Itex VMware NSX Network Virtualization Presentation Gabriel Maciel VCP3, VCP4/5-DCV, Security+, Project+ Sr. Systems Engineer Canadian Federal Government @gmaciel_ca 2014 VMware Inc. All rights reserved.
Before and After Network Virtualization Low Asset Utilization Transformation High Asset Utilization
VMware - Network Virtualization Benefits 1 2 3 4 5 Speed - Reducing Provisioning Times Changing the Operational Model IT Security - Micro-Segmentation Policy-Driven Services Cost Reduction 3
VMware - Network Virtualization Benefits 1 2 3 Speed - Reducing Provisioning Times Changing the Operational Model IT Security Micro-Segmentation 4
Millions The Starting Point for Network Virtualization 60 50 40 30 20 10 0 2010 2011 2012 2013 2014 2015 Half of all Server Access Ports are already virtual Virtual Server Access Ports 32% CAGR 15% for Physical Source Crehan Research
Network Provisioning is Hard Past Present VLAN networks Firewall 8~10 weeks Less than 1 or more weeks! 30 Minutes Load Balancer IDS, security, monitoring VPN Creating the VM is fast but we still have to wait for other services
Network Virtualization An Analogy Application Application Application Workload Workload Workload x86 Environment L2, L3, L4-7 Network Services Virtual Machine Virtual Machine Virtual Machine Virtual Network Virtual Network Virtual Network Requirement: x86 Hypervisor Decoupled Network Virtualization Platform Requirement: IP Transport Physical Compute & Memory Physical Network
Network Virtualization Layer Internet
VMware - Network Virtualization Benefits 1 2 3 Speed Reducing Provisioning Times Changing the Operational Model IT Security Micro-Segmentation 9
Network & Security Provisioning are Hard 10
Network & Security Provisioning are Hard Request: We need to deploy a new web application with two tiers. Network Admin: How do I implement that topology? Internet Web App 1 7 6 2 3 4 5 8 9
All Software Construct Changing the Operational Model - Simplifying the Provisioning of Network Services Web Tier L3 Subnet App Tier Internet NAT L3 Subnet DB Tier L3 Subnet Physical Network
VMware - Network Virtualization Benefits 1 2 3 Speed Reducing Provisioning Times Changing the Operational Model IT Security - Micro-Segmentation 13
Traffic Patterns in a Typical Datacenter North- South East-West
Goldilocks Zone In astronomy and astrobiology, the circumstellar habitable zone (CHZ) (or simply the habitable zone), colloquially known as the Goldilocks zone, is the region around a star within which planetary-mass objects with sufficient atmospheric pressure can support liquid water at their surfaces.
Why SDDC Virtualization Layer is the Security Goldilocks Zone Software Defined Data Center (SDDC) Any Application Traditional Approach High Context Low Isolation SDDC Platform Data Center Virtualization Any x86 No Ubiquitous Enforcement Any Storage Any IP network High Isolation Low Context
Why SDDC Virtualization Layer is the Security Goldilocks Zone Software Defined Data Center (SDDC) Secure Host Introspection Any Application SDDC Platform Data Center Virtualization Any x86 SDDC Approach High Context High Isolation Ubiquitous Enforcement Any Storage Any IP network
Why SDDC Virtualization Layer is the Security Goldilocks Zone Software Defined Data Center (SDDC) Network & Security Services Now in the Hypervisor Any Application SDDC Platform Data Center Virtualization Firewalling/ACLs Load Balancing Any x86 Any Storage L2 Switching L3 Routing Any IP network 18
Micro-Segmentation with NSX Unit-level trust Data Plane Distributed switching, routing, firewall Control Plane Management Plane Each VM have its own firewall with flexible granularity - entire data center down to the vnic level Security is shrink-wrapped around each workload Physical workloads and VLANS Faults and threats are contained with micro-granularity 19
Micro-Segmentation - Automating Security Operations ATTRIBUTE (if) ACTION (then) Quarantine VM with Firewall Virus found IIS.EXE Vulnerability found (old software version) Monitor VM with IPS Allow / Restrict PCI OR Sensitive Data Found Restrict access while investigating Security operations are automated and adapt to dynamic conditions 20
VMware NSX - The Power of Distribution
VMware NSX - The Power of Distribution
VMware NSX Benefits
VMware NSX Network Virtualization