Unleash the power of Cisco ACI and F5 Synthesis for Accelerated Application deployments. Ravi Balakrishnan Senior Marketing Manager, Cisco Systems

Transcription

1 Unleash the power of Cisco ACI and F5 Synthesis for Accelerated Application deployments Ravi Balakrishnan Senior Marketing Manager, Cisco Systems

2 Cisco F5 Solutions Outline Cisco and F5 Areas of Partnership and Integration Cisco ACI + F5 Integration Overview Cisco Nexus F5 LTM Design Overview Cisco SourceFire NGIPS + F5 LTM integration F5 Networks, Inc Confidential Under NDA only 2

3 F5 and Cisco are now Partners! Cisco - Leader in Networking and F5 - Leader in ADC partnering to provide: Deep technology integrations across all L2-L7 network services Simplified data center and cloud rollouts Comprehensive application-centric policy framework and enforcement Intelligent services orchestration Cisco ACI Launch Nov 13 High Performance application delivery and security Fabric Extensible platform supporting future service growth and needs Accelerated application deployments F5 Networks, Inc Confidential Under NDA only 3

4 F5 and Cisco Partnership Partnering to integrate F5 Synthesis architectural framework into the Cisco (ACI) Sharing a common vision for simplifying networking end to end by taking an applicationcentric policy-driven approach Joint testing for VMDC2.3 for traditional data center deployments F5 LTM tested with Nexus ACE customers can migrate to F5 utilizing VMDC2.3 guidance Exploring additional opportunities to bring joint solutions to Data Center customers Discussions underway to integrate RISE (Nexus 7000) and vpath (Nexus 1KV) technologies Partnering to integrate F5 LTM with Cisco sourcefire NGIPS F5 and Cisco Sourcefire enhance security posture and improved operational efficiency F5 Networks, Inc Confidential Under NDA only 4

5 Application Centric Infrastructure (ACI) Vision Rapid Deployment of Applications onto Networks with Scale, Security and Full Visibility NEXUS 9500 AND 9300 APPLICATION CENTRIC POLICY CONTROLLER ACI

6 The Benefit of Application Centric Policy Application Centric Infrastructure (ACI) allows the entire infrastructure to take commands in a business-relevant language. Policy = The Business-Relevant Commands that Drive Infrastructure Automation ACI Process Let my app servers talk to my web servers. Existing Process 1. Figure out where app lives in physical net 2. Trunk VLAN 112 to switch Add route. 4. Plumb ports Configure ACL 6. Apply QoS 7. Repeat every time app moves or needs more capacity F5 Networks, Inc Confidential Under NDA only 6

7 APPLICATION CENTRIC POLICY MODEL F/W ADC WEB APIC ADC APP DB Physical Networking Hypervisors and Virtual Networking L4 L7 Services Multi DC WAN + Cloud Storage Compute

8 FASTER APP AVAILABILITY SIMPLIFIED OPERATIONAL PROCESSES + AUTOMATION Business Agility POLICY AUTOMATION APPLICATION POLICY LANGUAGE COMMON POLICY FRAMEWORK AND PLATFORM FOR ALL IT TEAMS APIC STORAGE SECURITY F/W ADC L/B WEB ADC L/B APP DB APIC COMPUTE NETWORK APPLICATION CLOUD Service Request ARCHITECT DESIGN COMPUTE STORAGE SECURITY NETWORK Application Available TIME Cisco Confidential 8

9 F5 and Cisco ACI Joint Solution Benefits F5 DEVICE PACKAGE FOR APIC Automated layer 4-7 application service insertion, policy updates, and optimization within the ACI-enabled fabric with BIG-IP -Preserves richness of F5 Synthesis offering through policy abstraction offering investment protection ACI Fabric Programmability (irule / iapp / icontrol) Data Plane Control Plane Management Plane F5 Synthesis Fabric Accelerated application deployments with reliability, security and consistent scalable network and L4-L7 services - Existing F5 Physical and Virtual appliances, topologies integrate seamlessly with Cisco ACI Application agility using policy driven application delivery approach to significantly reduce operating costs - Provisioning workflows is efficient and faster while maintaining operational best practices across multiple IT teams Virtual Edition Appliance Chassis F5 Networks, Inc Confidential Under NDA only 9

10 Application Provisioning in Today s Data Centers App x TENANT (HR) L4-L7 NETWORK CONNECTIVITY COMPUTE + VM STORAGE L4-L7 App p TENANT (FINANCE) L4-L7 NETWORK CONNECTIVITY COMPUTE + VM STORAGE L4-L7 Lacks application agility - requires provisioning across different layers by different organizations Time to operationalize purchased assets is longer due to inefficient provisioning App y App z NETWORK CONNECTIVITY COMPUTE + VM STORAGE L4-L7 NETWORK CONNECTIVITY COMPUTE + VM STORAGE App q App r NETWORK CONNECTIVITY COMPUTE + VM STORAGE L4-L7 NETWORK CONNECTIVITY COMPUTE + VM STORAGE Longer time to deploy Applications with scale and security Harder to achieve application elasticity F5 Networks, Inc Confidential Under NDA only 10

11 Challenges with Network Service Insertion Router Configure Network to insert Firewall FW Configure firewall network parameters Service insertion takes days vfw Router Switch LB Configure firewall rules as required by the application Configure Load Balancer Network Parameters Configure Router to steer traffic to/from Load Balancer Network configuration is time consuming and error prone Difficult to track configuration on services Server Service Insertion In traditional Networks Configure Load Balancer as required by the application F5 Networks, Inc Confidential Under NDA only 11

12 Acentric infrastructure USING the language of apps in the network F5 DEVICE PACKAGE FOR APIC Application Agility Any where, Any time, Physical and Virtual Rapid Deployment of Applications with Scale and Security DB PHYSICAL NETWORKING HYPERVISOR HYPERVISOR HYPERVISOR WEB WEB WEB APP WEB APP WEB HYPERVISORS AND VIRTUAL NETWORKING COMPUTE L4 L7 SERVICES STORAGE DB MULTI DC WAN & CLOUD DB Application-centricity to Visibility and Troubleshooting Open Source Application Policies Common Operational Model through Open APIs BIG-IP PHYSICAL AND/OR VIRTUAL ACI slide Source: Cisco F5 Networks, Inc Confidential Under NDA only 12

13 Web App DB Outside (Tenant VRF) QoS Filter QoS Service QoS Filter APIC ACI Fabric Non-Blocking Penalty Free Overlay Application Policy Infrastructure Controller

14 Application Extend the principle of Cisco UCS Manager service profiles to the entire fabric Storage Storage Network profile: stateless definition of application requirements Web Tier App Tier DB Tier Application tiers Connectivity policies Layer 4 7 services XML/JSON schema Fully abstracted from the infrastructure implementation Removes dependencies of the infrastructure Portable across different data center fabrics The network profile fully describes the application connectivity requirements ## Network Profile: Defines Application Level Metadata (Pseudo Code Example) <Network-Profile = Production_Web> <App-Tier = Web> <Connected-To = Application_Client> <Connection-Policy = Secure_Firewall_External> <Connected-To = Application_Tier> <Connection-Policy = Secure_Firewall_Internal & High_Priority>... <App-Tier = DataBase> <Connected-To = Storage> <Connection-Policy = NFS_TCP & High_BW_Low_Latency>...

15 Providers Service Profile Service Graph Elastic service insertion architecture for physical and virtual services Helps enable administrative separation between application tier policy and service definition APIC as central point of network control with policy coordination Application Admin App Tier A Web Server Web Server Policy Redirection Chain Security 5 App Tier B App Server Web Server Automation of service bring-up / tear-down through programmable interface Supports existing operational model when integrated with existing services Service enforcement guaranteed, regardless of endpoint location Service Admin begin Security 5 Chain Defined Stage 1 inst inst.... Stage N inst inst end N+1 scale of cluster capable service nodes Firewall Load Balancer

16 Service Automation Through Device Package ACI + F5 Deployment F5 Device Package Device Package contains Policy Engine APIC provides extendable policy model through Device Package Configuration Model (XML File) Python Scripts APIC Policy Manager Configuration Model (XML File) Script Engine APIC Script Interface Python Scripts APIC Script Interface Device Package contains XML file defining Device Configuration Model Provider Administrator can upload a Device Package Device scripts translates APIC API callouts to device specific callouts BIG-IP F5 has rich programmability foundation - easier to integrate with Cisco APIC F5 Networks, Inc Confidential Under NDA only 16

17 Understanding Device Package A Device Package is a zip file containing two parts Device Specification Is an XML file that defines Functions provided by a device Like Load Balancing, Content- Switching, SSL termination etc Parameters required for configuring each use case ex: L4 SLB Interfaces and Network connectivity information for each function within the use case Device Script The integration between the Cisco APIC and a Device is performed by a Device Script (in Python) Cisco APIC programs the BIG-IP by invoking function calls defined in the device package. F5 Networks, Inc Confidential Under NDA only 17

18 F5 Use cases Target for APIC FCS Virtual Server Function Profiles Layer 4 Server Load balancing with SSL Off load Layer 7 Server Load balancing with SSL off load HTTP SLB FTP SLB SMTP SLB Microsoft SharePoint Parameters/Folders under each function Configuring Global and Tenant Self IP addresses Configuring Global and Tenant static routes Server Pools TCP Optimizations (WAN/LAN/Mobile) HTTP optimization HTTP Security (Application protocol security) TCP connection multiplexing (One Connect) Validators and Creation of tenant OneConnect profiles irules Validators and Creation of tenant acceleration profiles SNAT Pool management More than 80% of F5 customers use L4 SLB / L7 SLB with SSL off load, MSFT SharePoint hence 1st release targets these use cases F5 Networks, Inc Confidential Under NDA only 18

19 Defining Policy Model for an Application in a Tenant - APIC TENANT (HR) Traditional 3-Tier Application F/W ADC WEB WEB WEB WEB ADC APP APP APP APP DB DB DB DB APPLICATION NETWORK PROFILE APPLICATION PROFILE (3 TIER APP) EPGS ARE DEFINED HERE End Point Group (EPG) collection of bare metal servers, VMs, vnic Ex: WEB EPG - all web servers (bare metal or VMs) are grouped into this EPG Ex: APP EPG - all APP servers (bare metal or VMs) are grouped into this EPG NETWORKING POLICY (CONNECTIVITY FOR THE TENANT L2-L3) SECURITY POLICY (DEPLOYMENT OF A GRAPH IS DONE HERE) FILTERS WHICH EPG CAN TALK TO WHICH OTHER EPG Contract services between the WEB and APP EPG (web graph, HTTP graph) Graph can be single graph or muti graph Ex: APP is a provider and WEB is the consumer Define services within a contract: FW, ADC in this example ADC defined TROUBLESHOOTING POLICY SPAN, ERSPAN ETC MONITORING POLICY (EVENTS, SNMP ETC) L4-L7 SERVICES POLICY (CREATION OF A GRAPH IS DONE HERE) Service Graph (Ex: WEB graph utilizes L4 SLB) Device cluster F5 Networks, Inc Confidential Under NDA only 19

20 Where does F5 fit in the Application Policy Multi Tenants? Tenant (HR) Tenant (SALES) Tenant (Finance) App X L4-L7 services: WEB graph uses L4 SLB Attach service graph to contract between EPGS App Y App P L4-L7 services: HTTP graph uses L4 SLB Attach service graph to contract between EPGS App Q App M L4-L7 services: HTTP graph uses L4 SLB Attach service graph to contract between EPGS App N App Z App R App O BIG-IP (Physical or Virtual) Single BIG-IP instance supports TRUE Multi Tenancy with Traffic Isolation Supports single or multi tenants with single or multi graph scenarios F5 Networks, Inc Confidential Under NDA only 20

21 Benefits of using F5 Device Package F5 Synthesis value proposition is preserved in Cisco ACI Cisco ACI allows F5 to bring the value to ACI instead of normalizing across vendors F5 is a seamlessly integrated with Cisco ACI Preserves existing BIG-IP deployment topologies and L2-L3 interoperability no network redesign No HW upgrades needed on BIG-IP - no net new $$$ spending Flexibility in rolling out L4-L7 services on F5 fabric with APIC F5 Application policy framework aligns seamless with APIC policy framework Accelerated application deployments - Provides true application centric solution using profile based approach Portfolio of services combining application delivery and security Extensible to other L4-L7 services to address application requirements - GTM, AAM, AFM, APM, ASM Deep application performance visibility (future) Extensive application health score data Device package can integrate applications health score data from BIG IP F5 Networks, Inc Confidential Under NDA only 21

22 ACI Delivering Business Outcomes Lower Costs/TCO Cisco ACI is an open*, future-proofed data center architecture that can continue to grow as we enhance client services. Chuck Crane Network and Security Architect, Axciom (Transitioning from AWS to Private Cloud) Greater Business Agility Lower Capital Expenses Cisco s open* standards approach makes ACI even stronger. We conducted testing on ACI it fully delivered everything we expected, and proved to be quite stable and mature. Nik Weidenbacher Principal Engineer, SunGard Reduced Costs/ Complexity This will enable Telstra to deliver service agility, security and performance that our customers expect from an enterprise grade cloud. Erez Yarkoni Executive Director, Telstra Lower Operating Cost Resource Optimization 58 % Reduce Network Provisioning 25 % CAPEX Reduction 21 % Reduce Management Costs 45 % Reduce Power and Cooling Costs % Compute and Storage Optimization Source: Cisco IT * 4/2014 Cisco announced Opflex a standards track southbound protocol for integration of ACI with a broad ecosystem of L4-7 Services. Opflex was coauthored by: Microsoft, Citrix, IBM, and Sungard Availability Services

23