WAN Architectures and Design Principles Adam Groudan – Technical Solutions Architect Agenda
Total Page:16
File Type:pdf, Size:1020Kb
WAN Architectures and Design Principles Adam Groudan – Technical Solutions Architect Agenda . WAN Technologies & Solutions • WAN Transport Technologies • WAN Overlay Technologies • WAN Optimisation • Wide Area Network Quality of Service . WAN Architecture Design Considerations • WAN Design and Best Practices • Secure WAN Communication with GETVPN • Intelligent WAN Deployment . Summary The Challenge . Build a network that can adapt to a quickly changing business and technical environment . Realise rapid strategic advantage from new technologies • IPv6: global reachability • Cloud: flexible diversified resources • Internet of Things • Fast-IT • What’s next? . Adapt to business changes rapidly and smoothly • Mergers & divestures • Changes in the regulatory & security requirements • Changes in public perception of services Network Design Modularity East Theater West Theater Global IP/MPLS Core Tier 1 Tier In-Theater IP/MPLS Core Tier 2 Tier West Region East Region Internet Cloud Public Voice/Video Mobility Tier 3 Tier Metro Metro Service Private Service Public IP IP Service Service Hierarchical Network Principle . Use hierarchy to manage network scalability and complexity while reducing routing algorithm overhead . Hierarchical design used to be… • Three routed layers • Core, distribution, access • Only one hierarchical structure end-to-end . Hierarchical design has become any design that… • Splits the network up into “places,” or “regions” • Separates these “regions” by hiding information • Organises these “regions” around a network core • “hub and spoke” at a macro level MPLS L3VPN Topology Definition Spoke Site 1 Spoke Spoke Site 2 Site Y Hub Site (The Network) SP-Managed Equivalent to MPLS IP WAN Spoke Spoke Spoke Spoke Spoke Spoke Spoke Site 1 Site 2 Site X Site Y Site N Site X Site N . MPLS WAN is provided by a service provider . As seen by the enterprise network, every site is one IP “hop” away . Equivalent to a full mesh, or to a “hubless” hub-and-spoke Virtual Routing and Forwarding Instance (VRF) Provides Network Virtualisation and Path Isolation VRF VRF VRF VRF VRF VRF . Virtualisation at Layer 3 forwarding ! PE Router – Multiple VRFs ip vrf blue . Associates to Layer 3 interfaces on router/switch rd 65100:10 . Each VRF has its own route-target import 65100:10 route-target export 65100:10 Forwarding table (CEF) ip vrf yellow rd 65100:20 Routing process (RIP, OSPF, BGP) route-target import 65100:20 route-target export 65100:20 . VRF-Lite ! interface GigabitEthernet0/1.10 Hop-by-hop ip vrf forwarding blue . MPLS VPN interface GigabitEthernet0/1.20 ip vrf forwarding yellow Multi-hop Wide Area Network Design Trends Single Provider Design Dual Providers Design Overlay Network Design . Enterprise will home all sites . Enterprise will single or dual home . Overlay tunnelling technologies into a single carrier to sites into one or both carriers to with encryption for provider provide L3 MPLS VPN provide L3 MPLS VPN connectivity. transport agnostic design connectivity. Pro: Protects against MPLS service . Pro: Can use commodity . Pro: Simpler design with failure with Single Provider broadband services for lower consistent features cost higher bandwidth service . Pro: Potential business leverage for . Con: Bound to single carrier better competitive pricing . Pro: Flexible overlay network for feature velocity topology that couples from the . Con: Increased design complexity physical connectivity . Con: Does not protect due to service implementation against MPLS cloud failure differences (e.g. QoS, BGP AS . Con: Increased design with Single Provider Topology) complexity . Con: Feature differences between . Con: Additional technology providers could force customer to use needed for SLA over commodity least common denominator features. transport services Single Carrier Site Types (Non-Transit) . Dual Homed Non Transit AS 64517 Only advertise local prefixes (^$) CE3 CE4 Typically with Dual CE routers CE5 BGP design: eBGP to carrier AS 200 iBGP between CEs Redistribute cloud learned routes into site IGP CE1 CE2 . Single Homed Non Transit Site IGP C1 C2 Advertise local prefixes and AS 64512 optionally use default route. Dual Carrier: Transit vs. Non Transit . To guarantee single homed site reachability to a dual homed site experiencing a failure, transit CE3 CE4 sites had to be elected. CE5 . Transit sites would act as a BGP Transit AS 64545 bridge transiting routes between AS 100 AS 200 the two provider clouds. To minimise latency costs of transits, transits need to be CE1 CE2 Site selected with geographic IGP diversity (e.g. from the East, C1 C2 West and Central US.) Prefix X Prefix Y Prefix Z Metro Ethernet Service (L2VPN) E-Line (Point-to-Point) E-LAN (Point-to-Multipoint) . Replaces TDM private line . Offers point to multipoint for any-to- . Point-to-point EVCs offer predictable any connectivity performance for applications . Transparent to VLANs and Layer 2 . One or more EVCs allowed per control protocols single physical interface (UNI) . 4 or 6 classes of QoS support . Ideal for voice, video, and real-time . Ideal for LAN-to-LAN bulk data data MPLS (L3VPN) vs. Metro Ethernet (L2VPN) MPLS Layer 3 Service MetroE Layer 2 Service . Routing protocol dependent on the . Flexibility of routing protocol and carrier network topology independent of the carrier . Layer 3 capability depends on carrier offering . Customer manages layer 3 QoS • QoS (4 classes/6 classes) . Capable of transport IP and • IPv6 capability non-IP traffic. Transport IP protocol only . Routing protocol determines . Highly scalable and ideal for large scalability in point-to-multipoint network topology Agenda . WAN Technologies & Solutions • WAN Transport Technologies • WAN Overlay Technologies • WAN Optimisation • Wide Area Network Quality of Service . WAN Architecture Design Considerations • WAN Design and Best Practices • Secure WAN Communication with GETVPN • Intelligent WAN Deployment . Summary Types of Overlay Service Layer 2 Overlays Layer 3 Overlays • Layer 2 Tunnelling Protocol—Version 3 • IPSec—Encapsulating Security Payload (L2TPv3) (ESP) – Layer 2 payloads (Ethernet, Serial,…) – Strong encryption – Pseudowire capable – IP Unicast only • Other L2 overlay technologies – • Generic Routing Encapsulation (GRE) OTV, VxLAN – IP Unicast, Multicast, Broadcast – Multiprotocol support • Other L3 overlay technologies – MPLSomGRE, LISP, OTP Tunnelling GRE and IPSec Transport and Tunnel Modes IP HDR IP Payload GRE packet with new IP header: Protocol 47 (forwarded using new IP dst) IP HDR GRE IP HDR IP Payload 20 bytes 4 bytes IPSec Transport mode 2 bytes ESP ESP IP HDR ESP HDR IP Payload Trailer Auth 20 bytes 30 bytes Encrypted Authenticated IPSec Tunnel mode 2 bytes ESP ESP IP HDR ESP HDR IP HDR IP Payload Trailer Auth 20 bytes 54 bytes Encrypted Authenticated Locator/Identifier Separation Protocol (LISP) Dynamic Tunnelling Analogous to a DNS but for Network Infrastructure . DNS resolves IP addresses for URLs [ who is www.cisco.com] ? DNS DNS host Server URL Resolution [153.16.5.29, 2610:D0:110C:1::3 ] . LISP resolves locators for queried identities [ where is 2610:D0:110C:1::3] ? LISP LISP LISP Mapping Identity-to-location router [ location is 128.107.81.169 ] System Map Resolution This Topic Is Covered in Detail in BRKRST-3045 LISP Overview - Terminologies . EID (Endpoint Identifier) is the IP address of a host – just as it is today . RLOC (Routing Locator) is the IP address of the LISP router for the host . EID-to-RLOC mapping is the distributed architecture that maps EIDs to RLOCs ITR – Ingress Tunnel Router ETR – Egress Tunnel Router • Receives packets from site-facing interfaces • Receives packets from core-facing interfaces • Encap to remote LISP sites, or native-fwd to • De-cap, deliver packets to local EIDs at site non-LISP sites Provider A Provider X xTR-1 xTR-1 10.0.0.0/8 12.0.0.0/8 ETR ETR ITR ITR packet flow packet flow S ETR ETR ITR ITR D Provider Y xTR-2 Provider B xTR-2 11.0.0.0/8 13.0.0.0/8 LISP Site 1 LISP Site 2 LISP Operation Example LISP Data Plane - Unicast Packet Forwarding Map-Cache Entry 3 EID-prefix: 2001:db8:2::/48 Locator-set: This policy controlled 12.0.0.2, priority: 1, weight: 50 (D1) by the destination site 13.0.0.2, priority: 1, weight: 50 (D2) PI EID-prefix PI EID-prefix 2001:db8:1::/48 6 2001:db8:2::/48 11.0.0.2 -> 12.0.0.2 7 LISP Site 1 2001:db8:1::1 -> 2001:db8:2::1 LISP Site 2 2001:db8:1::1 -> 2001:db8:2::1 Provider A Provider X xTR-1 xTR-1 2 2001:db8:1::1 -> 2001:db8:2::1 10.0.0.0/8 12.0.0.0/8 ETR 5 ETR ITR 10.0.0.2 4 12.0.0.2 ITR 11.0.0.2 -> 12.0.0.2 2001:db8:1::1 -> 2001:db8:2::1 ETR ETR S 11.0.0.2 13.0.0.2 ITR ITR D Provider Y xTR-2 Provider B xTR-2 11.0.0.0/8 13.0.0.0/8 1 DNS entry: D.abc.com AAAA 2001:db8:2::1 LISP Use Cases IPv6 Transition Efficient Multi-Homing v6 PxTR v4 v6 IPv4 Core IPv6 Internet Internet v6 service xTR IPv4 Internet LISP LISP v6 Site routers . IPv6-over-IPv4, IPv6-over-IPv6 . IP Portability . IPv4-over-IPv6, IPv4-over-IPv4 . Ingress Traffic Engineering Without BGP Virtualisation/Multi-tenancy Data Centre/ VM Mobility Legacy Site Legacy Site Legacy Site Data Internet Data Centre 1 Centre 2 LISP Site PxTR LISP LISP Mapping routers routers IP Network DB VM move VM VM West East a.b.c.1 DC DC a.b.c.1 . Large Scale Segmentation . Cloud / Layer 3 VM Move EIGRP Over-the-Top (OTP) Overview EIGRP OTP extend end-to-end network visibility over WAN EIGRP RR CE1 172.16.2.1 172.16.1.1 CE3 EIGRP MPLS – L3 VPN EIGRP AS 100 AS 100 192.168.2.1 192.168.1.1 CE2 CE4 LISP Encapsulation EIGRP Control Plane LISP data plane