Overlay Transport Virtualization New DCI L2 extension solution

Transcription

1 Overlay Transport Virtualization New DCI L2 extension solution T-DC / L3 Miroslav Brzek Systems engineer mibrzek@cisco.com Sponsor Logo Sponsor Logo Sponsor Logo CIscoEXPO 1

2 Agenda 1. L2 extension Requirements Use Cases 2. Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 2

3 Agenda 1. L2 extension Requirements Use Cases 2. Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 3

4 L2 extension Requirements Use Cases 1.Virtual machine mobility 2.Extending Operating System / File System clusters 3.Extending Database clusters 4.Physical machine mobility 5.Extend DC to solve power/heat/space limitations 6.Virtual Hosting resources 7.Data Center migration & consolidation 4

5 Agenda 1. L2 extension Requirements Use Cases 2. Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 5

6 Traditional Layer 2 VPNs EoMPLS VPLS Dark Fiber 6

7 Traditional Layer 2 VPNs Flooding Behavior Traditional Layer 2 VPN technologies rely on flooding to propagate MAC reachability. The flooding behavior causes failures to propagate to every site in the L2-VPN. x2 Site A Site C MAC 1 MAC 1 propagation Site B 7

8 Traditional Layer 2 VPNs Pseudo-wires Maintenance Before any learning can happen a full mesh of pseudo-wires/tunnels must be in place. For N sites, there will be N*(N-1)/2 pseudo-wires. Complex to add/remove sites. Head-end replication for multicast and broadcast. Sub-optimal BW utilization. 8

9 Traditional Layer 2 VPNs Multi-Homing Require additional protocols to support Multi-homing. STP is often extended across the sites of the Layer 2 VPN. Very difficult to manage as the number of sites grows. Malfunctions on one site will likely impact all sites on the VPN. Active Active L2 Site L2 VPN L2 Site 9

10 What can be improved 1.Data Plane Learning Control Plane Learning Moving to a Control Plane protocol that proactively advertises MAC addresses and their reachability instead of the current flooding mechanism. 2.Pseudo-wires and Tunnels Dynamic Encapsulation No static tunnel or pseudo-wire configuration required. Optimal replication of traffic done closer to the destination, which translates into much more efficient bandwidth utilization in the core. 3.Multi-Homing Native Built-in Multi-homing Ideally a multi-homed solution should allow load balancing of flows within a single VLAN across the active devices in the same site, while preserving the independence of the sites. STP confined within the site (each site with its own STP Root bridge) 10

11 Agenda 1. L2 extension Requirements Use Cases 2. Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 11

12 Overlay Transport Virtualization () LAN Extensions delivers a virtual L2 transport O Overlay - A solution that is independent of the infrastructure technology and services, flexible over various inter-connect facilities T Transport - Transporting services for layer 2 and layer 3 Ethernet and IP traffic V Virtualization - Provides virtual connections, connections that are in turn virtualized and partitioned into VPNs, VRFs, VLANs 12

13 Overlay Transport Virtualization Technology Pillars is a MAC in IP technique for supporting Layer 2 VPNs OVER ANY TRANSPORT. Dynamic Encapsulation No Pseudo-Wire State Maintenance Optimal Multicast Replication Multi-point Connectivity Point-to-Cloud Model Protocol Learning Built-in Loop Prevention Preserve Failure Boundary Seamless Site Addition/Removal Automated Multi-homing 13

14 at a Glance 1. Ethernet traffic between sites is encapsulated in IP: MAC in IP 2. Dynamic encapsulation based on MAC routing table 3. No Pseudo-Wire or Tunnel state maintained MAC MAC1 MAC2 MAC3 MAC1 MAC2 IP A IP B MAC1 MAC2 MAC1 MAC2 Encap Decap IF Eth1 IP B IP B IP A IP B Server 1 MAC 1 Communication between MAC1 (site 1) and MAC2 (site 2) Server 2 MAC 2 14

15 Terminology 1. Edge Device: connects the site to the (WAN/MAN) core; responsible for performing all the functions 2. Internal Interfaces: interfaces of the Edge Devices that face the site. They behave as regular layer 2 interfaces. 3. Join interface: interface of the Edge Device that faces the core. Typically point-to-point routed interface used by to join the core multicast groups. Its IP address is used as the IP source address in the encapsulation. 4. Overlay Interface: logical multi-access multicast-capable interface. The overlay interface encapsulates Layer 2 frames in IP unicast or multicast headers. Overlay Interface Internal Interfaces L2 L3 Join Interface Core 15

16 Data Plane: Unicast Intra-Site Traffic MAC TABLE VLAN MAC IF MAC 2 Layer 2 Lookup MAC 1 MAC 2 Eth 2 Eth 1 MAC 4 MAC 1 MAC 2 Eth 1 Eth 2 IP A IP B Core L2 L3 L3 L2 Eth 1 Eth 2 MAC 1 West East MAC 3 16

17 Data Plane: Unicast Inter-Site Traffic MAC 2 1 Layer 2 Lookup VLAN MAC TABLE MAC MAC 1 MAC 2 MAC 3 MAC 4 MAC Table contains MAC addresses reachable through IP addresses IF Eth 2 Eth 1 IP B IP B 5 Layer 2 Lookup VLAN MAC TABLE MAC MAC 1 MAC 2 MAC 3 MAC 4 IF IP A IP A Eth 3 Eth 4 MAC 4 MAC 1 MAC 3 Eth 1 Eth 2 External IP A Eth 4 Eth 3 MAC 1 MAC 3 IP A IP B MAC 1 MAC MAC 1 3 MAC IP 3 A IP B Core External IP B L2 L3 L3 L2 2 3 Encap Decap 4 MAC 1 MAC 3 6 MAC 1 West East MAC 3 No Pseudo-Wire state is maintained. The encapsulation is done based on a Layer 2 destination lookup. 17

18 Multicast in the core 1. will leverage the multicast capabilities of the core. 2. The Edge Device joins a core s ASM/Bidir multicast group. The hellos and updates are encapsulates by the Edge Device into IP packets where the multicast group is the IP destination address. The Edge Devices behave like simple hosts relative to the Core. 3. An SSM group range for the multicast data generated by the site. 4. Using IP Multicast will allow to scale much better and allow lower OPEX for site adds and deletes. 5. However provides a solution for deployments where the core does not support multicast. 6. For these cases uses the Adjacency Server Mode of operation. 18

19 Edge Device Adjacency Creation Multicast Control Plane Adjacencies Established over the mcast group in the core Control Plane IP B IP A West IGMP Join Core IGMP Join East IGMP Join IP C Control Plane South 19

20 - Building the MAC tables 1. The control plane proactively advertises MAC reachability (controlplane learning). 2. The MAC addresses are advertised in the background once has been configured. 3. Every time an Edge Device learns a new MAC address, the control plane will advertise it together with its associated VLAN IDs and IP next hop. 4. The IP next hops are the addresses of the Edge Devices through which these MACs are reachable in the core. 3 New MACs are learned on VLAN 100 Vlan 100 Vlan 100 Vlan 100 West MAC A MAC B MAC C 1 Update 2 IP A Core update is replicated by the core 3 IP C Update 3 Update IP B VLAN VLAN MAC MAC A MAC B MAC C South-East East IF IP A IP A IP A MAC MAC A MAC B MAC C 4 IF IP A IP A IP A 20 4

21 - STP BPDU Handling 1.When STP is configured at a site, an Edge Device will send and receive BPDUs on the internal interfaces. 2.An Edge Device will not originate or forward BPDUs on the overlay network. 3.An Edge Device can become (but it is not required to) a root of one or more spanning trees within the site. The BPDUs stop here Core 21

22 - Unknown Unicast Packet Handling 1.Flooding of unknown unicast over the overlay is not required and is therefore suppressed. 2.Any unknown unicasts that reach the edge device will not be forwarded onto the overlay. 3.The assumption here is that the end-points connected to the network are not silent or uni-directional. 4.MAC addresses for uni-directional host are learnt and advertised by snooping the host s ARP reply No MAC 3 in the MAC Table VLAN MAC TABLE MAC IF 100 MAC 1 Eth1 100 MAC 2 IP B MAC 1 MAC 3 Core 22

23 - Proxy ARP 1.The Edge Devices handle all ARP information for hosts across sites 2. provides the ability to implement Proxy ARP at the Edge Devices. 3.With Proxy ARP the Edge devices may reply to ARPs on behalf of hosts at remote sites. 4.With Proxy ARP the ARP broadcast traffic crossing the core can be significantly reduced. 23

24 Multi-Homing: Loop Condition Handling 1. includes the logic necessary to avoid the creation of loops in multi-homed site scenarios. 2.Each site will have its own STP domain, which is separate and independent from the STP domains in other sites, even though all sites will be part of common Layer 2 domain. STP domain 1 No STP STP domain 2 Core 24

25 - Authoritative Edge Device 1. provides loop-free multi-homing by electing a designated forwarding device per site for each VLAN. 2.The designated forwarder is referred to as the Authoritative Edge Device (AED). 3.The Edge Devices at the site peer with each other on the internal interfaces to elect the AED 4.The AED is the only edge device that will forward multicast and broadcast traffic between a site and the overlay. Core 25

26 Active-Active ECMP & Load Balancing 1. allows different flows to use different edge devices when a site is multi-homed. 2.The choice of the edge device is based on both the source and destination addresses of the frames to be forwarded. 3.The logic affects both the election of the egress device (Load Balancing) as well as the election of the ECMP route to the remote site. Core AED AED 26

27 - Egress Routing Localization 1.HSRP hellos can be filtered at the site edge. 2.A single FHRP group will now have an active GWY on each site. 3.No special configuration of the FHRP is required. 4.ARP requests for A are intercepted at the edge to ensure the replies are from the local active GWY. 5.Optimal Egress Router choice. Active GWY Site 1 Active GWY Site 2 L3 L2 ARP traffic is kept local FHRP Hellos West FHRP Hellos East ARP traffic is kept local 27

28 Agenda 1. L2 extension Requirements Use Cases 2. Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 28

29 Design Example (1) Collapsed Core-Aggregation Dedicated DCI connection Layer 2 Link Layer 3 Link Virtual Link To other sites Dedicated DCI provides for a simpler design. WAN VDC handed out from the Agg Layer. IGMPv3 on the join interface link VDC with DCI Aggregation PIM enabled across the DCI Access 29

30 Design Example (2) Collapsed Core-Aggregation No Dedicated DCI connection To other sites Layer 2 Link Layer 3 Link Virtual Link Seamless integration even for small sites. WAN CPE VDC as an appliance at the Aggregation Layer. The VDC provides the logical DCI layer. VDC as appliance PIM VDC as appliance Agg/Core VDC joins the mcast core groups at the Aggregation Layer. Access 30

31 Agenda 1. L2 extension Requirements Use Cases 2.Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 31

32 - Configuration CLI configuration feature otv interface Overlay0 otv join-interface Ethernet1/1 otv control-group otv data-group /24 otv extend-vlan otv site-vlan 10 Connect to the core. Used to join the core mcast groups. Their IP addresses are used as source IP for the encap ASM/Bidir group in the core used for the Control Plane. SSM group range used to carry the site mcast traffic data. Site VLANs being extended by VLAN used within the Site for communication between the site s Edge Devices 32

33 Agenda 1. L2 extension Requirements Use Cases 2.Traditional Layer 2 VPNs 3. technical overview 4. Design examples 5. Configuration details 6. Cisco platform support 33

34 34