Cisco ACI and F5 LTM Integration for accelerated application deployments. Dennis de Leest Sr. Systems Engineer F5

Transcription

1 Cisco ACI and F5 LTM Integration for accelerated application deployments Dennis de Leest Sr. Systems Engineer F5

2 Agenda F5 Networks Who are we and what is Big-IP? F5 Synthesis Software Defined Application Services (SDAS) Overview Cisco Application Centric Infrastructure (ACI) L4-7 Services Insertion F5 and Cisco ACI Integration Key Takeaways Q&A F5 Networks, Inc 2

3 F5 MISSION Deliver the most secure, fast, and reliable applications to anyone anywhere at any time. F5 Networks, Inc 3

4 F5 Networks Connecting users with data Data Center Web Server Application Server File Storage Web Servers Application Servers F5 Networks, Inc 4

5 F5 s Strategic Point of Control Users Availability Optimization Security Management Scale HA / DR Bursting Load-Balancing Network Application Storage Offload Network Application Data Access Integration Visibility Automation Orchestration Resources APP OS APP OS APP OS APP OS APP OS APP OS APP OS APP OS Private Public Physical Virtual Multi-Site DCs Cloud F5 Networks, Inc 5

6 The F5 Application Delivery Framework Bringing deep application fluency to security LTM GTM AFM APM ASM AAM SWG SDN PEM CGN Websafe Mobilesafe Network firewall Traffic management Application security Access control One platform DDoS mitigation SSL inspection DNS security EAL 2+, EAL4+ in process F5 Networks, Inc 6

7 LTE Roaming VDI Application Services Portfolio Global Server Load Balancing Anti-Fraud SSL Inspection Policy Enforcement Endpoint Inspection SSL VPN Subscriber Traffic Control NfV Traffic Shaping and QoS DNSSEC Anti-Malware Compression Optimization Disaster Recovery SPDY Gateway Caching Application Optimization Access Control Web Access Management DNS Caching & Resolving VAS Bursting Intelligent EPC node selection SSL Programmability VOLTE Intelligence Service Chaining MDM Firewall Traffic Management Cloud Bridging SAML Federation Mobile Optimization SDN Mobile App Management F5 Networks, Inc 7 DDoS Authoritative DNS Cloud Federation Anti-Phishing Diameter & Routing SAML Federation Mobile Acceleration Global Load Balancing Gi Firewall Web Performance Enrichment Optimization Secure Web Gateway Cloud Bursting Traffic Management Single Sign-On Quota Management App Delivery Firewall Application Traffic Control CGNAT Web App Firewall Acceleration Business Continuity Active Sync Proxy DNS Firewall

8 F5 F5 Networks, Inc Inc. 8

9 The Evolution of F5 3 Hypervisor/Cloud ubiquity Multi-tenancy, all-active Identity access management 2 Security Mobility/LTE Domain Name Services 1 Traffic management Optimization Acceleration F5 Networks, Inc 9

10 Advanced threats Software defined everything SDDC/Cloud Internet of Things Mobility HTTP is the new TCP F5 Networks, Inc 10

11 Applications Impact on Data Center Architecture MICRO-ARCHITECTURES Each service is isolated and requires its own: Load balancing Authentication / authorization Security Layer 7 Services May be API-based, expanding services required More applications needing services API DOMINANCE Proxies are used in emerging API-centric architectures for: API versioning Client-based steering API Load balancing Metering & billing API key management More intelligence needed in services Service A Service C API v1 Service B Service D API v2

12 The Evolution of F5 4 Software Defined Application Services 3 Cloud Ready 2 Broadened Application Services 1 Application Delivery Controller F5 Networks, Inc. 12

13 F5 Synthesis Partner Ecosystem / DevOps F5 Networks, Inc. 13

14 SDDC/Cloud F5 Networks, Inc 14

15 Software Defined Application Services Elements High-Performance Services Fabric Simplified Business Models F5 Networks, Inc 15

16 High Performance Services Fabric F5 Networks, Inc 16

17 High-Performance Services Fabric Programmability Data Plane Control Plane Management Plane Virtual Edition Appliance Chassis Network [Physical Overlay SDN] F5 Networks, Inc 17

18 High-Performance Services Fabric Programmability Data Plane Control Plane Management Plane Virtual Edition Appliance Chassis Network [Physical Overlay SDN] F5 Networks, Inc 18

19 Intelligent Services Orchestration

20 Centralized Management Platform BIG - IQ BIG-IP BIG-IP Data Center Hybrid Cloud Public Cloud F5 Networks, Inc 20

21 Intelligent Services Orchestration Orchestration Connectors Fabric Connectors BIG-IQ Cloud Connectors Module Connectors F5 Networks, Inc 21

22 Intelligent Services Orchestration Orchestration Connectors Fabric Connectors BIG-IQ Cloud Connectors Module Connectors F5 Networks, Inc 22

23 Cisco Application Centric Infrastructure (ACI)

24 AGILITY: Any application, anywhere Physical and Virtual common application network profile Traditional 3-Tier Application F/W ADC WEB WEB WEB WEB ADC APP APP APP APP DB DB DB DB APPLICATION NETWORK PROFILE CONNECTIVITY POLICY SLA Extensible Scripting Model QoS Security SECURITY POLICIES Load Balancing QOS BANDWIDTH RESERVATION AVAILABILITY APPLICATION L4-L7 SERVICES STORAGE AND COMPUTE DB APPLICATION NETWORK PROFILE HYPERVISOR HYPERVISOR HYPERVISOR DB DB WEB WEB WEB APP WEB APP WEB 24

25 Service Graph Definition Service Graph: web-application Functions rendered on the same device Func: Firewall Func: SSL offload Func: Load Balancing Terminals Firewall params Permit ip tcp * dest-ip <vip> dest-port 80 Deny ip udp * Connectors SSL params Ipaddress <vip> port 80 Terminals Load-Balancing params virtual-ip <vip> port 80 Lb-aglorithm: round-robin Service graph is an ordered set of functions between a set of terminals A Service Graph can be defined through GUI, CLI or through APIC API A function has one or more connectors Network connectivity like VLAN tag is assigned to these connectors A function within a graph may require one or more parameters Parameters can be scoped by an EPG or an application profile or tenant context Parameters could also be assigned at the time of defining a service graph. Parameter values can be locked from further changes 25 F5 Networks, Inc 25

26 F5 integration with Cisco Application Centric Infrastructure (ACI)

27 F5 and Cisco ACI Joint Solution Benefits Automated layer 4-7 application service insertion, policy updates, and optimization within the ACI-enabled fabric with BIG- IP Accelerated application deployments with reliability, security and consistent scalable network and L4-L7 services F5 DEVICE PACKAGE FOR APIC ACI Fabric Preserves richness of F5 Synthesis offering through policy abstraction offering investment protection Existing F5 Physical and Virtual appliances, topologies integrate seamlessly with Cisco ACI Application agility using policy driven application delivery approach to significantly reduce operating costs Programmability (irule / iapp / icontrol) Data Plane Control Plane Management Plane F5 Synthesis Fabric Provisioning workflows is efficient and faster while maintaining operational best practices across multiple IT teams Virtual Edition Appliance Chassis F5 Networks, Inc 27

28 Service Automation Through Device Package Open DevicePackage Configuration Model (XML File) Python Scripts APIC Policy Engine APIC provides extendable policy model through Device Package APIC Policy Manager Configuration Model Device Package contains XML file defining Device Configuration Model Provider Administrator can upload a Device Package Script Engine APIC Script Interface Python Scripts APIC Script Interface Device scripts translates APIC API callouts to device specific callouts F5 Networks, Inc 28

29 Understanding Device Package APIC requires a Device Package to configure and monitor a service devices. A device package manages a class of service devices A Device Package is a zip file containing two parts Device Specification Is an XML file that defines Functions provided by a device Like Load Balancing, Content-Switching, SSL termination etc Parameters required for configuring each function Interfaces and Network connectivity information for each function Device Script The integration between the APIC and a Device is performed by a Device Script APIC events are mapped to function calls defined in Device Script XML / REST API APIC EPG level L4-L7 config Service Graph Function Node level L4-L7 config Python Device Package icontrol BIG-IP Physical or VE 29 F5 Networks, Inc 29

30 APIC Service Graph Config / F5 ADC (LTM) Config APIC Service Graph Function Node Config Parameters, for example, web pool, will be pushed from APIC to BIG-IP In this example, BIG-IP populates Pools configuration from APIC. Parameters that are optimized for L4 SLB (similar to iapp) will be pre-configured and automatically populated in BIG-IP F5 Networks, Inc 30

31 APIC Tenant / F5 ADC (LTM) Partition Tenant is a container for policies, where the primary elements that the tenant contains are: filters, contracts, bridge domains and application profiles that contain EPGs An ACI tenant will be represented as a partition within BIG-IP A function node identifies a set of network service functions that are required by an application A function node within a service graph will be represented as a Virtual Server within BIG-IP F5 Networks, Inc 31

32 Use cases Functions Virtual Server Layer 4 Server Load balancing Layer 4 SLB with SSL offload Layer 7 Server Load balancing Layer 7 SLB with SSL offload Microsoft SharePoint Parameters under Virtual Server Configuring Global and Tenant Self IP addresses Configuring Global and Tenant static routes Device Counters Server Pools TCP Optimizations (WAN/LAN/Mobile) HTTP optimization HTTP Security (Application protocol security) TCP connection multiplexing (One Connect) Validators and Creation of tenant OneConnect profiles irules Validators and Creation of tenant acceleration profiles SNAT Pool management More than 80% of F5 customers use the L4 SLB / L7 SLB / MSFT SharePoint / SSL offload hence 1st release targets these use cases 32 F5 Networks, Inc 32

33 Device Package: User Defined (Future) Cisco APIC and F5 APIs are open, user can defined its own device package, for example, adding other F5 modules like Access Policy Manager (APM VPN SSL solution) or Application Security Manager (ASM WAF solution), and have it incorporated with F5 Local Traffic Manager (LTM ADC solution)device package in the same service graph. User Defined Device Package F5 Provided Device Package To Consumer EPG F5 BIG-IP ASM F5 BIG-IP LTM To Provider EPG F5 Networks, Inc 33

34 Reference Material For Your Reference F5 SDAS and Cisco ACI Solution Brief Cisco Application Policy Infrastructure Controller (APIC) Automate Application Deployment with F5 Local Traffic Manager and Cisco Application Centric Infrastructure ollateral%2fdata-center-virtualization%2fapplication-centric-infrastructure%2fwhite-paper-c pdf&pos=4&query=f5+cisco+aci+integration+white+paper F5 BIG-IP LTM and Nexus lyMgR2dGlkA1ZJUERFMDVfMQ-- /RV=2/RE= /RO=10/RU=http%3a%2f%2fwww.cisco.com%2fc%2fdam%2fen%2fus%2fsolutions%2fcollateral%2f data-center-virtualization%2fapplication-centric-infrastructure%2fsolution-overview-c pdf/rk=0/rs=ct30nyclam50d8frbz0jl3py0iy- Follow us on -> Official Cisco Official F5 Networks Channel 34 F5 Networks, Inc 34

35 Summary Cisco and F5 extending partnership across the board from Service Provider and Security to Next-gen Data Centers Cisco ACI and F5 solves traditional network service insertion challenges through automated ACI policy model and F5 device package Application provisioning and configuration is made simple and agile through ACI policy model, F5 use-case driven device package approach and open Northbound APIs Key benefits of F5 / ACI model: Multi-Tenancy, separate Route-domain/L3 and Multi-Graph Support Use Case Focus Application level visibility and monitoring F5 Networks, Inc 35

36