Cisco ACI integration with F5 Big-IP Appliances

Transcription

1 Cisco ACI integration with F5 Big-IP Appliances Jan Van den Broeck Systems Engineer Data Center CCIE #18985

2 Agenda Cisco and F5 partnership Cisco ACI and F5 Big-IP Integration ACI and F5 Customer Quotes and Competitive Differentiations Cisco Confidential 2

3 Cisco and F5 are now partners Announcement at Cisco ACI launch in November 2013 Cisco and F5 partnering to provide: Deep technology integrations across L2-L7 network services to accelerate application deployments Simplified data center and cloud rollouts Comprehensive application-centric policy framework and enforcement Intelligent services orchestration High Performance application delivery and secure Fabric Extensible platform supporting future service growth and needs Cisco Confidential 3

4 Challenges with Network Service Insertion Router Configure Network to insert Firewall Firewall Configure firewall network parameters Service insertion takes days Virtual Firewall Router Switch Load Balancer Configure firewall rules as required by the application Configure Load Balancer Network Parameters Configure Router to steer traffic to/from Load Balancer Network configuration is time consuming and error prone Difficult to track configuration on services Server Service Insertion In traditional Networks Configure Load Balancer as required by the application Cisco Confidential 4

5 From today s model to a Policy Driven Fabric App 1 App 2 App 3 The policy driven fabric model first abstracts network constructs, removing complexity, then drives infrastructure based on application needs. App 1 Complexity App 2 App 3 Network Cisco Confidential 5

6 Policy Driven Fabric Web App DB Web App App 1 2 DB Web App App 3 DB Network Rather than looking at the applications as individual network end-points, policy is driven viewing the application as a whole; the grouping of end-points and connectivity policies that makes up an application or service. Cisco Confidential 6

7 Application Network Profile Web App DB Outside (Tenant VRF) QoS Filter QoS Load Balance QoS Filter Stateless ACI Fabric APIC Non-Blocking Penalty Free Overlay Application Policy Infrastructure Controller Cisco Confidential 7

8 IP fabric with integrated overlay ACI Spine Nodes IP unnumbered 40G fabric VTEP Loopback and VTEP IP addresses allocated from infra VRF through DHCP from APIC and advertised throug IS IS ACI Fabric provides: Simplified Architecture Zero-touch-deployment Integrated overlay Decoupling Identity from Location providing any workload anywhere Auto bind the overlay tunnels Innovative Load Balancing : Flowlet Switching Fast Restoration VXLAN IP Payload VTEP VTEP VTEP VTEP VTEP VTEP APIC APIC APIC APIC Cluster ACI Leaf Nodes ACI Controller Cisco Confidential 8

9 Universe.. Tenant A Tenant B App Profile App Profile Web Tier App Tier DB Tier Application Admin External Zone EPG APPLICATION EPG DMZ Trusted Zone DB Tier Security Admin SECURITY Network Admin Cisco Confidential 9

10 Any workload Virtual / Bare Metal / Container APIC Network Admin APIC ACI Fabric Integrated gateway for VLAN, VxLAN, and NVGRE networks from virtual to physical to container Normalization for NVGRE, VXLAN, VLAN VXLAN VLAN NVGRE VLAN VXLAN VLAN VXLAN VLAN and VLAN networks Customer not restricted by a choice of hypervisor Fabric is ready for ANY workload VMware Microsoft Red Hat Docker ESX VMware Hyper-V Microsoft KVM Red Hat Container Docker PHYSICAL SERVER Application Admin Application Management Cisco Confidential 10

11 ACI : Open APIs with a Large Ecosystem Automation Hypervisor Management Enterprise Monitoring Systems Management Orchestration Frameworks OVM REST API NORTHBOUND PROGRAMMABILITY LAYER APIC Fabric-attached Device API L4-7 Orchestration Scripting API SOUTHBOUND PROGRAMMABILITY LAYER APIC SUPPORTS A RICH ECOSYSTEM BUILT AROUND OPEN NORTHBOUND AND SOUTHBOUND APIS Cisco Confidential 11

12 Elastic service insertion architecture for physical and virtual services Helps enable administrative separation between application tier policy and service definition APIC as central point of network control with policy coordination Automation of service bring-up/tear-down through programmable interface Supports existing operational model when integrated with existing services Service enforcement guaranteed, regardless of endpoint location Application Admin Service Admin App Tier A Web Server Server begin Policy Redirection Load Balancing Chain Defined Stage 1 inst inst Firewall.... Stage N inst inst Load Balancer Providers end App Tier B App Web Server Server Service Graph Service Profile Cisco Confidential 12

13 Device Package Service automation requires a vendor device package. It is a zip file containing Device specification (XML file) Device scripts (Python) APIC interfaces with the device using device Python scripts APIC uses the device configuration model provided in the package to pass appropriate configurations to the device scripts Device script handlers interface with the device using its REST or CLI interface APIC Policy Element Device Model APIC Script Interface Device-Specific Python Scripts Device Interface: REST/CLI Service Device Script Engine APIC Node Device Specification <dev type= f5 > <service type= slb > <param name= vip > <dev ident= <validator= ip <hidden= no > <locked= yes > APIC Cisco Confidential 13

14 Understanding Device Package A device package is a zip file with two components: Device Specification XML file that defines Functions provided by a device - Load Balancing, Content-Switching, SSL termination Parameters required for configuring each use case i.e. L4 SLB Interfaces and Network connectivity information for each function within the use case Device Script The integration between the Cisco APIC and a Device is performed by a Device Script (in Python) Cisco APIC programs the BIG-IP by invoking function calls defined in the device package. Cisco Confidential 14

15 F5 Device Package Supported Functions at FCS Functions Virtual Server Ø Layer 4 Server Load balancing Ø Layer 4 SLB with SSL offload Ø Layer 7 Server Load balancing Ø Layer 7 SLB with SSL offload Microsoft SharePoint Parameters under Virtual Server Configuring Global and Tenant Self IP addresses Configuring Global and Tenant static routes Device Counters Server Pools TCP Optimizations (WAN/LAN/Mobile) HTTP optimization HTTP Security (Application protocol security) TCP connection multiplexing (One Connect) Validators and Creation of tenant OneConnect profiles irules Validators and Creation of tenant acceleration profiles SNAT Pool management More than 80% of F5 customers use the L4 SLB / L7 SLB / MSFT SharePoint / SSL offload hence 1st release targets these use cases Cisco Confidential 15

16 ACI + F5 Using the Language of Applications in the Network Application Agility Any where, Any time, Physical and Virtual F5 DEVICE PACKAGE FOR APIC Rapid Deployment of Applications with Scale and Security Application-centricity to Visibility and Troubleshooting Open Source Application Policies DB HYPERVISOR HYPERVISOR HYPERVISOR WEB WEB WEB APP WEB APP WEB DB DB Common Operational Model through Open APIs PHYSICAL NETWORKING HYPERVISORS AND VIRTUAL NETWORKING COMPUTE L4 L7 SERVICES STORAGE MULTI DC WAN & CLOUD BIG-IP PHYSICAL AND/OR VIRTUAL Cisco Confidential 16

17 F5 extends APIC multi-tenancy to the application layer Tenant (HR) Tenant (SALES) Tenant (Finance) App X L4-L7 services: WEB graph uses L4 SLB Attach service graph to contract between EPGS App Y App P L4-L7 services: HTTP graph uses L4 SLB Attach service graph to contract between EPGS App Q App M L4-L7 services: HTTP graph uses L4 SLB Attach service graph to contract between EPGS App N App Z App R App O BIG-IP (Physical or Virtual) Single BIG-IP instance supports TRUE Multi Tenancy with Traffic Isolation Supports single or multi tenants with single or multi graph scenarios Cisco Confidential 17

18 Benefits of using F5 Device Package F5 Synthesis value proposition is preserved in Cisco ACI Cisco ACI allows F5 to bring the value to ACI instead of normalizing across vendors Customer can leverage existing investments F5 has rich programmability foundation - easier to integrate with Cisco APIC F5 is a seamlessly integrated with Cisco ACI preserves existing BIG-IP deployment topologies and L2-L3 interoperability no network redesign no HW upgrades needed on BIG-IP - no net new $$$ spending F5 device pkg preserves multi tenancy within APIC provides true traffic isolation per tenant through the ACI Flexibility in rolling out L4-L7 services on F5 fabric with APIC F5 icontrol/tmsh or iapp Config on Physical and/or Virtual broad customer environments (future phase) F5 Application policy framework aligns seamless with APIC policy framework - F5 device package uses Use case model leveraging existing iapp knowledge Accelerated application deployments - Provides true application centric solution using profile based approach Portfolio of services combining application delivery and security Extensible to other L4-L7 services to address application requirements - GTM, AAM, AFM, APM, ASM Deep application performance visibility (future) Extensive application health score data Device package can integrate applications health score data from BIG IP Cisco Confidential 18

19 F5 BIG-IP Platform Options for Nexus 9K/ACI deployments Unique Application Delivery Architecture: Good, Better, Best Platforms TMOS is the implementation of software on hardware, which includes physical, virtual and hybrid deployments for complete Application Delivery flexibility 25M 200M 1Gbps 3Gbps 5Gbps 4000 series 5000 Series 7000 Series Series 10Gbps Series VIPRION 2400 VIPRION 4480 VIPRION 4800 Choose Your Platforms Virtual F5 virtual editions Provide flexible deployment options for virtual environments and the cloud Virtual ADC is best for: Accelerated deployment Maximizing data center efficiency Private and public cloud deployments Application or tenant-based pods Keeping security close to the app Lab, test, and QA deployments Physical F5 physical ADCs High-performance with specialized and dedicated hardware Physical ADC is best for: Fastest performance Highest scale SSL offload, compression, and accelerated DoS mitigation An all F5 solution: integrated HW+SW Edge and front door services Purpose-built isolation for application delivery workloads Hybrid Physical + virtual = hybrid ADC infrastructure Ultimate flexibility and performance Hybrid ADC is best for: Transitioning from physical to virtual and private data center to cloud Cloud bursting Splitting large workloads Tiered levels of service Cisco Confidential 19

20 ACI + F5 Efficient and Accelerated Application Deployment Cisco Confidential 20

21 F5 + Cisco Nexus 9000/ACI Deployment Scenarios 1. Nexus Nexus 9300 or Nexus 3K Standalone designs Insert F5 10G or 40 Traditional data center deployment model standalone Physical/Virtual Nexus 9500 Physical and/or Virtual Nexus 9300 Nexus Cisco ACI - Nexus 9K + APIC Customer can take full advantage of ACI with F5 device package ACI Nexus 9300 Nexus 9500 Nexus 9300 Cisco Confidential 21

22 Cisco ACI + F5 Additional Resources APIC integration with F5 device package demo ACI and F5 solution brief, whitepapers and design guides Cisco Confidential 22

23 Thank you. In Collaboration with