Going Cloud, Going Mobile: Will Your Network Drag You Down? Wes Morgan, IBM / 2 Feb 2016

Transcription

1 Going Cloud, Going Mobile: Will Your Network Drag You Down? Wes Morgan, IBM / 2 Feb 2016

2 What We ll Cover Why Are We Here? Understanding Data Flow Fundamental Change Aggregate Effects Remote Sites Security Mobile/BYOD Location, Location, Location VPN Users In or Out? Content Delivery Networks Testing Network/Carrier Performance Setting Expectations Q&A 2

3 Why Are We Here? Applications folks aren't usually network folks Enterprise networks are increasingly complex Concerned about application performance Need to set expectations Everywhere Access can be a challenge Mobile/BYOD business pressure Ever-increasing security concerns 3

4 Understanding Data Flow Nothing more than the path of transactions to/from (OR FOR) the server(s) in question THIS IS NOT JUST A POINT-TO-POINT QUESTION! Multiple factors affect data flow WAN links Proxy/firewall use Concentration of users Network design Side band transactions (authentication, document archival/retrieval, directory, etc.) Each step can introduce its own latencies Each step has its own overhead 4

5 Typical Enterprise Data Flow VPN Users Variable DMZ (extranet) Variable Internet Regional Variable VPN Users Gigabit Data Center Main Office Gigabit Data Center WAN Regio n HQ WAN/DSL WAN/DSL Internal External Field Office s Home Region Field Office s Other Region(s)

6 What's Your Data Flow Today? Questions to ask Things you should know already How many remote offices? How many users? What bandwidth do they have? How many home/vpn users? Users by geography? Planning for mobile/cloud Current Internet access Where? How? (direct access, HTTP proxy?) Authentication required? Different in other regions? Current Internet capacity & utilization? PARTNER WITH YOUR NETWORK TEAM NOW! 6

7 Moving to the Cloud A Fundamental Change Depending on the application, you may be moving up to 100% of your application's data flow to the Internet Auxiliary tasks may set up multiple tasks/connections per client Significant increase in both number of connections and volume of data Throughput of boundary devices (e.g. firewalls) Licensing (many firewalls, & network devices are licensed by # of concurrent connections) It's the Internet, folks Added latency how much? Content Distribution Networks (e.g. Akamai) in use? Electrons only move so fast 7

8 Typical Cloud Data Flow VPN Variable Internet Variable Users VPN DMZ (extranet) Variable Regional Data Center Users Main Office Gigabit Data Center WAN Regio n HQ WAN/DSL WAN/DSL Internal External Field Office s Home Region Field Office s Other Region(s)

9 Worst-Case Scenario: Think About Remote Sites Leaf node a location with only one connection to the enterprise network Still seen in both small and large enterprises Largely rendered moot by ISP cloud model everyone has one connection Think about low-bandwidth (or high-latency) sites DSL T1 (1.5 Mbit/s) or lower Satellite links Geographically remote sites usually suffer higher latency

10 Worst-Case Scenario: Think About Remote Sites Old latency = site to network core and back ( ping the data center ) Aggregate effect of every link in network path Cloud latency = site to network core to INTERNET SITE and back Bandwidth-intensive apps (e.g. audio/video) will suffer even more Be sure to include such sites in your tests and/or pilot deployment 10

11 Security How Much Is Too Much? Security policies can have significant impact on cloud performance Mandatory use of proxies is a known flashpoint Moving to cloud-based service will potentially add THOUSANDS of connections/hour to the proxy load Stressed proxy servers can introduce very high latency If proxies are required, you may need to upgrade/add proxy servers to handle the load Some proxies are licensed by number of concurrent connections - may need upgrade 11

12 Security How Much Is Too Much? HOWEVER... Many (if not most) cloud apps use either HTTPS or native encryption May be sufficient to meet security policies/concerns If so, bypass the proxy for connections to cloud services (PAC file for browser-based apps, open outbound firewall) Some customers have established dedicated proxies Some firewalls are also licensed by number of concurrent connections HAVE THIS DISCUSSION NOW! Performance problems in these areas are intermittent and difficult to diagnose 12

13 Mobile/BYOD Location, Location, Location Placement of servers is key First question which services will be external? These servers should go in your DMZ May require receipt of push notifications, e.g. Apple APNS Don't want external connections coming all the way in to the data center 13

14 Mobile/BYOD Location, Location, Location Second question - what MDM will I use? MDM solution necessary to manage access, passwords, appstore access, etc. Third question - what has to be open in the firewall? Mix of inbound/outbound connectivity, depending on service May need to come in to internal servers (e.g. Traveler) Most purely internal BYOD clients can be treated as any other internal client May wind up using reverse proxies to reach internal servers e.g. Sametime Proxy Server in DMZ vs. reverse-proxy to internal Sametime Proxy Server 14

15 Mobile/BYOD: Where Are My Back-End Servers? Mobile provisioning usually doesn't change where the user's data lives HOWEVER... Now you're establishing a mobile base in your DMZ that has to be able to reach ALL of the internal servers hosting the user's data Significant increase in firewall traffic, both external-to- DMZ and internal-to-dmz Can create additional latency (Traveler server in US DMZ, user's mail server in European data center) 15

16 VPN Users In or Out? Many VPNs push ALL traffic to enterprise network Resulting data flow for VPN user is: Remote site to enterprise network via Internet Enterprise network routes traffic to Internet for cloud services (perhaps via proxy) Response from cloud service returns to enterprise network via Internet (perhaps via proxy) Enterprise network returns response to VPN client via Internet DO YOU SEE THE PROBLEM? (Hint: think overhead!) 16

17 VPN Users In or Out? Most VPNs allow policy settings per IP address Some VPNs modify browser settings (like a PAC file) Allow VPN clients to reach cloud services directly Strips out the middleman of the enterprise network Reduces latency Improves performance Reduces load on enterprise network (VPN concentrators, proxy servers, etc.) 17

18 VPN Users In or Out? Review VPN configuration specifics Many optimizations for data-center target introduce problems with cloud targets, e.g.: Nagle algorithm Delayed ACKs TCP slow start Consider additional load on VPN server(s) 18

19 Understanding Content Delivery Networks Front-end servers at edges of Internet Often hosted at ISP level May perform caching (e.g. HTTP) or simply provide an accelerated tunnel to the cloud provider (e.g. IMAP) Clients directed via DNS Universal name (e.g. server.cloud.com ) DNS gives different answers in different locations (usually via BGP) Clients directed by whatever their DNS says, WHETHER OR NOT IT IS THE CLOSEST CDN POINT! Example: apps.na.collabserv.com Windstream DNS (KY) (11 hops, 38ms) Google DNS (CA) (10 hops, 58ms) VPN #1 (CO) (12 hops, 72ms) VPN #2 (NJ) (14 hops, 108ms) 19

20 Understanding Content Delivery Networks & VPN VPN using corporate DNS but local connectivity C = CDN devices Home client Cloud web access Cloud Provider DNS C C C C Corporate network 20

21 Understanding Content Delivery Networks & VPN VPN using corporate DNS and corporate Internet connectivity C = CDN devices Cloud Home client Cloud web access DNS C C Provider C C Corporate proxy Corporate network 21

22 Content Accelerators Potential Problem! Also known as Enterprise Distributed Content Network (EDCN) devices May be protocol-specific Usually serve as caching/compression engines Usually work in pairs (remote site to data center/core network) Fine if you control both endpoints Can create problems if you access both local and cloud resources with the same protocol Should be configured to only accelerate LOCAL conversations 22

23 SSL Terminators Another Point of Overload Also known as SSL accelerators Serve as a man in the middle to broker SSL connections Usually hardware-limited to a maximum number of concurrent SSL sessions (some as low as 10,000 concurrent connections per board ) Moving to the cloud (or putting mobile resources in your DMZ!) can easily push tens of thousands of connections through these devices Symptom intermittent Everyone who gets in is fine, but suddenly no new people can get in Discuss SSL capacity with your network team! 23

24 Quality of Service (QoS) is your friend! QoS is a network traffic priority scheme Many (if not most) enterprise networks implement some form of QoS today, especially if VoIP is deployed Talk with your network team about QoS consideration for cloud/mobile traffic From the network's perspective, your cloud/mobile traffic is just more Internet traffic You don't necessarily need to be #1 on the priority list, but you want to be higher than the person checking Facebook or Twitter I recommend an initial QoS treatment of one step above routine traffic Can be ABSOLUTELY critical if/when your Internet connectivity is highly utilized 24

25 Testing Network Performance with iperf 3.0 iperf 3.0 created by es.net and Lawrence National Laboratory Free, open-source software Can test TCP, UDP and SCTP throughput iperf packages available at Servers available for Windows and Linux Desktop clients available for Windows, Linux, MacOS Hurricane Electric's HE.NET Network Tools for ios and Android includes an iperf3 client (App Store and Google Play) Requires firewall open for tcp/5201 and udp/5201 Install an iperf server within your cloud/mobile deployments 25

26 Testing Network Performance with iperf 3.0 Linux server, ios client UDP test, transfer 2MB, report every 5s Note that server log includes jitter! Desktop clients can get a copy of the server report with --get-server-output 26

27 Testing Network Performance with iperf 3.0 You can also do basic flood testing -P to specify number of concurrent streams -t to specify test duration -b <number>{k/m/g} to specify bandwidth Example: 8 UDP streams of 384K for 120s (think A/V) 27

28 Evaluating Mobile Users (and Carriers) with GeoIP GeoIP = cross reference IP addresses with city/country/as Also known as 'IP geolocation' AS = Autonomous System (network provider) GeoIP Legacy databases available free from MaxMind Not as precise as paid versions Wireshark supports GeoIP databases Allows you to find/profile: Individual users Performance by city/country Performance by mobile/network provider

29 Wireshark and GeoIP Example from a Traveler deployment

30 Summary - Setting Expectations May need to limit features in some locations Audio/video Database replication Your network team can do a bandwidth analysis Estimated per-user addition to Internet pipe consumption Your testing should accomplish several things Baseline performance for well-connected/central sites Performance rates for remote or poorly-connected sites (be sure to test them!) Identify potential chokepoints in your enterprise networks Compare against other sites (e.g. from home without VPN, public wifi sites, etc.) Estimated per-user addition to proxy load 30

31 Setting Expectations Network upgrades, if indicated, may delay performance improvements for some users REPEAT YOUR TESTING PERIODICALLY! Network may change around you New deployments may affect network performance 31

32 Your Feedback Is Important! Based upon your session attendance, a customized list of surveys will be built for you. Please complete your surveys via the conference kiosks or any web enabled device at or through IBM Event Connect.

33 QUESTIONS AND ANSWERS THANKS FOR BEING HERE! Blog: