Copyright 2016 EMC Corporation. All rights reserved.

Transcription

1 1

2 DISASTER RECOVERY (DR) WITH NSX AND SRM ABHISHEK TIWARI JOHN WHITMAN NSBU PRODUCT MANAGEMENT,

3 AGENDA 1 Traditional Disaster Recovery 2 Disaster Recovery with NSX and SRM 3 Solution Overview 4 Demonstration 5 Q & A 3 3

4 TRADITIONAL DISASTER RECOVERY 4

5 TRADITIONAL DISASTER RECOVERY INFRASTRUCTURE CHALLENGES: COMPUTE, NETWORKING AND STORAGE WAN / Internet WAN / Internet Storage Compute Network We b D B App We b D B App Deployment/Recovery Manual, Complex, Error Prone Deployment/Recovery Automated and Reliable Deployment/Recovery Automated and Reliable We b D B App We b D B App Network Compute Storage 5 5

6 TRADITIONAL DISASTER RECOVERY INFRASTRUCTURE CHALLENGES: SITE CONNECTIVITY Protected WAN / Internet Complex and Expensive DCI at the WAN Edge Recovery WAN / Internet Network Fabric Recreate FW, LB Policies Recreate L3 Recreate L2 (Re-IP/Preserve IP Space) Network Fabric V M V M V M / /24 V M V M V M V M V M V M /24 Data Center Interconnect (DCI) /24 V M V M V M V M V M V M /24 (VPLS, Overlay Transport, L2 Extensions) /24 V M V M V M 6 6

7 TRADITIONAL DISASTER RECOVERY WAN / Internet Networking and Security Policies Network Network Admin Recovery Plan Scripts/APIs/Tools Recovery Management? Compute and Storage Recovery Policies We b D B App We b D B App Compute Compute/Virtualization Admin Recovery Plan Scripts/APIs/Tools Storag e 7 7

8 NEW APPROACH TO DR WITH NSX AND SRM 8

9 VSPHERE SITE RECOVERY MANAGER (SRM) COMPONENTS Required at both protected and recovery sites vcenter Server Virtual Machines Site Recovery Manager Site Recovery Manager Manages recovery plans Automates failovers and failbacks Tightly integrated with vcenter and replication Compute Storage Networking? VMware vsphere Servers Storage Replication Options vsphere Replication Part of vsphere platform Replicates virtual machines between vsphere clusters Storage-Based Replication (3 rd party) Provided by replication vendor Integrated via replication adapters created, certified and supported by replication vendor 9 9

10 APPLYING BENEFITS OF NETWORK VIRTUALIZATION TO DR Virtual Virtual Network Operations 1. Decouple 2. Reproduce 3. Automate Physical Physical Build the recovery site independent of protected Site (Equipment and Topology) Recreate Application Networking and Security decoupled of underlying infrastructure Cloud Operations Automate the entire recovery process with APIs, vro and other tools 1 10

11 DISASTER RECOVERY WITH SRM + NSX Protected Site Recovery Site NSX Manager vcenter Server SRM NSX Manager vcenter Server SRM NSX NSX vsphere vsphere Storage Storage 1 11

12 DISASTER RECOVERY NSX + SRM ACTIVE-STANDBY APPLICATION PAIR Site Local N-S Site Local N-S WAN/Internet Protected Site Active N-S Stand-by N-S Recovery Site VC+SRM SRM Pair VC+SRM Cross-vC NSX DB We b DB We b App Active-Standby Application Pair App Local Storage Replicated Local Storage 1 12

13 SUPPORTED FAILOVER SCENARIOS PARTIAL FAILOVER, STRETCHED DEPLOYMENT, FULL FAILOVER N-S Connectivity WAN/Internet N-S Connectivity vcenter-a We b App DB Full App Failover or Site Failure We b App DB vcenter-b DB App We b App We b SRM Partial Failover or Planned Migration SRM <150ms Local Storage Local Storage 1 13

14 DR WITH NSX AND SRM SOLUTION OVERVIEW 14

15 COMPONENTS SRM vsphere 6.0 NSX 6.2 SRM 6.0 or

16 CROSS VCENTER NSX (6.2) Universal Object Configuration (NSX UI & API) Universal Synchronization Service Universal Controller Cluster USS USS USS vcenter & NSX Manager A Primary vcenter & NSX Manager B Secondary vcenter & NSX Manager H Secondary Local VC Inventory Local VC Inventory Local VC Inventory Universal Distributed Logical Router Universal Logica Switches Universal DFW L3 Network/IP Fabric 1 16

17 CROSS VC NSX EGRESS OPTIMIZED ROUTING ROUTING WITH LOCALE-ID Site A L3 Networ k Site B Site A NSX Edge GW Uplink Net A vcenter Server Route Updates with Locale ID Uplink Net B Site B NSX Edge GW vcenter Server Control VM w/ Local Egress VM1 VM 2 Locale ID: NSX-A Universal Distributed Logical Router Universal Logical Switch A VM3 Control VM w/ Local Egress Locale ID: NSX-B Cross vcenter Local Egress with Locale-ID 1 17

18 DESIGN CONSIDERATION Partial Failover (VM1 Fails) Use the Existing N-S from Protected Site Cost of cross site link traversal is generally low N-S Stateful Services continue work No rerouting or specific route advertisement Zero touch partial failure/planned migration Protected Site /29 Recovery Site NSX ESG NSX ESG Full Failover (VM1, VM2 Fails) Use the Recovery Site N-S Egress Localization managed through NSX Locale-ID Ingress Managed through Route Advertisement with Prefix List (or GSLB) U-LS VM2 VM1 myapp.com U-DLR /29 Failed over VM1 VM2 1 18

19 WHAT ABOUT /32 (PER VM) ROUTE ADVERTISEMENTS? In most scenarios complexity outweigh the benefits Requires route re-advertisement triggers based on per VM failover (vmotion) Not currently supported in the product requires external scripting Works in Private Networks only (/32 advertisement on a SP Network may not be possible) If there is still a need for a solution supporting /32 Example scripts available (unsupported) 1 19

20 DEPLOYMENT OPTION 1 NSX + SRM FAILOVER USING LOCAL EGRESS FOR PARTIAL APP FAILURE AND FULL SITE FAILOVER 20

21 DR WITH NSX+SRM: INITIAL SET-UP Protected SR M Active N-S U-DLR Control VM Allow prefix list: Web, App, DB Subnet U-DLR Control VM Deny prefix list: Web, App, DB Subnet Stand-by N-S SR M Recover y Local Egress Enabled Local Egress Enabled Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS Universal Control VM Locale-ID Set to Protected Site Web App DB Web App DB Locale-ID Set to Protected Site 2 21

22 DR WITH NSX+SRM: PLANNED MIGRATION/PARTIAL FAILURE Protected SR M Active N-S U-DLR Control VM Allow prefix list: Web, App, DB Subnet U-DLR Control VM Deny prefix list: Web, App, DB Subnet Stand-by N-S SR M Recovery Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS Universal Control VM Universal Logical Switch Web App DB Web App DB 2 22

23 DR WITH NSX+SRM: COMPLETE APPLICATION FAILURE Restored N-S Protected SRM Active N-S U-DLR Control VM Deny prefix list: Web, App, DB Subnet U-DLR Control VM Allow prefix list: Web, App, DB Subnet Stand-by Active N-S N-S SRM Recovery App reachability no longer advertised Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS DB Web App DB Universal Control VM Universal Logical Switch Locale-ID Set to Recovery Site 2 23

24 DEPLOYMENT OPTION 2 NSX + SRM FAILOVER USING DYNAMIC ROUTING 24

25 DR WITH NSX+SRM: INITIAL SET-UP Protected Active N-S Stand-by N-S Recovery SRM Edge Services GW (ESG) Routing: BGP Weight 10 OSPF Cost 1 Edge Services GW (ESG) Routing: BGP Weight 1 OSPF Cost 10 SRM Local Egress NOT Enabled Local Egress NOT Enabled Universal Control VM Universal DLR Web U-LS App U-LS DB U-LS Web App DB Web App DB 2 25

26 DR WITH NSX + SRM: ESG/UPSTREAM FAILURES Protected SRM Active N-S Edge Services GW (ESG) Routing: BGP Weight 10 OSPF Cost 1 Route Updates Edge Services GW (ESG) Routing: BGP Weight 1 OSPF Cost 10 Stand-by N-S SRM Recover y Local Egress NOT Enabled Local Egress NOT Enabled Universal Control VM Universal DLR Web U-LS App U-LS DB U-LS Web App DB Web App DB 2 26

27 FAILOVER OPTIONS: LOCAL EGRESS VS. DYNAMIC ROUTING Deployment Model Benefits Disadvantages Failover using Dynamic Routing Dynamic Routing detects ESG/upstream failures Automatic network failover (via Routing Updates) Purely Active/Passive for North-South traffic Requires Control-VM redeployment in the event of an infrastructure failure Failover using Local Egress Granular/Controlled Failover (per network) Provides opportunities for automation triggered by compute operations/dr Orchestration Control VM doesn t need to be redeployed (already provisioned at recovery site) Requires Additional Configuration (Control VM, Local Egress) Not fully automatic in the event of upstream network or site failures Route redistribution or Locale-ID changes required to failover routing The best fit depends on customer requirements, but the general recommendation is to use Dynamic Routing based failover where possible Network outages are more likely than primary site failure CONFIDENTIAL 2 27

28 NSX + SRM INGRESS TRAFFIC REDIRECTION WITH GSLB 28

29 DR WITH NSX+SRM WITH GSLB Protected Site m VIP: (Primary) IP: Protected Site Local Router Active N-S DNS Queries DR Site GSLB m VIP: (Post DR) Stand-by N-S Site Local Router IP: Recovery SRM SRM Primary NSX Manager NSX ESG Transit VLAN U-DLR LIF Web-VIP: (SNAT: ) Web-VIP: (SNAT: ) Transit U-LS Transit U-LS Universal DLR Transit VLAN NSX ESG Secondary NSX Manager Universal Control VM Web U-LS App U-LS DB U-LS / / /24 Universal Control VM U-DLR LIF Web App DB Web App DB Web-VM IP: Placeholder Web-VM IP:

30 SITE FAILURE AND RECOVERY STEPS 1 Primary NSX Manager or Universal Controller Cluster extended outage VC with NSX Manager Secondary Primary Universal Controller Cluster 6 Recover old Primary NSX Manager as a Secondary Promote existing Secondary to Primary -Sync the Config from New Manager to Controller 2 4 Universal Controller Cluster VC with NSX Manager Secondary Primary 3 Deploy new Universal Controller Cluster No Data Plane Impact* Universal Control VM Universal CC config pushed to ESXi Hosts managed by Secondary Universal DLR 5 Deploy Control VM -Not needed for Local Egress Universal Control VM No Data Plane Impact* CONFIDENTIAL 3 30

31 SRM INTEGRATION AUTOMATED RESOURCE MAPPING Before NSX SRM 6.1 Integration After NSX SRM 6.1 Integration 3 31

32 DR AUTOMATION Cross vcenter NSX Synchronizes Logical Networks No Automation Needed L2, L3, Firewall/Security Security Groups with Dynamic Membership, Security Tags vro based automation may be an option What about N-S Edge Service Gateway? Not synchronized between Primary and Secondary NSX N-S Components are site specific (Physical Connectivity etc) NSX Components Recovery (Complete Site Failure) Manual Recovery or APIs or vro Workflows Doesn t impact the RTO 3 32

33 SUMMARY: NSX VS. TRADITIONAL DR SOLUTIONS Traditional DR Solutions Tied to Physical Infrastructure (Primary/DR) Address preservation in the Physical Infrastructure Requires L2 extension to preserve IP addressing Manual DR Set-up and Run book No integration with Compute/Storage NSX Decoupled from Physical Infrastructure Logical Networks preserve IP Addressing Overlay networks with distributed L2, L3 and Firewall API based DR and Run book Automation Integration/Validation with Vmware SRM 3 33

34 DEPLOYMENT WALKTHROUGH AND DEMO 34

35 DR WITH NSX+SRM: INITIAL SET-UP Protected Site Active N-S Stand-by N-S Recovery Site Site Local Router Site Local Router SRM SRM U-DLR LIF U-DLR LIF Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS Universal Control VM Universal Logical Switch Web Locale-ID Set to Protected Site App DB Web App DB Locale-ID Set to Protected Site 3 35

36 INITIAL CONFIG WALKTHRU NSX BASE INSTALL 3 36

37 INITIAL CONFIG WALKTHRU NSX PREPARED CLUSTERS 3 37

38 INITIAL CONFIG WALKTHRU UNIVERSAL LOGICAL SWITCHES 38

39 INITIAL CONFIG WALKTHRU AUTO CROSS SITE PORTGROUP CREATION 3 39

40 DR WITH NSX+SRM: SET-UP CONFIGURED Protected Site Active N-S Stand-by N-S Recovery Site Site Local Router Site Local Router SRM SRM NSX Edge (Advertising reachability) NSX ESG U-DLR LIF U-DLR LIF Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS Universal Control VM Universal Logical Switch Web Locale-ID Set to Protected Site App DB Web App DB Locale-ID Set to Protected Site 4 40

41 INITIAL CONFIG WALKTHRU DEPLOYING U- DLR CONTROL VMS 4 41

42 INITIAL CONFIG WALKTHRU NSX UNIVERSAL DISTRIBUTED FIREWALLING 4 42

43 DR WITH NSX+SRM: SET-UP CONFIGURED Protected Site SRM Active N-S Site Local Router Site Local Router Stand-by N-S SRM Recovery Site NSX Edge (Advertising reachability) U-DLR LIF NSX ESG U-DLR LIF Universal DLR Universal Control VM Web U-LS App U-LS DB U-LS Universal Control VM Universal Logical Switch Web Locale-ID Set to Protected Site App DB Web App DB Locale-ID Set to Protected Site 4 43

44 INITIAL CONFIG WALKTHRU SRM CONFIG 4 44

45 Initial Config Walkthru SRM Config 4 45

46 Physical Design Initial Flow Mgmt IP: ToR-Protected ToR-Recovery Mgmt IP: Physical Network / / 28 Protected Site OSPF Backbone Area 0 VLAN 1020 VLAN 1010 OSPF Backbone Area 0 Recovery Site / / 28 Protected Perimeter ESG Recovery Perimeter ESG Proto Add: OSPF Normal /29 Proto Add: Area /29 /29 /29 OSPF Normal Area 51 UDLR - Control VM Web / /29 App Universal Distributed Logical Router Universal DLR /29 Web DB App UDLR - Control VM2 DB Universal Web Logical Switch /29 Universal Database Logical Switch Universal Application Logical Switch 46

47 Physical Design Stretched Application Mgmt IP: ToR-Protected ToR-Recovery Mgmt IP: Physical Network / / 28 Protected Site OSPF Backbone Area 0 VLAN 1020 VLAN 1010 OSPF Backbone Area 0 Recovery Site / / 28 Protected Perimeter ESG Recovery Perimeter ESG Proto Add: OSPF Normal /29 Proto Add: Area /29 /29 /29 OSPF Normal Area 51 UDLR - Control VM / / /29 DB Universal DLR Web App UDLR - Control VM2 DB Universal Web Logical Switch Universal Database Logical Switch Universal Application Logical Switch 47

48 Physical Design Complete Application Failure Mgmt IP: ToR-Protected ToR-Recovery Mgmt IP: Physical Network / / 28 Protected Site OSPF Backbone Area 0 OSPF UP OSPF Backbone Area 0 Recovery Site / / 28 Protected Perimeter ESG Recovery Perimeter ESG Proto Add: OSPF Normal /29 Proto Add: Area /29 /29 /29 OSPF Normal Area 51 UDLR - Control VM Web / /29 /29 DB App Universal DLR Web App UDLR - Control VM2 DB Universal Web Logical Switch /29 Universal Application Logical Switch Universal Database Logical Switch s Set Locale-ID to Recovery Site 48

49 4 49

50 TAKEAWAYS NSX simplifies Disaster Recovery NSX and SRM Integration SDDC Approach to DR Cross vc Networking and Security with NSX 6.2 No need for an expensive WAN Edge Connectivity for Applications DR Runbook automation with vro 5 50

51 51

52 52