Cisco Prime Network Services Controller. Sonali Kalje Sr. Product Manager Cloud and Virtualization, Cisco Systems

Transcription

1

2 Cisco Prime Network Services Controller Sonali Kalje Sr. Product Manager Cloud and Virtualization, Cisco Systems

3 Agenda Cloud Networking Challenges Prime Network Services Controller L4-7 Services Solutions Integrations Cisco Intercloud Fabric Cisco IAC Cisco Virtual Application Container Services Cisco DFA Use Cases 3

4 Managing The Evolution of the Data Center Cloud

5 The Evolution of the DC World of Many Clouds Enabling New IT Sourcing Models, Legacy Hosting and Cloud Hosting Hybrid Cloud Public Cloud Services Traditional Data Center Private Cloud

6 The Evolution of the DC Virtualization is Distributed Every environment uses a virtualization solution with its own management platform Hybrid Cloud Public Cloud Services Traditional Data Center Private Cloud

7 Hybrid Cloud Extending The Traditional Data Center Hybrid Cloud DC or Private Cloud Public Cloud Sustained workloads Control & compliance Workload Portability Policy Consistency Elastic workloads Quick ramp

8 Multi-Tenancy in the Data Center Consolidating Resources Distinct Data Centers Business Units Multi-Tenant Data Center Sales Finance R&D

9 Deploy Tenant containers in cloud Today s Approach Is Manual, Complex & Error Prone Secure & Shared Infrastructure It takes month(s) to provision Networking & Security at the Virtual Layer IT Director, Enterprise Customer A B C Secure Zoned Containers Cisco s Converged Infrastructure Today s Solution leads to: Customer assembling diverse set of virtual & physical services Provisioning nightmare through different Management Tools Flexpod

10 Poll Question 1 10

11 Introducing.. Prime Network Services Controller Multi- Hypervisor Multi- Cloud Multi-Service, Multi-Tenant Prime Network Services Controller

12 Prime Network Services Controller Enabling network service automation, policy consistency in private and hybrid cloud Multi-Services - Network services automation for service deployments and configuration Multi-Cloud - Intercloud enablement platform for infrastructure and services Multi-Hypervisor Services across multiple landscapes Orchestration CIAC Openstack BMC CLM UCSD DCNM Cloudstack Admin / Tenant Web Interface Northbound API Prime Network Services Controller Virtual Services Hypervisor Provider Cloud Cisco powered ] cloud providers Enabling service automation, policy consistency with policy mobility across private and hybrid cloud

13 Managing Cloud Services with Cisco Prime Network Services Controller Orchestration Northbound API Prime Network Services Controller Virtual Services Hypervisor Cloud Cisco Powered Cloud Providers Enabling service automation, policy consistency with policy mobility across private and hybrid cloud 13

14 Poll Question 2 14

15 Prime Network Services Controller Features VM lifecycle management Northbound XML API Role-Based Access Controls Multi-tenant Service management Dynamic Service Provisioning Non disruptive Operations VM add, delete, Tenant assignment Network IP management License automation Service VM scaling Policy management 15

16 Prime Network Services Controller High Level Architecture Cisco Intelligent Automation for Cloud Cisco UCS Director BMC CLM OpenStack Cisco Intercloud CloudStack Single Northbound API IP Address Management Image Management Policy Management Service Configuration System Administration License Management Amazon Capacity Management Service Chaining Config Archive VM Lifecycle Change Audit Monitoring Azure Performance Management Policy Driven, Template Based Nexus1000V Cisco Prime Network Services Controller VSG (Zone- Based Firewall) Virtual ASA(Edge Firewall) CSR1000V (L3 Router) 3 rd Party vswitch Nexus 1000v Third-Party Load Balancers (VPX) Cisco Powered Cloud Providers vsphere HyperV KVM Xen Multi-Hypervisor

17 Virtual Data Center / Cloud Network Services Cisco Prime Network Services Controller L3 VPN Citrix NetScaler CSR1000V Internet ASA1000V VSG Per tenant Service lifecycle and Policy management for : o Load Balancer o Edge Router o Edge Firewall o Compute/App Firewall o Service Chaining configuration Public Zone Protected FE Zone 1 Zone 2 Zone 3 Front-End Zones Back-End Zones 17

18 L4-7 Services Management

19 Compute Firewall Features Cisco Virtual Security Gateway (VSG) Secures inter-vm traffic within a tenant Context-aware security Zone-based controls VM context-aware rules Establish zones of trust Context-aware security Scale Policies follow vmotion / live migration Multi-instance deployment 19

20 Compute Firewall in Prime Network Services Controller 20

21 Edge Router Features Cloud Services Router (CSR) 1000V Cisco IOS Router in Virtual Form-Factor Security Routing Interfaces Other features IOS zone-based firewall, ACLs OSPF, EIGRP, BGP and static routing Routed interface, loopback interface, sub interface, VPN tunnel interface Site-to-Site IPSec VPN, DHCP Server & Relay, Smart Licensing 21

22 Edge Router 22

23 Edge Router - Instantiation 23

24 CSR 1000V Smart Licensing 24

25 Network Services Image Management 25

26 Load Balancer Features Citrix NetScaler VPX/1000V Virtual Load Balancer Protocols Load-balancing algorithms Persistence Other features HTTP, TCP, UDP, FTP, DNS, etc. Round Robin, Least Connection, Source IP Hash, URL Hash, etc. None, Cookie Insert, Source IP, SSL Session One-arm mode, license automation, vpath configuration 26

27 Load Balancer Instantiation 27

28 Prime Network Services Controller enabling L4-L7 Services in broader solutions

29 Prime Network Services Controller - Solution Integrations Intelligent Automation for Cloud Dynamic Fabric Automation Intercloud Fabric UCS Director 3 rd Party Integrations BMC CLM, Cloudstack 29

30 Cisco Intercloud Fabric Solution Overview Enterprise DC / Private Cloud Provider Clouds vsphere Intercloud Business Edition Intercloud Provider Edition Cloud Providers & Cisco Powered Services Hyper-V End User & IT Admin Portals Openstack/KVM Secure Fabric Network, Compute & Storage Azure APIs CloudStack/Xen EC2 APIs

31 Poll Question 3 31

32 Cisco s Hybrid Cloud Differentiation No Vendor Lock-In Any Hypervisor to Any Provider Open Ecosystem Heterogeneous Infrastructure Customer Cloud Providers Open Choice Cloud Brokers End-to-End Security Cisco InterCloud Cisco Powered Services Unified Workload Management and Governance Workload Mobility Across Clouds

33 Cisco Intercloud Fabric Architecture Details Administrator installs Intercloud Fabric Director SP Admin deploys Provider Platform End Users VM Manager V M IT Admins VM Private Intercloud Fabric Director Prime NSC Intercloud Extender Installed and configured through Intercloud Fabric Director V M Intercloud Secure Fabric Intercloud Secure Fabric Intercloud Switch Intercloud Fabric Provider Platform Cloud Providers V M Intercloud Fabric Services Public 33

34 Prime Network Services Controller in Intercloud Fabric Cloud User End user portal Intercloud Fabric Director Cloud Admin Intercloud Fabric Services Management Prime Network Services Controller Provider Cloud Enterprise DC IC Secure Tunnel Hybrid Cloud Tenant1 - Production Tenant2 Dev / QA 34

35 Prime Network Services Controller in Intercloud Fabric Enterprise DC Intercloud Fabric Director Prime Network Services Controller Provider Cloud FW IC Secure Tunnel FW NAT VPN Tenant1 - Production FW Tenant2 Dev / QA 35

36 Virtualized Services Architecture (VSA) Orchestration Cisco Intelligent Automation for Cloud (Cisco IAC) Cisco Prime Service Catalog Virtual Cisco Prime Network Services Controller Cisco Process Orchestrator Physical Physical CSP Virtual Storage Domain Orchestrator Network Devices and Services (Physical and Virtual) UCSM vsphere Compute Storage Network Element Management / Service Assurance 36

37 Prime Network Services Controller in Cisco Intelligent Automation for Cloud

38 Services Integration in Cisco Dynamic Fabric Automation Cloud Stacks Advantages Any workload, anywhere, anytime Open APIs UCS Director Compute & Storage Policies Network & Network Services Policies Open Integration: orchestration Automated scalable provisioning Workload aware fabric Fabric Mgmt Provisioning Network Services Controller Published Schemas 38

39 Dynamic Fabric Automation Services Architecture 39

40 Use Cases

41 Deploy topology agnostic service chains in minutes Web Intelligent service chaining with Nexus 1000V vpath Flat network: as shown, all application tier is on VLAN 100 segment, and each have different set of services enabled based on service requirement WAN Optimization + Edge Firewall + NAT + Load Balancer + Web Application Firewall + Zone based Firewall vpath Load Balancer + Zone based Firewall VSG Zone based Firewall VLAN 100 VLAN 100 VLAN 100

42 Use Case: Deploy 3-Tier Application Container 3 Tier App Container Upstream Router Routing CSR 1000V VLAN 1/ VXLAN 101 LB 1. NAT (Optional) 2. L3 Routing Dynamic or Static (Optional) 3. Edge FW 4. Load Balancer 5. App FW VSG Zone based FW Web Tier App Tier DB Tier All network services and policy management in centralized UI with Prime Network Services Controller

43 Cloud Service Provider Multi-Tenancy Compute Cluster Tenant A Cisco ASA1kV Tenant B Cisco CSR1kV Management Cluster Cisco VSG Virtual Infrastructure Citrix NetScaler1k Cisco VSG Citrix NetScaler1k V V Cisco vpath Cisco Nexus 1000V One or more Cisco Nexus 1000V VSM and Cisco Prime NSC Instance per cluster Multi-Tenancy Dedicated Service Node per Tenant Shared host resources across Tenants Management through Single Plane of Glass

44 Poll Question 4 44

45 Cloud Service Provider On-demand Firewall and LB services Provisioning Customer Cluster 1 VSG Virtual Infrastructure Customer A CSR1kV VSG Customer B One VSM and PNSC Instance per customer cluster VSG Customer C Cloud Provider Portal offers Services - Add services to your Cloud Resources: - Firewalls - Load balancers - SSL VPN Customer C Admin creates new cloud resource request on CSP portal CSP On-boards new Customer C VM s on customer cluster 1 Tenant C admin configures LB and Firewall Policies via Mgmt console on CSP Tenant Portal Tenant VM s secured with dedicated VSG Firewall with policies provision in less than 10 Seconds VSG Policies are to secure tenant boundary and VM s isolation within Tenant using VSG zones and custom attributes

46 Key Takeaways.. Prime Network Services Controller Policy and VM Mobility - Private and Hybrid Cloud Prime Network Services Controller (Prime NSC) Multi-tenant Programmable Intercloud Fabric Service VM Life-cycle management Enabling service automation, policy consistency and policy mobility across private and hybrid cloud

47