VACS: Secure Application Segmentation in Minutes

VACS: Secure Application Segmentation in Minutes Joachim Jerberg Jensen Systems Engineer, Global Service Providers CCIE SP #42403 September 2015

Agenda VACS overblik 4 slides Container Topologies Deployment process Hvad er nyt I VACS 2.0 Customization Demo af portal og VACS UCS-D komponent Cisco Confidential 2

VACS Overview Cisco Confidential 3

Cisco Virtual Application Container Services (VACS) Secure segmentation in minutes on shared infrastructure Simplified virtual networking and security Unified virtual services licensing: cost-effective solution Cisco Confidential 4

Secure Segmentation in Minutes on Shared Infrastructure Current physically segmented architecture Virtual segmentation with VACS Physical segmentation results in longer provision time and under-utilized resources Procure, rack, stack and provision individual devices Secure segmentation in mins on shared infrastructure Enforced by best in class virtual networking and security services Simplified virtual networking and security Vcenter Virtual segmentation independent of physical topology VACS VACS Unified virtual services licensing: cost-effective solution Vcenter Cisco Confidential 5

Simplified Virtual Networking and Security on Shared Infrastructure Current provisioning model Wizard based provisioning model with full life cycle mgmt. of virtual services No longer have to configure individual components. VACS does it for you. VACS VACS Provisions subnet / NAT / Routing Provisions VIP Provision FW rules / GW Vcenter Vcenter Cisco Confidential 6

Unified Virtual Services Licensing Per Server Based Current pricing schema makes virtual services cost prohibitive Every vendor has different licensing schema Per instance based Expensive as throughout increases Automated Provisioning and Orchestration UCS director Load-balancer HA Proxy VACS Routing CSR 1000V Edge FW CSR 1000V Zone based FW Virtual Security Gateway Unified Licensing Per Server Based Create as many instances as you need and with 10G throughput! Virtual Fabric Nexus 1000V Platform for Distribute FW HA Proxy in VACS 2.0 GA June 15 Cisco Confidential 7

Container Topology Configuration Cisco Confidential 8

What is a VACS Container? VACS Containers are: Virtual Network & Security Services VACS Templates for Application Workloads Topology Configurations designed for logical secure isolation and compliance Exposed through UCS-D GUI to allow rapid and consistent provisioning of Secure Applications Cisco Confidential 9

Types of VACS Logical Container Templates VACS VACS VACS 3 Tier - Internal Access 3 Tier - External Access Custom Container Cisco Confidential 10

Deeper View: VACS Containers 3-Tier (Internal) Upstream Router Routing EIGRP or OSPF or Static CSR 1000V VLAN 1/ VXLAN 101 VACS 3 Tier App Container (Internal) NAT (Optional) L3 Routing EIGRP or OSPF (P2) Edge FW Monitoring Features VSG Zone based FW HA Proxy HTTP(s) LB Web Zone App Zone DB Zone Cisco Confidential 11

Deeper View: VACS Containers 3-Tier (External) Upstream Router Routing EIGRP or OSPF or Static CSR 1000V VLAN 1/ VXLAN 101 VACS 3 Tier App Container (External) NAT (Optional) L3 Routing EIGRP or OSPF (P2) Edge FW Monitoring Features VSG Zone based FW HA Proxy HTTP(s) LB Web Zone App Zone DB Zone Cisco Confidential 12

Custom VACS Containers Upstream Router Routing EIGRP or OSPF or Static VACS Custom Container CSR 1000V VLAN 1/ VXLAN 101 NAT (Optional) L3 Routing EIGRP or OSPF (P2) Edge FW Monitoring Features VSG Zone based FW HA Proxy Any Zone LB Zone 1 Zone 2 Cisco Confidential 13

Going forward - Build container with GW of choice Built-In GW Physical GW Other Virtual GW VM VM VM VM VM VM VM VM VM VACS VACS VACS Virtual GW CSR 1,000v Physical GW ASA/Checkpoint, PAN External Virtual GW ASAv, vgw, vpan * VACS 2.0 GA June 15 Cisco Confidential 14

Example Physical Topology Nexus 5000 Nexus 5000 Nexus FEX Nexus FEX Static or mac-pinning vpc mac-pinning Static or mac-pinning (single trunk supported but not recommended) Server-1 / VEM-1 Server-2 / VEM-2 Server-n / VEM-n UCS-D PNSC Vmware HA vsum Nexus 1000V Manager N1KV VSM HA Pair UCS-D HA Pair Tier 1 VM 1 Tier 1 VM 2 Tier 1 VM 3 N1KV VSM Note: HA is optional for Beta VSG CSR 1000V VACS Container Cisco Confidential 15

VACS Deployments Service Provider Managed Cloud DC Enterprise Multi-Tenant Private Cloud Cisco Confidential 16

Deployment process Cisco Confidential 17

VACS Deployment Phases Day 0 Day 1 Day 2 Day 3+ Review System Requirements/ Fill out deployment worksheet Provision VC and Hosts Allocate IP addresses and IP Address Pools Download necessary files Install UCS-Director Install VACS patch Install UCSD and VACS licenses Install CSR License Perform Package Upload Add Virtual Physical and Virtual Accounts Configure UCSD Cloud Components: Site Pod Cloud Provision VACS Management Components: PNSC N1KV/VSG Hosts Review Container Template Requirements Configure Policy Elements: Compute, Storage, VM Templates, Mgmt and VM IP Pools, VLAN and VXLAN Pools Setup customer Access Controls for custom containers, if required Setup Secure VACS containers using self-service portal GUI Publish Templates to a Self- Service Catalog for end-users Train end-users on ordering containers and managing workload VMs lifecycle Train system admins and operations team on VACS secure container concepts, etc. Server Admin Server Admin SMEs End-Users Cisco Confidential 18

VACS Deployment Phases Day 0 Day 1 Day 2 Day 3+ Review System Requirements/ Fill out deployment worksheet Provision VC and Hosts Allocate IP addresses and IP Address Pools Download necessary files Install UCS-Director Install VACS patch Install UCSD & VACS licenses Install CSR License Perform Package Upload Add Virtual Physical & Virtual Accounts Configure UCSD Cloud Components: Site Pod Cloud Provision VACS Management Components: PNSC N1KV/VSG Hosts Review Container Template Requirements Configure Policy Elements: Compute, Storage, VM Templates, Mgmt & VM IP Pools, VLAN & VXLAN Pools Setup customer Access Controls for custom containers, if required Setup Secure VACS containers using self-service portal GUI Publish Templates to a Self- Service Catalog for end-users Train end-users on ordering containers and managing workload VMs lifecycle Train system admins and operations team on VACS secure container concepts, etc. Server Admin Server Admin SMEs End-Users Cisco Confidential 19

VACS Admin Experience Install UCSD 1 Initial Setup Install UCS Director as the VACS Management Console 2 Apply VACS Patch 3 Apply the UCSD & VACS Licenses UCS-D UCS / Cloud Services Platform UCS 1 UCS N Cisco Confidential 20

VACS Deployment Phases Day 0 Day 1 Day 2 Day 3+ Review System Requirements/ Fill out deployment worksheet Provision VC and Hosts Allocate IP addresses and IP Address Pools Download necessary files Install UCS-Director Install VACS patch Install Latest VACS Workflows Install UCSD & VACS licenses Install CSR License Perform Package Upload Add Virtual Physical & Virtual Accounts Configure UCSD Cloud Components: Site Pod Cloud Provision VACS Management Components: PNSC N1KV/VSG Hosts Review Container Template Requirements Configure Policy Elements: Compute, Storage, VM Templates, Mgmt & VM IP Pools, VLAN & VXLAN Pools Setup customer Access Controls for custom containers, if required Setup Secure VACS containers using self-service portal GUI Publish Templates to a Self- Service Catalog for end-users Train end-users on ordering containers and managing workload VMs lifecycle Train system admins and operations team on VACS secure container concepts, etc. Server Admin Server Admin SMEs End-Users Cisco Confidential 21

VACS Admin Experience Install UCSD 1 Setup Virtual Accounts 2 Setup Physical Accounts 3 Create Groups and Users UCS-D UCS / Cloud Services Platform UCS 1 UCS N Cisco Confidential 22

VACS Admin Experience Install VACS Management Components Install Management Components q Install CSR Token q Install PNSC from GUI (Wizard Driven) q Install N1KV VSM from GUI (Wizard Driven) q Install VEMs via GUI also wizard driven UCS-D VSM PNSC UCS / Cloud Services Platform VEM UCS 1 VEM UCS N Cisco Confidential 23

VACS User Experience Define Global Resource Pools Define Global Resource Pools Ø Define Global Resource Pools q Create Pools of resources for later consumption: q VLAN Pools: VLAN / VXLAN Pools CSR External interface VLAN ID q IP Pools: Global and/or NAT IP Pool VSG Management IP Pool VSG Data IP pool CSR External Subnet IP Pool UCS-D VSM PNSC VEM UCS / Cloud Services Platform UCS 1 VEM UCS N Cisco Confidential 25

VACS in motion - Container Definition & Deployment (Admin View) 3 Tier App Container Template Create container in less than 6 questions Ø Create Template Ø Deploy Container Deploy from Container Templates dynamically installs & licenses VSG, CSR1000V VACS Container Deployment cut from weeks to mere minutes (approximately 20 minutes) Optionally you can deploy VMs along with Container reducing additional steps. UCS-D VSM PNSC UCS / Cloud Services Platform VEM UCS 1 VEM UCS N Cisco Confidential 27

VACS in motion - Container Definition & Deployment (User View) Ø Template are published by Administrators Ø End Users can Deploy Containers themselves Deploy from Container Templates dynamically installs & licenses VSG, CSR1000V dynamically deploys VMs/Apps VACS Container Self Service Portal Deploy without having to engage with IT team Worry free deployments UCS-D VSM PNSC UCS / Cloud Services Platform VEM UCS 1 VEM UCS N Cisco Confidential 28

VACS in motion Deploy Tiered App 1 Add VMs to the Container VACS Container UCS-D VSM PNSC UCS / Cloud Services Platform VEM UCS 1 VEM UCS N Cisco Confidential 29

What is new in VACS 2.0 Cisco Confidential 30

Server Load Balancing as part of VACS container Server Load Balancing functionality supported through open source HAProxy Available for both out-of-box and custom containers Cisco Confidential 31

Building VACS container with Gateway of choice Flexibility in combining VACS services with user-deployed services Available for custom containers VACS provisions the application VMs Gateway IP needs to be manually configured by user on the external gateway Cisco Confidential 32

Further Customization to VACS Cisco Confidential 33

Further customization for Expert Users Use Case: 1. Insert a shell script after Container deployed 2. Add PVLAN to a N1KV port profile 3. Update DNS server after container is created Solution: 1. UCS Director allows custom workflows using custom tasks (scripts) 2. Create custom task 3. Create a custom workflow by appending custom task to the VACS container Type of Task Description SSH Command task Collect Inventory task Execute Cloupia Script task Notify URL task Custom Tasks allowed Executes a command in a secure shell (SSH) session Collects inventory collection task for available devices Execute a script within a workflow Notifies the specified URL Cisco Confidential 34

Creating custom workflows Cisco Confidential 35

VACS Offers for FY15 A la carte SKU s Software only Cisco ONE for Data Center Software only Key Licensing Points: 1. VACS Licensing same as UCSD License per Server for 50 VMs Includes all component product license N1Kv, VSG and CSR 1000V (VACS functionality only) Cisco Confidential 36

Al-a-carte SKU for VACS Option 1: For Existing UCSD Customers Option 2: For New UCSD & VACS Customer or Existing Nexus 1000V Customers Promo Bundle - $6000 LIST/server VACS: VACS - $4500 LIST/server Secured Containers + Virtual Services $4500 LIST Per Server Perpetual Secured Containers + Virtual Services UCS Director: Physical + Virtual Infra Management 4 Months Promo Volume Discounts SKU Available SKU: CUIC-VACS-SVR-PROM Cisco Confidential 37

Demo Cisco Confidential 38

Thank you.