CloudStack Networking. Paul Angus Cloud

Transcription

1 CloudStack Networking Paul Angus Cloud

2 Cloud Architect with ShapeBlue Worked with CloudStack since About Me Specialising in deployment of CloudStack and supporting infrastructure Orange, TomTom, PaddyPower, Ascenty, BSkyB, SunGard, T Mobile I view CloudStack from a What can cloud consumers practically do with it point ofview

3 About ShapeBlue ShapeBlue are expert builders of public & private clouds. They are the leading global CloudStack / CloudPlatform integrator & consultancy

4

5 Why NaaS The Use Cases VPS Cloud NaaS

6 CloudStack Networking Logical Networking Models Basic Advanced

7 Basic Networking AWS Style L3 isolation Massive Scale Simple Flat Network Each POD has a unique CIDR Optional Guest Isolation via Security Groups Optional NetScaler Integration Elastic IPs and Elastic LB Optional Nicira NVP Integration

8 Security Groups Isolate traffic between VMs Available for both Basic and Advanced Networking XenServer must use Linux Bridge and not Open vswitch xe switch network backend bridge Edit sysctl to enable net.bridge.bridge nf call iptables and net.bridge.bridge nf call arptables Must be implemented before adding to CloudStack

9 Security Groups Rules can be mapped to CIDR or another Account/Security Group

10 Advanced Networking This network model provides the most flexibility in defining guest networks and providing custom network offerings such as firewall, VPN, Load Balancer & VPC functionality. Guest isolation is provided through layer 2 means such as VLANs or SDN technologies

11 Advanced Networking Private and Shared Guest Networks Multiple Physical Networks Virtual Router for each Network providing: DNS & DHCP Firewall Client VPN Load Balancing Source / Static NAT Port Forwarding

12 Advanced Networking & Security Groups Effectively enables the deployment of multiple Basic style networks which use Security Groups for isolation of VMs, but with each Network encapsulated within a unique VLAN.

13 Management Network Traffic between CloudStack Management Servers and the various cloud components (Hosts, System VMs, Storage*, vcenter etc)

14 Guest Network Basic & Advanced

15 Guest Network Basic Zone EIP / ELB

16 Public Network Basic & Advanced

17 Public Network System VMs CPVM, SSVM & VRs have a connection to the Public Network *VRs only have public connection in Advanced Network

18 Storage Network

19 Physical Connectivity

20 Basic Zone Example IP Schema

21 Advanced Zone Example IP Schema

22 Network Service Providers A Hardware or Virtual Appliance that provide Network Services to CloudStack e.g. Virtual Router VPC Virtual Router Internal LBVM Citrix NetScaler F5 Load Balancer Juniper SRX Firewall Nicira Nvp Midokura Midonet BigSwitch Vns Cisco VNMC Baremetal DHCP* Baremetal PXE* Palo Alto* Ovs (GRE/VXLAN) *new in 4.3

23 Virtual Private Clouds (VPC) Private multi tiered Virtual Networks ACLs to control traffic isolation Inter VLAN Routing Site 2 Site VPN Private Gateway VPC 2 VPC VPN* User VPN* *new in 4.3

24 VPC Components Virtual Router Connects all the VPC Components Network Tiers Isolated Networks, each with unique VLAN and CIDR

25 VPC Components Public Gateway

26 VPC Components Site 2 Site VPN Linked to Public Gateway

27 VPC Components User VPN Linked to Public Gateway

28 VPC Components VPC 2 VPC VPN Linked to Public Gateway

29 VPC Components Private Gateway Created by Root Admins Configured by Users (Static Routes)

30 VPC Components

31 VPC Components

32 VPC Components

33 Communication Ports