H3C Data Center Solution

Transcription

1 Data Center SOLUTION H3C Data Center Soltion Forward A data center (DC) refers to an integrated IT application environment formed throgh data centralization. It is a center that provides diversified IT applications and a center of data processing, transmission, and storage. A DC realizes the nified management of IT infrastrctre, services, and data, the nified deployment of secrity policies, and O&M management. DCs remain the focs of IT constrction by telecom operators and indstry cstomers. Operators, large-scale bsinesses, government agencies, and bsinesses in the fields of financial secrities, energy, electricity, transportation, edcation, manfactring, power grids, and e-commerce have already constrcted or are constrcting their DCs. Thanks to DCs, IT information systems are integrated and nified management is now available to raise internal operations and management efficiency and external service levels while redcing the TCO of IT constrction. H3C is dedicated to the research, development, prodction, and sales of IP technologies, prodcts, and services. Apart from the fll series of Ethernet switches and roters, H3C has gained a steady growth in secrity, IP storage, IP monitoring, voice videoconferencing, WVLAN, SOHO, and software management systems. At present, H3C ranks the first in China in the market share of prodcts, among the top three in the market share of secrity prodcts in China, and the first in the market share of IP storage prodcts in the Asian-Pacific region. H3C takes a lead in the world in the IP monitoring technology. From a eqipment spplier, H3C has established itself as an IToIP soltion provider with mltiple prodcts. H3C follows closely the development of the data center sector and sstains the inpt to the R&D of DC soltions. The H3C IToIP-based DC soltions that combine, secrity, IP storage, software management, and IP monitoring effectively address varios togh problems in the constrction of data centers and have been extensively applied to DCs of all sectors. Based on the long-standing R&D and technological accmlations in the data commnications field and the history of DCs, H3C divides the development of DCs into the following levels: Basic DC integration: In this stage, the primary focs of data center constrction is to integrate the existing heterogeneos service systems, resorces, and IT resorces based on service reqirements and open-standard IP protocols. A basic DC is divided into fnctional areas, follows layers, and featres hierarchical server access. Thanks to the high availability (HA) technologies and sond design, yo can ensre the reliable rnning of data centers and garantee service continity. Application intelligence data center: Based on the open TCP/IP architectre, application intelligence enables the seamless deployment and pgrade of varios new services and applications on the basic DC architectre. This satisfies the changing reqirements of sers and ensres the service sstainability and continity of a data center. The secrity, optimization, and integration of diversified applications can be seamlessly deployed over the data center. Data center virtalization: The traditional DC model with isolated application islands has poor scalability. The allocation of core resorces does not match the service application development, leading to neven resorce tilization and driving p operation costs. As a reslt, the existing investment cannot bring ot the optimal tilization; new services can hardly be deployed; the continity of existing services cannot be garanteed; the data center faces secrity threats. By bilding a shared resorce pool, virtalization manages, plans, and controls, processing, and storage resorces, simplifies management and maintenance, enhances the tilization rate of device resorces, optimizes the service procedres, and lowers maintenance costs. Data center resorce intelligence: With the intelligence management platform, yo can manage, allocate, and

2 H3C Data Center Soltion schedle resorces in an intelligent manner, and constrct a highly intelligent atomatic data center. I. Basic Network Integration 1. Network Design With the rapid development of services, the service applications and data of bsinesses inclding operators, firms, and indstrial sers are heading for integration from scattered deployment. The deployment model of IT facilities that carry services also experiences dramatic changes. The interconnection cannot satisfy the reqirement for sstained service development after the application integration. A is the only niversal entity that connects all DC IT components. Bilding solid infrastrctres garantees the continity, management, and O&M of data center services. User services are generally classified into several sbsystems that depend on each other in terms of data sharing, service access, data access control and isolation. Based on service relevance and related procedres, ser services shold be designed into different modles on the principle of low copling and high cohesion to ensre system and data secrity, reliability, flexible scalability, and easy management. The design of basic DC s shold follow the principle of different areas, layers, and hierarchies. Area division In area division, yo are reqired to divide ser services into mltiple service sbsystems based on the relevance and management of the entire IT system. Each sbsystem has independent core switches, servers, and secrity bondary devices. The sbsystems follow hierarchical access control policies. Rational logical area division and secrity area division are a prereqisite for a data center. Based on the characteristics of a company, the relevance of service systems, the access reqirements of data flows, and the secrity control reqirements, DC servers and service systems can be divided into the areas of intranet, extranet, and Internet. In each area, the service procedres can be frther classified. Intranet area An intranet area is generally an internal data center area that allows data access within a company. An intranet is not visible to external s. Extranet area An extranet area is a data center area that allows data access of partners. By constrcting VPNs, sers can access server farms and isolate different bsinesses. Internet area An Internet area, also known as the DMZ area, is a data center area provided by a company for the access of Internet sers. External sers can access the Internet area throgh a pblic. The Internet area is sally deployed on the server farm that accommodates the portal website of the company. Layered design It is based pon the principle of internal and external traffic flows. A DC is divided into three layers: core layer, aggregation layer, and access layer. The traffic between a server and a service system is mostly within a single fnctional area and does not need to enter the core layer. The traffic between layers, however, shold enter the core layer. In this manner, yo can easily configre access control policies on the aggregation switches in each area, lessen the traffic pressre on the core layer, minimize the scope of a falt, and rapidly rectify a falt. Core layer The core layer connects mltiple interconnected DC aggregation modles and connects the camps core area. The core layer is reqired to have powerfl switching capability and strong adaptability to brst traffic. A 2

3 H3C Data Center Soltion large-scale DC core layer shold be able to connect mltiple aggregation modles throgh extension. Small and medim-scale DCs can share the camps core area. Crrently, 10-Gbit/s interfaces are mostly in se. For to eight 10-Gbit/s interfaces shold be bndled to spport high performance applications. Aggregation layer The aggregation layer provides server farms with otbond interfaces of high bandwidth. High-density GE or 10GE interfaces are reqired to connect the access layer. The aggregation layer provides many slots for vale-added service modles. Access layer The access layer provides high density GE or 10GE access. The percentage of the overall access bandwidth and the pstream bandwidth has two modes: aggregation ratio and line rate. In terms of rack monting, the 1 RU is capable of flexible deployments. The access layer spports stacks and featres good scalability. It also spports dal pstream links in redndancy mode. The Web layer is responsible for providing application windows, accepting cstomer reqests, and retrning end reslts. It is the external interface of service systems and data. IIS and Apache servers work on the Web layer. Application layer The application layer is responsible for data processing and service procedre integration. The common middleware technologies sch as WebLogic and J2EE are implemented on the application layer. Database layer The database layer is responsible for storing data for the access and random debgging of service systems. MS SQL server, Oracle 9i, and IBM DB2 work on the database layer. The mainstream practices in the indstry show that diversified secrity and application optimization services are deployed on the aggregation layer. For example, integrate the firewall, load balancing, or application accelerator board fnctions on the switch. Internally interconnected throgh the switching, the three-tier server access model featres hierarchical secrity protection, distinct architectre, and convenient deployment. The three-tier interconnection has two models: horizontal and flat. The horizontal model has a distinct architectre and easy management whereas the flat model saves investment. Advantages of the H3C basic DC s Secrity The secrity relations in different areas can be easily identified. Yo can then enforce secrity policies in each area separately withot affecting other areas. Hierarchical strctre The application access model has already transformed to the browser/server (B/S) model from the traditional client/server (C/S) model. The B/S model reqires a three-tier server strctre that can be classified into the following layers: Web layer Scalability Bilt into different areas and levels as reqired, the H3C basic DC boasts flexible service deployments. Yo can easily add a new server farm area withot changing the original strctre. High availability Yo can easily isolate falty areas, simplify data paths, and 3

4 H3C Data Center Soltion accelerate the convergence time. Easy management The distinct strctre facilitates rotine O&M and falt location. 2. High Availability Soltion With the increasingly intensified market competition, cstomers depend more and more on information systems. The reqirements for information systems also grow higher and higher. To ensre a HA data center, providing the 7 x 24 services becomes the primary objective in constrction. It is also the tmost concern in DC constrction. Network failres that lead to navailable s are classified into the following types: Uncontrollable factors inclding natral disasters, wars, blackot, and hman sabotage By constrcting the "three centers at two locations" model that consists of a prodction center, a local backp center, and a remote disaster tolerance center, together with rational overall planning and design, yo can ensre the HA of a data center in the case of ncontrollable factors. Controllable factors inclding device failres, link failres, congestion, misoperations, and malicios attacks Several factors are considered by H3C in prodct designs and a fll series of soltions that cover the physical layer, link layer, IP layer, transport layer, and application layer are implemented to enhance availability in an all-rond manner. Hardware redndancy: dal main control boards, hot swappable boards, redndant power spply modles, and redndant fan modles In addition to HA prodcts, H3C also provide a complete HA data center soltion. The soltion incldes HA server access, HA from the access layer to the aggregation layer, and HA aggregation layer. HA server access It is also called the mlti-nic server access. To ensre the HA of service access, a server is generally connected to an pstream device throgh mltiple links. In this case, two or more NICs are in se. The driver program in the server bndles the two or mote NICs into a virtal NIC. If one NIC fails, the other NIC takes over the MAC address. The two NICs se the same IP address and are located in the same broadcast domain, that is, in the same sbnet. There are many methods to connect a server to an access switch. The availability of the preceding connections increases from left to right. The forth connection method is recommended. In this mode, a server is connected to two cabinet switches in falt tolerance mode. In addition, a VLAN trnk is configred on the switches to ensre highly reliable access of the server. HA from the access layer to the aggregation layer There are for methods to connect access devices to the aggregation layer: inverted U-shape, U-shape, triangle, and rectanglar. These connection methods are all based on Layer 2 links. Take the rectanglar connection as an example. The links between access devices, from access devices to aggregation devices, and between aggregation devices are all Layer 2 links. This forms rectanglar Layer 2 links. Redndant physical links sch as Ethernet link aggregation Ring technologies sch as RPR and RRPP Redndant Layer 2 paths sch as MSTP and SmartLink Redndant Layer 3 paths sch as VRRP, ECMP, and fast convergence of dynamic rotes Fast falt detection technologies sch as BFD Non-blocking forwarding technologies sch as GR 4

5 H3C Data Center Soltion H3C recommends the triangle connection: It spports redndant links and paths and has the smallest convergence time in case of failres. The VLAN can extend to different switches on the aggregation layer and the servers boast flexible deployments. In practice, yo can choose one of the following schemes as reqired: H3C Intelligent Resilient Framework (IRF): The H3C IRF manages distribted devices, distribted rotes, and aggregates links connecting different devices. In addition to improved availability and redced impact of single point failress, the H3C IRF also has the following featres: - Largely enhances the performance by the distribted processing of Layer 2 and Layer 3 protocols. - Ensres effective configration management by considering each grop of devices as a logical fabric. - Facilitates easy pgrade by allowing the simltaneos software pgrade of all devices in a stack grop. - Allows flexible management by spporting hot swapping of devices in all stack grops. Adopt MSTP+VRRP to connect access devices to aggregation devices. This improves availability and also shares the traffic load among links. HA aggregation layer Configre VRRP between aggregation switches. VRRP configred between secrity and application optimization devices can be bilt in or attached to aggregation switches. The attachment method is recommended. In this case, the devices are not connected to the in tandem, eliminating performance bottleneck. With the HRP protocol, yo can back p the key configration commands and session stats between the master and the backp firewall devices. The HRP protocol is carried over VGMP packets. Throgh the specified load balancing algorithm, the packets to a server farm are balanced among the member servers. This maximizes the external service provision capability of the server farm, improves the availability of servers, and enhances the processing performance of the server farm. II. Application Intelligence 1. Model Today, with the emerging of Web 2.0 applications sch as Flickr, YoTbe, Blog, WIKI, and Podcast, the Internet thrives again after the first bbble collapses. The nderlying hero of these new applications is the Web technology. Web 1.0 addresses the sbject of standardizing hman-machine interactive interfaces, and Web 2.0 frther standardizes the application data interaction. Web 2.0 is developed on the basis of XML protocols and a series of Web technologies. The most striking characteristic of the Web 2.0 era is that every one can become a data provider. In the coming few years, the poplarity of Web applications is bond to lead to the emerge of a new standard, that is, standard Web-based applications. In the OSI model, it is the standard session and presentation layers. Once standardization is complete, application is available. This means that the standardized application fnctions are integrated to devices. New services are pressing for new application intelligence s. Corporate services and data head for high centralization from scattered deployment. The nmber of data centers soars and the attention paid to the significance of data centers is nparalleled. Application optimization, secrity, and application secrity devices are deployed in a large scale. Application intelligence data centers that combine application secrity and optimization capabilities are becoming increasingly poplar. In this context, mlti-service aggregation switches become an indispensable component in data center constrction. Application secrity incldes: 5

6 H3C Data Center Soltion Athentication, athorization, and acconting at the application layer Encryption (SSL) and integrated PKI deployment at the application layer Firewall (HTTP/XML firewall, Secrity Assertion Markp Langage (SAML)) at the application layer Protecting application contents against virses and intrsion Application optimization incldes: Application load balancing Hardware-based application bffer, compression, and switching Application protocol optimization (HTTP/TCP) The following figre shows the model of an application intelligence DC that combines application secrity and optimization. inherent secrity reqirements of a data center. Based on an in-depth analysis of IT secrity, H3C pts forward the stats-based evolving secrity model that classifies the IT secrity into the following: Device secrity: indicates rights management, virs protection, and data backp. Regional secrity: indicates remote access, intrsion inspection, secrity convergence, and secrity cooperation. Deep secrity: indicates disaster tolerance backp, deep defense, secrity aditing, and traffic analysis. Unified secrity: indicates risk management, corporate internal control, nified planning, and nified management. With the evoltion of the stats, secrity takes a trend of application intelligence secrity. In whatever sitation, information is in only one of the following processes: Processing: indicates the process that information is created, modified, deleted, searched, or processed in-depth. Commnications: indicates the process of transmitting information between different settings or within one setting. Storage: indicates the process of saving information temporarily or permanently. Secrity application aims to protect the data in the three statses. The secrity stats of information determines its secrity policy. With regard to a data center, the secrity policies cover access control, patch management, attack defense, filtration defense, virs control, traffic control, and risk control. Secrity areas 2. Secrity Apart from carrying core services and confidential data of sers, data centers also provide service interactions and data exchanges between internal and external cstomers, and partners. In this case, the secrity of data centers mst be integrated with service systems and secrity policies shold be easily deployed on s. One of the major concepts in the secrity constrction of data centers is layered hierarchical secrity. The secrity of an IT system contains several levels and is divided into different secrity areas, spplementing to the The basis of secrity policies lies in the logical division of services and of secrity areas. The advantages of secrity area division in data center services are as follows: Easy deployment of new fnctional areas Different secrity policies for different areas Independent expansion of each area if reqired Easy falt location and rapid recovery in case of failres In accordance with the division concept, a data center is divided into different logical areas based on the service types. Each area 6

7 H3C Data Center Soltion is deployed with its own secrity policy and trst model. The data center ths becomes a hierarchical secrity domain. In actal deployment, secrity policies are classified into: Bondary access control Deep intelligence defense Intelligent secrity management 1. Bondary access control Bondary control, the access control of sers to a data center, is the fndamental reqirement of the data center. With the evoltion of secrity stats, secrity takes a trend of application intelligence secrity. H3C SecBlade II 10GE firewalls, core and aggregation switches are all integrated with mltiple services and can exchange data directly throgh the backplane. The doble merits of high performance and reliability avoid the performance bottleneck and single point failres of switches dring in-service deployment. Compared with the attachment of a firewall to a data center, bondary control featres easy configration of policies, nchanged data forwarding paths, distinct traffic forwarding process, and easy deployment and maintenance. is necessary to collect and manage the secrity,, system, and application events, and convert and screen the raw data into effective information of intelligence secrity throgh intelligence analysis. The H3C SecCenter soltion manages the secrity and prodcts of p to 100 mainstream sppliers, generates reports atomatically or manally, monitors the traffic and attacks in real time, analyzes the relevance of mass events and threats, performs the secrity aditing, and keeps track of any falt origins. In all, the H3C commnications secrity goal is to provide service-oriented end-to-end secrity garantee to clients, s, DC servers, and storage systems. 2. Deep intelligence defense In the presence of endless intrsions of DDoS attacks, Trojan horses, and hackers to a data center, traditional IDS prodcts detect only some events and cannot realize real-time analysis and defense. The indstry leading H3C Intrsion Prevention System (IPS) is deployed on the key paths of a cstomer in online or bypass mode (so that the IPS can protect the against attacks or configre the Layer 2 retrn fnction). The IPS performs the Layers 2 throgh 7 deep analysis for data flows on the key paths, accrately identifies and blocks or restricts in real time the attacks by hackers, worms, virses, Trojan horses, DoS/DDoS, scanning, spyware, abnormal protocol, phishing, P2P, IM, and online games, or abses. In this manner, the H3C IPS protects the applications, infrastrctre, and performance of the cstomer's. The H3C IPS series prodcts also boast strong and practical bandwidth management and URL filtering fnctions, bringing cstomers high added vales. 3. Intelligent secrity management In addition to the operations of mass devices, service interactions between varios servers and operating systems abond in a data center. Immense alarming, monitoring, SNMP, and WMI messages are also transmitted over the DC. It 3. Optimization With the continos development of the Internet and ser services, Web applications already become the major data processing tasks of servers. HTTP is sed to transmit Web-based data between a server and a client. TCP is employed to provide garanteed connections and falt correction to HTTP. Althogh an ideal transmission mechanism, TCP also has limitations. When sed to transmit Web data, TCP consmes a large amont of resorces and reslts in the poor performance of servers. The performance bottleneck of data centers becomes increasingly severe. To address sch performance problems, traffic management prodcts sch as roters that can identify and manage deep inspection for the P2P traffic are introdced at the layer to handle application optimization problems in data transmission. These prodcts balance the traffic load and aim to overcome the bottleneck in server access. They cannot, however, solve the performance problems at the application layer of a data center. In this context, H3C application optimization devices are introdced. The H3C devices se advanced connection 7

8 H3C Data Center Soltion management technologies to nload TCP and optimize the end-to-end transmission at the transport layer, take into accont the concrrent processing of SSL, compression, and encryption, largely enhancing the performance of data access to data centers. When connected to clients, the ASE primarily handles and maintains all connections initiated by the clients. For a server, however, the ASE creates a few bt long-standing connections to the server and ses these connections to transmit new data continosly. GET A;GET B;GET C GET A;GET B;GET D GET C;GET D;GET E GET B;GET A;GET D GET C;GET D;GET E GET A;GET B;GET C GET E;GET B;GET C GET F;GET E;GET G GET F;GET A;GET C GET A;GET B;GET C GET C;GET D;GET E Server H3C SecPath ASE series are designed in hardware-based architectres (NP+FPGA) and spport TCP optimization, contents compression, load balancing, and SSL acceleration throgh different bilt-in hardware modles to achieve application acceleration. The H3C ASE relieves data centers from the existing nbearable heavy load and forms an integrated soltion with other prodcts to accommodate the reqirements of data centers. The following figre shows the application scenario of the H3C SecPath ASE. The ASE ses varios algorithms to determine when a new connection to the server shold be set p or when an existing connection shold be contined. The advantages of connection pooling broght by the ASE are as follows: 1) The ASE handles all connections from the clients and the server is not reqired to set p or release connections. 2) The server needs to process only a few TCP sessions after the connection pooling. 3) The ASE shields varios WAN accesses from clients and avoids the impact of server delay, clash, and packet loss on the clients. 4) The ASE sets p a few connections to the server and transmits a large volme of data, maximizing resorce tilization. In addition, the ASE is in the same LAN as the server, which is like relocating clients to the server LAN. This largely redces the delay from clients to the server. The ASE integrates Web acceleration, SSL nloading and acceleration, compression, TCP optimization, load balancing, and anti-ddos attack into a hardware platform, where each fnctional modle is rn by a special hardware chip. The hardware-based acceleration processing technologies are sed to help bsinesses enhance application performance and the performance of a Web server can be enhanced p to 10 times. In addition, the SecPath ASE provides high availability load balancing, rapid and sper intelligent Layers 4 throgh 7 switching, fine interaction control, and other featres to garantee the finest protection to DC s. In a client and server model, the ASE assmes dal roles. For the client, the ASE is a server and for the server, the ASE is a client. The connection and reqest processing mechanism and powerfl processing capability of the ASE enables the ASE to handle peak loads and protects the server against overloads so that the fll potential of the server can be pt into play. SecPath ASE single-arm deployment In the single-arm mode, yo can attach the ASE to a withot changing the original deployment. Users who access the Web server shold first be directed to the ASE and the ASE then sends service reqests to the daemon server. Diagram of the SecPath ASE single-arm deployment 8

9 H3C Data Center Soltion to clients in a rapid and steady manner. Withot load balancing configration at a data center, the servers have neven traffic loads. To handle new service reqests, some already heavily-loaded servers show degraded performance, have longer response time, and even go Down. Other servers may have light loads or remain idle for a long time. As a reslt, the overall performance of the data center is degraded; the resorce tilization is decreased; the overall investment is not garanteed. This deployment does not change the setting and greatly speeds p application operations while ensring application reliability. It also redces maintenance tasks and lowers rotine operation costs. SecPath ASE online deployment In this mode, the ASE is deployed in the front of the server farm to provide application acceleration and load balancing to sers and to enhance the performance of applications. Diagram of the SecPath ASE online deployment After load balancing is configred, the neven task schedling and nreasonable resorce tilization of servers are addressed, and the performance and the overall robstness of the service system improved. The ASE provides sers with an application acceleration path, terminates the connections from remote sers, and performs application acceleration and load balancing. In online deployment mode, the SecPath ASE transparently transmits non-http protocol packets to ensre the normal operation of other services on the servers. Meanwhile, the end sers who access the Web server first have to access the ASE. This protects the end servers from DDoS attacks becase the servers are not directly connected to the Web server. 4. Load Balancing As the heart of service s, data centers are confronted with nmeros challenges. Scalability, flexibility, high performance, reliability, and secrity are all imposed on data centers. It shold be particlarly noted that in the case of an abrpt increase in access reqests, servers are still reqired to transmit applications The SecBlade Load Balance (LB) service modle, a model of high-performance load balancing devices, perfectly combines application optimization with switching devices in an innovative manner. The model featres plg-and-play and strong scalability, redces management complexity, and lowers maintenance costs. By identifying and differentiating varios applications and monitoring the health and performance of servers and firewalls, the SecBlade LB ses the ato-adaptive intelligence algorithms to evenly distribte the application reqests to different devices. This greatly speeds p application access and provides bsinesses and operator s with a cost-effective load balancing soltions with high performance. 9

10 H3C Data Center Soltion Increased nmber of service systems: reqires more devices and servers. The rnning service systems change freqently and the shortage of resorces and devices becomes increasingly intensified. Mass devices and complex deployment: In the trend of high data centralization, the IT infrastrctre inside a DC eqipment room becomes hge. The nmber of devices to be added contines to increase and the deployment complexity grows. Contined rising investment: The scale of IT infrastrctre mltiplies and drives p the costs in the hardware, software, and hman resorces reqired in a data center. Two links or link aggregation grops, which are L3 and L2 links or link aggregation grops, exist between the LB and an aggregation switch. The server gateway is directed to the LB. For the traffic that shold be balanced, the aggregation layer specifies the next hop of the VSIP packets to the LB. The defalt rote of the LB leads to the aggregation switch. High O&M costs and energy consmption: The increased nmber of devices natrally leads to higher costs in energy consmption and O&M, which does not follow the trend of green data centers. Energy consmption already becomes a heavy economic brden in the O&M of a data center. To lower the TCO, data centers shold be integrated. This involves a series of togh problems. Secrity: Secrity shold be garanteed when mltiple services are integrated on the same set of devices. Rational resorce allocation: Different services have different reqirements on the DC resorces and rational resorce allocation mst be ensred for each service. Virtalization addresses these problems by creating one logical entity for mltiple physical entities or creating mltiple logical entities for one physical entity. An entity can be compting, storage,, or application resorces. The essence of viralization is isolation. The virtalization technology isolates different services and blocks their mtal access to ensre the secrity reqirements of services. Virtalization also isolates different service resorces to meet the reqirements of data center resorces by services. The H3C virtalization soltion consists of three parts: III. Virtalization Thanks to continos development of services, freqent pgrade of systems, increasing nmber of devices, and soaring energy consmption, data centers enconter a togh isse to match resorce allocations with service development. Network virtalization Compting virtalization Storage virtalization The combination of DC virtalization and camps virtalization links DC access with the athentication, 10

11 H3C Data Center Soltion secrity check, and dynamic athorization of end sers. This ensres the secrity of and flexible access to a data center. The core switch at the data center serves as the PE of the camps area VPN and the aggregation switch as the corresponding MCE. In this manner, the camps area virtalization is terminated at the data center. Configre VLANs on the access switch at the data center to logically isolate services. Each VLAN is recorded in the corresponding roting table of the MCE. In this manner, the data center virtalization is penetrated to the camps area virtalization throgh the access, aggregation, and core devices at the data center, forming an end-to-end virtalization. The firewall at the data center spports virtalization and can be integrated onto or attached to the aggregation switch to assist virtalization in the virtalization of data center resorces. The highlight of the H3C data center virtalization is the end-to-end virtalization of s, compting, and storage. IV. Storage DC virtalization, client virtalization (EAD), and camps virtalization form the end-to-end virtal access path of H3C s. H3C cooperates with VMWARE, the indstry leader, to realize the virtalization of compting resorces. The H3C adopts the IV5000 series that spport the dynamic expansion of physical disk spaces to implement storage virtalization. In this manner, existing devices can be incorporated in the advanced storage virtalization system. This garantees the existing investment of sers, lowers the TCO, implements the dynamic expansion of storage capacity, and raises the Retrn on Investment (ROI). IP standards have developed into information technology infrastrctre standards. Driven by this irresistible force, standardization, enhanced performance, compactness, and easy availability become the trend of IP storage. All transport technologies applied with IP technologies provide wide application prospects for IP storage. With the combination of the increasingly sophisticated 10GE storage technology and the 10GE transport technology, the IP -based storage technologies is predicted to dominate the integrated data center storage. The H3C fll series IP storage prodcts provide complete data center storage soltions. 1. Integrated Storage Soltion 11

12 H3C Data Center Soltion 10GE access to the servers GE access to the servers soltion allows not only the rapid recovery of historical data bt also avoids data loss or service interrption cased by the hardware failres of online storage devices. 3. Remote Data Backp and Recovery Storage system 10GE GE In this soltion, the 10GE Ethernet switches are bilt pon the IP storage area (SAN). The IP standard platform hosts a variety of servers with bilt-in Ethernet cards. These servers comply with nified standards and operate nder the same management platform. The 10GE prodcts prevails and IP SANs that adopt 10GE Ethernet technologies increase bandwidth and speed p service access. The shared storage of sever farms in particlar, has high reqirements on performance. Driven by these changes, 10GE storage is bond to become the choice in the integrated storage of ftre data center severs. 2. Continos Data Protection Soltion Remote data backp lays a fondation for data disaster recovery. In the remote data backp and recovery soltion, strategic incremental replication is performed to key service data over the IP between the prodction center and the backp center. In case of nexpected disasters in the prodction center, the data can be rapidly recovered from the remote backp center. In remote data replication, the block-based incremental backp technology replicates only the incremental data since the previos replication. The backp data is then compressed throgh the data compression technology before being transmitted. This effectively redces the occpation of WAN resorces. V. Disaster Tolerance In this soltion, the continos data protection (CDP) technology is adopted. Data are effectively protected in the case of any change. Mltiple data copies at different times are saved. The single data copy problem in the traditional one data mirroring or backp mode is ths eradicated. For bsinesses that have high reqirements on service continity, CDP redces the time reqired for data recovery and garantees continos service operations. The near-line CDP soltion allows a storage system to rapidly recover the sond stats of data at a certain point throgh the markp of time points in the system. The online CDP Along with hge benefits, high data centralization also brings in high risks. How to handle and dissolve risks broght by data centralization, how to garantee data secrity in case of disasters, how to ensre service continity, and how to maintain corporate reptation are all problems to be confronted with. The constrction of a disaster tolerance system becomes an rgent task with the increasingly high data centralization. Data center disaster tolerance means activities and procedres designed to recover the falty or collapsed stats of varios application systems in a data center to the normal operation stats. For that prpose, a disaster tolerance center shold be constrcted to replace the main data center for service processing in case of disasters. 12

13 H3C Data Center Soltion A typical disaster tolerance system consists of basic infrastrctre, data backp system, backp processing system, commnications system, and disaster recovery schemes. When designing a disaster tolerance system, yo need to se qalitative disaster recovery capability indexes to measre the goal and level of disaster tolerance. centers can be independently bilt, shared, or leased for the prpose of disaster tolerance. In terms of disaster tolerance, the three centers at two locations model represents the best practice to maximize data protection and service continity in the case of severe regional disasters. Prodction center Local data backp center Remote data backp center Storage system Disaster occrrence Operation recovery System interrption Ethernet switch Ethernet switch Ethernet switch Time Aggregation switch Aggregation switch Aggregation switch Core switch Core switch Core switch Recovery time Aggregation switch Aggregation switch Aggregation switch T1 T2 Core roter Core roter Core roter Remote data backp center Last point of effective data stats Data loss phase Disaster occrrence Time Branches Prodction center Local data backp center Recovery point T0 T1 Recovery Time Object (RTO) refers to the time reqired by an information system to recover the operational stats from a disaster. RTO is sed to evalate the service recovery capability of a disaster tolerance system. VI. Management A data center spports service and office IT services of a bsiness. The sond management of the data center, considered as the heart of the bsiness, is of great importance. Recovery Point Object (RPO) indicates the maximm amont of data lost in a disaster on a service system. RPO is sed to evalate the data redndancy backp capability of a disaster tolerance system. By referring to the traditional FCAPS management model that consists of falt, configration, accont/directory, performance, and secrity managements, H3C incorporates the server/ device management, data storage management, ser management, and log aditing into the data center management RPO and RTO form qalitative disaster recovery objectives that in trn lead to different levels of disaster recovery. The following scheme. The core of H3C data center schemes is the Intelligent Management Center (imc). table shows the relations of disaster recovery capabilities and RTOs/RPOs in a certain indstry. As an important component in the integrated IToIP soltion, imc follows the open service-oriented architectre (SOA) design concept, implements falt alarms, configration management, ser management, topology management, and behavior aditing, and addresses existing problems in secrity, optimization, and operations. Device management The constrction of a data backp center takes data disaster tolerance as the core and focses on service continity to ensre safe prodction and operations. The constrction of data backp centers has three models: local backp center, remote backp center, and the three centers at two locations model. Data backp Unified all-rond management that covers topology, performance, falt, and configration is reqired for -wide servers and devices. H3C imc platform implements converged management on 13

14 H3C Data Center Soltion resorces, sers, and services, provides basic management of resorces, topology, failres, performance, sers, and system secrity. Based on the B/S architectre, the platform can be integrated with other service modles to manage all H3C datacom prodcts and the datacom devices of mainstream vendors sch as Cisco and 3Com throgh MIBs. performance monitoring, and data backp adjstments. Terminal access and ser management Secrity is a top priority in a data center. With the development of technologies, new secrity threats constantly emerge. Virses and worms plage the s with severer effect over wider areas. This leads to collapsed systems and paralyzed s, reslting in hge loss of sers. The secrity stats (mainly the anti-virs capability, patch level, and system secrity settings) of any terminal has a direct impact on the secrity of the entire. Thanks to its dependence on the SOA, the imc jointly coordinates ser terminals and services to perform terminal secrity check, ser athentication/aaa, dynamic access athorization, and ser behavior aditing. Resorce intelligence The imc spports the atomatic discovery of topologies, the nified topology view of all devices on a, and the rapid navigation between views throgh the tree view navigation. The servers are managed throgh the KVM system. As a trend and one of the ltimate objectives in the constantly evolving data centers, intelligent resorce management aims to effectively capitalize pon valable data center resorces for dynamic allocation and maximm otpt. Resorce intelligence is a continosly self-improvement process. With the emergence of new services and applications, the data center architectre always needs to adapt to new reqirements. The data center constrction constantly improves and perfects itself. Smmary The featres of H3C data center soltions are: High secrity, reliability, performance, mlti-services, scalability, heterogeneos convergence, and intelligence management Remote IP sers are connected to the remote monitoring server throgh TCP/IP connections for clock-arond remote access. This enables administrators to rapidly and effectively modify and store services or data and trobleshoot failres on servers. Unified data manager (UDM) soltion In addition to device management, the imc also provides nified management on all H3C storage and prodcts, covering all management processes after the hardware is deployed on a shared data backp. The management extends to the complete processes of atomatic discovery of and storage devices, configration on storage devices, alarm management on the data backp, shared ser management, shared service procedre management, atomatic deployment of shared services, data backp monitoring, As a carrier of core services, a data center is a systematic engineering project. The life cycles of analysis, design, constrction, and O&M shold be defined based on reqirements analysis and service characteristics. In this manner, the data center constrction realizes the objective of optimizing and integrating service procedres, improving operation efficiency, and enhancing competitiveness. Appendix 1 H3C Data Center Prodcts H3C data center soltions consist of five components: 14

15 H3C Data Center Soltion F1.1 Basic platform: The H3C data center connects office sers, compting resorces, and storage resorces throgh GE or 10GE Ethernet links. The architectral reliability (separation of the service and management, modlar design), reliability ( elements, links, and topology redndancy design), and device reliability (carrier-class devices, dal main control boards, and redndancy design of key parts) all contribte to a highly reliable platform. In addition, the good scalability and modlar design of prodcts flly meet the scalability reqirements of the data center architectre. WAN optimization devices are deployed to expand the WAN capacity, redce the response time of applications and decrease protocol interactions. In addition, the priorities of applications are identified and the applications are controlled to ensre the minimm or maximm bandwidth for key applications and control or block non-key (roge) applications. Related prodcts: H3C S12500 roting switch, H3C S9500 roting switch, H3C S7500E/S7500 roting switch, H3C S5600 Ethernet switch, H3C S5500 Ethernet switch, and SECPATH ASE application optimization F1.2 Network secrity: Based on the internal BPDU gard, PVLAN, binding of the qintple information, 802.1X integrated secrity featres, the H3C switches protects Layer 2 data. The firewalls protects data at the layer whereas the Intrsion Prevention System (IPS) provides deep data secrity protection at the application layer. Based on the management platform of mlti-service secrity access, the Comprehensive Access Management Server (CAMS) and H3C switches, roters, and VPN gateways can be deployed in the same ing to manage, athenticate, athorize, and charge the broadband, VPN, wireless, and IP telephony access of sbscribers. The SecCenter A1000 intelligence secrity management center can atomatically collect and analyze the mass secrity events and logs on the entire and then perform high aggregation storage and assimilation to the collected data. The device is compatible with devices of several vendors over a heterogeneos and monitors the secrity stats of an entire in real time. Meanwhile, it can atomatically generate convincing secrity stats and policy compliance aditing reports based on different reqirements. Related prodcts: H3C SecBalde I/II, IPS, ACG series, H3C SecPath series firewalls or VPN prodcts, SecCenter, and H3C Endpoint Admission Defense (EAD) F1.3 Data storage: stores and back p centralized data. As a pioneer in the IP storage, H3C ses the all IP architectre to combine the storage with the front-end, bilding the homogeneos IT infrastrctre. This architectre featres flexibility, openness, sharing, high performance, and low cost. Related prodcts: H3C Neocean IV5000 series prodcts F1.4 Data management: implements the virtalization management, resorce debgging, and operation management of data. H3C data center soltion allows the harmonios existence of IP storage and FC storage prodcts of different vendors. This allocates resorces for nified sage and eradicates the heterogeneity problem. In addition, the H3C data center soltion has good scalability, redces maintenance complexity, and lowers costs. Related prodcts: H3C Neocean IV5100 virtalization data management prodct, H3C Neocean IV5200virtalization data management prodct, and H3C DM data management platform F1.5 Data backp and recovery: The objective of bilding a remote or local data backp center is to avoid the nrecoverable loss of original data de to small probability events sch as disasters. In this manner, important service data are protected in case of disasters and can be recovered within the set time to ensre service continity. <The rapid data recovery capability frther enhances the corporate reptation, boosts the confidence of cstomers and potential cstomers, and gains an edge over competitors. Related prodcts: H3C S9500 roting switch, H3C SR8800 service roter, H3C Neocean IX5000 IP SAN storage prodcts, H3C Neocean IX1000 IP SAN storage prodcts, H3C Neocean IV5100 virtal data management prodcts, H3C Neocean IV5200 virtal data management prodcts, and H3C SecPath series firewalls/vpn prodcts 15

16 H3C Data Center Soltion Appendix 2 List of Key Users Shanghai data center of the Agricltral Bank of China Shanghai disaster recovery center of the Bank of China Server farm data center at the China Constrction Bank headqarter Data center at Shandong Rral Credit Cooperatives Zibo Commercial Bank Local backp center at Hishang Bank Data center of Anbang Property & Casalty Insrance Company Ltd. Baid data center Soh data center NetEase data center IDC at Shanghai Zhangjiang High-Tech Park Development Co., Ltd. Sothern data center of the Chengd mnicipal government E-government data center of Nanshan District, Shenzhen Data center at Szho Branch of Haxia Bank Data center at the Ministry of Personnel of the PRC Information sharing system at the Ministry of Science and Technology of PRC The United front Work Department of CCCPC State Administration for Indstry & Commerce of the PRC 16