Balaji Sivasubramanian, Gunnar Anderson, Appaji Malla Cisco Cloud Networking & Services Group 12/04/2013 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1 • Cisco’s Virtual Networking Vision • Cisco Networking Portfolio Update Citrix NetScaler 1000V (NS1000V) Cisco Nexus 1000V for Hyper-V Recent Promotions • Resources © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 IT’S ALL ABOUT THE APPLICATION SHIFTS THAT ARE RE-DEFINING IT—AT ALL LEVELS TODAY FUTURE Business Models WEB APP ECONOMY ECONOMY Any application any where Velocity and Visibility Consumption Models ON CLOUD PREMISE BASED IT SERVICES Virtual, Physical, Cloud Common Policy INFRASTRUCTURE APPLICATION AS A SERVICE Scale with Security DEVELOPMENT VS. DEV OPS INTEGRATION OPERATIONS Open, Automation BOXManagement Models APPLICATION-CENTRIC CENTRIC Systems Approach Service Models Operational Models © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Virtualized Data Center Private Cloud Hybrid Cloud Consistent operational model of physical and virtual resources • Automation through Cloud Management Platforms • Seamless Secure extension of private cloud to public cloud Flexibility to select any hypervisor for Applications • Flexibility with Application placement on any hypervisor • Single pane of management of local/remote resources Consistency across physical and virtual service nodes • Automated service insertion, policy management and chaining • Consistent servers and policies regardless of location of workloads • Choice in Cloud Providers and MultiCloud Models Consistent Application Policy Enforcement © 2011 Cisco and/or its affiliates. All rights reserved. • Increased Resource Utilization Cisco Confidential 4 Seamless Interaction Across Physical and Virtual Workloads & Services Orchestration and Fabric Automation Physical Workloads Physical Service Nodes Traditional Physical Fabric Physical Fabric Infrastructure • ASA 55xx VXLAN HW Gateway Nexus 1000V vPath FW Virtual Fabric Infrastructure Zone FW NVGRE L3 VXLAN VXLAN 802.1Q • • • Multi-Hypervisor vPath L4-L7 Services VXLAN WAN Op © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Citrix NetScaler 1000V • Citrix Best-in-Class virtual application delivery controller (vADC) • Sold and supported exclusively Cisco • Tightly integrated via vPath (policy based traffic steering) • Integrated with Nexus 1100 Series Cloud Services Platform (CSP) • Part of Cisco Validated Design(CSP) – VMDC 4.0 VSA Cisco Cloud Services Platform vPath Nexus 1000V Citrix NetScaler 1000V Prime virtual NAM Virtual Security Gateway Data Center Mgt. Center Any Hypervisor DCN M* VM VM VM Nexus 1100 Series Cloud Services Platform © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 NetScaler 1000V Editions Standard Enterprise Platinum Edition Edition Edition Comprehensive L4-7 load balancing and optimizes expensive server and network resources to reduce cost Web application delivery solution providing advanced traffic management and powerful application acceleration Module 03 – Slide 9 – Copyright © 1999-2013 Citrix Systems, Inc. All Rights Reserved Web application delivery solution designed to deliver mission-critical applications with web application firewall security, fastest performance, and lowest cost Editions Throughput Standard Enterprise Platinum 500 Mbps L-NS-1KV-500S= L-NS-1KV-500E= L-NS-1KV-500P= 1 Gbps L-NS-1KV-1KS= L-NS-1KV-1KE= L-NS-1KV-1KP= 2 Gbps L-NS-1KV-2KS= L-NS-1KV-2KE= L-NS-1KV-2KP= Licenses applicable for Nexus 1110/1010 or ESXi • You define which L4-7 Virtual Services through policy, NOT network topology • Transparent Services Insertion • Dynamic Service chains enabled per VM/Application/Tenant NetScaler 1000V vPath Integrated Virtual Service A Virtual Service B Virtual Service C VOD VM Container #2 (Policy 1) Web VM Container #1 (Policy 2) Client N1KV Virtual Distributed Architecture (Admin User Policy 1 & Policy 2 defined for each tenant) Expanded vPath Ecosystem: VSG, ASA 1000V, vWAAS, & NetScaler 1000V Cloud Network Services (CNS) vPath is Nexus 1000V dataplane component: 1. Distributed Service insertion architecture, with Intelligent traffic intercept and redirection mechanism 2. Intelligent Service insertion at hypervisor level 3. Topology agnostic service insertion model 4. Service Chaining across multiple virtual services 5. Performance acceleration with vPath e.g. VSG flow offload 6. Efficient and Scalable Architecture 7. VM Policy mobility with VM mobility © 2013 Cisco and/or its affiliates. All rights reserved. Nexus 1000V VEM vPath Any Hypervisor Cisco Confidential 12 Without vPath • Complex deploymentper host service nodes • Service chaining is static • No Fast path acceleration • Services tightly coupled with network topology With vPath • Distributed policy-driven Service Insertion & chaining • Non-disruptive operations • Fast-Path acceleration • Decouple services from network topology Evolve the Network for the next wave of application requirements © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 Virtual Appliance VSM1 Network Admin VSM2 L2 Connectivity Back Plane Supervisor-1 Supervisor-2 Linecard-1 Linecard-2 … L3 Connectivity Modular Switch Linecard-N VEM-1 vPath Hypervisor VEM-2 vPath Hypervisor VEM-N vPath Hypervisor VSM: Virtual Supervisor Module VEM: Virtual Ethernet Module © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14 • vPath enables service insertion based on policies created for Application VM’s vPATH Interception is configured on Server VM’s Port Profile in both directions to redirect packets to a Service Node Server VM vPATH VEM Server traffic is intercepted by vPATH interception in VEM and redirected to a Virtual Service Node Both ingress and egress traffic for a VM is intercepted by vPath © 2013 Cisco and/or its affiliates. All rights reserved. Interception : In/Out VSM Upstream Switch Cisco Confidential 15 • Current generation network capabilities are driven by physical network topology. Example, If the firewall is plugged into the Internet connection and then the load balancer into firewall, the path of traffic must always flow in that order. • Application driven requirements that change the relationship (load balancing, then firewall) cannot be supported without physically changing the layout of the network. Application Proxy Server Core Router/Switch Load Balancer Firewall © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 • Source NAT (SNAT) is primarily for its simplicity, however client source is obscured often preventing SNAT deployment • Policy Based Routing (PBR) is a partial solution to preserve the client source, but increases deployment complexity and operation cost • Inline ADC’s become performance bottleneck high-performance and scalable datacenters • Despite this performance limitation, the most deployments (> 70%) are inline due to their relative simplicity in configuration • Only necessary traffic needs to be sent to ADC for optimal capacity usage © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 vPath is the solution : • No SNAT needs to be configured on NetScaler 1000V; vPath redirects return traffic to SLB • Application workload and East-West services (eg. Firewall) have full visibility into source and destination VM • ADC is not required to be deployed as a gateway or inline mode for application VM’s. vPath redirection will handle traffic flows to SLB • Enables policy-based service chaining for applications; decouple services from underlying network • Enables new use-cases for SLB in east-west flows © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 © 2012 Cisco and/or its affiliates. All rights reserved. 19 vPath Service Chaining Benefits Intelligent policy-based traffic steering through multiple network services • Decouples network services from underlying network topology with vPath Overlays • Dynamic Service chains enabled per VM port • Programmability • Transparent Services Insertion • Multi-Tenancy • VxLAN Expanded vPath Ecosystem: VSG, ASA 1000V, vWAAS, & NetScaler 1000V © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS APP OS Web Tier Cisco vPath VM VM VM DB Tier Cisco vPath 1 Client Initiates Flow to Web Server (VIP as Server IP) 1 Client › LB-VIP © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS APP OS Web Tier Cisco vPath VM VM VM DB Tier Cisco vPath 2 2 NS1000V load balance web request, selects Web Server 1 (Client › S1) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS APP OS Web Tier VM VM VM DB Tier Cisco vPath Cisco vPath 3 3 Based on policy, vPath redirect traffic to service chain, starting with zone-based firewall, VSG © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS VM APP OS VM VM DB Tier Web Tier Cisco vPath Cisco vPath 4 4 Traffic returns to Virtual Ethernet Module ready for next network service © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS VM APP OS VM VM DB Tier Web Tier 5 Cisco vPath 5 Cisco vPath Web to DB Tier Connection © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS VM APP OS VM DB Tier Web Tier Cisco vPath 6 VM 6 Cisco vPath Web to DB Tier Connection : Database tier security policy © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 Services Chaining with vPath Intelligent Policy-based Traffic Steering Through Multiple Network Services APP OS APP OS VM APP OS VM DB Tier Web Tier Cisco vPath 7 VM 7 Cisco vPath Apply VSG policy and forward packet to database © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27 Web • Preserve Client IP; No Source NAT or PBR required to send server return traffic to NetScaler1000V • Dynamic SLB (NS1000V) deployments in Multi-Tenant environment • NetScaler 1000V gets rich benefits of intelligent service chaining with no worrying about VLAN stitching in dynamic virtual environments vPath • No disruption to east-west / distributed services, that would normally happen with source NAT © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 VM VM VM Advanced NX-OS feature-set VM VNICs Nexus 1000V VEM Nexus 1000V VSM Innovative Services architecture (vPath) Extensible vSwitch Consistent operational model SCVMM Integration PNICs © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30 VM VM VM VM Cisco Nexus 1000V VEM VM VM VM VM Cisco Nexus 1000V VEM WS 2012 Hyper-V Server VM VM VM VM Cisco Nexus 1000V VEM WS 2012 Hyper-V Server WS 2012 Hyper-V Server Virtual Supervisor Module (VSM) Virtual Ethernet Module (VEM) • Virtual or Physical appliance running Cisco NXOS (supports Hi-availability) • Enables advanced networking capability on the hypervisor • Performs management, monitoring, and configuration • Provides each virtual machine with dedicated “switch port” • Tight integration with management platforms • Collection of VEMs : 1 virtual network Distributed Switch Cisco Nexus 1000V VSM © 2011 Cisco and/or its affiliates. All rights reserved. System Center Virtual Machine Manager Cisco Confidential 31 VM VM VM VM VM VMware vSphere VMware vCenter © 2011 Cisco and/or its affiliates. All rights reserved. VM VM Nexus 1000V VEM Nexus 1000V VEM Nexus 1000V VSM VM Nexus 1000V VSM WS 2012 Hyper-V SCVMM Cisco Confidential 32 Cisco PNSC SCVMM vPath VSNs Cisco Nexus 1000V Cisco Nexus 1000V © 2011 Cisco and/or its affiliates. All rights reserved. Virtual Machine Attributes Cisco PNSC vPath VSNs Port Profiles Virtual Machine Attributes Port Profiles VMware vCenter Cisco Confidential 33 Nexus 1110 VSG VSM VEM-1 vPath Overlay VMware ESX VEM-2 vPath Overlay VMware ESX NAM VSG* VEM-1 vPath Overlay WS 2012 Hyper-V VSM VEM-2 vPath Overlay WS 2012 Hyper-V Existing Nexus 1010 virtual blades support EITHER hypervisor environment © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34 Essential ($0) Advanced ($695/cpu) VLANs, ACL, QoS vPath LACP Multicast Netflow, SPAN, ERSPAN Management (SNMP etc.) SCVMM Integration DHCP Snooping IP Source Guard Dynamic ARP Inspection Virtual Security Gateway** © 2011 Cisco and/or its affiliates. All rights reserved. ** Only supports network-attributes Cisco Confidential 35 SCVMM Terminology Cisco Nexus 1000V Terminology Logical Networks Logical Networks Network Sites Network Segment Pools VM Network Definitions Network Segments IP-Pools IP-Pools & IP-Pool Templates Port-Classifications Port-profiles © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36 nsm logical network DMZ # nsm network segment pool DMZ_POD1 # member-of logical network DMZ # nsm network segment DMZ_POD1_SUBNET1 member-of network segment pool DMZ_POD1 switchport mode access switchport access vlan 20 ip-pool import template DMZ_POD1_Pool1 Logical network “DMZ” Network Site “DMZ_POD1” VM Network DMZ_POD1_SUBNET1 VM Network DMZ_POD1_SUBNET2 # nsm network segment DMZ_POD1_SUBNET2 member-of network segment pool DMZ_POD1 switchport mode access switchport access vlan 21 ip-pool import template DMZ_POD1_Pool2 VM Network DMZ_POD1_SUBNET3 # nsm network segment DMZ_POD1_SUBNET3 member-of network segment pool DMZ_POD1 switchport mode access switchport access vlan 22 ip-pool import template DMZ_POD1_Pool2 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 VM VM VM VM SCVMM manages the placement and live-migration of the VMs based on the constraints between VM networks and the network sites. 4 Server Admin 3 Adds hosts to N1KV SCVMM Nexus 1000V VEM Connects VMs (VNICs) to VM Networks WS 2012 Hyper-V 5 2 Networks & policies synced to SCVMM Server 1 Nexus 1000V VSM © 2011 Cisco and/or its affiliates. All rights reserved. Create networks and policies (logical networks, network sites, VMnetworks) Network Mgmt Cisco Confidential 38 http://developer.cisco.com/web/n1k/hyperv PowerShell CmdLet: <Action>-N1k<Object> Examples Action Verbs Create an object* New Create a Logical Network* Read an object Get Read port-profile info Update an object Set Update an IP-Pool Delete an object Remove Remove network segment New-N1kLogicalNetwork() Get-N1kPortProfile() Set-N1kPoolTemplate() Remove-N1kNetworkSegment() *Objects can be Logical Networks, VM networks, Port-profiles, IP-Pools, Port-profiles etc. Write/Update Operations are only supported on limited set of objects Open a connection to VSM from PowerShell using the credentials © 2011 Cisco and/or its affiliates. All rights reserved. Identify the required PowerShell CmdLets Run the Cmdlet directly from the PowerShell Prompt Parse the response for the required information Cisco Confidential 39 • Support for Windows Server 2012 R2 • Additional PowerShell Commands • Universal Licensing • VSG/PNSC support for VM and Custom attributes © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 40 • CRUD Operations for User-creation To Create/Read/Update/Delete VSM user account information Get-User, New-User, Set-User, Remove-User • Managing SPAN & ERSPAN sessions To Create/Read/Update/Delete SPAN/ERSPAN session information Get-Session, New-Session, Set-Session, Remove-Session • CRUD operations for port-profiles To Create/Update/Delete port-profiles New-PortProfile, Set-PortProfile, Remove-PortProfile © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41 Before v1.5.2 After v1.5.2 • Separate Advanced Licenses for each hypervisor version • Licenses for one hypervisor won’t work on other hypervisors • Existing N1KV Licenses can be used for N1KV/Hyper-V • If you already bought N1KV/Hyper-V, we will issue new universal licenses © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42 Virtual Security Gateway (VSG) Prime Network Services Controller (PNSC) © 2011 Cisco and/or its affiliates. All rights reserved. Context Aware Security VM context aware rules Zone-Based Control Establish zones of trust Dynamic, Agile Policies follow Live Migration Best-in-Class Architecture Efficient, fast, scale-out SW (with vPath intelligence) Non-Disruptive Operations Security team manages security Policy Based Administration Central mgmt, scalable deployment, multi-tenancy Designed for Automation XML API, security profiles Cisco Confidential 43 Microsoft SCVMM VM/Network Attributes Cisco Prime Network Services Controller (PNSC) Security Profiles Device Profiles VM attributes VM-to-IP Binding VSN VSM VSM VSG Port Profiles Interactions Packets (Fast-Path) © 2011 Cisco and/or its affiliates. All rights reserved. Packets (Slow-Path) vPath Nexus 1000V VEM Hyper-V Servers Packets (Fast-Path) Cisco Confidential 44 Rule Source Condition Destination Condition Condition Match Criteria Attribute Type Condition Action Network Match All (And) VM Match Any (Or) User Defined vZone VM Attributes Network Attributes Operator Operator VM Name IP Address eq member Guest OS name Network Port neq Not-member gt Contains lt And (Global Level) range Or (Global Level) Port Profile Name VM DNS Name Not-in-range © 2011 Cisco and/or its affiliates. All rights reserved. Prefix Cisco Confidential 46 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 47 Virtual Network Server ANY HYPERVISOR Nexus 1000V Promotion @ 40% price reduction Universal License – Flexibility for Any Hypervisor Virtual Switch Access Switch Physical Network Any of the Nexus 5K/2K or Nexus 6K/2K Bundles • Consistency across Physical, Virtual & Hypervisors • Investment Protection (people, process & tools) • Future-proofing network fabric architectures © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 48 • Base Package: Nexus 1110-X Hosting Appliance For hosting Virtual Supervisor Module, Virtual Security Gateway, VXLAN VLAN gateway and other virtual services (e.g. NetScaler 1000V, vNAM etc.) 64 Universal Licenses Nexus 1000V License for ANY hypervisor. Migration allowed. VSG licenses included • Optional Package: Additional 64 Universal Licenses Nexus 1000V License for ANY hypervisor. Migration allowed. VSG licenses included © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 49 N6K-FEX-N1K-PROMO Base Package: N1110-X+64 licenses Optional Package: Add. 64-licenses N6004EF-6FEX-1G N6004EF-8FEX-1G N6004EF-4FEX-10G N5K-FEX-N1K-PROMO N6001P-6FEX-1G Base Package: N1110-X+64 licenses N6001P-8FEX-1G Optional Package: Add. 64-licenses N6001P-4FEX-10G N5596UP-4N2232PF N6001P-6FEX-10G N5596UP-4FEX N6001P-4FEX-10GT N5548UP-4N2248TF N5548UPL3-2N2248TF N5548UPM-4FEX N5596UPM-6FEX N5596UPMM-8FEX N5596UP-6N2248TF N6004EF-6FEX-10G N6001P-6FEX-10GT N5596UPM-8N2248TF N6004EF-4FEX-10GT N6004EF-12FEX-1G N5548UP-4N2248TP N6004EF-6FEX-10GT N6004EF-8FEX-10G N5596UP-6N2248TP N6004EF-4FEX-1G N6004EF-8FEX-10GT N5548UP-4N2248TR N5596UPM-8N2248TP N6001P-2FEX-10G N6001P-4FEX-1G N5596UP-6N2248TR N5548UPM-6N2248TR N5596UPMM-12N2248T © 2011 Cisco and/or its affiliates. All rights reserved. N5548UPM-6N2248TP Cisco Confidential 50 © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 51 PID Description List Price N1K-M-VSG-UCS- Nexus 1000V Advanced Edition for Hyper-V with the purchase of UCS B/C series configurable SKUs (not $495 BUN available with fixed SmartPlay Bundles) per cpu N1K-VSG-UCSBUN Nexus 1000V Advanced Edition for vSphere with the purchase of UCS B/C series configurable SKUs (not $495 available with fixed SmartPlay Bundles) per cpu Upto 30% Discount on N1KV © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 52 Includes Nexus 1000V Advanced Edition (with VSG bundled) and ASA 1000V PID L-N1K-ASA1K-01-PR (eDelivery) or N1K-ASA1K-01-PR (Paper Delivery) L-N1K-ASA1K-04-PR (eDelivery) or N1K-ASA1K-04-PR (Paper Delivery) L-N1K-ASA1K-16-PR (eDelivery) or N1K-ASA1K-16-PR (Paper Delivery) L-N1K-ASA1K-32-PR (eDelivery) or N1K-ASA1K-32-PR (Paper Delivery) Description List Price 1 Promo N1KV Advanced (including VSG), ASA1000V, VNMC license $2,495 [base license is needed for each VNMC instance] 4 Promo N1KV Advanced (including VSG), ASA1000V, $9,945 VNMC incremental licenses 16 Promo N1KV Advanced (including VSG), ASA1000V, $39,445 VNMC incremental licenses 32 Promo N1KV Advanced (including VSG), ASA1000V, $78,645 VNMC incremental licenses Up to 32% Discount on N1KV © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 53 • Cisco Virtual Networking is Hypervisor Agnostic • Virtual Networking is integrated to physical network fabric to provide seamless virtual+physical network management • Cisco and Citrix has collaborated to introduce Netscaler 1000V – virtual Load-Balancing solution enhanced by Nexus 1000V. • Cisco Nexus 1000V for Hyper-V shipping now – supports WS2012-R2 and enhanced VSG • Take advantage of the limited time Nexus 1000V promotions. © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 54 • Cisco Virtual Networking: www.cisco.com/go/1000v • Cisco N1KV/Hyper-V: www.cisco.com/go/1000v/hyper-v • Citrix NetScaler 1000V: http://www.cisco.com/go/ns1000v • Cisco N1KV Communities: www.cisco.com/go/n1kvcommunity • Cisco Nexus 1100 Series: http://www.cisco.com/go/1100 • Cisco Virtual Security Gateway (VSG): http://www.cisco.com/go/vsg • Cisco ASA 1000V Cloud Firewall: http://www.cisco.com/go/asa1000v © 2011 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 55 Thank you.