Enterprise Grade Networking with OpenStack

  • View
    304

  • Download
    2

Embed Size (px)

Transcript

1. Copyright2013Alcatel-Lucent.Allrightsreserved. CONFIDENTIAL-SOLELYFORAUTHORIZEDPERSONSHAVINGANEEDTOKNOW PROPRIETARYUSEPURSUANTTOCOMPANYINSTRUCTION NuageNetworks 2. Copyright2013Alcatel-Lucent.Allrightsreserved. CONFIDENTIAL-SOLELYFORAUTHORIZEDPERSONSHAVINGANEEDTOKNOW PROPRIETARYUSEPURSUANTTOCOMPANYINSTRUCTION NuageNetworks NuageNetworks Enterprise-GradeNetworkinginOpenStack @martenhauville@jonasvermeulen MartenHauville PrincipalSolu-onsArchitectANZ JonasVermeulen ProductLineManagerEMEA 3. Copyright2013Alcatel-Lucent.Allrightsreserved. CONFIDENTIAL-SOLELYFORAUTHORIZEDPERSONSHAVINGANEEDTOKNOW PROPRIETARYUSEPURSUANTTOCOMPANYINSTRUCTION NuageNetworks or how enterprise IT needs to deliver networking with High Availability, Scalability & Interoperability across complex multi site environments; seamlessly with existing heterogeneous infrastructure & vendors. Oh, and interconnect OpenStack private clouds with external public clouds too. 4. WhatdoesEnterprisewant? FasterTmetomarket Lowercost,higherquality ReducedOpEx Ubiquitous,easytomanage,maintain,consume 5. Enterprisetechnologydrivers Selfservicefromcatalogue OndemandService OpExmodelforcharging(charge-back) Poolofresourcesthatcanbeeasilyadjusted AvailabilityofintegratedapplicaTonsinshared environmentApplicaTonPaaS Shortcycleprovisioning 6. Enterpriserequirescomplexity ExisTnghardware,hypervisors,pla]orms Pla]orms,Appsthatcannotbevirtualised MulTpleDataCentres,remotebranches Remoteworkers OperaTonal&Maintenancecosts 7. Enterpriserequirescomplexity Pressurefrombusinesstoperform HiddenITAWSworkloads ReporTng,compliance Limitedhighlyskilledsta 8. Enterprisenetworkingneeds Scalable UpandOut,resilientandfederated AbstracDon AbstracTonofthenetworktopologiesand complexiTes,oersservicevelocity Flexibility IntegraTonwiththird-party physicalnetworkinginfrastructure Extensibility Servicesneedtobeextendedacrossdata centers,publicorprivate EnterpriseConsumpDon 9. ConsumableEnterpriseIT 10. OpenStackdeliverstoEnterprise Enablefasterturnupforbusiness Enableeciency,minimisecost DevOps,DevOps,DevOps Openecosystemofvendors&soaware Freedomofchoice Strong(er)enterprisevendorsupport 11. Enterprisenetworkingcanbecomplex 12. ApplicaTonNetworksPolicyTemplates Users ApplicaTonTypes BusinessRules PolicyEvaluaTon Firewall Firewall W BLBL W Firewall W W Firewall Firewall W BLBL W Firewall Firewall W BLBL W BLBL Designonce,re-usemulDpleDmes PolicyApproachtoNetworking 13. NetworksneedFlexibility DHCP,DNS IPAM LoadBalancing Firewalls TracFlows:Edge,North-South,East-West AuthenTcaTon:users&elements Security,reporTng,compliance 14. Enterprisesdeployservicesacrossdatacenters NetworkServices Layer2Extension? TrueL2/L3DR? DynamicService Provisioning? 15. Enterprise Environment Physical/Virtual Servers, Global Distribution, Multi Cloud Platform >NuageVSC >T1RedHatOSP >>Compute2 >>Compute3 >F5 >PaloAltoNetworks >NuageVSD >T1RedHatOSP >>Controller >>Compute1 >Infoblox >T2CanonicalOS [MaaSSetup] >>Controller >>Compute1 >>Compute2 >AviNetworks SJC TOR WDC HKG 16. ThemesAddressedfromatechnicalperspecDve AbstracTon Scalability Flexilibity Extensibility EnterpriseNeeds NetworksinDev/Test/Prod #Endpoints/#subnets/#... XaaSConnecTvity Stretched/HybridCloud Examples 17. Internet/Intranet Dev Management DevEnvironmentNetworkingneeds ExportablePolicyforeachApp Lotsof(Distributed)RouTngInstances PotenTaloverlapofIPspace AbstracDonandVelocityacrossDev/Test/Prod 18. Internet/Intranet Dev Management TestEnvironmentNetworkingneeds Re-UsablePolicyfromDev VerylargeDistributedRouTngInstance UniqueIPspace Test AbstracDonandVelocityacrossDev/Test/Prod 19. Internet/Intranet Dev Management ProdEnvironmentNetworkingneeds Re-UsablePolicyfromTest VerylargeDistributedRouTngInstance UniqueIPspace Test AbstracDonandVelocityacrossDev/Test/Prod Prod 20. AbstracDonandVelocityacrossDev/Test/Prod Desiretore-usepolicy,butnetworkstructureisdierent betweenDevTest/Prod 1. Modifycookbooksbetweenenvironments 2. Useexternalsystemfordeningtopologyandenforcing policies NuageNetworksallowsexternaldeniTonandmappingintotenant- structure 21. AbstracDonandVelocityacrossDev/Test/Prod DistrRoutercanspanacross mulTpletenants Tenantsonlyseetheirown subnets Security-groupstolimitE-W tracows 1Logical Router 1Projectmaps to>=1Tenant ExampleforTest-Environment 22. AbstracDonandVelocityacrossDev/Test/Prod CM-Tools DenePolicies perApplicaTon Apply,Merge, Finetune&Get Approval CommitFinal Test PROD DesignOnce,Re-Use DEV 23. AbstracDonandVelocityacrossDev/Test/Prod TopPolicyList Owner:NetAdmin BomomPolicyList Owner:NetAdmin B2CSitePolicyList Priority:5 Owner:B2BSite-Admin StockAppPolicyList Priority:10 Owner:StockNW Rule1:PortSSHallow Rule2:PortTelnetdrop Rule3:PortHTTPdrop Rule2:Port8080AllowtoApp Rule6:PortSQLAllowInternal Rule11:Port443drop Rule7:Port70allow Rule888:Port80allow Rule1:Alldrop Infrastructure Policies ApplicaTon Policies Infrastructure Policies DesignOnce,Re-Use 24. AbstracDonandVelocityacrossDev/Test/Prod CM-Tools Test PROD DesignOnce,Re-Use DEV Backout/ Roll-Back Re-Test Roll-BacktoN-1 25. ScalingnetworkprimiDves LargeDierencebetweenDevTest/Prod Scalingimpact VirtualRoutersHighestforDev~1500 SubnetsHighestforTest/Prod400+perrouter Security/PolicyGroupsHighestforTest/Prod2000+ 26. ScalingnetworkprimiDves NuageVSC ServersasVMs inAWSVPC NuageVSD ScalingTestinAWS 80subnets/40routers 20Kinstances(500/server) InstancesareDockercontainers 140KACLs(7ACLsperVM) ConguraTon VSDrunningasC3.4xlarge(16-core) VSCrunningasC3.2xlarge(8core) VRSrunningasM3.xlarge Timetocreate:8minutes* *(whenAWSVPCbehaves) 27. Default= CentralizedVirtualized-Single-Tenant coreplugin serviceplugin FWaaS Neutron-Server LBaaS VPNaaS Compute- Node VM VM Compute- Node VM VM Network-Node LB FW VPN LB FW VPN LogicalTenantNetwork1 LogicaTenantNetwork2 FlexibilitytoconnectXaaS 28. FlexibilitytoconnectXaaS Compute-Node TypicallyforLegacyNon-Virtualized Appliances ConnecTvity Interfacetogateway Per-Tenantserviceprovidedthrough Provider-Networks(VLAN) Examples LBaaS:F5 FWaaS:PaloAlto Centralized-Non-Virtualized-MulD-Tenant coreplugin nuage serviceplugin FWaaS Neutron-Server LBaaS VPNaaS Compute-Node VRS LogicalTenantNetwork1 VM VM LogicaTenantNetwork2 nuage-gateway FW/LB Context1 Context2 VMVM VMVM VLAN=Provider Network 29. ServicesasTenant-VMs Tenant-VMsaredistributedusing OpenStackplacementalgorithm ManagementviaXaaSPlugin Example:AVILB DistributedVirtualizedSingle-Tenant coreplugin nuage serviceplugin FWaaS Neutron-Server LBaaS VPNaaS LogicalTenantNetwork1 Compute-Node VRS VM VMVM LB1 Compute- Node VRS VM VM Compute- Node VRS VM LB2 LogicaTenantNetwork2 FlexibilitytoconnectXaaS 30. Tracgetslocallyredirectedtoan AgentrunningintheHV VM,process,docker ExampleAgenttasks ProxyARP/DHCP Meta-dataAgent StorageProxyforSwia L5-L7(EgIDS/DPI) DistributedAgentMulD-Tenant coreplugin nuage serviceplugin FWaaS Neutron-Server LBaaS VPNaaS Compute-Node VRS TenantNetwork1 VM VM TenantNetwork2 VMVM VMVM Compute-Node VRS VM VM VMVM VMVM Agent Agent FlexibilitytoconnectXaaS 31. Site1-Private Keystone Nova Neutron Site2-Private Keystone Nova Neutron Sitex-Public Keystone Nova Neutron Users UsersUsers Network Network Network Extendingcloudstoothersites 32. IdenTty FederaTon CanIfederatethenetwork? =CanIhaveasinglesubnetacrosssites? =CanIamachanewsubnettoarouterdenedinanothersite? =CanmyVMcommunicatewithaVMatadierentsite? =CanmysecuritypoliciesencompassVMsfromdierentsites? Kilo Site1-Private Keystone Nova Neutron Site2-Private Keystone Nova Neutron Sitex-Public Keystone Nova Neutron Network Network Network Users Extendingcloudstoothersites 33. Site1-Private Keystone Nova Neutron Site1-Private Keystone Nova Neutron Sitex-Public Keystone Nova Neutron Users IdenTty FederaTon Network FederaTon withNuage nuage nuage nuage Network CentralizeddeniTon,sharingpolicy Kilo Extendingcloudstoothersites 34. Site1-Private Keystone Nova Neutron Site2-Private Keystone Nova Neutron Sitex-Public Keystone Nova Neutron Users IdenTty FederaTon Network FederaTon withNuage nuage nuage nuage Network FederatedPolicy: Policyrequestedfrom HomeVSDfortherouter Stretchedsubnets Newsubnetamachedtorouterofothersite VMscancommunicateacrosssites Securitypoliciesacrosssites Kilo Extendingcloudstoothersites 35. Conclusions AbstracTon Scalability Flexilibity Extensibility EnterpriseNeeds NetworkPolicies DistrControlPlane AnyXaaSTopology NetworkFederaTon Deliveredthrough 36. THANKYOU SeeNuageNetworksinacTonat 4:15PMAviNetworksBoothT9 OpenStackPrivateCloudCaseStudy byNuageNetworks&AviNetworks