VMworld 2011 Session #SPO3989 Cisco VXI – Desktop Virtualisation Optimised Infrastructure for Scaling VMware View Stacey Goldsmith October 2011 © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1 What about the network? What about voice and video? What about security? How can I scale my View environment? How can I simplify my Data Centre? © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 Branch Site WAN Optimisation Campus WAN Optimization View Clients WAN WAN Branch Branch Router Internet Firewall Firewall Switch Router Edge SLB Data Center Internet Internet View Core Layer Router Security View Client Servers Aggregation Layer Aggregation Remote Access Firewall Server Load Balancing Network Management Access Layer Compute/SAN VMware vSphere View Connection View Agents Environment Servers © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Data Centre Considerations • Desktop Density • Data Centre Architecture Simplification • Infrastructure Scalability Network Considerations • Desktop and Network Security • Server Load Balancing and Connection Optimisations • Best Practices Endpoint Considerations • Rich Media: voice and the hairpin effect • Tablet‘s in the Workplace • Workspace Power Management – Power over Ethernet © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 • Low desktop density drives more infrastructure; servers, networking, power, cooling, management, software, etc. • VDI has lots of puzzle pieces which impacts • integration and testing • engineering • troubleshooting/operations • time to service • costs • Scalability – starting small and growing estate • Challenging ROI © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 • Greater virtual desktop density w/o performance impact • Simple Operation—start in minutes, scale in seconds • Massive Scalability—scales easily to 1000‘s of desktops per UCS system • Extended memory and I/O to avoid desktop virtualisation bottlenecks Memory • No 3 WW Blade Server Shipments CPU • 7400+ Unique Customers Unified Fabric • 44+ World Records (FCoE) © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 Single Management Domain • All chassis and servers physically connected via inherent 10GB low- Mgmt LAN SAN A SAN B latency Fabric • IO is consolidated through a pair of fault resilient Fabric Interconnects • Wire-once for bandwidth • Policy-driven bandwidth allocation • 1/10GB lossless ethernet, Fibre Channel over Ethernet (FCoE), Native Fibre Channel © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Single Management Domain • Service Profiles - similar to VMware Tightly Coupled Existing Partner Management Tools Management Tools VMX CFG files but for bare metal servers XML API Traditional APIs • Contain over 100 pieces of configuration e.g. BIOS, WWN, MAC, QoS, etc. • Rapid provisioning through cloning and templates • Also contains Firmware Service Profile: OracleVDI-ESX Network: ORAVDI-VLAN-VLAN Network QoS:: HighHigh MAC: 08:00:69:02:01:FC WWN:: 20:65:32:25:B5:00:A4:28 BIOS: Version 1.03 Boot Order: SAN, LAN © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 Mgmt LAN SAN A SAN B © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 Conventional System Xeon 5600 Xeon 5600 12 DIMMs 18 DIMMs Highest Performance Lower Performance x Highest Cost x Lowest Cost Cisco UCS With Extended Memory Xeon 5600 Xeon 5600 48 DIMMs Highest Performance Lowest Cost © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 vSphere 4.1 / View 4.5 1400 Linear scalability from 1 to 8 1200 blades and beyond 1000 800 600 # virtual desktops virtual # 400 200 0 1 4 8 Desktop Profile UCS Blade Profile • Windows 7, 32bit UCS Blades • B250 M2 • 1.5GB RAM • 192GB Memory • 1vCPU • Dual Xeon 5680 CPU © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11 2,000 Unified Fabric switch ports DC Infrastructure required for 3,000 users Internal SAN switch ports 1,800 Internal LAN switch ports 60 – 70% Less EOR SAN switch ports 1,600 components to procure, install, configure, power, EOR LAN switch ports 1,400 cool, monitor, repair, Racks dispose . Uplink cables from TOR SAN 1,200 TOR SAN switches TOR SAN switch ports 1,000 Uplink cables from TOR LAN TOR LAN Switches 800 TOR LAN switch ports SAN uplink cables to EOR SAN switch 600 number of components of number ports LAN uplink cables to EOR LAN switch ports Cisco UCS 6100 Series Fabric 400 Interconnects Cables from fabric extenders to interconnects 200 Cisco UCS 2104XP Fabric Extenders Uplink cables from integrated SAN 52 52 32 0 Integrated SAN switches Conventional Conventional Cisco Unified Rack Servers Blade Servers Computing System © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 • Cisco Validated Designs are available to download at www.cisco.com/go/vxi • Provide in-depth details of configuration and testing for end-to-end solution including hypervisor, broker, anti-virus, user virtualisation, storage array, storage optimisation, compute, network, end-points, security, WAN acceleration and more © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 What about the network? What about voice and video? What about security? How can I scale my • Compute platform that scales to 1,000‘s of desktops View environment? that can address high density cost effective memory How can I simplify • Dramatically reduce DC infrastructure. Pre- my Data Centre? integrated system reduces integration issues. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14 Data Centre Considerations • Desktop Density • Data Centre Architecture – Simplification • Infrastructure Scalability Network Considerations • Desktop and Network Security • Server Load Balancing and Connection Optimisations • Best Practices Endpoint Considerations • Rich Media: voice and the hairpin effect • Tablet‘s in the Workplace • Workspace Power Management – Power over Ethernet © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15 • Managing common security policies for virtual and physical desktops. • Security policies not extending from VM to end-point • Lines of administration blurring between Network and Server administrators. • Approximately 40 percent of desktop virtualisation evaluations or deployments are driven by the desire to improve security. How can I ensure security at all levels? • Secured Shared infrastructure. • Any device, Any where, Any time © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 Rogue VM: Send ARP to Rogue VM: Rogue VM: Rogue DHCP Announce VM Change/Add Change/Add IP Server Location MAC Address Address VM VM VM VM VM VM VM VM VM VM VM VMotion © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 Rogue VM: Port Security IP Source Guard Send ARP to Rogue VM: Rogue VM: Rogue DHCP Announce VM Change/Add Change/Add IP Server Location MAC Address Address VM VM VM VM VM VM VM VM VM VM VM Nexus 1000V DVS VMotion Dynamic ARP Inspection DHCP Snooping © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 Server Zones Portal Records Database Application • Secure segmentation with zone-based Virtual Security Gateway (VSG) firewall • VM-level granularity HVD Zones with context-aware IT Admin Assistant Doctor Guest rules • Allow connections from End Point and VDI Services • AD, DHCP, DNS, Brokers and Applications Network • Block‘s VM to VM connections (default) iT Admin Guest Doctor © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 • Intelligent, always-on VPN • Automatically selects the optimal network access point • Optimal head end auto-detect • Extensive range of supported devices • Windows, Mac and Linux • Apple iOS 4+ - iPhone, iPad • Cisco CIUS, VXC • Google Android • Samsung Galaxy • HP webOS and Palm • Nokia © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20 Server Zones • Cisco Nexus 1000V and Cisco Healthcare Portal Records Database Application Virtual Security Gateway protects the virtual environment within the data center. • Cisco ASA 5500 Appliances (ASA) Nexus 1000V and Virtual Security Gateway secure the data center to defend HVD Zones against threats and unauthorised access IT Admin Assistant Doctor Guest • Cisco AnyConnect Secure Mobility Solution (AnyConnect) establishes trusted access between the client and the data center ASA • Cisco ScanSafe offers Cloud Security (SaaS) with Secure Split Network tunneling IT Admin Cisco AnyConnect Doctor Guest © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21 The Cisco Application Control Engine (ACE) provides detailed health monitoring and load balancing functions for the Web Front End/Connection broker Mobile Cisco ACE Teleworker Virtual IP View View Connection Clients Servers ACE Load Balancer Thin Client Cisco ACE supports Multiple Device Contexts – reducing the number of load balancing devices © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 Video processed on VM causing bandwidth and Video Source server compute overload Branch Office End-users could see pixelization as media is rendered from the data centre Branch Router Increasing bandwidth Data Centre might not help Campus End-users may not experience pixelization on LAN © 2010 Cisco and/or its affiliates. All rights reserved.