Cloud Compu(ng

Network Virtualization

lunedì 17 dicembre 12
 Agenda
• Introduction
• External network virtualization
§ What  to be virtualized ?
  • Network device virtualiza1on
  • Network data path virtualiza1on
§ How to be virtualized ?
• Protocol approach
• Internal  network virtualization
§ Traditional  approach
§ New techniques
§ Case study

• Best  practice  with  VMware

2

lunedì 17 dicembre 12
 •Introduction  
•External  network virtualization
•Internal  network virtualization
•Best  Practices  with  VMware
NETWORK VIRTUALIZATION

lunedì 17 dicembre 12
   Related Concepts
5

¨ Virtual Private Networks (VPN)

¤ Virtual network connecting distributed sites
¤ Not customizable enough

¨ Active and Programmable Networks

¤ Customized network functionalities
¤ Programmable interfaces and active codes

¨ Overlay Networks
¤ Application layer virtual networks
¤ Not flexible enough

lunedì 17 dicembre 12
   Network Virtualization Model
6

¨ Business Model
¨ Architecture

¨ Design Principles

¨ Design Goals

lunedì 17 dicembre 12
   Business Model
7

Players Relationships
¨ Infrastructure Providers (InPs)
¤ Manage underlying physical networks

End$User$
¨ Service Providers (SPs)
 ¤ Create and manage virtual networks
SLA$
¤ Deploy customized end-to-end services
Broker$ Service$Provider$
EIA$
¨ End Users
 ¤ Buy and use services from different service NPA$
    providers Infrastructure$
SIA$

Provider$
¨ Brokers
 ¤ Mediators/Arbiters IIA$

lunedì 17 dicembre 12
 Architecture
Architecture
 
8

University of Waterloo - eNVy Wednesday, May 14, 2008

lunedì 17 dicembre 12
   Design Principles
9
Design Principles
9
Concurrence of multiple heterogeneous
¨
virtual networks Hierarchy of Roles
 Concurrence of multiple heterogeneous
  ¤ Introduces diversity
virtual networks Hierarchy of Roles
 Introduces diversity
Service Provider N
Recursion of virtual networks Infrastructure
¨
 ¤ Opens theofdoor
Recursion for networks
virtual network virtualization
Virtual Network N
Provider N+1
    economics
 Opens the door for network virtualization …
economics Service Provider 1
Inheritance of architectural attributes Virtual Network 1
Infrastructure
¨
 ¤ Promotes
Inheritancevalue-addition
of architectural attributes
Provider 2

 Promotes value-addition
Revisitation of virtual nodes Service Provider 0
Infrastructure
¨
     ¤ Revisitation
Simplifies network
of virtualoperation
nodes and
Virtual Network 0
Provider 1
    management
 Simplifies network operation and
management Infrastructure
Provider 0

University of Waterloo - eNVy Wednesday, May 14, 2008

lunedì 17 dicembre 12
   Design Goals
10

¨ Flexibility
¤ Service providers can choose
n arbitrary network topology,
n routing and forwarding functionalities,
n customized control and data planes

¨ Scalability
¤ Maximize the number of co-existing virtual networks
¤ Increase resource utilization and amortize CAPEX and OPEX

¨ Security, Privacy, and Isolation

¤ Complete isolation between virtual networks
n Logical and resource

¤ Isolate faults, bugs, and misconfigurations

n Secured and private
lunedì 17 dicembre 12
   Design Goals (2)
12

¨ Programmability
¤ Ofnetwork elements e.g. routers
¤ Answer “How much” and “how”
¤ Easy and effective without being vulnerable to threats

¨ Heterogeneity
¤ Networking technologies
n Optical, sensor, wireless etc.
¤ Virtual networks

lunedì 17 dicembre 12
   Definition (Sort of)
14

  Network virtualization is a networking environment that allows

multiple service providers to dynamically compose multiple

heterogeneous virtual networks that co-exist together in isolation

from each other, and to deploy customized end-to-end services

on-the-fly as well as manage them on those virtual networks for

the end-users by effectively sharing and utilizing underlying

network resources leased from multiple infrastructure providers.

lunedì 17 dicembre 12
 Introduc(on
• What is computer network ?
§ A computer  network, often simply referred to as a network, is a
collection  of computers and devices interconnected  by
communications  channels that facilitate  communications  among
users and allows users to share resources.
• Why should we study network ?
§ Computer  networks are used for communication  and coordination,
as well as commerce by large as well as small organizations.
§ Computer  networks and the Internet is a vital part of business
infrastructure.

lunedì 17 dicembre 12
 Network Protocol and Model
• Network protocol
§ Rules and procedures governing transmission  between computers
§ Used to identify communicating  devices, secure attention  of
intended  recipient, check for errors and re-­‐transmissions
§ All computers using a protocol  have to agree on how to
code/decode the message, how to identify errors, and steps to take
when there are errors or missed communications

Computer
System Protocol

Delivery Protocol

Packaging Protocol

lunedì 17 dicembre 12
 Network Protocol and Model

lunedì 17 dicembre 12
 Network Types
• LANs and WANs
§ Local area network
• Network of computers and other devices within a limited distance
• Uses star, bus or ring topologies
• Network interface cards in each device specifies transmission rate,
message structure, and topology
• Network opera1ng system routes and manages communica1ons and
coordinates network resources
§ Wide area network
• Network of computers spanning broad geographical distances
• Switched or dedicated lines
• Firms use commercial WANs for communica1on

lunedì 17 dicembre 12
 Network Architecture
• Packet switching
§ Message/Data  is divided into Qixed or variable length packets
§ Each packet is numbered and sent along different  paths to the
destination
§ Packets  are assembled
at the destination
§ Useful for continued
message transmission
even when part of the
network path is
broken

lunedì 17 dicembre 12
 Network Architecture
Connect two networks

lunedì 17 dicembre 12
 Network Architecture
Connect mul(ple networks

lunedì 17 dicembre 12
 Network Architecture
Connect mul(ple networks

lunedì 17 dicembre 12
 Network Architecture
Connect mul(ple networks

lunedì 17 dicembre 12
 Network Architecture
The simple view of Internet

lunedì 17 dicembre 12
 Network Design Rules

• Hierarchical approach
§ TrafQic  is aggregated  hierarchically
from an access layer into a layer of
distribution  switches and Qinally
onto  the network core.
§ A hierarchical  approach  to
network design has proven to
deliver the best results in terms of
optimizing  scalability, improving
manageability,and maximizing
network availability.

lunedì 17 dicembre 12
 Network Virtualiza(on
• Two categories :
§ External  network virtualization
• Combining many networks, or parts of networks, into a virtual unit.
§ Internal  network virtualization
• Providing network-­‐like func1onality to the soGware containers on a single
system.

lunedì 17 dicembre 12
 •Introduction  
•External  network virtualization
•Internal  network virtualization
•Best  Practices  with  VMware
NETWORK VIRTUALIZATION

lunedì 17 dicembre 12
 Network Virtualiza(on
• External network virtualization in different layers :
§ Layer1
• Seldom virtualiza1on implement in this physical data transmission layer.
§ Layer2
• Use some tags in MAC address packet to provide virtualiza1on.
• Example, VLAN.
§ Layer3
• Use some tunnel techniques to form a virtual network.
• Example, VPN.
§ Layer4 or higher
• Build up some overlay network for some applica1on.
• Example, P2P.

lunedì 17 dicembre 12
         Network Virtualiza(on
• Two virtualization  components :
  § Device virtualization
    • Virtualize physical devices in the
      network
  § Data path virtualization
• Virtualize communica1on path Data Path
  between network access points
  Router

    Switch
    22

lunedì 17 dicembre 12
   Network Virtualiza(on
• Device virtualization
§ Layer2 solution § Layer 3 solution 3
  • Divide physical switch into   • VRF technique
    mul1ple logical switches.     ( Virtual Rou1ng and Forwarding )
  • Emulate isolated rou1ng tables
    within one physical router.

     

lunedì 17 dicembre 12
 Network Virtualiza(on
• Data path virtualization
§ Hop-­‐to-­‐hop  case
• Consider the virtualiza1on
applied on a single hop data-­‐
path.

§ Hop-­‐to-­‐cloud  case
• Consider the virtualiza1on
tunnels allow mul1-­‐hop data-­‐
path.

24

lunedì 17 dicembre 12
 Network Virtualiza(on
• Protocol approach
§ Protocols  usually used to approach  data-­‐path  virtualization.
§ Three implementations
• 802.1Q – implement hop to hop data-­‐path virtualiza1on
• MPLS ( Mul?protocol Label Switch ) – implement router and switch
layer virtualiza1on
• GRE (Generic Rou?ng Encapsula?on) – implement virtualiza1on among
wide variety of networks with tunneling technique.

25

lunedì 17 dicembre 12
 Network Virtualiza(on
• 802.1Q
§ Standard by IEEE 802.1
§ Not encapsulate the
original frame
§ Add a 32-­‐bit Qield
between MAC address and
EtherTypes Qield
  • ETYPE(2B): Protocol
iden1fier
• Dot1Q Tag(2B): VLAN
number, Priority code
CE: Customer Edge router
  PE: Provider Edge router
26

lunedì 17 dicembre 12
 Network Virtualiza(on
• MPLS ( Multiprotocol Label Switch )
§ Also classiQied as layer 2.5 virtualization
§ Add one or more labels into package
§ Need Label Switch Router(LSR)to read MPLS header

28

lunedì 17 dicembre 12
   Network Virtualiza(on
• Example of MPLS

5
4 VN 1
2
7 9
8

LSR Physical Network

LER LER
CE LSR CE
LER
CE
5 VN 2
4 2
7
9
29

lunedì 17 dicembre 12
 Network Virtualiza(on
• GRE ( Generic Routing Encapsulation )
§ GRE is a tunnel protocol  developed by CISCO
§ Encapsulate  a wide variety of network layer protocol
§ Stateless  property
• This means end-­‐point doesn't keep informa1on about the state

Built Tunnel

30

lunedì 17 dicembre 12
 •Introduction  
•External  network virtualization
•Internal  network virtualization
•Best  Practices  with  VMware
NETWORK VIRTUALIZATION

lunedì 17 dicembre 12
 Internal Network Virtualiza(on
• Internal  network virtualization
§ A single system is conQigured  with containers, such as the Xen
domain,  combined with hypervisor control  programs  or pseudo-­‐
interfaces  such as the VNIC, to create  a “network in a box”.
§ This solution  improves overall efQiciency of a single system by
isolating  applications  into separate  containers  and/or pseudo
interfaces.
§ Virtual  machine and virtual switch :
• The VMs are connected logically to each other so that they can send data
to and receive data from each other.
• Each virtual network is serviced by a single virtual switch.
• A virtual network can be connected to a physical network by associa1ng
one or more network adapters (uplink adapters) with the virtual switch.

lunedì 17 dicembre 12
 Network Virtualiza(on
• Internal  network virtualization in different layers :
§ Layer1
• Hypervisor usually do not need to emulate the physical layer.
§ Layer2
• Implement virtual L2 network devices, such as switch, in hypervisor.
• Example, Linux TAP driver + Linux bridge.
§ Layer3
• Implement virtual L3 network devices, such as router, in hypervisor.
• Example, Linux TUN driver + Linux bridge + IP-­‐tables.
§ Layer4 or higher
• Layer 4 or higher layers virtualiza1on is usually implemented in guest OS.
• Applica1ons should make their own choice.

lunedì 17 dicembre 12
 Network Virtualiza(on
• Desirable properties of network virtualization :
§ Scalability
• Easy to extend resources in need
• Administrator can dynamically create or delete virtual network connec1on
§ Resilience
• Recover from the failures
• Virtual network will automa1cally redirect packets by redundant links
§ Security
• Increased path isola1on and user segmenta1on
• Virtual network should work with firewall soGware
§ Availability
• Access network resource any1me

18

lunedì 17 dicembre 12
 Internal Network Virtualiza(on
• Properties of virtual switch
§ A virtual switch works much like a physical Ethernet switch.
§ It detects which VMs are logically  connected to each of its virtual
ports and uses that information  to forward  trafQic  to the correct
virtual  machines.
• Typical virtual network conQiguration
§ Communication  network
  • Connect VMs on different hosts
§ Storage  network
• Connect VMs to remote storage system
§ Management  network
• Individual links for system administra1on

lunedì 17 dicembre 12
 Internal Network Virtualiza(on
Network virtualiza(on example form VMware

lunedì 17 dicembre 12
 Tradi(onal Approach
• KVM  (Kernel-­‐based  Virtual  Machine)  is  a  full  virtualization  
solution  for  Linux  on  x86  hardware  containing  virtualization  
extensions  (Intel  VT  or  AMD-­‐V).  It  consists  of  a  loadable  kernel  
module,  kvm.ko,  that  provides  the  core  virtualization  
infrastructure  and  a  processor  speciQic  module,  kvm-­‐intel.ko  or  
kvm-­‐amd.ko
§ KVM focus on CPU and memory virtualization,  so IO virtualization
framework  is completed by QEMU project.
§ In QEMU, network interface  of virtual machines connect to host by
TUN/TAP driver and Linux bridge.
§ Work with TUN/TAP and Linux Bridge :
• Virtual machines connect to host by a virtual network adapter, which is
implemented by TUN/TAP driver.
• Virtual adapters will connect to Linux bridges, which play the role of
virtual switch.

lunedì 17 dicembre 12
 Tradi(onal Approach
• TUN/TAP driver
§ TUN and TAP are virtual network kernel drivers :
• TAP (as in network tap) simulates an Ethernet device and it operates with
layer 2 packets such as Ethernet frames.
• TUN (as in network TUNnel) simulates a network layer device and it
operates with layer 3 packets such as IP.

§ Data Qlow of TUN/TAP driver

• Packets sent by an opera1ng system via a TUN/TAP device are delivered to
a user-­‐space program that ahaches itself to the device.
• A user-­‐space program may pass packets into a TUN/TAP device.
• TUN/TAP device delivers (or "injects") these packets to the opera1ng
system network stack thus emula1ng their recep1on from an external
source.

lunedì 17 dicembre 12
 Tradi(onal Approach

lunedì 17 dicembre 12
 Tradi(onal Approach
• Linux bridge
§ Bridging  is a forwarding  technique used in packet-­‐switched
computer  networks.
§ Unlike routing,  bridging makes no assumption  about where in a
network a particular  address is located.
§ Bridging  depends on Qlooding  and examination  of source addresses
in received packet headers to locate  unknown devices.
§ Bridging  connects multiple  network
segments  at the data link layer
(Layer 2) of the OSI model.

lunedì 17 dicembre 12
 Tradi(onal Approach
TAP/TUN driver + Linux Bridge

lunedì 17 dicembre 12
 New Techniques
• In Xen system
§ Since  implemented with para-­‐virtualization  type, guest OS load
modiQied  network interface  drivers.
§ ModiQied  network interface drivers communicate  with virtual
switches in Dom0, which act as TAP in traditional  approach.
§ Virtual  switch in Xen can be
implemented  by Linux bridge
or work with other
optimization.

lunedì 17 dicembre 12
 New Techniques
Detail in Xen System

lunedì 17 dicembre 12
 New Techniques
• Some performance issues :
§ Page remapping
• Hypervisor remap memory page
for MMIO.
§ Contexts  witching
• Whenever packets send, induce
one context switch from guest to
Domain 0 to drive real NIC.
§ Software  bridge management
• Linux bridge is a pure soGware
implementa1on.
§ Interrupt  handling
• When interrupt occur, induce one
context switch again.

lunedì 17 dicembre 12
 New Techniques
• Improve Xen performance by software
§ Large  effective  MTU
§ Fewer packets
§ Lower per-­‐byte cost

lunedì 17 dicembre 12
 New Techniques
• Improve Xen performance by hardware
§ CDNA (ConcurrentDirect Network Access) hardware  adapter
§ Remove driver domain  from data and interrupts
§ Hypervisor only responsible for virtual interrupts  and assigning
context  to guest OS

lunedì 17 dicembre 12
 Case Study

• VMware offer a hybrid

solution of network
virtualization in Cloud.
  § Use redundant links to
provide high  availability.
§ Virtual  switch in host OS
will automatically  detect
link failure  and redirect
packets  to back-­‐up links.

lunedì 17 dicembre 12
 Network Virtualiza(on Summary
• Virtualization in layers
§ Usually in Layer 2 and Layer 3
• External network virtualization
§ Layer2
• 802.1q
§ Layer3
• MPLS, GRE
• Internal  network virtualization
§ Layer 2
• TAP/TUN + Linux bridge
§ Layer3
• Virtual switch, CDNA

lunedì 17 dicembre 12
 IaaS Case Study
• IaaS open source project – Eucalyptus
§ Elastic  Utility Computing  Architecture
for Linking Your Programs  to Useful Systems

IaaS Architecture of Eucalyptus

lunedì 17 dicembre 12
 IaaS Case Study
Server Virtualiza(on

lunedì 17 dicembre 12
 IaaS Case Study
• System Component :
§ Cloud Controller(CLC)
• Dispatch user request to some clusters.
§ ClusterController(CC)
• Determine enough resource for virtual machine deployment.
§ Node Controller (NC)
  • Run user’s virtual machines.

lunedì 17 dicembre 12
 IaaS Case Study
Network Virtualiza(on

lunedì 17 dicembre 12
 NAT-­‐PT
• Network  Address  Transla1on  Port  Transla1on  or  NAT-­‐PT  is  a  technique  that  allows  
the  transla1on  of  local  network  addresses  or  the  internal  IP  addresses  (used  within  
an  organiza1on)  into  globally  unique  IP  addresses  that  help  iden1fy  an  online  
resource  in  a  unique  manner  over  the  Internet.
– the  local  network  address  is  in  the  range  of  private  addresses  as  defined  by  RFC  1918  and  
RFC  4193.
  10.0.0.0  –  10.255.255.255       16,777,216  
  172.16.0.0  –  172.31.255.255     1,048,576  16  
  192.168.0.0  –  192.168.255.255     65,536  256  
– These  addresses  are  characterized  as  private  because  they  are  not  globally  delegated,  
meaning  they  are  not  allocated  to  any  specific  organiza1on,  and  IP  packets  addressed  by  
them  cannot  be  transmihed  onto  the  public  Internet.  Anyone  may  use  these  addresses  
without  approval  from  a  regional  Internet  registry  (RIR).
• The  process  is  also  referred  to  as  Network  Masquerading  or  the  Na1ve  Address  
Transla1on.  Network  Address  Transla1on  allows  mul1ple  resources  within  an  
organiza1on  or  connected  to  a  local  LAN  to  use  a  single  public  IP  address  to  access  
the  Internet.  

lunedì 17 dicembre 12
 NAT  usage
• The  idea  of  Network  Address  Transla1on  is  very  
simple.  
– It  essen1ally  abstracts  internal  addressing  from  the  
global  IP  addressing  used  over  the  Internet.  This  
abstrac1on  allows  helps  the  network  resources  to  get  
over  a  shortage  of  the  address  space  by  mapping  
rela1vely  few  real  IP  addresses  to  the  abundant  local  IP  
addresses  created  locally  by  the  Proxy  server  for  
addressing  purposes.  
– It  allows  the  use  of  different  addresses  over  the  local  
and  global  level  and  local  sharing  of  IP  addresses  over  
the  Internet.

lunedì 17 dicembre 12
 Example  1:  when  the  web  service  is  on  the  public  network

80.88.10.2 192.168.0.1
default  gateway default  gateway

Virtual  Switch
HOST Router  NAT-­‐PT

src  addr:  80.88.10.2:8320 src  addr:  192.168.0.2:10225

dst  addr:  66.90.12.12:80 dst  addr:  66.90.12.12:80

192.168.0.2
Local  Address
lunedì 17 dicembre 12
 Example  2:  when  the  web  services  are  behind  the  NAT

192.168.0.3
80.88.10.2 192.168.0.1 Local  Address
default  gateway default  gateway

Virtual  Switch
HOST Router  NAT-­‐PT

src  addr:  66.90.12.12:8320 src  addr:  66.90.12.12:8320

dst  addr:  80.88.10.2:80 dst  addr:  192.168.02:80

src  addr:  66.90.12.12:9608 src  addr:  66.90.12.12:8320

192.168.0.2
dst  addr:  80.88.10.2:8080 dst  addr:  192.168.03:80
Local  Address
lunedì 17 dicembre 12
 Example  2:  when  the  web  services  are  behind  the  NAT

192.168.0.3
80.88.10.2 192.168.0.1 Local  Address
default  gateway default  gateway

Port  Forwarding  Table

Virtual  Switch
Public   TCP/ Private   Port
HOST Port UDP
Router   NAddress
AT-­‐PT
80 TCP 192.168.0.2 80

8080 TCP 192.168.0.3 80

src  addr:  66.90.12.12:8320 src  addr:  66.90.12.12:8320

dst  addr:  80.88.10.2:80 dst  addr:  192.168.02:80

src  addr:  66.90.12.12:9608 src  addr:  66.90.12.12:8320

192.168.0.2
dst  addr:  80.88.10.2:8080 dst  addr:  192.168.03:80
Local  Address
lunedì 17 dicembre 12
 Drawbacks
1. Network   Address   Transla1on  does  not  allow   a   true  end-­‐to-­‐end  connec?vity   that   is   required  by  
some  real  ?me   applica?ons.  A  number  of   real-­‐1me  applica1ons   require  the   crea1on   of  a  logical  
tunnel   to   exchange   the   data   packets   quickly   in   real-­‐1me.   It   requires   a   fast   and   seamless  
connec1vity   devoid   of  any  intermediaries   such   as  a  proxy  server   that  tends  to   complicate  and  
slow  down  the  communica1ons  process.  

2. NAT  creates  complica1ons  in  the  func1oning  of   Tunneling  protocols.  Any  communica1on  that   is  
routed  through   a  Proxy  server  tends   to  be   compara1vely   slow  and   prone  to  disrup1ons.  Certain  
cri1cal   applica1ons   offer   no   room   for   such   inadequacies.   Examples   include   telemedicine   and  
teleconferencing.   Such   applica1ons   find   the   process   of   network   address   transla?on   as   a  
boJleneck   in   the   communica?on   network   crea1ng   avoidable   distor1ons   in   the   end-­‐to-­‐end  
connec1vity.  

3. NAT   acts   as   a   redundant   channel   in   the   online   communica?on   over   the   Internet.   The   twin  
reasons   for   the   widespread   popularity   and   subsequent   adop1on   of   the   network   address  
transla1on   process  were  a  shortage  of   IPv4  address  space  and   the  security  concerns.   Both  these  
issues   have   been   fully   addressed   in   the   IPv6   protocol.   As   the   IPv6   slowly   replaces   the   IPv4  
protocol,   the   network   address   transla1on   process   will   become   redundant   and   useless   while  
consuming   the   scarce   network   resources   for   providing   services  that   will  be  no  longer   required  
over  the  IPv6  networks.

lunedì 17 dicembre 12
 IaaS Case Study
• Network architecture :
§ Bridge ( Virtual Switch )
• Make virtual machines on one node share physical NICs.
§ DHCP
• Map virtual MAC addresses of VMs to private IPs in the LAN.
§ NAT
• Forward the packages to public network (WAN).
§ IP/MAC mapping table
• IP addresses are assigned by Eucalyptus.
• MAC addresses are assigned by hypervisor.
• This mapping table is maintained by Eucalyptus system.

lunedì 17 dicembre 12
 •Introduction  
•External  network virtualization
•Internal  network virtualization
•Best  Practices  with  VMware  
(Guy Brunsdon, VMware, Inc.)

NETWORK VIRTUALIZATION

lunedì 17 dicembre 12
 Agenda

Virtual Networking Concepts Networking Design Examples

  and Best Practices   Example 1: Blade Server
    Why Virtual Networking?   with 2 NIC ports
    Anatomy of Virtual Networking   Example 2: Server with
    Virtual Switch Options and   4 NIC ports
    alternatives   Example 3: Server with 4 NIC
    ESX Virtual Switch Capabilities   ports (variation)
    Spanning Tree Protocol   Servers with >4 NIC ports
    NIC Teaming Additional Considerations
    Port Group Configuration   IP Storage considerations
    Traffic types   IPv6
    VLAN Trunking   vNetwork Appliance API
    FCoE and 10GigE   Further Reading
  VMotion: network operation under
  the covers
  Migrating to vDS and/or Nexus
  1000V

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Why Do We Need a Virtual Switch?
Non-Virtualized Virtualized

  ESX host

…
Access Ports
(single VLAN L2 Virtual Switch
—no tagging) provides fanout and
policy control to each VM
(consistent with non-
Per Host virtualized environment)
network visibility Access Ports Virtual Switch Layer 2 Virtual Access
from each port (single VLAN switch
—no tagging)

VLAN
    Layer 2 Access Trunks
    switches
  Layer 2
VLAN
Trunks
  switches
VLAN
  Distribution Trunks
  and core
Distribution
  and core

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Anatomy of Virtual Networking

  Service Console
ESX Host (management port)

VM0 VM1 VM2 VM3

Virtual
Machine (VM) Service vmkernel Vmkernel
Console
(port for IP Storage
  Virtual NIC    
and VMotion)
    (vnic)
Port Group   MAC addresses
  (L2) assigned to
Virtual Switch
      vnics
vSwitch
   
(vSwitch)

   Physical NIC    NIC Teams

  (vmnic or pnic)
        Uplinks   VLAN Trunk
(overlaid on uplinks in
   VST mode)
      Physical switch
 
Production
Network

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vNetwork Distributed Switch (vDS)
ESX Host 1 ESX Host 2 ESX Host 3
A B G H C D I J E F K L
 
Service vmkernel Service vmkernel Service vmkernel

Console Console
… Console

The Data Plane remains in each

ESX host and is responsible for vCenter Server
frame forwarding, teaming, etc

  The Virtual Switch Control   vDS Representation

Planes are aggregated
in vCenter Server
A B C D E F G H I J K L
 
Service
Console
1    
Service
Console
2
Service
Console
3
 
Vmk
1
Vmk
2  
Vmk
3

DV Port Groups aggregated over

entire vDS and across hosts and vNetwork Distributed Switch
group ports with same
configuration and policy
 
Production
Network

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Virtual Switch Options with vSphere 4

Virtual Switch Model Details

vNetwork Standard Host based: - Same as vSwitch in VI3
Switch 1 or more per
ESX host
vNetwork Distributed Distributed: - Expanded feature set
Switch 1 or more per   - Private VLANs
―Datacenterǁ‖   - Bi-directional traffic shaping
  - Network Vmotion
- Simplified management
Cisco Nexus 1000V Distributed: - Cisco Catalyst/Nexus feature set
1 or more per - Cisco IOS cli
    ―Datacenterǁ‖

  Virtual networking concepts similar with all virtual switches

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vNetwork Standard Switch: A Closer Look
vSS defined on a per host basis from Home à Inventory à Hosts and Clusters.

Uplinks (physical NICs)

attached to vSwitch.

Port Groups are policy

definitions for a set
or group of ports.
e.g. VLAN membership,
port security policy,
teaming policy, etc

vNetwork Standard
Switch (vSwitch)

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vNetwork Distributed Switch: A Closer Look

  DV Uplink Port Group

  defines uplink policies

   DV Uplinks abstract

actual physical nics
DV Port Groups
 
span all hosts
  (vmnics) on hosts
   
covered by vDS
     
and are groups
         
of ports
  defined with the
       
same policy
   
e.g. VLAN, etc
             
vmnics on each host
            mapped to dvUplinks

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 ESX Virtual Switch: Capabilities

  Layer 2 switch—forwards frames based

  on 48-bit destination MAC address in
frame
VM0 VM1

MAC address known by registration

(it knows its VMs!)—no MAC
    MAC learning required
  address Can terminate VLAN trunks (VST mode)
assigned to
vnic
or pass trunk through to VM (VGT mode)
vSwitch
Physical NICs associated with vSwitches
  NIC teaming (of uplinks)
    Availability: uplink to multiple
    physical switches
    Load sharing: spread load
    over uplinks

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 ESX Virtual Switch: Forwarding Rules

  The vSwitch will forward frames

VM0 VM1
VM ßà VM
VM ßà Uplink

 
MAC a MAC b   MAC c
But not forward

vSwitch
  vSwitch to vSwitch
vSwitch
  Uplink to Uplink
      ESX vSwitch will not create loops
      in the physical network
      And will not affect Spanning Tree
      (STP) in the physical network
   Physical
  Switches

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Spanning Tree Protocol (STP) Considerations
  Spanning Tree Protocol used to
    VM0 VM1
create loop-free L2 tree topologies
in the physical network
 
MAC a MAC b
  Some physical links put in ―blockingǁ‖
  state to construct loop-free tree
vSwitch ESX vSwitch does not participate
in Spanning Tree and will not create
  loops with uplinks
vSwitch drops
     
BPDUs
    àESX Uplinks will not block and
 Physical     always active (full use of all links)
Switches
   Switches sending
  BPDUs every 2s to Recommendations for Physical Network Config:
   construct and 1. Leave Spanning Tree enabled on physical network
maintain Spanning
  Tree Topology and ESX facing ports (i.e. leave it as is!)
2. Use ―portfastǁ‖ or ―portfast trunkǁ‖ on ESX facing
ports (puts ports in forwarding state immediately)
Blocked link
3. Use ―bpduguardǁ‖ to enforce STP boundary

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming for Availability and Load Sharing

  NIC Teaming aggregates multiple

VM0   VM1
   physical uplinks for:
  Availability—reduce exposure
  to single points of failure
  (NIC, uplink, physical switch)
  Load Sharing—distribute load over
vSwitch   multiple uplinks (according to
  selected NIC teaming algorithm)
NIC Team
Requirements:
  Two or more NICs on same vSwitch
  Teamed NICs on same L2
  broadcast domain

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming Options

Name Algorithm—vmnic Physical Network Considerations

chosen based upon:
Originating vnic port Teamed ports in same L2 domain
Virtual Port ID (BP: team over two physical switches)
Source MAC MAC seen on vnic Teamed ports in same L2 domain
Address (BP: team over two physical switches)
IP Hash Hash(SrcIP, DstIP) Teamed ports configured in static
802.3ad ―Etherchannelǁ‖
 - no LACP
 - Needs MEC to span 2 switches
Explicit Failover Highest order uplink Teamed ports in same L2 domain
Order from active list (BP: team over two physical switches)

  Best Practice: Use Originating Virtual PortID for VMs

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming with vSS and vDS
  vNetwork Standard Switch   vNetwork Distributed Switch

      Teaming applied to      
    physical uplink adapters    
Teaming applied to

        (vmnics)    
virtual uplink adapters
   
(dvUplinks)

Apply NIC Teaming Policy to vSwitch Apply NIC Teaming Policy on DV Port
and optionally override on each Groups only
Port Group definition Applied to dvUplinks (vmnics mapped per host
Applied to vmnics to dvUplinks)

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming with vDS
esx10a.tml.local
Teaming Policies Are Applied in DV Port Groups to dvUplinks esx09a.tml.local
esx09b.tml.local
vDS
A B

  vmkernel
Service
Console

vmnic0 esx09a.tml.local
vmnic0 esx09b.tml.local
vmnic0 esx10a.tml.local
vmnic23 esx10b.tml.local vmnic1 vmnic3 vmnic2 vmnic0

vmnic1 esx09a.tml.local
vmnic1 esx09b.tml.local
vmnic1 esx10a.tml.local
vmnic02 esx10b.tml.local

―Orangeǁ‖ DV Port Group esx10b.tml.local

vmnic2 esx09a.tml.local
vmnic2 esx09b.tml.local Teaming Policy
A B
vmnic2 esx10a.tml.local
vmnic31 esx10b.tml.local Service vmkernel

Console

vmnic3 esx09a.tml.local
vmnic3 esx09b.tml.local
vmnic3 esx10a.tml.local
vmnic10esx10b.tml.local
vmnic0 vmnic1 vmnic2 vmnic3

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming: Originating Virtual Port ID

  Outgoing uplink chosen

  from hash of ―Originating
MAC a MAC b MAC c MAC d MAC e MAC f Virtual PortIDǁ‖
vnics
All traffic from vnic will hit same
Virtual
 
Ports
vmnic until failover event
Return traffic will follow
Uplink same path
 
Ports
  Physical switch ―learnsǁ‖ originating
  mac address (and populates its
     vmnic   CAM table)
   or pnic
Physical switches unaware
of teaming
Port 2 Port 4
Port 1   Port 3   Same L2 domain
  No special configuration
Recommendation: Use Originating Virtual Port
Teamed Ports in same L2 domain
ID for simplicity and multi-switch availability

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming: MAC Based Teaming

  Outgoing uplink chosen from

  hash of ―Source MAC addressǁ‖
MAC a MAC b MAC c MAC d MAC e MAC f
from vnic
vnics
All traffic from mac address
Virtual will hit same vmnic until
 
Ports
failover event

Uplink
Return traffic will follow
 
Ports same path
  Physical switch ―learnsǁ‖
     vmnic   originating mac address
   or pnic
  (and populates its CAM table)
Physical switches unaware
Port 1
Port 2
Port 3
Port 4
of teaming
    Same L2 domain
    No special configuration
  Teamed Ports in same L2 domain

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming: IP Hash Based Teaming

  Outgoing uplink chosen from

  hash of Source IP and
    vnics    
IP Destination IP
 
IP Address
―Xǁ‖
 
Address
―Yǁ‖
Requires multiple IP Destinations
Virtual
 
Ports to spread traffic from one source
Must configure Etherchannel
Uplink on physical switch
 
Ports
  Static etherchannel—no LACP
     vmnic   Single physical switch unless multi-
   or pnic   chassis etherchannel support . e.g.
p Cisco Cat6500 VSS
   Etherchannel
   (portchannel) p Catalyst 3750 Cross-Stack
 configured on Etherchannel
Physical switch p Nortel SMLT
   IP-hash NIC team can span Return path determined by
multiple physical switches only
  if multi-chassis etherchannel etherchannel hash on physical
      (MEC) supported switch—may use different uplink
IP Address ―Aǁ‖ IP Address ―Bǁ‖ IP Address ―Cǁ‖
in NIC team

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming: Multiple Policies Can Apply Per Team
    Virtual Port

  PortGroups

1 2 3 4 5 6 7 8 9 10 11 12 13 14   VM
ports

Active Standby
A B C D E F

Standby Active Standby

A B C D E F A B C D E F

Standby Active
uplink ports A B C D E F

  Port Groups can override failover policy on uplinks for groups of VMs

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 NIC Teaming: Assigning Physical NICs

  Mix NIC team with ports from

  multiple NIC cards and LOM
  VM0   VM1
(LAN on Motherboard)
  Avoid single point of failure from
  single card or single component

vSwitch
LOM Card1   Card2

NIC Team of NIC Team of

 
two ports  
four ports

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Port Group Configuration

A Port Group is a template for one or more ports with a common

configuration
Assigns VLAN to port group members
L2 Security—select ―rejectǁ‖ to see only frames for VM mac addr
Promiscuous mode/MAC address change/Forged transmits
Traffic Shaping—limit egress traffic from VM
Load Balancing—Origin VPID, Src MAC, IP-Hash, Explicit
Failover Policy— Link Status & Beacon Probing
Notify Switches—ǁ‖yesǁ‖-gratuitously tell switches of mac location
Failback—ǁ‖yesǁ‖ if no fear of blackholing traffic, or, …
… use Failover Order in ―Active Adaptersǁ‖
Distributed Virtual Port Group (vNetwork Distributed Switch)
All above plus:
Bidirectional traffic shaping (ingress and egress)
Network VMotion—network port state migrated upon VMotion

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Traffic Types on a Virtual Network
Virtual Machine Traffic
Traffic sourced and received from virtual machine(s)
Isolate from each other based on service level

VMotion Traffic
Traffic sent when moving a virtual machine from one ESX host to another
Should be isolated

Management Traffic
Should be isolated from VM traffic (one or two Service Consoles)
If VMware HA is enabled, includes heartbeats

IP Storage Traffic—NFS and/or iSCSI via vmkernel interface

Should be isolated from other traffic types
Fault Tolerance (FT) Logging Traffic
Low latency, high bandwidth
Should be isolated from other traffic types

How do we maintain traffic isolation without proliferating NICs?

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 VLAN Trunking to Server
  IEEE 802.1Q VLAN Tagging
VM0   VM1
Enables logical network partitioning
(Traffic separation)
Scale traffic types without scaling physical NICs
PortGroup
Port Group
     
―Blueǁ‖ Virtual machines connect to virtual
―Yellowǁ‖
 
VLAN 10
 
VLAN 20 switch ports (like access ports
on physical switch)
Virtual switch ports are associated
vSwitch with a particular VLAN (VST mode)—defined
    in PortGroup
    Virtual switch tags packets exiting host
VLAN Trunks
 
Carrying
VLANs 10, 20

      12-bit VLAN id
8100 field
    (0-4095)
  802.1Q Header

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 VLAN Tagging Options
  VST – Virtual Switch Tagging VGT – Virtual Guest Tagging EST – External Switch Tagging

VLAN
assigned in
Port Group
policy
      vSwitch       vSwitch vSwitch

VLAN Tags
 
applied in
VLAN Tags
 
applied in
 PortGroup
   
vSwitch    
Guest
set to VLAN
    ―4095ǁ‖

        Physical Switch         Physical Switch   Physical Switch

External Physical
 
switch applies
  VST is the best practice and VLAN tags
    most common method

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Virtual Switch VLAN Tagging: Further Example
Access Ports Access Ports Access Ports
 
on VLAN 10  
on VLAN 20  
on VLAN 50

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

All VLANs
A B C (10,20,50,90)
trunked to
  VM
       VLAN Trunks
interface GigabitEthernet1/2
      Carrying VLANs
      10, 20, 50, 90
description host32-vmnic0
 
switchport trunk encapsulation dot1q
 
switchport trunk native vlan 999
 
switchport trunk allowed vlan 10,20,50,90   Example
 
switchport mode trunk
configuration on
spanning-tree portfast trunk
Physical Switch

  Uplinks A, B, and C connected to trunk ports on physical switch which carry four VLANs
     (e.g. VLANs 10, 20, 50, 90)
  Ports 1-14 emit untagged frames, and only those frames which were tagged with their
     respective VLAN ID (equivalent to ―access portǁ‖ on physical switch)
    Port Group VLAN ID set to one of 1-4094
  Port 15 emits tagged frames for all VLANs.
    Port Group VLAN ID set to 4095 (for vSS) or ―VLAN Trunkingǁ‖ on vDS DV Port Group

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Fibre Channel over Ethernet (FCoE)
Current DC Architecture     DC Architecture with FCoE

10GigE with
PFC (Priority
Flow Control)
for lossless
Top-of rack behavior for FC
L2 Ethernet
 
 
Access Top-of-rack
Switch FCoE Switches

    FC Switches
or Directors

Distribution Distribution FC Switches

switches switches or Directors

  Storage

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 FCoE on ESX

  VMware ESX Support

    FCoE supported since ESX 3.5u2
ESX Requires Converged Network
vSwitch Adapters ―CNAsǁ‖—(see HCL) e.g.
  Emulex LP21000 Series
  Fibre
10GigE   Channel   Qlogic QLE8000 Series
NIC   HBA

CNA—Converged Appears to ESX as:

Network Adapter
FCoE   10GigE NIC
  FC HBA
FCoE
Switch SFP+ pluggable transceivers
Fibre   Copper twin-ax (<10m)
Ethernet Channel
Optical

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Using 10GigE
  Ingress (into switch)
  traffic shaping policy
  control on Port Group
Variable/high High
b/w 2Gbps+ 1-2G b/w Low b/w

iSCSI NFS VMotion FT SC

2x 10GigE common/expected
SC#2
  10GigE CNAs or NICs
Possible Deployment Method
  Active/Standby on all Portgroups
vSwitch
Gbps VMs ―stickyǁ‖ to one vmnic
FCoE FCoE
10GE
10GE
  10 SC/vmk ports sticky to other
Use Ingress Traffic Shaping
to control traffic type per
Port Group
  FCoE
If FCoE, use Priority Group
bandwidth reservation
FCoE Priority Group (on CNA utility)
bandwidth reservation
  (in CNA config utility)

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 VMotion: How Does It Operate on the Network?
ESX Host 1 ESX Host 2 VMotion and Networking
   1. L2 Domain required
A B C 2. VM C begins to VMotion
to ESX Host 2
3. Virtual machine state is
MACA MACB MACC copied over the network
IPA IPB IPC
4. Virtual Port state copied
(if vDS or Nexus 1000V)
5. RARP to complete
MAC move

RARP for MAC

  move
MACA MACC (broadcast to L2
MACB
MACC MACC     network)
  VMotion Traffic
L2 Physical Switch #1 L2 Physical Switch #2

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vDS Deployment Options
Original Environment Complete Migration to vDS

vSS vSS vSS vDS

vSS, vDS and Nexus

  Switches can co-exist
Partial Migration to vDS
  on same host
Network VMotion only
  required for Guest VMs VMs use
vDS vDS
Optionally leave SC,
vmkernel ports on vSS Service Console,
 
vmkernel ports vSS vSS vSS
  Note: enhanced features    
remain on vSS

  only on vDS

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vDS Deployment Options (Cont.)
Original Environment Complete Migration to Nexus 1000V

vSS vSS vSS vSS vSS vSS

Cisco Nexus 1000V

Partial Migration to Nexus 1000V

Multiple vDS

  vDS   vDS

vSS vSS vSS

vDS

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Deployment Rules

vSS, vDS, Nexus 1000V can co-exist

Multiple vSS and vDS per host
Maximum of one Nexus 1000V per host (VEM)
Take note of deployment limits (subject to change!)
Refer to published limits
pnics (vmnics) can only belong to one virtual switch

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Provisioning vDS using vDS UI and Host Profiles
Start     1. Create a vDS   Host Profiles

2. Create DV Port Groups

 3. Add host(s) & migrate: Create Host Profile

    - dvUplinks     of migrated host
4. Repeat   - Virtual Ports
    for - VM Networking
remaining
  hosts   Attach & apply (in
      Migrate more maintenance mode) on
Yes
        hosts with      remaining hosts
vDS UI?

  No
          Bulk Migrate VM Networking
   Migration Yes
  using Host       5. *Optionally*
     Profiles?     Delete Standard
     No         Switch(es)
Per host vDS UI Migration
Control over vmnic to dvUplink mapping   6. Fine tune policies
VMs can be powered on
Host Profiles Migration Complete!
Migrate multiple hosts automatically
  Requires maintenance mode (VMs off or migrated)

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vDS: Step 1: Select General Properties
Home > Inventory > Networking
àSelect ―New vNetwork Distributed Switchǁ‖

Name the vDS

Select the max number of

uplink ports (NICs) of any host
associated with this vDS

Uplinks show up here

(default is four)

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Private VLANs: Traffic Isolation for VMs
Private VLAN traffic isolation
Scale VMs on same subnet but between guest VMs

  selectivity restrict inter-VM

  communication
  Avoids scaling and complexity
  issues from assigning one VLAN
  and IP subnet per VM
    vSwitch with
    Private VLAN
    capability

      Common
      Primary VLAN
      on uplinks

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Designing the Network
How do you design the virtual network for
 performance and availability and but maintain
 isolation between the various traffic types
 (e.g. VM traffic, VMotion, and Management)?
Starting point depends on:
Number of available physical ports on server
Required traffic types

2 NIC minimum for availability, 4+ NICs

per server preferred
802.1Q VLAN trunking highly recommended for logical
scaling (particularly with low NIC port servers)
Following examples are meant as guidance and do not
represent strict requirements in terms of design
Understand your requirements and resultant traffic types
and design accordingly

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Example 1: Blade Server with 2 NIC Ports

  Candidate Design:
SC vmkernel Team both NIC ports
Create one virtual switch
Portgroup3 Portgroup1 Portgroup2
VLAN 30 VLAN 10 VLAN 20
Create three port groups:
vSwitch
  Use Active/Standby policy
    vmnic0 vmnic1   for each portgroup
  Portgroup1: Service Console (SC)
 
VLAN Trunks
  Portgroup2: VMotion
(VLANs 10, 20, 30)

  Portgroup3: VM traffic
Use VLAN trunking
  Active   Trunk VLANs 10, 20,
  Standby   30 on each uplink

  Note: Team over dvUplinks with vDS

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Example 2: Server with 4 NIC Ports

  Candidate Design:
SC vmkernel Create two virtual switches
          Team two NICs to each vSwitch
Portgroup4
VLAN 40
     
Portgroup3
VLAN 30
     
Portgroup1
VLAN 10  
Portgroup2
VLAN 20
vSwitch0 (use active/standby
vSwitch1     vSwitch0 for each portgroup):
  Portgroup1: Service Console (SC)
  vmnic0 vmnic2 vmnic1       vmnic3

  Portgroup2: VMotion
vSwitch1 (use Originating Virtual
VLANs
30, 40
VLANs
10, 20 PortID)
  Portgroup3: VM traffic #1
  Portgroup4: VM traffic #2
  Active Use VLAN trunking
  Standby
  vmnic1 and vmnic3: Trunk VLANs 10, 20
  vmnic0 and vmnic2: Trunk VLANs 30, 40
Note: Team over dvUplinks with vDS

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Example 3: Server with 4 NIC Ports (Slight Variation)

  Candidate Design:
SC vmkernel Create one virtual switch
Create two NIC teams
 
Portgroup4
VLAN 40  
Portgroup3
VLAN 30  
Portgroup1
VLAN 10  
Portgroup2
VLAN 20

vSwitch0 (use active/standby

vSwitch0
for portgroups 1 & 2):
vmnic0 vmnic2 vmnic1 vmnic3 Portgroup1: Service Console (SC)
Portgroup2: Vmotion

VLANs VLANs
Use Originating Virtual PortID
30, 40 10, 20 for Portgroups 3 & 4
  Portgroup3: VM traffic #1
  Portgroup4: VM traffic #2
Active
Standby
Use VLAN trunking
  vmnic1 and vmnic3: Trunk VLANs 10, 20
Note: Team over dvUplinks with vDS vmnic0 and vmnic2: Trunk VLANs 30, 40

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Servers with More NIC Ports

More than 4 NIC Ports – Design Considerations

With Trunks (VLAN tagging):
Use previous approach and scale up to meet additional bandwidth and
redundancy requirements
Add NICs to NIC team supporting VM traffic
VLAN Tagging always recommended, but options if NICs available:
Dedicated NIC for VMotion
At least one NIC
Dedicated NICs for IP Storage (NFS and/or iSCSI)
Usually two teamed NICs (consider IP-hash & etherchannel if multiple
destinations and Multi-Chassis Etherchannel employed on physical switches)
Dedicated NIC(s) for Service Console
At least two for availability
Note: easy to consume many physical NICs and switch ports if not using VLAN tagging

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 IP Storage: Using iSCSI

Provides SCSI block storage access over IP network

Relevant for VMs using the iSCSI software-based initiator
Design depends on number of NIC ports available on server
General Design Guidance:
Keep iSCSI traffic on its own dedicated subnet (VLAN)
Dedicate (if possible) specific NIC(s) to iSCSI traffic
For redundancy, use at least 2 NICs
In multi-NIC scenarios, use teaming with:
―Virtual Source Port IDǁ‖ setting if all your iSCSI targets share the
same IP address
―IP Hashǁ‖ setting for other scenarios, including the case for multiple targets
Note: iSCSI Multipath available in ESX 4.0

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 iSCSI Design Guide – Specific Examples

Common Case – Server with 6x 1GigE NIC Ports:

Follow the 4 port example
For remaining 2 NIC ports:
Create a virtual switch dedicated to iSCSI traffic
Create a port group dedicated to iSCSI traffic
Team and dedicate both NICs to iSCSI traffic
Uncommon case (some blades) – 2x 1GigE ports:
Buying additional NIC ports recommended (if possible)
Follow 2 port example (Port Group 1 and 2)
For environments with high amount of VM traffic:
Create port group 1 – SC + VMotion + iSCSI
Create port group 2 – VM traffic
For environments with low VM traffic:
Create port group 1 – SC + VMotion
Create port group 2 – VM traffic + iSCSI

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 vNetwork Appliance API
  Filter driver in vmkernel to provide
  security features within ESX
  networking layer
  vNetwork Appliance APIs available
  to partners
  Clients of this API may
  inspect/alter/drop/inject any frame
  on a given port:
    Either directly in the IO path
Heavyweight filtering   (fast path agent)
in ―Slow Pathǁ‖ agent
  Or by punting frames up to an appliance
  VM (slow path agent)
Lightweight filtering State mobility for data in fast path
in ―Fast Pathǁ‖ agent agent and slow path agent
  Communication between slow path
  and fast path agents
  Bind to VM’s vNIC or to dvswitch port

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 IPv6 in vSphere 4

IPv6 guests supported since ESX 3.5

IPv6 support for
ESX 4
vSphere Client
vCenter Server
Vmotion
IP Storage (iSCSI, NFS)—experimental
Not supported for vSphere vCLI, HA, FT

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Further Reading…

VMware Networking Technology

vmware.com/go/networking

Networking Blog
blogs.vmware.com/networking

Copyright © 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.

lunedì 17 dicembre 12
 Reference
• Books :
§ Kumar Reddy & Victor Moreno, Network Virtualization, Cisco Press 2006

• Web resources :
§ Linux Bridge http://www.ibm.com/developerworks/cn/linux/l-­‐tuntap/index.html
§ Xen networking http://wiki.xensource.com/xenwiki/XenNetworking
§ VMware Virtual Networking Concepts
http://www.vmware.com/Biles/pdf/virtual_networking_concepts.pdf
§ TUN/TAP wiki http://en.wikipedia.org/wiki/TUN/TAP
§ Network Virtualization wiki http://en.wikipedia.org/wiki/Network_virtualization
§ VMware  Networking  Technology    vmware.com/go/networking

• Papers :
•A. Menon, A. Cox, and W. Zwaenepoel. Optimizing Network Virtualization in Xen.  
USENIX Annual Technical Conference (USENIX 2006), pages 15–28, 2006.

•N.M.  Mosharaf  Kabir  Chowdhury,  Raouf  Boutaba,  “A  Survey  of  Network  
Virtualization”,  University  of  Waterloo  Technical  Report  CS-­‐2008-­‐25,  Oct.  2008.

lunedì 17 dicembre 12