager Sappington Production Manager Sappington Warning & Disclaimer Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The authors, VMware Press, VMware, and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book. The opinions expressed in this book belong to the author and are not necessarily those of VMware. VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com. Copyright © 2017 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. and its subsidiaries in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Table of Contents About the Technical Reviewer ...............................................................................XII Foreword ....................................................................................................................... XVI Introduction .................................................................................................................. XX Chapter 1 - What is Network Virtualization? ........................................................1 Virtualization as the New Reality ...............................................................................2 The Server Virtualization Revolution ...................................................................... 4 Virtualization in Network Technologies ................................................................ 8 Defining Network Virtualization ...............................................................................16 VMware NSX Architecture .........................................................................................23 What Did This Chapter Achieve? ............................................................................27 Chapter 2 - Rethinking Network Constructs ................................................... 29 Layer 2 Connectivity .................................................................................................... 30 Provisioning VLANs ........................................................................................................31 Introducing Logical Switches .................................................................................. 34 Layer 3 Connectivity ....................................................................................................40 Introducing Distributed Logical Routing ........................................................... 43 Starting to Get Physical ...............................................................................................45 Living on the Edge .........................................................................................................47 Edge Routing ................................................................................................................... 48 Network Address Translation ...................................................................................53 Server Load Balancing .................................................................................................56 Introducing Logical Load Balancing .....................................................................59 Other Interesting Edge Network Features ....................................................... 64 What Did This Chapter Achieve? ............................................................................65 Chapter 3 - Virtualization as a Security Control............................................. 67 The Evolution of Firewalls .......................................................................................... 68 Statefulness Defined .................................................................................................... 69 Application Firewalls and Next-Generation Firewalls ......................................................................................... 70 Demilitarized Zone ..........................................................................................................71 Classic Data Center Security Designs ..................................................................72 Anatomy of a Modern Cyber Attack.....................................................................75 The Zero Trust Model ....................................................................................................77 A Real World Analogy: Secure Airport ...............................................................77 Introducing the VMware NSX Distributed Firewall .............................................................................................79 VMware NSX Security Partners Integration ......................................................83 Security On-Demand: Service Composer .........................................................85 Identity Firewall .............................................................................................................. 88 Micro-Segmentation Defined .................................................................................. 89 Edge Firewall ....................................................................................................................90 | V Security-Based Virtual Private networks ...........................................................92 IPsec VPN with VMware NSX ...................................................................................93 SSL VPN-Plus with VMware NSX ...........................................................................95 Other Interesting VMware NSX Security Features .................................................................................................97 SpoofGuard ........................................................................................................................97 Endpoint Monitoring and Application Rule Manager ......................................................................................... 98 What Did This Chapter Achieve? ........................................................................... 98 Chapter 4 - Virtual Networks, Real Extensions ..............................................101 The Evolution of Secondary Sites ........................................................................102 The Cold Site ...................................................................................................................103 The Warm Site ............................................................................................................... 104 The Hot-Backup Site ...................................................................................................105 The Virtualized Hot Site .............................................................................................107 The Active Site ...............................................................................................................108 Networking Challenges in Active-Standby Sites ..............................................................................................110 VMware NSX for Active-Standby Sites .............................................................. 112 Networking Challenges in Active-Active Sites ................................................................................................... 116 Spanning Tree Protocol and Failure Domains ......................................................................................................117 Layer 2 Extension and Traffic Behavior.............................................................120 Provisioning Complexity ........................................................................................... 123 VMware NSX for Active-Active Sites .................................................................. 125 Layer 2 VPNs ................................................................................................................... 127 What Did This Chapter Achieve? ..........................................................................130 Chapter 5 - Industrializing Networks .................................................................133 Automating IT .................................................................................................................134 Pre-Provisioned Networks ....................................................................................... 137 Challenges and Limitations ..................................................................................... 140 Automating Physical Networks ............................................................................ 140 Example of an Automated Network Topology ........................................................................................................ 142 Challenges and Limitations ......................................................................................144
Load more

Recommended publications
  • Evaluating and Optimizing I/O Virtualization in Kernel-Based Virtual Machine (KVM)
    Evaluating and Optimizing I/O Virtualization in Kernel-based Virtual Machine (KVM) Binbin Zhang1, Xiaolin Wang1, Rongfeng Lai1, Liang Yang1, Zhenlin Wang2, Yingwei Luo1, and Xiaoming Li1 1 Dept. of Computer Science and Technology, Peking University, Beijing, China, 100871 2 Dept. of Computer Science, Michigan Technological University, Houghton, USA {wxl,lyw}@pku.edu.cn, [email protected] Abstract. I/O virtualization performance is an important problem in KVM. In this paper, we evaluate KVM I/O performance and propose several optimiza- tions for improvement. First, we reduce VM Exits by merging successive I/O instructions and decreasing the frequency of timer interrupt. Second, we simplify the Guest OS by removing redundant operations when the guest OS operates in a virtual environment. We eliminate the operations that are useless in the virtual environment and bypass the I/O scheduling in the Guest OS whose results will be rescheduled in the Host OS. We also change NIC driver’s con- figuration in Guest OS to adapt the virtual environment for better performance. Keywords: Virtualization, KVM, I/O Virtualization, Optimization. 1 Introduction Software emulation is used as the key technique in I/O device virtualization in Ker- nel-based Virtual Machine (KVM). KVM uses a kernel module to intercept I/O re- quests from a Guest OS, and passes them to QEMU, an emulator running on the user space of Host OS. QEMU translates these requests into system calls to the Host OS, which will access the physical devices via device drivers. This implementation of VMM is simple, but the performance is usually not satisfactory because multiple environments are involved in each I/O operation that results in multiple context switches and long scheduling latency.
    [Show full text]
  • Cisco Nexus 1000V Switch for KVM Data Sheet
    Data Sheet Cisco Nexus 1000V Switch for KVM Product Overview Bring enterprise-class networking features to OpenStack cloud operating system environments. The Cisco Nexus ® 1000V Switch for the Ubuntu Kernel-based Virtual Machine (KVM) reduces the operating complexity associated with virtual machine networking. Together with the OpenStack cloud operating system, this switch helps you gain control of large pools of computing, storage, and networking resources. The Cisco Nexus 1000V Switch provides a comprehensive and extensible architectural platform for virtual machine and cloud networking. This switch is designed to accelerate your server virtualization and multitenant cloud deployments in a secure and operationally transparent manner. Operating as a distributed switching platform, the Cisco Nexus 1000V enhances the visibility and manageability of your virtual and cloud networking infrastructure. It supports multiple hypervisors and many networking services and is tightly integrated with multiple cloud management systems. The Cisco Nexus 1000V Switch for KVM offers enterprise-class networking features to OpenStack cloud operating system environments, including: ● Advanced switching features such as access control lists (ACLs) and port-based access control lists (PACLS). ● Support for highly scalable, multitenant virtual networking through Virtual Extensible LAN (VXLAN). ● Manageability features such as Simple Network Management Protocol (SNMP), NETCONF, syslog, and advanced troubleshooting command-line interface (CLI) features. ● Strong north-bound management interfaces including OpenStack Neutron plug-in support and REST APIs. Benefits The Cisco Nexus 1000V Switch reduces the operational complexity associated with virtual machine networking and enables you to accomplish the following: ● Easily deploy your Infrastructure-as-a-service (IaaS) networks ◦ As the industry’s leading networking platform, the Cisco Nexus 1000V delivers performance, scalability, and stability with familiar manageability and control.
    [Show full text]
  • CCNA-Cloud -CLDFND-210-451-Official-Cert-Guide.Pdf
    ptg17120290 CCNA Cloud CLDFND 210-451 Official Cert Guide ptg17120290 GUSTAVO A. A. SANTANA, CCIE No. 8806 Cisco Press 800 East 96th Street Indianapolis, IN 46240 ii CCNA Cloud CLDFND 210-451 Official Cert Guide CCNA Cloud CLDFND 210-451 Official Cert Guide Gustavo A. A. Santana Copyright© 2016 Pearson Education, Inc. Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review. Printed in the United States of America First Printing April 2016 Library of Congress Control Number: 2015957536 ISBN-13: 978-1-58714-700-5 ISBN-10: 1-58714-7009 Warning and Disclaimer ptg17120290 This book is designed to provide information about the CCNA Cloud CLDFND 210-451 exam. Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information is provided on an “as is” basis. The author, Cisco Press, and Cisco Systems, Inc. shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it. The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc.
    [Show full text]
  • Virtualizing Your Network: Benefits & Challenges
    Network Monitoring Technology Virtualizing Your Network: Benefits & Challenges What is Virtualization? factory or process plant. Virtualization can give this software Gartner Research1 defined network virtualization as the a longer operating lifecycle time, and can save both costs process of combining hardware and software network and intellectual property. resources and functionality into a single virtual network. This offers access to routing features and data streams that can provide newer, service-aware, resilient solutions; newer security services that are native within network elements; support for subscriber-aware policy control for peer-to- peer traffic management; and application-aware, real-time session control for converged voice and video applications with guaranteed bandwidth on-demand. For the most part, when we speak of virtualization, we speak of hardware virtualization. That means that we create, on a host machine, a virtual machine that looks like another computer with an operating system and software. The software on the virtual machine is separate from the host machine’s resources, and as far as it is concerned, it is running on its own computer (that we call the guest). Both in information technology (IT) and in operational technology (OT) environments the benefits of virtualization have led to its rapid adoption. This white paper is not a prescriptive guide to network virtualization, rather it is a high-level overview focused on the benefits and challenges of network virtualization. While it will Desktop virtualization separates the logical desktop from review the benefits, it will also cover the specific challenges the actual hardware. Virtual desktop infrastructure (VDI) network administrators and their respective businesses should permits the user to interact with the computer through understand to cost-effectively apply this technology to gain another host computer or device on a network connection.
    [Show full text]
  • 1 Intel CEO Remarks Pat Gelsinger Q2'21 Earnings Webcast July 22
    Intel CEO Remarks Pat Gelsinger Q2’21 Earnings Webcast July 22, 2021 Good afternoon, everyone. Thanks for joining our second-quarter earnings call. It’s a thrilling time for both the semiconductor industry and for Intel. We're seeing unprecedented demand as the digitization of everything is accelerated by the superpowers of AI, pervasive connectivity, cloud-to-edge infrastructure and increasingly ubiquitous compute. Our depth and breadth of software, silicon and platforms, and packaging and process, combined with our at-scale manufacturing, uniquely positions Intel to capitalize on this vast growth opportunity. Our Q2 results, which exceeded our top and bottom line expectations, reflect the strength of the industry, the demand for our products, as well as the superb execution of our factory network. As I’ve said before, we are only in the early innings of what is likely to be a decade of sustained growth across the industry. Our momentum is building as once again we beat expectations and raise our full-year revenue and EPS guidance. Since laying out our IDM 2.0 strategy in March, we feel increasingly confident that we're moving the company forward toward our goal of delivering leadership products in every category in which we compete. While we have work to do, we are making strides to renew our execution machine: 7nm is progressing very well. We’ve launched new innovative products, established Intel Foundry Services, and made operational and organizational changes to lay the foundation needed to win in the next phase of our company’s great history. Here at Intel, we’re proud of our past, pragmatic about the work ahead, but, most importantly, confident in our future.
    [Show full text]
  • Solving the Virtualization Conundrum
    White Paper Solving the Virtualization Conundrum Collapsing hierarchical, multi-tiered networks of the past into more compact, resilient, feature rich, two-tiered, leaf- spine or SplineTM networks have clear advantages in the data center. The benefits of more scalable and more stable layer 3 networks far outweigh the challenges this architecture creates. Layer 2 networking fabrics of the past lacked stability and scale. This legacy architecture limited workload size, mobility, and confined virtual workloads to a smaller set of physical servers. As virtualization scaled in the data center, the true limitations of these fabrics quickly surfaced. The economics of workload convergence drives compute density and network scale. Similarly, to meet dynamic needs of business stakeholders, growing data centers must deliver better mobility and its administration must be automated. In essence, virtualized networks must scale, be stable and be programmatically administered! What the Internet has taught us is that TCP/IP architectures are reliable, fault tolerant, and built to last. Why create yet another fabric when we can leverage open standards and all the benefits that layer 3 networks provide. With this settled, we can work to develop an overlay technology to span layer two networks over a stable IP infrastructure. This is how Virtual eXtensible LAN (VXLAN) was born. arista.com White Paper At Arista we work to bring VXLAN to the mainstream by co-authoring the standard with industry virtualization leaders. We’re also innovating programmatic services and APIs that automate virtualized workflow management, monitoring, visualization and troubleshooting. VXLAN is designed from the ground up to leverage layer 3 IP underlays and the scale and stability it provides.
    [Show full text]
  • Understanding Linux Internetworking
    White Paper by David Davis, ActualTech Media Understanding Linux Internetworking In this Paper Introduction Layer 2 vs. Layer 3 Internetworking................ 2 The Internet: the largest internetwork ever created. In fact, the Layer 2 Internetworking on term Internet (with a capital I) is just a shortened version of the Linux Systems ............................................... 3 term internetwork, which means multiple networks connected Bridging ......................................................... 3 together. Most companies create some form of internetwork when they connect their local-area network (LAN) to a wide area Spanning Tree ............................................... 4 network (WAN). For IP packets to be delivered from one Layer 3 Internetworking View on network to another network, IP routing is used — typically in Linux Systems ............................................... 5 conjunction with dynamic routing protocols such as OSPF or BGP. You c an e as i l y use Linux as an internetworking device and Neighbor Table .............................................. 5 connect hosts together on local networks and connect local IP Routing ..................................................... 6 networks together and to the Internet. Virtual LANs (VLANs) ..................................... 7 Here’s what you’ll learn in this paper: Overlay Networks with VXLAN ....................... 9 • The differences between layer 2 and layer 3 internetworking In Summary ................................................. 10 • How to configure IP routing and bridging in Linux Appendix A: The Basics of TCP/IP Addresses ....................................... 11 • How to configure advanced Linux internetworking, such as VLANs, VXLAN, and network packet filtering Appendix B: The OSI Model......................... 12 To create an internetwork, you need to understand layer 2 and layer 3 internetworking, MAC addresses, bridging, routing, ACLs, VLANs, and VXLAN. We’ve got a lot to cover, so let’s get started! Understanding Linux Internetworking 1 Layer 2 vs.
    [Show full text]
  • Energy Efficiency in Office Computing Environments
    Fakulät für Informatik und Mathematik Universität Passau, Germany Energy Efficiency in Office Computing Environments Andreas Berl Supervisor: Hermann de Meer A thesis submitted for Doctoral Degree March 2011 1. Reviewer: Prof. Hermann de Meer Professor of Computer Networks and Communications University of Passau Innstr. 43 94032 Passau, Germany Email: [email protected] Web: http://www.net.fim.uni-passau.de 2. Reviewer: Prof. David Hutchison Director of InfoLab21 and Professor of Computing Lancaster University LA1 4WA Lancaster, UK Email: [email protected] Web: http://www.infolab21.lancs.ac.uk Abstract The increasing cost of energy and the worldwide desire to reduce CO2 emissions has raised concern about the energy efficiency of information and communica- tion technology. Whilst research has focused on data centres recently, this thesis identifies office computing environments as significant consumers of energy. Office computing environments offer great potential for energy savings: On one hand, such environments consist of a large number of hosts. On the other hand, these hosts often remain turned on 24 hours per day while being underutilised or even idle. This thesis analyzes the energy consumption within office computing environments and suggests an energy-efficient virtualized office environment. The office environment is virtualized to achieve flexible virtualized office resources that enable an energy-based resource management. This resource management stops idle services and idle hosts from consuming resources within the office and consolidates utilised office services on office hosts. This increases the utilisation of some hosts while other hosts are turned off to save energy. The suggested architecture is based on a decentralized approach that can be applied to all kinds of office computing environments, even if no centralized data centre infrastructure is available.
    [Show full text]
  • Infrastructure : Netapp Solutions
    Infrastructure NetApp Solutions NetApp October 06, 2021 This PDF was generated from https://docs.netapp.com/us-en/netapp-solutions/infra/rhv- architecture_overview.html on October 06, 2021. Always check docs.netapp.com for the latest. Table of Contents Infrastructure . 1 NVA-1148: NetApp HCI with Red Hat Virtualization. 1 TR-4857: NetApp HCI with Cisco ACI . 84 Workload Performance. 121 Infrastructure NVA-1148: NetApp HCI with Red Hat Virtualization Alan Cowles, Nikhil M Kulkarni, NetApp NetApp HCI with Red Hat Virtualization is a verified, best-practice architecture for the deployment of an on- premises virtual datacenter environment in a reliable and dependable manner. This architecture reference document serves as both a design guide and a deployment validation of the Red Hat Virtualization solution on NetApp HCI. The architecture described in this document has been validated by subject matter experts at NetApp and Red Hat to provide a best-practice implementation for an enterprise virtual datacenter deployment using Red Hat Virtualization on NetApp HCI within your own enterprise datacenter environment. Use Cases The NetApp HCI for Red Hat OpenShift on Red Hat Virtualization solution is architected to deliver exceptional value for customers with the following use cases: 1. Infrastructure to scale on demand with NetApp HCI 2. Enterprise virtualized workloads in Red Hat Virtualization Value Proposition and Differentiation of NetApp HCI with Red Hat Virtualization NetApp HCI provides the following advantages with this virtual infrastructure solution: • A disaggregated architecture that allows for independent scaling of compute and storage. • The elimination of virtualization licensing costs and a performance tax on independent NetApp HCI storage nodes.
    [Show full text]
  • Increasing Business Agility Through Digital Transformation
    Increasing Business Agility Through Digital Transformation VMware IT Performance Annual Report 2019 At VMware, we have a deep and long-standing commitment to helping shape tech as a force for ‘‘ good in the world. That begins with good engineering, and one of the best examples of world-class engineering is our own IT department. VMware IT puts all VMware products to work PAT GELSINGER within our own operations—testing, scaling and CHIEF EXECUTIVE OFFICER VMWARE validating for a demanding customer base of VMware engineers and users. VMware IT is then able to actively engage with customers about the reality of operations in a complex, large- scale, enterprise environment, while ensuring ‘‘ that everything also meets productivity, agility, security and resiliency requirements. I couldn’t be prouder of these efforts and VMware IT. Table of Contents Welcome from the CIO 2 Embracing New Ways of Operating 5 Creating an Agile Enterprise Through App Modernization 19 Building on an Infrastructure Primed for Transformation 24 Transforming Business Through IT Innovation 29 Contact Us 30 1 | ANNUAL REPORT 2019 Welcome from the CIO I write this annual letter with a sense of pride about our company and our thousands of employees in the IT organization around the world driving our transformation. At VMware, our core philosophy is around people and process first, followed by technology. We’re creating a workplace of the future that makes it easier for colleagues to access the tools they need to be productive. We’re employing new technologies and launching innovative initiatives designed to enhance efficiency, boost productivity, improve engagement with business partners and customers, and increase business agility.
    [Show full text]
  • Adaptive Distributed Firewall Using Intrusion Detection Lars Strand
    UNIVERSITY OF OSLO Department of Informatics Adaptive distributed firewall using intrusion detection Lars Strand UniK University Graduate Center University of Oslo lars (at) unik no 1. November 2004 ABSTRACT Conventional firewalls rely on a strict outside/inside topology where the gateway(s) enforce some sort of traffic filtering. Some claims that with the evolving connectivity of the Internet, the tradi- tional firewall has been obsolete. High speed links, dynamic topology, end-to-end encryption, threat from internal users are all issues that must be addressed. Steven M. Bellovin was the first to propose a “distributed firewall” that addresses these shortcomings. In this master thesis, the design and implementation of a “distributed firewall” with an intrusion detection mechanism is presented using Python and a scriptable firewall (IPTables, IPFW, netsh). PREFACE This thesis is written as a part of my master degree in Computer Science at the University of Oslo, Department of Informatics. The thesis is written at the Norwegian Defence Research Establishment (FFI). Scripting has been one of my favourite activities since I first learned it. Combined with the art of Computer Security, which I find fascinating and non-exhaustive, it had to be an explosive combina- tion. My problem next was to find someone to supervise me. This is where Professor Hans Petter Langtangen at Simula Research Laboratory and Geir Hallingstad, researcher at FFI, stepped in. Hans Petter Langtangen is a masterful scripting guru and truly deserves the title “Hacker”. Geir Hallingstad is expert in the field of computer/network security and gave valuable input and support when designing this prototype.
    [Show full text]
  • Intel CEO Remarks Q1'21 Earnings Webcast April 22, 2021
    Intel CEO Remarks Q1’21 Earnings Webcast April 22, 2021 Pat Gelsinger, Intel CEO Good afternoon everyone. It’s a pleasure to be with you for my first earnings call. I consider it an honor to be CEO of this great company. Thanks for joining. Intel delivered a strong Q1 that beat our January guide on both the top and bottom line, driven by exceptional demand for our products and exquisite execution by our team. We shipped a record volume of notebook CPUs. We launched new competitive Intel® Core™ and Xeon® processors. Mobileye had its best quarter ever. With tremendous industry support, we unveiled our IDM 2.0 strategy, setting a bold new course for technology leadership at Intel. The response from employees, partners and customers has been incredible. Our teams are re- invigorated, innovating and executing. It’s amazing to be back at Intel ... and Intel is back. Before George takes you through the financial details of the quarter, I’ll begin with the industry trends we’re seeing and why Intel is well positioned to aggressively capitalize on them. Said simply, Intel is the only company with the depth and breadth of software, silicon and platforms, and packaging and process with at-scale manufacturing that customers can depend on for their next-generation innovations. There are four superpowers driving digital transformation: cloud, connectivity, artificial intelligence and the intelligent edge. Intel’s mission, and we are uniquely positioned to do so, is to help customers harness these superpowers to improve the lives of every human on the planet The digitization of everything was markedly accelerated by COVID and has spurred innovation and new models of working, learning, interacting and caring.
    [Show full text]