Enterprise Grade Networking with OpenStack

Copyright 2013 Alcatel-‐Lucent. All rights reserved. CONFIDENTIAL -‐ SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW

PROPRIETARY – USE PURSUANT TO COMPANY INSTRUCTION Nuage Networks



Nuage Networks Enterprise-‐Grade Networking in OpenStack

@martenhauville @jonasvermeulen

Marten Hauville Principal Solu-ons Architect ANZ

Jonas Vermeulen Product Line Manager EMEA



…or how enterprise IT needs to deliver networking with High Availability, Scalability &

Interoperability across complex multi site environments; seamlessly with existing heterogeneous infrastructure & vendors.

Oh, and interconnect OpenStack private clouds

with external public clouds too.

What does Enterprise want?

§  Faster Tme to market §  Lower cost, higher quality §  Reduced OpEx §  Ubiquitous, easy to manage, maintain, consume

Enterprise technology drivers §  Self service from catalogue §  On demand Service §  OpEx model for charging (charge-‐back) §  Pool of resources that can be easily adjusted §  Availability of integrated applicaTons in shared

environment – ApplicaTon PaaS §  Short cycle provisioning

Enterprise requires complexity

§  ExisTng hardware, hypervisors, pla]orms §  Pla]orms, Apps that cannot be virtualised §  MulTple Data Centres, remote branches §  Remote workers §  OperaTonal & Maintenance costs

Enterprise requires complexity

§  Pressure from business to perform §  Hidden IT – AWS workloads §  ReporTng, compliance §  Limited highly skilled staff

Enterprise networking needs

Scalable Up and Out, resilient and federated

AbstracDon AbstracTon of the network topologies and

complexiTes, offers service velocity

Flexibility IntegraTon with third-‐party

physical networking infrastructure

Extensibility Services need to be extended across data

centers, public or private

Enterprise ConsumpDon

Consumable Enterprise IT

OpenStack delivers to Enterprise §  Enable faster turn up for business §  Enable efficiency, minimise cost §  DevOps, DevOps, DevOps §  Open ecosystem of vendors & soaware §  Freedom of choice §  Strong(er) enterprise vendor support

Enterprise networking can be complex

ApplicaTon Networks Policy Templates

Users

ApplicaTon Types

Business Rules

Policy EvaluaTon

Firewall

Firewall

W

BL BL

W

Firewall W W

Firewall

Firewall

W

BL BL

W

Firewall

Firewall

W

BL BL

W

BL BL

Design once, re-‐use mulDple Dmes

Policy Approach to Networking

Networks need Flexibility

§  DHCP, DNS §  IPAM §  Load Balancing §  Firewalls §  Traffic Flows: Edge, North-‐South, East-‐West §  AuthenTcaTon: users & elements §  Security, reporTng, compliance

Enterprises deploy services across datacenters

Network Services

•  Layer 2 Extension? •  True L2/L3 DR? •  Dynamic Service

Provisioning?

Enterprise Environment Physical/Virtual Servers, Global Distribution, Multi Cloud Platform

> Nuage VSC

> T1 RedHat OSP >> Compute 2 >> Compute 3 > F5 > Palo Alto Networks > Nuage VSD

> T1 RedHat OSP >> Controller >> Compute 1 > Infoblox

> T2 Canonical OS [MaaS Setup] >> Controller >> Compute 1 >> Compute 2 > Avi Networks

SJC

TOR

WDC

HKG

Themes Addressed from a technical perspecDve

AbstracTon

Scalability

Flexilibity

Extensibility

Enterprise Needs

Networks in Dev/Test/Prod

# Endpoints / # subnets / #...

XaaS ConnecTvity

Stretched / Hybrid Cloud

Examples

Internet/Intranet

Dev

Management

Dev Environment Networking needs

Exportable Policy for each App

Lots of (Distributed) RouTng Instances

PotenTal overlap of IP space

AbstracDon and Velocity across Dev/Test/Prod

Internet/Intranet

Dev

Management

Test Environment Networking needs

Re-‐Usable Policy from Dev

Very large Distributed RouTng Instance

Unique IP space

Test


Internet/Intranet

Dev

Management

Prod Environment Networking needs

Re-‐Usable Policy from Test

Very large Distributed RouTng Instance

Unique IP space

Test


Prod


Desire to re-‐use policy, but network structure is different between Dev <-‐> Test/Prod

1.  Modify cookbooks between environments 2.  Use external system for defining topology and enforcing

policies è Nuage Networks allows external definiTon and mapping into tenant-‐structure


§  Distr Router can span across mulTple tenants

§  Tenants only see their own subnets

§  Security-‐groups to limit E-‐W traffic flows

1 Logical Router

1 Project maps to >=1 Tenant

Example for Test-‐Environment

AbstracDon and Velocity across Dev/Test/Prod CM-‐Tools

Define Policies per ApplicaTon

Apply, Merge, Finetune & Get

Approval

Commit Final

Test PROD

Design Once, Re-‐Use

DEV

AbstracDon and Velocity across Dev/Test/Prod Top PolicyList Owner: Net Admin

Bomom PolicyList Owner: Net Admin

B2CSitePolicyList Priority: 5

Owner: B2BSite-‐Admin

StockApp PolicyList Priority: 10 Owner: StockNW

Rule 1: Port SSH allow

Rule 2: Port Telnet drop

Rule 3: Port HTTP drop

Rule 2: Port 8080 Allow to App

Rule 6: Port SQL Allow Internal

Rule 11: Port 443 drop

Rule 7: Port 70 allow

Rule 888: Port 80 allow

Rule 1: All drop

Infrastructure Policies

ApplicaTon Policies

Infrastructure Policies Design Once, Re-‐Use

AbstracDon and Velocity across Dev/Test/Prod CM-‐Tools

Test PROD

Design Once, Re-‐Use

DEV

Backout / Roll-‐Back

Re-‐Test

Roll-‐Back to N-‐1

Scaling network primiDves §  Large Difference between Dev <-‐> Test/Prod §  Scaling impact

§  Virtual Routers – Highest for Dev à ~1500 §  Subnets – Highest for Test / Prod à 400+ per router §  Security/Policy Groups – Highest for Test / Prod à 2000+

Scaling network primiDves

Nuage VSC

…

Servers as VMs in AWS VPC

Nuage VSD §  Scaling Test in AWS

§  80 subnets / 40 routers §  20K instances (500/server)

§  Instances are Docker containers §  140K ACLs (7 ACLs per VM)

§  ConfiguraTon §  VSD running as C3.4xlarge (16-‐core) §  VSC running as C3.2xlarge ( 8 core) §  VRS running as M3.xlarge

§  Time to create: 8 minutes * *(when AWS VPC behaves)

Default = Centralized – Virtualized -‐ Single-‐Tenant

core plugin service plugin

FWaaS

Neutron-‐Server

LBaaS VPNaaS

Compute-‐Node

VM VM

Compute-‐Node

VM VM

Network-‐Node

LB

FW

VPN

LB

FW

VPN

Logical Tenant Network 1

Logica Tenant Network 2

Flexibility to connect XaaS


Compute-‐Node

§  Typically for Legacy Non-‐Virtualized Appliances

§  ConnecTvity §  Interface to gateway §  Per-‐Tenant service provided through

Provider-‐Networks (VLAN) §  Examples

§  LBaaS: F5 §  FWaaS: PaloAlto

Centralized -‐ Non-‐Virtualized -‐ MulD-‐Tenant

core plugin

nuage

service plugin

FWaaS

Neutron-‐Server

LBaaS VPNaaS

Compute-‐Node

VRS


VM VM


nuage-‐gateway

FW / LB

Context 1

Context 2

VM VM VM VM

VLAN = Provider Network

§  Services as Tenant-‐VM’s §  Tenant-‐VMs are distributed using

OpenStack placement algorithm §  Management via XaaS Plugin

§  Example: AVI LB

Distributed – Virtualized – Single-‐Tenant

core plugin

nuage

service plugin

FWaaS

Neutron-‐Server

LBaaS VPNaaS


Compute-‐Node

VRS

VM VM VM LB1

Compute-‐Node

VRS

VM VM

Compute-‐Node

VRS

VM LB2



§  Traffic gets locally redirected to an Agent running in the HV §  VM, process, docker

§  Example Agent tasks §  Proxy ARP / DHCP §  Meta-‐data Agent §  Storage Proxy for Swia §  L5-‐L7 (Eg IDS/DPI)

Distributed – Agent – MulD-‐Tenant

core plugin

nuage

service plugin

FWaaS

Neutron-‐Server

LBaaS VPNaaS

Compute-‐Node

VRS

Tenant Network 1

VM VM

Tenant Network 2

VM VM VM VM

Compute-‐Node

VRS

VM VM VM VM VM VM

Agent 1 2

Agent 1 2


Site 1 -‐ Private

Keystone

Nova

Neutron

Site 2 -‐ Private

Keystone

Nova

Neutron

Site x -‐ Public

Keystone

Nova

Neutron

Users Users Users

Network Network Network

Extending clouds to other sites

IdenTty FederaTon

Can I federate the network ? = Can I have a single subnet across sites ?

= Can I amach a new subnet to a router defined in another site ? = Can my VM communicate with a VM at a different site ?

= Can my security policies encompass VMs from different sites ?

Kilo

Site 1 -‐ Private

Keystone

Nova

Neutron

Site 2 -‐ Private

Keystone

Nova

Neutron

Site x -‐ Public

Keystone

Nova

Neutron

Network Network Network

Users


Site 1 -‐ Private

Keystone

Nova

Neutron

Site 1 -‐ Private

Keystone

Nova

Neutron

Site x -‐ Public

Keystone

Nova

Neutron

Users IdenTty FederaTon

Network FederaTon with Nuage

nuage nuage nuage Network

Centralized definiTon, sharing policy

Kilo


Site 1 -‐ Private

Keystone

Nova

Neutron

Site 2 -‐ Private

Keystone

Nova

Neutron

Site x -‐ Public

Keystone

Nova

Neutron

Users IdenTty FederaTon

Network FederaTon with Nuage

nuage nuage nuage Network

Federated Policy: Policy requested from “Home VSD” for the router

ü  Stretched subnets ü  New subnet amached to router of other site ü  VMs can communicate across sites ü  Security policies across sites

Kilo


Conclusions

AbstracTon

Scalability

Flexilibity

Extensibility

Enterprise Needs

Network Policies

Distr Control Plane

Any XaaS Topology

Network FederaTon

Delivered through

THANK YOU

See Nuage Networks in acTon at 4:15PM Avi Networks Booth T9 OpenStack Private Cloud Case Study by Nuage Networks & Avi Networks

Technology

Enterprise Grade Networking with OpenStack