Cloud networking deep dive

© 2009 VMware Inc. All rights reserved

vCloud Networking

Deep Dive

Updated: 16 November 2010

2

Agenda

Networking Overview

External Network

Network Pools

Organization Networks

vApp Networks

Example Use Cases

Q & A

3

Networking Overview

Layers of Networking

• External

• Network Pools

• Organization

• vApp

Managed at two layers: Consumers & Providers

An External Network is an network that is outside of VMware

vCloud Director.

• This is set up by the Provider

An Organization Network is contained within an organization.

• This is also set up by the Provider

vApp Network is a contained within a vApp.

• This is set up by Consumers Note: Both organization networks and vApp networks are entirely

within VMware vCloud Director-managed infrastructure..

4

External Network: Overview

a.k.a ‘Provided Network’

• Network that is external to VMware vCloud Director

• Created in vSphere/vCenter environment and consumed by VMware vCloud

Director to provide external connectivity to Organizations

• Mapped to a portgroup at the VMware vSphere layer

• vSS or vDS

• The portgroup is attached to VMware vCloud Director as an “External Network”

Use cases

• Internet access

• Provider supplied network endpoints

• IP based storage

• Backup servers

• Backhauled networking to a customer datacenter

• VPN access to a private cloud

• MPLS termination

Set up by Provider

5

External Networks: In vSphere

• VMware vCloud Director does NOT create portgroups when you create an External

Network

• The VI Admin must create the portgroups first, before a VMware vCloud Director

Provider Admin can map External Networks to them.

• It is recommended that you define these port groups on a dedicated “Provider” vDS vs.

creating them on a vSS on each ESX host in your cluster. (Can use Cisco Nexus 1000V)

• Below is an example of VLAN isolated External Networks:

6

External Networks: In VMware vCloud Director

• In VMware vCloud Director, create an External Network and attach it to one of the

portgroups

• Note if done using the VIM SDK you should create an ephemeral port group; otherwise,

you get static portgroups when created with the vCenter UI

7

Network Pools: Overview

A set of pre-configured network resources that can be used for

Organization and vApp Networks

• Use to facilitate VM to VM communication

Three Types of Network Pools in VMware vCloud Director

• Portgroup-backed

• Reference pre-created portgroups

• These have to be created in vSphere manually or through orchestration

• Do not have to be VLAN isolated (but should for L2 isolation)

• Attach a collection of them to VMware vCloud Director

• VLAN-backed

• Exactly like portgroup-backed…but VMware vCloud Director will automatically

create the portgroups as needed, and use a range of VLANs to isolate them.

• vCloud Network Isolation-backed (vCD-NI)

• VMware proprietary network isolation technology

8

Network Pools: Portgroup-backed

Requires

• Preconfigured portgroups at the vSphere layer

• Assign meaningful names so its obvious what is being mapped

• If using vSS portgroups, they must exist on all ESX/ESXi hosts in the cluster

How it works

• The system administrator manually creates the portgroups.

• When creating the network pool, you are given a list of unused portgroups that

exist in the cluster.

Advantages

• Works with all types of vSwitches.

Disadvantages

• Requires manual work or orchestration to create all of the portgroups

• Portgroups needs to be keep in sync on a vSS

• To ensure isolation portgroups rely on VLANs for L2 isolation

9

Network Pools: VLAN-backed

Requires • A vDS that’s connected to all ESX/ESXi hosts in your cluster

• A range of unused VLANs

How it works • vCD admin creates the network pool and chooses an “Organization” vDS to

attach it to, then provides a range of valid VLANs, for example, 10 – 15.

• When an isolated network is needed, vCD will automatically create a portgroup

on the vDS and assign it one of the unused VLAN numbers.

• Many isolated portgroups can coexist on the same vDS because they are

isolated by the VLAN tag

Advantages • Isolated networks

• Best network performance.

Disadvantages • Requires VLANs to exist in the physical network hardware (physical switches)

• VLANs are limited and may not be available at all

• Not compatible with Cisco Nexus 1000V • Use portgroup-backed network pool of portgroups that happen to have VLAN tags

10

Network Pools: VLAN-backed in VMware vCloud Director

VLAN-backed: • define the VLAN range for the pool and select the vDS to provision the portgoups on

11

Network Pools: VLAN-backed in vSphere

VLAN-backed Example: • The VLAN-backed network pool was defined to use the range 10-15

• The External Org Network was called Emca External.

• An ephemeral port group was created for you with a vShield edge, vse-1821527865.

• Editing properties shows the switch is named with V10 matching the consumed VLAN

and the name is dvs.VC1098296841DVS1CM1-V10-Emca External

12

Network Pools: vCloud Network Isolation

VMware proprietary network isolation technology

• vCD-NI “networks” span hosts and are represented as portgroups on a vDS.

• Setup:

• Designate a “Transport Network” – an actual layer 2 segment to carry the

packets for vCD-NI networks

• Decide how many networks you want in the pool

• Individual vCD-NI Networks are isolated from each other and the Transport

Network via MAC-in-MAC encapsulation

• Works with vmkernel functionality in ESX/ESXi 4.0U2 or 4.1 and above

• (vCD Beta required Service VM on older ESX/ESXi hosts)

• Technical details:

• Implemented with MAC-in-MAC encapsulation

• Can cause frame fragmentation with default MTU

• Requires a small increase in MTU to 1524 or higher

In Lab Manager, this was

called “Cross-Host Fencing”

13

Network Pools: vCloud Network Isolation-backed

Requires • A vDS that’s connected to all ESX/ESXi hosts in your cluster.

How it works: • vCD creates an overlay “transport” network for each isolated network to carry

encapsulated traffic

• Each overlay network is assigned a Network ID number.

• Encapsulation contains source and destination MAC addresses of ESX/ESXi

hosts where VM endpoints reside as well as the Network ID

• ESX/ESXi host strips the vCD-NI packet to expose the VM source and

destination MAC addressed packet that is delivered to the destination VM

Advantages: • Does not require VLANs (can optionally set a VLAN ID for the transport

network; leaving blank defaults to 0)

• More secure than VLAN-backed

Disadvantages: • Small performance overhead due to encapsulation (dvFilter).

• Added MAC header require an increase in MTU same as in MPLS networks

• vCD-NI is for layer 2 adjacency and not for routed networks

• vCD-NI is only for VMs and cannot be accessed by physical hosts

14

Network Pools: vCloud Network Isolation in vSphere

vCD-NI-backed Example: • A vCD-NI-Backed Pool where transport VLAN is 99 was created.

• The VI portgroup does not reflect isolation, just the transport VLAN used for the vCD-NI

• The name of the portgroup gives you a hint that it’s isolated. It contains, in this instance,

with “V99-F1” meaning it’s using VLAN 99 and isolation network ID 1.

15

Organization Networks: Overview

Contained within an organization

Allows vApps within the organization to communicate with each

other or to outside the organization

Can be connected to External Networks as:

• Public (External Org Direct)

• Bridged connection to an External Network

• Others outside the organization can see

• Private Routed (External Org NAT-Routed)

• Connected to an External Network through a vShield Edge

• Can be configured for NAT & Firewall

…or left unconnected to external

• Private Internal (Internal Org)

• No External connectivity

Backed By Network Pools

Set up by Provider

16

Organization Networks: In VMware vCloud Director

Creating NAT-Routed and Isolated Org Networks: • Select the type of Org Network to create using the typical radio button and

dropdown box

17


Creating NAT-Routed and Isolated Org Networks: • Select the Network Pool to use for the Internal Network

• Assign internal addressing for the Internal Network

18


Creating NAT-Routed and Isolated Org Networks: • For the External Network select the External Network to attach to as well as the internal

• Also select the Network Pool to use for the Internal Network behind the vShield Edge.

• Assign internal addressing for the Inside portion of Org Network

19

vApp Networks: Overview

Contained within a vApp

• Inherently Private Internal

Allows VMs in a vApp to communicate with each other

or...by connecting them to Org Networks, other vApps

Can be connected to Org Networks as

• Public (Direct)

• Bridged connection to a organization network

• Private Routed

• Connected to a organization network through a vShield Edge

• Can be configured for NAT & Firewall

Backed by a Network Pool

Set up by Consumers

20

Putting it Together: vCloud Networking Options – Examples

vApp network

vApp

External Network (set up by system admin)

External Organization Network (set up by system admin)

Organization

Internal Organization network (set up by system admin)

vApp network

(set up by org admin/vApp author, internal to vApp)

External Organization Network

vApp network 1 2 3

4

5 6

7

8

21

Putting it Together: vCloud Networking Options – Examples

Organization Network 1

External Network 1



External Organization Network – Direct Connection

External Organization Network – NAT-routed Connection

Internal Organization Network

vApp 4

vApp Network

(Private)

vApp 3

Connected to Organization Network

(vApp network with NAT-routed connection and IP masquerading defined)

vApp 1

Connected to Organization network

(vNICs connected to Organization network)

vSphere Network 1

External Network 2

vSphere Network 2

vShield Edge (NAT/firewall)

vShield Edge (NAT/firewall)

.11 .12

.111 .112

Internal vSphere network

(backed by Network Pool)

Isolated VM





vApp 2

Connected to Organization network

(vApp network with direct connection)



vApp Network



vApp Network

Isolated vApp Network

Organization

22

Use Cases

23

Networking Use Cases – Example 1 of 4

Use Case 1: Isolated vApp

24


Use Case 2: Dev/Test

25


Use Case 3: Pre-Production with access to Internet

26


Use Case 4: Pre-Production with access to VPN

27

Networking Multi-tenancy

28

vSphere Dependencies

Network Pools: Backing for private networks in vCloud Director

• vSphere Port Group backed

• Requires vSS or vDS or N1KV Switches

• VLAN-backed

• Requires vDS and VLANs

• vCloud Director Network Isolation-backed (vCD-NI)

• Requires vDS and VLANs

• Mac-in-Mac Encapsulation (1524 bytes MTU)

External Networks: for Internet, VPN/MPLS, IP SAN connectivity

• Requires vSS or vDS or N1KV Switches

29

Network Security

vShield Edge

• Integrated with vCloud Director

• Network security services

• Firewall

• NAT

• DHCP

• Port forwarding

• IP masquerading

Option for internal only or connected externally

• Internal only – within vApp or within organization

30

Questions

Technology

Cloud networking deep dive