sdn controller
Embed Size (px)
TRANSCRIPT
SOFTWARE DRIVEN NETWORKS (SDN)
contrail SDN CONTROLLER
Jakub Pavlik, tcp cloud
#
Copyright 2013 Juniper Networks, Inc.
Datacenter Use Case
#
Copyright 2013 Juniper Networks, Inc. contrail use case 1: cloudenterprise private cloud
Finance
HR
MarketingVLANPhysical Service AppliancesSilo'ed resource allocationManual configurationStatic service deployment
#
Copyright 2013 Juniper Networks, Inc.
3
contrail use case 1: cloudenterprise private cloud
Finance
HR
Marketing
FinanceHRMarketing
VLAN
Physical Service Appliances
VirtualNetwork
Silo'ed resource allocationManual configurationStatic service deployment
Dynamic resource allocationAutomated configurationDynamic service chains
Network policies enforced as ACLs and service chains
#
Copyright 2013 Juniper Networks, Inc.
4
contrail use case 2: cloudservice provider cloud (IaaS, VPC)
Service ProviderInfrastructure as a Service (IaaS)
Service ProviderL3VPN, E-VPNPublic Cloud Providers, Content Providers, ...
Service ProviderManaged Virtual Private Cloud (VPC)
Enterprise OfficesEnd-to-End Virtual Network Orchestration and Automation
Enterprise Data Center
#
Copyright 2013 Juniper Networks, Inc.
5
Network Virtualisation----The Importance of Abstraction
"SDN as a Compiler"
#
Copyright 2013 Juniper Networks, Inc. What Is Network VirtualizationIndependent of Physical Network Location or StateLogical Network across any server, any rack, any cluster, any data-centerVirtual Machines can migrate without requiring any reworking of security policies, load balancing, etc New Workloads or Networks should not require provisioning of physical network Nodes in Physical Network can fail without any disruption to WorkloadFull Isolation for Multi-tenancy and Fault ToleranceMAC and IP Addresses are completely private per tenantAny failures or configuration errors by tenants do not affect other applications or tenantsAny failures in the virtual layer do not propagate to physical layer
#
Copyright 2013 Juniper Networks, Inc. What Is Network Virtualization
What is network virtualization? Its essentially building logical infrastructures on top of a physical topology. You want to build virtual topologies that are independent of location so that you can tie the VM, wherever it may be or wherever those workloads are, to the network in a way that connects it appropriately to the right customers and the right user. You want to make sure that the nodes in the physical network can fail without any disruption to the workload; that the VMs can migrate without requiring any reworking of security polices load balancing. The logical topology should follow where the VMs need to go. Youll also want to be able to support this notion of scale-out so you can keep adding VMs to support larger workloads without having to retool the whole environment to do that. The other thing you want to make sure is that for full isolation for multi tenancy and fault tolerance, all your MACs and IPs have to be completely private per tenant, because tenants may choose to use the same IP address blocks within their private environments, and any failures or misconfiguration by those tenants are not impacting other applications. The workflows have to be independent and not impact each other. This will be the same as what we would do in a WAN environment. Once you have the topology built, customers can operate within those topologies and not impact each other based on how theyve deployed their environment.
7
Contrail KEY ABSTRACTIONS"Lego Blocks"
VN
VMVM
VN
VN
Virtual MachinesCloud Tenants and Virtual Network FunctionsVirtual NetworksConnect Virtual MachinesGateway DevicesConnect the Virtual to the Physical
#
Copyright 2013 Juniper Networks, Inc.
8
Contrail KEY abstractionsconstructing complex use cases with simple "LEGO blocks"
VMVMVM
Virtual NetworkVMVMVM
Virtual NetworkTenant Virtual MachinesVirtual FirewallPhysical Gateway RouterNon-Virtualized (Bare Metal) ServerPhysical Network (Internet, L3VPN, ...)Virtual NetworkPhysicalNetwork
Virtual Load BalancerService Chain
#
Copyright 2013 Juniper Networks, Inc.
9
SDN as a COMPILER
North-Bound REST APIsService Data Model(Logical Abstraction)Transformation EngineTechnology Data Model(Physical Realization)AnalyticsSouth-Bound Protocols
Contrail SDN Controller
#
Copyright 2013 Juniper Networks, Inc.
10
virtual networkaka network slicing, aka multi-tenancy
OpenStackCloudStackContrailController
VMG1VMR1
VMG2VMR2
Contrail Controller
REST APIs
XMPPVirtualizedServerContrail vRouterHypervisorRouting Instance
Overlay TunnelMPLS/GRE, MPLS/UDP, VXLANUnderlay Switch
GreenVirtual NetworkVMVMVMVM
RedVirtual NetworkVMVMVMVM
#
Copyright 2013 Juniper Networks, Inc.
11
service chainingin the context of a data center
VMG1VMG2VMG3
GreenVirtual NetworkVMR1VMR2VMR3
RedVirtual Network
ContrailControllerVMG
VMR
XMPP
OpenStackCloudStack
#
Copyright 2013 Juniper Networks, Inc.
12
gateway to l3vpn
ContrailController
VMR1
VMR2
PhysicalL3VPN
BGP + NetconfOverlay TunnelMPLS/GRE, MPLS/UDP, VXLAN
RedVirtual NetworkVMVMVMVM
Route Reflector
LSP (RSVP, LDP)
BGPGateway Router (PE Router)
OpenStackCloudStack
#
Copyright 2013 Juniper Networks, Inc.
13
gateway to bare-metal server
ContrailController
VMR1
VMR2
BGP + NetconfOverlay TunnelMPLS/GRE, MPLS/UDP, VXLAN
RedVirtual NetworkVMVM
Gateway Router or Switch
Bare Metal Server(Non-Virtualized Server)
OpenStackCloudStack
#
Copyright 2013 Juniper Networks, Inc.
14
Contrail Architecture
#
Copyright 2013 Juniper Networks, Inc. contrail architecturea general purpose SDN platform
Physical NetworkInteroperability with traditional network devicesAny-to-any non-blocking low-latency fabric: Q-Fabric or Clos
Virtual Network OverlayMulti-tenancy for private and virtual public cloudsGateway functions - connect to virtual to physical networkService chaining (physical and virtual)
MarketingHRFinance
Control Plane - Physical, VirtualOpen, standards-based, federated controllerScalable and resilient
Control Plane
Configuration manager, AutomationControl Plane
Control PlaneOrchestration, Automation, AnalyticsOpen source and partner eco system of orchestratorsApi and sdk for integration with OSS / BSS
OSS
#
Copyright 2013 Juniper Networks, Inc.
16
role of contrail in a virtualized environmentOrchestratorOpenStack, CloudStackContrail Controller"Logically Centralized, Physically Distributed"
Physical Network(Fabric)
Physical and VirtualNetworkServicesVMVM
VM
VMServerServerStorage
Physical Network(Gateway)StorageComputeNetwork (Physical and Virtual)ComputeNetworkHigh Level AbstractionLow Level RealizationContrail vRouter
#
Copyright 2013 Juniper Networks, Inc.
17
JunosV Contrail Stack
Configuration NodesControlPlaneComputeNode(Virtual Router)ServiceNode(SRX, Firefly, JSP, ...)
GatewayNode(MX, EX/QFX, ...)ControlPlaneControlPlaneAnalyticsEngineAnalyticsEngineAnalyticsEngineREST APIs (Configuration, Operational, and Analytics)OpenstackCustomer OSS/BSSCloudstack
#
Copyright 2013 Juniper Networks, Inc. JunosV Contrail Stack18
Scale-Out Network System
JUNOSV CONTRAIL SystemConfiguration NodeConfiguration NodeControl NodeControlNodeComputeNode(Virtual Router)ServiceNode(SRX, Firefly, JSP, ...)Analytics NodeAnalytics Node
GatewayNode(MX, EX/QFX, ...)
Orchestrator(OpenStack)
RESTIBGPIF-MAPXMPPBGP, NETCONFLogically Centralized(Physically Distributed)
Horizontally Scalable
Highly Available(Active-Active)
Federated
#
Copyright 2013 Juniper Networks, Inc. In Summary Scale-Out Network System
In summary, we have a system thats built and designed to be a scale-out solution. All the components, analytics, configuration, control and compute nodes all have scale-out properties. Were leveraging standards based protocols IBGP, Netconf, XMPP, IF-MAP, REST APIs. We can plug into most orchestration systems, its an integration effort. As far as deployment goes, well make an ISO available and on that ISO is a base operating system, KVM is a hypervisor, all the OpenStack components required and then Contrail. Then you decide what that particular server nodes functions are going to be, whether its going to be a config node, a control node, analytics node, its going to be a compute node running vRouter. And actually you can combine all of these into a single system if you want as well.
19
APIS FIRST
ConfigurationNodes
AnalyticsNodes
REST APIsContrail Controller
Service Data ModelHigh Level of AbstractionGenerates
Contrail GUI
OSS / BSS
Service Orchestrator
#
Copyright 2013 Juniper Networks, Inc.
20
rich integrated analytics
#
Copyright 2013 Juniper Networks, Inc.
21
the importance of abstraction
LOGICAL TOPOLOGY
SimpleHigh level of abstraction
Simple to configure
Simple to troubleshoot
Contrail provides abstractionConfigure logical layerMapping to physical layer"SDN as a Compiler"Analytics at physical layerMapping to logical layer
VMG1VMG3VMR1VMR2VMR3
VN RBMSR4
VN GVMG2VMFW
L3VPN
#
Copyright 2013 Juniper Networks, Inc.
22
open contrail
Contrail is available as Open Source www.opencontrail.org. Commercial support available from Juniper.Same features and scaling as commercial versionUses proven stable standards. Production-Ready.Permissive license Apache 2.0Integrated into open source virtualization stacksOpenStack, CloudStack
#
Copyright 2013 Juniper Networks, Inc.
23
Contrail Detailed Walk-Through
#
Copyright 2013 Juniper Networks, Inc. logical topology
VMG1VMG2VMG3
VN GVMR1VMR2VMR3
VN R
PNVMFW
BMSR4Virtual NetworkTenant Virtual MachinesVirtual FirewallPhysical Gateway RouterNon-Virtualized (Bare Metal) ServerPhysical Network (Internet, L3VPN, ...)
#
Copyright 2013 Juniper Networks, Inc.
25
physical topology
OpenStackContrailControllerNeutronNovaVirtualized ServerHypervisor with Contrail vRouterNon-Virtualized (Bare Metal) ServerUnderlay SwitchesGateway Router to Internet or L3VPN
#
Copyright 2013 Juniper Networks, Inc.
26
mapping of logical to virtual topology
VMG1VMG2VMG3
VN GVMR1VMR2VMR3
VN R
L3VPNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
#
Copyright 2013 Juniper Networks, Inc.
27
Starting pointempty logical topology
VMG1VMG2VMG3
VN GVMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
#
Copyright 2013 Juniper Networks, Inc.
28
create green tenantcreate virtual network "green"
VMG1VMG2VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GCreate VN G
#
Copyright 2013 Juniper Networks, Inc.
29
create green tenantcreate virtual machine "g1"
VMG1VMG2VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GCreate VM G1Attach to VN GNova: Create VMVMG1
#
Copyright 2013 Juniper Networks, Inc.
30
create green tenantcreate virtual machine "g1"
VMG1VMG2VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1Neutron:Attach VM to VNCreate VM G1Attach to VN GXMPP:Create routing-instance
#
Copyright 2013 Juniper Networks, Inc.
31
create green tenantcreate virtual machine "g2"
VMG1VMG2VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GCreate VM G2Attach to VN GVMG1
Nova: Create VMVMG2
#
Copyright 2013 Juniper Networks, Inc.
32
create green tenantcreate virtual machine "g2"
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1Neutron:Attach VM to VNCreate VM G2Attach to VN GVMG2
XMPP:Create routing-instance
VMG2
#
Copyright 2013 Juniper Networks, Inc.
33
create green tenantcreate virtual machine "g2"
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1Create VM G2Attach to VN GVMG2
XMPP:Exchange routesCreate tunnels
VMG2
#
Copyright 2013 Juniper Networks, Inc.
34
create green tenantforwarding tables and encapsulation
VMG1VMG2
IP prefixNexthopVM G1Virtual ethernet port to VM G1Green routing-instance IP FIBVM G2Push label L2 +GRE encaps to server S2MPLS labelNexthopL1Pop + Green routing-instanceGlobal MPLS FIBIP prefixNexthopServer S2Physical ethernet port Global IP FIB
IP prefixNexthopVM G1Push label L1GRE encaps to server S1Green routing-instance IP FIBVM G2Virtual ethernet portto VM G2MPLS labelNexthopL2Pop + Green routing-instanceGlobal MPLS FIBIP prefixNexthopServer S1Physical ethernet port Global IP FIBInner IP headerPayloadVM G1Source IPVM G2Dest IP...MPLSL2LabelGRE...Outer IP headerServer S1Source IPServer S2Dest IPEthernetServer S1Source MACServer S2Dest MACPacketS1S2
#
Copyright 2013 Juniper Networks, Inc.
35
create green tenantcreate virtual machine "g3"
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2Create VM G3Attach to VN GNova: Create VMVMG3
#
Copyright 2013 Juniper Networks, Inc.
36
create green tenantcreate virtual machine "g3"
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2Create VM G3Attach to VN GVMG3Neutron:Attach VM to VNXMPP:Create routing-instance
#
Copyright 2013 Juniper Networks, Inc.
37
create green tenantcreate virtual machine "g3"
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2Create VM G3Attach to VN GVMG3XMPP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
38
create green tenantEnd state
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2VMG3
#
Copyright 2013 Juniper Networks, Inc.
39
create red tenantSame steps as green tenant
VMG1VMG3VMR1VMR2VMR3
VN R
PNVMFW
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2VMG3VMR1VMR3
VMR2
#
Copyright 2013 Juniper Networks, Inc.
40
connect green to red tenant via firewallcreate virtual machine for firewall
VMG1VMG3VMR1VMR2VMR3
VN R
PN
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2VMG3VMR1VMR3
VMR2
Create VM FWAttach to VN GAttach to VN RVMFWNova: Create VMVMFW
#
Copyright 2013 Juniper Networks, Inc.
41
connect green to red tenant via firewallattach firewall to red and green virtual networks
VMG1VMG3VMR1VMR2VMR3
VN R
PN
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2
VMG2VMG3VMR1VMR3
VMR2
Create VM FWAttach to VN GAttach to VN RVMFWVMFW
Neutron:Attach VM to VNsXMPP: Create routing-instance
#
Copyright 2013 Juniper Networks, Inc.
42
connect green to red tenant via firewallapply policy, exchange routes, and create tunnels
VMG1VMG3VMR1VMR2VMR3
VN R
L3VPN
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFWApply PolicyVN G VN RXMPP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
43
connect green to red tenant via firewallend state
VMG1VMG3VMR1VMR2VMR3
VN R
L3VPN
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
#
Copyright 2013 Juniper Networks, Inc.
44
connect green to red tenant via firewalldata plane: red GREEN TRAFFIC FORCED THROUGH THE Firewall
VMG1VMG3VMR1VMR2VMR3
VN R
L3VPN
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
#
Copyright 2013 Juniper Networks, Inc.
45
connect red tenant to physical l3vpnconfigure l3vpn routing instance
VMG1VMG3VMR1VMR2VMR3
VN R
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Apply PolicyVN R L3VPNNetconf:Configure routing-instance
#
Copyright 2013 Juniper Networks, Inc.
46
connect red tenant to physical l3vpnexchange routes with physical router, create tunnels
VMG1VMG3VMR1VMR2VMR3
VN R
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Apply PolicyVN R L3VPNBGP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
47
connect red tenant to physical l3vpnexchange routes with vrouters, create tunnels
VMG1VMG3VMR1VMR2VMR3
VN R
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Apply PolicyVN R L3VPNXMPP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
48
Connect bare metal server to red tenantuse top-of-rack switch as gateway
VMG1VMG3VMR1VMR2VMR3
VN R
BMSR4
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
#
Copyright 2013 Juniper Networks, Inc.
49
Connect bare metal server to red tenantcreate routing instance
VMG1VMG3VMR1VMR2VMR3
VN R
BMSR4
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Attach BMS R4to VN Rusing switch SNetconf:Configure routing-instance
#
Copyright 2013 Juniper Networks, Inc.
50
Connect bare metal server to red tenantexchange routes with physical switch, create tunnels
VMG1VMG3VMR1VMR2VMR3
VN R
BMSR4
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Attach BMS R4to VN Rusing switch SBGP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
51
Connect bare metal server to red tenantexchange routes with vrouters, create tunnels
VMG1VMG3VMR1VMR2VMR3
VN R
BMSR4
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
Attach BMS R4to VN Rusing switch S
XMPP:Exchange routesCreate tunnels
#
Copyright 2013 Juniper Networks, Inc.
52
Connect bare metal server to red tenantend state
VMG1VMG3VMR1VMR2VMR3
VN R
BMSR4
OpenStackContrailControllerNeutronNovaPHYSICALLOGICALBMSR4
VN GVMG1VMG2VMG2VMG3VMR1VMR3
VMR2
VMFWVMFW
L3VPN
#
Copyright 2013 Juniper Networks, Inc.
53
contrail is based on mpls VPN technology
P
PPEPE
RouteReflectorRouteReflector
CE
CEUnderlaySwitchvRouter
ControlNodeControlNodeUnderlaySwitchVMVM
VMVMvRouterVMVMIBGPIBGP
IBGP
XMPPMPLS over MPLSMPLS over GRE or VXLANNetwork Management System (NMS)
DMIConfigNodeOrchestrator
AnalyticsNode
SDN SystemMPLS L3VPN / E-VPNContrail
#
Copyright 2013 Juniper Networks, Inc.
54
JunosV Contrail with L3VPN
10.1.1.110.1.1.2
70.10.10.1151.10.10.110.1.1.2: NH = 80.20.20.1; LBL = 417
10.1.1.110.1.1.2
PAYLOADVRFPriSrcIPPriDstIPVMVRFPriSrcIPPriDstIPVMIP Network
AgentXMPPXMPP
Configuration ManagementDC1REST/API(Dynamic Tunnel Encapsulation)(Dynamic Tunnel Decapsulation)Server 1Server 210.1.1.110.1.1.2
PAYLOAD
LBL=417
GRE70.10.10.180.20.20.1PubSrcIPPubDstIPPriSrcIPPriDstIP
10.1.1.110.1.1.2
PAYLOAD
LBL=17
GRE160.20.20.1151.10.10.1PubSrcIPPubDstIPPriSrcIPPriDstIP
MXMXMPLSIP Network 80.20.20.1160.20.20.1
Control Plane*Outer MAC header was left out intentionally to reduce clutter10.1.1.2:NH = 80.20.20.1; LBL = 417
10.1.1.2:NH = 151.10.10.1; LBL = 17
REST/API
BGP Control Nodes10.1.1.110.1.1.2
PAYLOAD
LBL=217
PriSrcIPPriDstIPMPLS Outer LabelControl PlaneI-MBGPMX
I-MBGP200.1.1.1100.1.1.110.1.1.2:NH = 80.20.20.1;LBL = 417;RD;RT
Configuration ManagementDC2
Agent
BGP Control NodesMX
MX
I-MBGPMX
10.1.1.2:NH = 200.1.1.1;LBL = 317;RD;RT10.1.1.2:NH = 100.1.1.1;LBL = 217;RD;RT10.1.1.2:NH = 160.20.20.1;LBL = 117;RD;RT10.1.1.2:NH = 151.10.10.1;LBL = 17;RD;RT160.20.20.180.20.20.1E-MBGPE-MBGP
MX
MX200.1.1.1100.1.1.1Service Provider10.1.1.110.1.1.2
PAYLOAD
#
Copyright 2013 Juniper Networks, Inc. JunosV Contrail with L3VPN
They look very similar in an L3VPN environment. But instead of going from one vRouter to another vRouter within the same DC as the GRE header lookup, so now I have GRE that gets me to the gateway router which is an MX, that MX is peering with the L3VPN environment, and so at that point, I do a VPN lookup and it says the next hop is the MX on the other side, and in that case, Im pushing a transport MPLS label to get from MX to MX across the WAN infrastructure, and then Im doing label swapping again for the particular VPN to get back into the DC and send it on. This is your traditional inter-provider implementation for BGP. And you can follow along with the label swapping up here, but theres nothing different than what you already know from an Internet provider perspective. Im doing a GRE as an outer label, Im doing an MPLS label, Im going across the WAN, and then Im doing a GRE header again to go through the DC. Speaking of GRE, were agnostic as to the tunnel encapsulation type within the DC. Weve chosen GRE because it seemed like the least common denominator, GRE has been around a long time, most hardware vendors have feature implementation for GRE for dynamic GRE tunnels whereas some of the other tunneling mechanisms have varying support from various vendors. Well support GRE, UDP, well support VX LAN, but if we need to support SDT or MBGRE, or some other tunneling mechanisms that our customers decide needs to happen in the future, the architecture will support any essentially and encap type that we need to support.
55
VN-Green: 10.10.1.2 -> Machine BVN-Red (Extranet): 10.20.1.2 -> Machine C Miss: Use Public IP SA (e.g. 200.10.5.1 assigned for 10.10.1.1)10.10.1.1
10.10.1.210.20.1.2LookupMachine AMachine BMachine C
1:1 NAT10.10.1.1 200.10.5.1Intra-VN Green PolicyVN Green VN Red PolicyVN Green External PolicyVRFVRFVRFLookupVRFVRFVRFVRFVRF
Public IP NetworkSA= 200.10.5.1 DA=Public IPNAT (Floating IP / Elastic IP)
Description: Floating IP is a public IP that is pre-assigned to a particular VM and is used by the VM irrespective of the location or movement of the VM
1:1 NAT function is used to translate the SA/DA of a packet from a VM. Floating IP address on the vRouter is advertised on Public VRF to the Gateway Router
Policy gets applied to all communications in accordance to pre-defined rules.VM (VN-Green) VM (VN-Green) VM (VN-Red)
#
Copyright 2013 Juniper Networks, Inc. NAT (Floating IP / Elastic IP)
Floating IPs: This is where NAT comes in, in most cases, although NAT we can use for other things as well. But in a DC environment, typically you would have an IP addressed out of some private address pool, assigned to the actual interfaces on your VMs, and if you go log into your VM and its s Linux system and you ask what IP addresses are configured, its typically these kind of private addresses. But what happens if you actually need to wrap that traffic on a particular interface in a VM to the outside world? Do you actually want to assign a real life IP address to that VM, and then have to go log into that VM to change it all the time or do you want something that is essentially going to float? In this case, when you want something to float, you assign it virtually to that interface thats on a particular VM, but the IP address is essentially held in the VRF on the vRouter. That IP address is advertised to the outside world. Any traffic that needs to go to that IP address, now has the destination, and well send, and any traffic thats received by the vRouter to that IP address, youve now done this mapping between that floating IP and the private IP address or whatever IP address that was assigned actually to the interface on the VM, and we get this one-to-one mapping such that the vRouter will translate all traffic from this public IP address to the private IP address on the VM and then if you need to move that VM, the IP address will just go with it, or if you need to move that floating IP to and associate it with another VM, you can do that as well without having to affect the routing advertisements to the outside world. To them, that route is still available and you dont actually have to do anything with it even though the VMs may have moved under the covers. This is something that is used in DCs quite a bit.
56