Avaya Fabric Attach Table of Contents Fabric Attach the Ecosystem and Solution... 1 Fabric Attach Avaya Identity Engines with an FA solution... 2 Fabric Attach the key elements... 3 Fabric Attach in an SDN Fx Environment... 4 Fabric Attach and the promise of SDN... 5 Appendix Fabric Attach Use Cases... 6 Extending Fabric Capabilities to legacy (non MAC in MAC switches)... 6 Extending the Fabric value to Wireless Networks... 8 SDN Fx and the Open Networking Adapter... 9 SDN Fx and Fabric Attach in the data center to enable VM mobility... 10 SDN Fx, Fabric Attach and the Internet of Things...11 One of the key benefits of Avaya Fabric Connect (an enhanced implementation of Shortest Path Bridging (SPB)) technology is simplified operations through access layer only network provisioning. Fabric Connect delivers a Zero- Touch-Core that virtually eliminates the chance of core network misconfiguration. It allows simple and secure deployment for any type of network service without the need to make any configuration changes on intermediate/ core nodes, even in environments where clients roam. But until now, these benefits have been available only on Fabric Connect capable devices. Avaya has developed Fabric Attach to extend these same benefits to network elements or hosts that are NOT SPB-capable. Avaya Fabric Attach (FA) extends Fabric Connect to deliver an Autonomic Edge capability that dramatically reduces the costs of adding or modifying new or existing services. Any FA capable device (a switch, server, AP, IP Phone, etc.) can now be securely connected to the network, be authorized for a network service, and attach to the appropriate network service instance all automatically and based on IT policy. This enables Fabric Attach devices to come straight out of the box and onto the network with Zero Touch! Imagine if your operations team could roll out new application services instantly, without the associated risks of touching most or all of your network devices. Avaya recently commissioned an analysis of Fabric Connect customers with Market Dynamics 1. The findings were telling; Fabric Connect customers spent 85% less time and effort configuring their networks to turn up new services. Additionally, on average, Fabric Connect customers went from an average of 3 human caused errors during configurations to zero per year. Fabric Attach the Ecosystem and Solution Avaya Fabric Attach (FA) fundamentally introduces autonomic/automatic attachment to network services for end users, or Internet of Things (IoT) devices to a network infrastructure. Fabric Attach and Fabric Connect are key building blocks of the Avaya SDN Fx architecture. avaya.com 1
One of the key benefits of implementing Fabric Attach is not only the automatic and dynamic provisioning of VLAN and Virtualized services within a network infrastructure, but also the removal of those services when they are no longer required. Creating a fully elastic and programmable network with services that expand and contract in step with the enterprises demands and loads. Fabric Attach can be deployed in two ways: 1. In the access layer(s) of any network. 2. In the access layer(s) of an Avaya Fabric Connect network. With any existing core network infrastructure, Fabric Attach enables autoattach of access layer and edge devices and the automatic creation of VLAN based network services. All network infrastructure supporting Fabric Attach is able to dynamically create and configure the required services right up to the legacy core network infrastructure. When Avaya Identity Engines policy server is in place, it can be used to authenticate and authorize both network devices and users, then create the VLAN based services to automatically connect the user or end device with the appropriate policy and permissions. Simply put, Fabric Attach will auto-attach any FA client device, automatically building the desired VLAN (typically the management VLAN) with a secure handshake between the FA Server and the FA Client. In the case of using Fabric Attach with an Avaya Fabric Connect solution, Fabric Attach provides the same capabilities at the access layer (as noted above) but now those services and policies are mapped across the entire network end-toend. FA provides an organization with a fully autonomic network, making user and end device attachment simple through authorization and only creating the network configuration and setting up resources when needed. One of the key benefits of implementing Fabric Attach is not only the automatic and dynamic provisioning of VLAN and Virtualized services within a network infrastructure, but also the removal of those services when they are no longer required. Thus creating a fully elastic and programmable network with services that expand and contract in step with the enterprises demands and loads. Fabric Attach Avaya Identity Engines with an FA solution Avaya Identity Engines policy server is designed to work hand in hand with Fabric Attach and Fabric Connect. While Identity Engines is an optional component in a Fabric Attach solution, its inclusion enhances the creation of VLAN and SPB based services based on wired or wireless end device and end user authentication. For example, including Identity Engines policy server in a Fabric Attach solution for an existing non-spb core network infrastructure (Figure 1) allows VLAN service creation control based on end user and device authentication and authorization. Users and devices can be placed in the specific VLAN required for the desired service, or that VLAN could be automatically created based on their individual policy. By including Identity Engines policy server in a Fabric Attach solution containing a Fabric Connect core network infrastructure (Figure 2), you will receive the maximum benefits of end-to-end provisioning of VLANs and SPB Virtual Services. All VLAN and virtualized services can be dynamically created avaya.com 2
based on end device and user authentication and authorization, and placed directly into their associated service based on their individual policy. Fabric Attach the key elements FA-Server: An SPB capable network device at the Fabric Connect edge running in the FA Server mode to support downstream FA-Proxy and FA-Client devices. FA-Servers are always network switching nodes supporting this function. FA-Client: A network attached end device running the FA agent in FA-Client mode. FA-Clients can be Avaya Ethernet Routing Switches, WLAN 9100 Access Points, IP Phones, Hypervisors supporting FA-Client on Open vswitch, or other third party devices planned for the future. FA-Proxy: A network device running the FA agent in FA Proxy mode. FA-Proxy switches can also support Client mode for directly attached users or end devices. FA-Proxy s are always network switching nodes supporting downstream FA-Client devices, while directly connected to an upstream FA-Server device. FA-Proxy Standalone: A non-spb network device running the FA agent in FA Proxy mode supporting FA-Client devices, but without the need for an upstream FA-Server. This is used where Fabric Attach is running in a non-fabric Connect network. FA-Policy Server: Avaya Identity Engines server, which can be optionally used in an FA solution to authenticate end-user and enddevices. Network services (VLAN only or VLAN plus SPB services) can be created in the Fabric Attach environment based on authorization of the end-user or end-device. avaya.com 3
Avaya Fabric Attach fundamentally introduces autonomic/ automatic attachment to network services for end users, or Internet of Things devices to a network infrastructure. Fabric Attach and Fabric Connect are key building blocks of the Avaya SDN Fx architecture. Figure 1- Fabric Attach in a non-spb network Figure 2- Fabric Attach in a Fabric Connect network Fabric Attach in an SDN Fx Environment Software-Defined Networks (SDN) holds great hope as The Solution for nearly every networking pain point that IT departments experience today. Everyday challenges like network complexity, time to service, change management and network scalability are frequently mentioned among the top items that networking administrators would like to see addressed and improved. It is an interesting fact that SDN was born out of the needs of avaya.com 4
Network Service Providers and Data Center Hosting Providers to address these same challenges. The challenge of manually provisioning every router or switch from edge to core to edge just to turn up a new service or application is very time consuming, labor intensive and prone to errors. SPB was born out of the need to address this challenge from a networking perspective. A solid network foundation is required to make SDN a reality. Avaya SDN Fx is designed to enable SDN programmability on that solid, autonomic foundation. Fabric Attach and the promise of SDN Fabric Attach is a key building block to reaching the promise of SDN, full programmability, pervasive policy and the necessary security to ensure on-going performance. Avaya has brought the powerful benefits of Fabric Connect to the very edge of the network and is now going beyond. Avaya Open Networking Adapter (ONA) will bring Fabric Attach autonomic capabilities to the very edge, to end devices. Many enterprises are burdened by the need to support legacy devices. In medicine it may be an MRI system or in manufacturing it could be an automated system. Devices like these require lots of individual attention and care to keep running while they also produce extra effort and risk for the IT department. Extra effort in the form of manual inventory and device location and risk in the form of a device that could be compromised by hackers or inadvertently by an employee charging their personal device on an available USB port. Fabric Connect, Fabric Attach and ONA offer IT groups a force multiplier bringing powerful security (and stealth!), SDN ready programmability and autonomic capabilities to today s networks. avaya.com 5
Fabric Attach on legacy switches ensures that older switch platforms can benefit from all of the ease of use and configuration that the fabric capable switches have. Appendix Fabric Attach Use Cases This white paper describes the inner workings and the components of the Avaya Fabric Attach (FA) solution. In this appendix, we intend to demonstrate how we put the Fabric Attach components into practice. We also want to demonstrate the inherent simplicity that the FA solution brings to a broad range of different environments, thus lowering time to service, lowering operational cost and ensuring IT teams are freed of low-value operational tasks and can apply their skill and time to business relevant tasks. The inherent power of Fabric Attach is already demonstrated by the sheer amount of possible use cases. The selection of use cases discussed in this paper tries to cover a broad range, but is by no means comprehensive. Example use cases covered are: Extending Fabric Capabilities to legacy (non MAC in MAC switches) Extending the Fabric value to Wireless Networks SDN Fx, Fabric Attach and the Open Networking Adapter SDN Fx and Fabric Attach in the modern data center to enable VM mobility SDN Fx, Fabric Attach and the Internet of Things Extending Fabric Capabilities to legacy (non MAC in MAC switches) One of the early and important use cases for Fabric Attach is the extension of Fabric capabilities to legacy Avaya switches that do not inherently support MAC in MAC for deployment in both Fabric and non-fabric environments. While this indeed pertains to legacy switches of significant age, is exemplifies Avaya s commitment to providing customers with maximum investment protection while enabling a smooth migration path to the Avaya Fabric and SDN Fx architecture. Fabric Attach on legacy switches ensures that older switch platforms can benefit from all of the ease of use and configuration that the fabric capable switches have, i.e. the edge service configuration (for details, refer to the body of the white paper). While these switches will not have all of the capabilities of a fabric enabled switch (a Fabric Connect Backbone Edge Bridge (BEB)), this use case provides investment protection to our customers, extends the ease of use and automation to the legacy edge of the network and provides a smooth migration path to Avaya Fabric and SDN Fx. avaya.com 6
Example 1: Fabric Attach in combination with Fabric Connect with wired and wireless access Example 2: Fabric Attach in combination with a legacy network core with wired and wireless access While Example 1 is a powerful end-to-end solution, Example 2 shows that Fabric Attach can also be deployed at the edge with a legacy routed core, for instance in situations where a new Avaya edge is added to an existing legacy Avaya or non-avaya core. As this network evolves to Fabric Connect, the addition of Fabric Extend can interconnect disparate fabric networks and can create a single Fabric Connect environment. Fabric Extend allows Fabric Connect to be deployed over any existing LAN/WAN network in the migration to a full fabric environment. The above use case is likely to be one of the more widely deployed scenarios. For sake of completeness, the table below summarizes some of the different possible variants of this use case. avaya.com 7
By bringing Fabric Attach to the wireless infrastructure, Avaya has significantly reduced the operational cost related to deployment and management, but additionally enables service roaming by allowing virtual services network (and users on them) to securely roam from AP to AP with the service network. Core Edge FA policy via Identity Engines 2 Legacy Fabric Attach No Legacy Fabric Attach Yes Legacy with Fabric Extend overlay Legacy with Fabric Extend Overlay Fabric Connect & Fabric Attach Fabric Connect & Fabric Attach Fabric Connect Fabric Extend No Fabric Connect Fabric Extend Yes As explained in the body of this white paper, while Identity Engines is not strictly required for FA to work, Identity Engines is a very powerful and recommended addition to the FA framework. Extending the Fabric value to Wireless Networks As wireless becomes more prevalent, the demand driven by BYOD and the general trend towards more than one wireless device per user increases, much of the edge network traffic shifts to wireless from wired, forcing IT organizations to upgrade and deploy a higher density of access points to ensure sufficient capacity and coverage. In response to this trend, Avaya has launched the Avaya WLAN 9100 series of Access Points (AP) that provide a far more scalable solution than previous controller-based AP s. But with this increased density of devices, the deployment of the AP s, security and virtualized traffic management becomes an increasing challenge for IT organizations. No Yes Enter Fabric Attach on Avaya Wireless LAN 9100! By providing Fabric Attach on the AP s, Avaya enables zero touch deployment, meaning that no longer is the IT organization required to deploy AP s, but anyone capable of mounting the AP and connecting an RJ45 cable to a PoE switch can deploy the device. As the device boots up, it is authenticated by the network, connects to its controller automatically, deploys the required configuration and uses Fabric Attach to map wireless traffic onto the required virtual service network (VSN) automatically based on policy 3. By bringing Fabric Attach to the wireless infrastructure, Avaya has significantly reduced the operational cost related to deployment and management, but additionally enables service roaming by allowing virtual services network (and users on them) to securely roam from AP to AP with the service network. This capability significantly enhances usability and supports effective spectrum usage, but also significantly lowers operational cost related to configuration management as well as decreasing risk as non-required service networks are removed from the AP s automatically when they are no longer needed. avaya.com 8
Example 3: Fabric Attach in combination with WLAN 9100 and Identity Engines SDN Fx and the Open Networking Adapter The revolutionary and newly released family of Avaya Open Networking Adapter (ONA) products, marries Open Source vswitch software with Fabric Attach creating an innovative hardware package. The ONA is at the core of providing a broad range of innovative SDN enabled edge solutions by attaching these devices to the Fabric. By attaching these devices to the fabric and the Avaya SDN controller, Avaya enables ease and speed of deployment as well as full SDN programmability. Avaya, through Fabric Connect and Fabric Attach as core elements of the SDN Fx Architecture, enables one of the simplest possible deployment model for a SDN solution in the industry. Example 4: Fabric Attach and the Open Networking Adapter as part of the SDN Fx architecture avaya.com 9
Avaya Fabric Attach provides IT organizations a means to support device auto attach and zero touch mobility. This model is highly flexible and allows customers to adjust to their specific needs in terms of programmability and security as well as ease of use. For more details please refer to the latest Avaya White papers on Avaya SDN Fx and the Avaya Open Networking Adapter SDN Fx and Fabric Attach in the data center to enable VM mobility Similar to the wireless access points and the Open Networking Adapter family of products, Avaya s submission of the standard Fabric Attach 4 code into the Open vswitch provides data center operators with the ability to significantly reduce the complexity related to attaching, moving and removing VM s in the network. The Fabric Attach enabled Open vswitch is the standard hypervisor switch in Open Source environments such as Xen and KVM, but also has been ported to Microsoft Hyper-V. This means that VM s can automatically attach to the required virtual service network, and can be moved with the service network attachment following the VM. When a VM is disconnected or relocated, the original network configuration point is automatically removed without any operator intervention. Unlike other vendor implementations, this approach does not require additional software to manage the synchronization between the management system and the network. This results in a unified data plane (the fabric), massively reduced complexity and cost since less software layers and licenses are required. From an operational perspective, this approach also delivers far better insight into traffic flows and can benefit from the carrier grade OAM and Fault Management capabilities of the fabric. With powerful Avaya tools, including Avaya Diagnostic Server that can help data center operators monitor their SLA s and pinpoint and resolve issues quickly. Example 5: Significantly simplified VM mobility with Fabric Attach 5 For more details please refer to the latest Avaya White papers on Avaya Data Center Architectures and VM Mobility and the Avaya SDN Fx avaya.com 10
SDN Fx, Fabric Attach and the Internet of Things In 2014 many things were said about the Internet of Things (IoT) but did not fully materialize. The reality is that in 2015 and beyond, we will see an explosion of devices. However, it is less important when exactly it will happen, the fact is that it will and in some industries such as manufacturing, healthcare it is happening already. The consequence of this increase in devices and Machineto-Machine communications is a significant increase in operational cost since IT organizations will need to manage all these devices. Avaya Fabric Attach, with or without the recommended Identity Engines for policy control and authentication, provides IT organizations a means to support device auto attach and zero touch mobility. This model is highly flexible and allows customers to adjust to their specific needs in terms of programmability and security as well as ease of use. Examples that use auto attach to provide zero-touch mobility and enhanced IoT security are the following: Option 1: Use Identity Engines to authenticate the device or user, and via policy automatically map the device or user into the designated VSN Option 2: Use ONA s (without Identity Engines) to auto attach a device to the network and then use the Avaya SDN controller to dynamically assign the device to a designated VSN as well as securing flows down to the required set of flows Option 3: Use ONA s (with Identity Engines) to authenticate the device, auto attach a device to the network and then use the Avaya SDN controller to dynamically assign the device to a designated VSN as well as securing communications down to the required set of flows. Note that there are many more options and combinations, however, key is that customers have a wide range of options using the same base components (Fabric Connect, Fabric Attach, Identity Engines and Open Networking Adapters) to tailor design the solution required for the specific use case whereby different use cases can naturally co-exist. Customers can tailor the solution based on mobility needs, automation needs, policy control, flow control and security, SDN programmability, etc. to suit their specific needs. For more details please refer to the latest Avaya White papers on Avaya Open Networking Adapter and the Avaya SDN Fx * Note that Avaya has submitted the client code and a reference framework into open source at https://github.com/auto-attach to allow customers and IoT developers to make use of the auto attach capabilities. Examples are security camera s, sensors, etc. for which vendors today already support auto attach. 1 Fabric Connect Customer Experience Research (Market Dynamics, January 2015) 2 Avaya Identity Engines; http://www.avaya.com/usa/product/identity-engines/ 3 Requires Avaya Identity Engines 4 The standard refers to this function as auto attach 5 Note that Identity Engines is optional. Note also that SMLT support supporting server dual homing and auto attach are scheduled for VOS Rel 5.1 avaya.com 11
About Avaya Avaya is a leading, global provider of customer and team engagement solutions and services available in a variety of flexible on-premise and cloud deployment options. Avaya s fabric-based networking solutions help simplify and accelerate the deployment of business critical applications and services. For more information, please visit www.avaya.com. 2015 Avaya Inc. All Rights Reserved. Avaya and the Avaya logo are trademarks of Avaya Inc. and are registered in the United States and other countries. All other trademarks identified by, TM, or SM are registered marks, trademarks, and service marks, respectively, of Avaya Inc. 03/15 DN7713-01 avaya.com 12