Cloud-Based Services: Assure Performance, Availability, and Security What You Will Learn Services available from the cloud offer cost and efficiency benefits to businesses, but until now many customers have been hesitant to buy cloud services, especially for mission-critical business applications, because of concerns about security, performance, and availability. Cloud service providers need to address these concerns by offering network services that benefit virtualized applications hosted in the cloud. Cloud service providers can use their data center and IP NGN assets to deliver these services. However, they need a new service delivery model that fits their cloud service environment, offering the scalability, flexibility, and multitenant capabilities needed for cloud service delivery. This document provides an overview of the trends and challenges for cloud service delivery and describes the Cisco technologies and platforms in the data center that cloud service providers can use to address their customer s concerns with security, availability, and performance for applications hosted in the cloud. This solution provides a framework for service delivery that meets the needs for deploying services for virtualized applications in a way that scales and facilitates rapid service delivery, allowing customers to adopt cloud services with greater confidence while rewarding cloud service providers with increased revenues and customer loyalty. The Trend Towards Cloud Services Many Chief Information Officers (CIOs) are measured on the business impact they can create. This means being accountable for new service creation and revenue generation, promoting profitability and productivity, and delivering new business models. To meet the objectives of delivering new services to support the business while keeping costs down, many organizations wish to reduce their information and communications technology (ICT) investment and move to cloud services. In a recent report, IDC predicts a huge growth for this market, with "six times the rate of IT spending between now and 2013 for cloud services. In 2009, approximately $17 billion was spent on cloud-related technologies, hardware and software. By 2013, that spending is expected to grow to $45 billion." IDC says that in 2 to 5 years, 40 percent of service provider customers will buy cloud services and cloud-related spending could account for 25 percent of IT spending growth. Merrill Lynch sees a larger market, and believes that by 2012 the value of the cloud computing market opportunity will be $160 billion, including $95 billion in business and productivity applications such as email, office, and customer relationship management (CRM) applications, and $65 billion in online advertising. Gartner s estimate falls between those of IDC and Merrill Lynch: a $56.3 billion cloud market for 2012. Harris Interactive, in a recent survey, indicates that 43 percent of IT executives foresee increased use of both public and private cloud platforms. Among 210 IT executives surveyed in the United States, about a third currently uses private cloud-based services, while another third uses both private and public cloud services. All of these reports agree that cloud services represent a significant opportunity for cloud service providers. Motivators and Challenges for Cloud Services There are many motivators for adopting cloud computing. Cloud services can transform enterprise IT departments, because the enterprises can reduce data center capacity requirements by bursting their peak-capacity workloads to the cloud service provider. Organizations no longer need to maintain large groups of servers for temporary workloads. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 8
Customers like the fact that they only pay for services that they use and that these services are standardized at predictable prices and performance levels. To reduce operational complexity and costs, many customers emphasize automation of service delivery. Customers want to be able to scale up services as they need them. They want services that are simple to use and that support assigning roles, verifying identity, and enforcing policy across services. Customers expect service level agreements (SLAs) and expect to be able to access resources when and where they need them. As businesses look to cloud-based services, they realize that money invested in these services increases productivity and efficiency across the rest of the organization. Adopting cloud services lets businesses focus on what they do best while optimizing their resources. However, to some degree organizations have been cautious in their adoption of cloud services. The transition to cloud services can be hindered by a number of concerns. Security is primary, and trust-based security is a crucial element as companies move into cloud-based models and virtual services. Another major inhibitor of cloud adoption is poor application response time experienced by users in remote sites. The latency of the WAN link between the data center and cloud location and the user at the remote site adversely affects the performance of business applications. IDC recently reported that security, availability, and performance are the top three concerns mentioned by potential adopters of cloud services. As service providers build out data centers and networks for cloud service delivery, they are looking for ways to address these customer concerns. Evolving Service Delivery Models With the development of anything as a service, and rise of cloud computing, service providers are changing how they deliver services. The service delivery model is evolving from the original customer premises equipment (CPE) model, such as managed router or WAN optimization services, toward hosted communications services and Infrastructure as a Service (IaaS) and Software as a Service (SaaS). This trend toward cloud-based services requires a network infrastructure that supports customer migration to the cloud. Customers are at different stages of adoption of these services, and migration may span stages. Customers still have their own data centers and host their own services, but they are also considering moving applications to the service provider data center and taking advantage of the cost benefits of using IaaS and SaaS. As service providers examine their assets, they see that by having data centers for application hosting and by owning the WAN that provides the connectivity, they are uniquely positioned to take advantage of the growth of cloud services. Compared to traditional hosting providers and over-the-top (OTT) providers such as Google and Amazon, the combination of data centers and WANs allow service providers to create services that address the concerns of their customers. To take full advantage of these assets, cloud service providers need a model for delivering cloud services in a consistent manner that helps them to address customer concerns and provides performance, availability, and security. Cisco Unified Network Services: Solution for Cloud Service Delivery Delivering cloud services poses new requirements for packaging and deploying network services. The model for offering services in a cloud environment must support on-demand deployment and associate the services with specific application server virtual machines, giving the cloud provider the agility and capability to offer a differentiated optimized-application service rather than a basic computing service. The model must include the following components. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 2 of 8
Configuration automation: The cloud services model must support automation of network configuration for consistent and compliant configuration even with increasing scale, so as new server virtual machines are instantiated to accommodate increasing application load, the network configuration needed to optimize these new virtual machine instances is in place. Automation provides rapid deployment and consistent enforcement of network policies. Multitenant deployment: Support for multitenant deployments must be provided, to reduce the hardware required and lower the fixed hardware costs for the cloud service provider. Virtual machine moves within a multitenant environment create operational complexity related to troubleshooting and traceback, but the benefits of privacy, security, and cost efficiency outweigh these concerns. Virtual machine mobility: The model must support awareness of virtual machine mobility. Given the dynamic nature of cloud resource pools, services provided to a set of application servers need to be continually available regardless of the physical location of the application server virtual machines. Elastic scaling: The model must support simultaneous scaling of the service in different ways for different tenants as demand grows or diminishes, requiring an elastic scale deployment architecture. Services Evolution in the Data Center To meet their customers requirements for delivery of applications with high performance and security, service providers offer services such as server load balancing, WAN optimization, and security as managed services, and provide reporting and monitoring of application performance to demonstrate the value of the services to customers. Customers who obtain application services from the cloud require the same types of network services as those provided in a managed services environment. Cloud-based applications travel over the service provider s network to the customer s remote locations and they are hosted as virtualized instances on the cloud service providers compute platform. Customers expect their applications to operate securely and their data to be protected, so cloud service providers need security solutions that work in the virtualized and dynamic cloud environment. Customers expect high availability for their applications, so cloud service providers need a solution for server load balancing. Customers also expect high performance for their applications over the network, so cloud service providers need a solution for WAN optimization. Because meeting all of these expectations requires that you can demonstrate performance and availability to customers, cloud service providers also need a solution for visibility, monitoring, and reporting. Cisco provides devices for many of these services today in a physical form factor. Among these are Cisco Wide Area Application Services (WAAS) for WAN optimization and Cisco Application Control Engine (ACE) for server load balancing, both of which deliver application performance enhancements, and the Cisco Adaptive Security Algorithm (ASA) and Cisco Firewall Services Module (FWSM), implemented for security. For monitoring and reporting, Cisco provides the Cisco Network Analysis Module (NAM), which interoperates with network management solutions from our network management system (NMS) partners. Many service providers are already using these devices to deliver managed services or services from their data centers and across the network. For example, Cisco WAAS and the Cisco NAM are used in application performance management offerings. As service providers move to offer cloud services, they need virtual form factors. Racking and stacking hardware within cloud environments reduces the fundamental economic advantages and shared resources across the model. As service providers prepare to deliver cloud services, Cisco is migrating these network services devices to a virtualized form to support delivery from the cloud. Cisco has already announced virtual WAN optimization, Cisco virtual WAAS (vwaas), and security through the Cisco Virtual Security Gateway (VSG) and Cisco NAM, in their virtual form factors. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 3 of 8
Unified Network Services for the Cloud As service providers move from a physical to a virtualized service delivery model, they have certain expectations. They might currently be using network services in a physical appliance or router module (for example, Cisco WAAS), or a switch module (for example, Cisco ACE), for server load balancing. In their virtualized form these modules should provide consistency across each of the services and the features that are supported. The modules should provide a policy framework that helps service providers to treat multiple services in a consistent way in the data center. These services have to scale out to serve many customers, not just scale up to serve one large workload. This means that in addition to the dedicated, hardware-coupled model, you need a dynamic on-demand model, where hardware is decoupled from software, allowing rapid deployment. The physical devices will not go away. There will still be many instances where you might choose to deploy dedicated appliances or service modules. The virtualized network service model needs to provide scale and awareness of virtual machines. The Cisco solution can be deployed using a platform for service delivery based on the Cisco Unified Computing System (UCS) servers, using the Cisco Nexus 1000V Series Switch and the VMware hypervisor, with the virtualized network services running upon this platform. The Cisco UCS is the foundation, and on this runs the VMware Hypervisor and the virtualized services such as vwaas or VSG. They are all connected by the Cisco Nexus 1000V, which associates the physical network with the virtualized servers and services. These services are managed through the Cisco Virtual Network Management Center (VNMC). With this platform, service providers can scale services horizontally across many tenants and instantiate services on demand as they deploy virtual machines for their customers. This Unified Network Services (UNS) model exists within the Cisco Unified Service Delivery architecture, but moves the services from the aggregation layer to the virtualization layer. Let s look at some of the Cisco UNS services and the platforms on which they run. Cisco Virtual WAAS: Cloud-Ready WAN Applications delivered from the cloud need high performance as they travel across the network to users in remote offices. These offices might be serviced by links with limited bandwidth, high latency, and congestion. This situation offers an opportunity to build WAN optimization as a service, on a utility basis, in response to the provisioning of application server virtual machines. The solution must be virtualized so that devices can be deployed on demand, unlike hardware appliances, which need to be racked, stacked, and cabled. These virtualized devices reduce hardware costs in environments serving multiple organizations, because a dedicated device is not needed for each tenant. As user demand increases, service providers can easily scale up performance of virtual appliances by moving them to a more powerful platform or by allocating more resources on existing platforms. Cisco vwaas is the industry s first cloud-ready WAN optimization solution. Cisco vwaas is a virtual appliance that accelerates business applications delivered from private and virtual private cloud infrastructure, providing optimal user experiences for workers in remote branch offices. Cisco vwaas runs on VMware ESXi Hypervisor, so it is integrated into the virtualized environment. And Cisco vwaas runs on Cisco UCS x86 servers, allowing an agile, elastic and multitenant deployment model. Cisco vwaas is the only WAN optimization service that supports on-demand orchestration, using policy-based configuration in the Cisco Nexus 1000V switch. This means that Cisco vwaas service is associated with specific application server virtual machines as they are instantiated or moved. This allows cloud service providers to offer rapid delivery of the WAN optimization service, with minimal network configuration, to improve the performance of hosted applications in remote locations over congested links with low bandwidth. Cisco vwaas is the only WAN optimization service that will be system-tested with Cisco computing, network, and storage products to help remove risk from your deployment for cloud services. These capabilities allow cloud service providers to offer value-added cloud-optimized application services on demand in their catalogs of cloud services. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 4 of 8
Cisco vwaas helps cloud providers to offer rapid creation of the WAN optimization service, with minimal network configuration and disruption in cloud-based environments. This model fundamentally changes the economics and the pervasiveness of WAN optimization, so you can not only sell WAN optimization, but also support a more rapid transition to cloud services, which will provide other revenue streams from your cloud hosting services. Cisco Virtual Security Gateway Security is a major concern that customers have with adoption of cloud services. In a virtual world, security is shared across the hypervisor, which has to be multitenant. Customers have many workloads, such as web and application traffic, database traffic, and virtual desktop infrastructure (VDI), as well as data that must be Payment Card Industry (PCI) compliant. To create services in a shared virtualized environment, service providers need virtualized and virtualization-aware tools for security enforcement. This requires the ability to apply security to virtual machines and security policies that can follow the machines as they move in the cloud. Cisco VSG and Cisco VNMC provide policy control and security to support cloud service delivery. Cisco VSG can apply security to the virtualized infrastructure, not just to the network. Cisco VSG goes beyond IP address, port numbers, and VLANs. The gateway recognizes a virtual machine and can apply security policies to the virtual ports that it uses, and the gateway follows that virtual machine from one data center to another in the cloud and maintains the security policies. Cisco VSG uses an extensible rule engine to interpret virtual machine context and apply rules based on this context. The gateway can also apply policies to security zones. This goes beyond a VLAN and recognizes a zone within a VLAN, so that the service provider can designate one VLAN per customer and provide a security zone within that VLAN, such as a zone for a workload. The gateway also recognizes segments such as a virtual data center or a virtual application, so it is flexible in a cloud service delivery environment. The Cisco VSG is multitenant, so it can be deployed scalably in the virtualized environment, and it has APIs, so other portals and orchestration tools can connect to it and provision in an automated way. The Cisco VSG is managed by the virtual network management center, a centralized console for configuring policies across an entire virtualized cloud infrastructure. Cisco VNMC supports separation of duties, so that the server management team can be assigned roles to define security policies within their areas of control. With the virtual network service data path (vpath) technology in the Cisco Nexus 1000V switch, the Cisco VSG can be transparently inserted into the virtualized environment. Security profiles are provisioned in the Cisco VNMC, and they are applied to virtual machines, forming logical zones. The insertion of Cisco VSG is topology-independent and its policy enforcement is VLAN-independent, so security deployment and enforcement is decoupled from the underlying network environment. This gives you operational simplicity. For resiliency, the Cisco VSG is deployed in an active standby high-availability mode, just as in traditional appliance or network device deployment. Thus security can be maintained even in the event of failure of a server that hosts the active gateway. Cisco VSG natively supports dynamic provisioning of virtual machines through security profiles, and helps ensure that policies follow vmotion events. When a new virtual machine is instantiated, it has the 1000V port profile applied for network policies, along with its corresponding security profile. If the virtual machine moves to a different host, the zone moves with it. Security enforcement is transparent to vmotion events. If you need to upgrade a server s hardware, you simply move the virtual machines to a different server, and the zones move with them. In this way the Cisco VSG not only supports agility for a virtual environment, but also supports agility of the physical infrastructure and allows rapid deployment of security in a virtualized environment. With these capabilities, the Cisco VSG provides security services for cloud-hosted applications. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 5 of 8
Cisco Network Analysis Module The Cisco NAM is the basis of an application performance management service. Cisco NAM is used for application performance monitoring of voice, video, and TCP-based applications. The module gathers data from Cisco IOS services such as NetFlow, and provides end-to-end visibility into WAAS deployments and the response time for optimized traffic. Cisco NAM can be used for per-application and per-user specificity of traffic analysis, and for advanced troubleshooting. Cisco NAM provides support for Cisco WAAS, and allows the service provider to measure the application response time and bandwidth improvements that WAAS delivers and to view the application delivery improvements at the client side, the WAN side, and the server side. Cisco NAM can report on the following: Total delay (response time) and total transaction time as experienced by the client Bandwidth usage (bytes and packets) as experienced by the client Number of transactions as experienced by the client Server application delay Bandwidth usage (bytes and packets) on optimized WAN links Server bandwidth usage (bytes and packets) and WAN network delay The service provider can use NAM to provide application performance consulting services and application tuning services. When using Cisco WAAS as a data source, the application performance metrics can not only help troubleshoot issues with the Cisco WAAS service, but can also highlight and verify the performance gains realized by employing Cisco WAAS. Cisco Nexus 1000V Series Switch What ties Cisco UNS services together is the Cisco Nexus 1000V, a virtualized switch in the VMware hypervisor. Cisco vwaas and Cisco VSG use the virtualization-aware switching capabilities of the Cisco Nexus 1000V, called vpath, to provide network awareness for the virtual machines, so as they move from server to server or from data center to data center, their network attributes follow them. The Cisco Nexus 1000V is integrated with the VMware hypervisor and is located in the kernel to provide fast-path performance. The Cisco Nexus 1000V switch provides feature and operational consistency with the physical Cisco Nexus switches, so network administrators can manage using Cisco command-line interfaces (CLIs) in their traditional environment, as well as in the new virtual environment, using the Cisco VNMC. You also get the advanced Cisco NX-OS capabilities, such as security features and private VLANs. All of the Cisco NX-OS control plane security features are in the Cisco Nexus 1000V. Thus, the network team can manage the network and the server team can managed the servers, but the server team does not have to worry about VLANs, QoS, and other network-related issues. Administrative tools work the same in this virtual environment as well, including syslog, Management Information Bases (MIBs), and network management and analysis. This allows service providers to offer services to many customers on a shared platform, in an automated way that preserves administrative roles. Cisco Unified Computing System As you build out your cloud service delivery architecture, you need a computing platform that lets you be more responsive to the business, at a lower cost. Virtualization is an essential component of this delivery model, but it only addresses part of the problem, while possibly increasing operational expenses and infrastructural complexity. To overcome issues that virtualization introduces, you need a computing platform that is designed for the virtualized service delivery environment, that is flexible and scalable, and that is designed for rapid service delivery. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 6 of 8
The Cisco UCS is the foundation of the Cisco Unified Network Services framework. This integrated system brings together the network fabric, computing resources, and virtualization and management software to simplify setup, improve business metrics, and support just-in-time provisioning for service deployment. The Cisco UCS simplifies and accelerates deployment of new infrastructure (virtualization, server, network, and storage) and new applications and services to support your hosted application delivery environment. A major component of service delivery is the provisioning of services. When you deploy services on the Cisco UCS, you can reduce both capital and operating costs while improving the return on your assets. Studies conducted by Cisco have found that the Cisco UCS accelerates the startup of new services by 20 percent, reduces site total cost of ownership (TCO) by 20 percent, reduces platform TCO by 15 percent, and reduces organizational TCO by 35 percent. Cisco UCS lowers costs by its design as a preintegrated system that preassembles the network fabric, computer resources, virtualization software, and management software to reduce complexity, in a way that is optimized for virtualization applications. Vblock Infrastructure Packages The Vblock architectures are a pretested, integrated and validated data center foundation from Cisco, EMC, and VMware. Vblock is a computing and storage platform built on Cisco UCS, Cisco Nexus 1000V, VMware and EMC storage. Cloud service providers can deploy Vblock as the basis for cloud service delivery. If service providers use Vblock for application hosting, Cisco UNS lets them earn additional revenue from Vblock and differentiate the service offering. Vblock Infrastructure Packages are integrated IT offerings from the Virtual Computing Environment (VCE) coalition, combining the best products in their categories for networking, computing, storage, security, and management technologies with end-to-end vendor accountability. These technologies are preintegrated into a new way of delivering IT to business and are validated to support the creation of customized solution packages by the channel, partners, and independent software vendors. Rather than buy and assemble individual components, customers can use Vblock Infrastructure Packages, which are validated, secure, and warranted. Service providers may wish to build a service delivery cloud (to provide multitenant services to multiple customers as well as for internal IT use), often called a public cloud. Service providers may use the Vblock design as a component for an enterprise data center or as a component in their overall service delivery solution; for example, Cisco Unified Service Delivery, which integrates data-center and IP NGN networks for secure end-to-end delivery of services to multiple customers. Data Center Service Delivery Framework Improved data center agility and efficiency transforms IT, allowing the adoption of cloud-based services and enhancing the productivity and efficiency of organizations. Cloud computing models are changing as organizations seek to deliver application fluency and scale regardless of location or device. Within the data center, concepts such as virtualization have become entrenched, and virtual machine awareness and workload mobility are now requirements. Cisco is exceptionally well positioned to address customer requirements for cloud computing solutions. With an extensive partner ecosystem, Cisco can deliver effective solutions based on its emphasis on systems engineering. The Cisco Unified Fabric and Cisco UCS approaches provide the basis for delivering true architectural flexibility, investment protection, and lower TCO. These approaches offer service providers an open, scalable, highperformance foundation on which to offer network, computing, and application-level services that address the new challenges arising in data centers and across enterprises. 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 7 of 8
Application performance and fluency within data centers and enterprises is increasingly important, as applications become more pervasive and device-independent. Security is also essential, especially as companies move to cloudbased models and virtual services. These services require optimizing resources and enhancing security, application availability, and performance transparently across an organization. Cisco Unified Fabric and Cisco UCS provide holistic solutions instead of disconnected partial answers. Together with Cisco Lifecycle Services and Cisco solutions for simplified policy-based management Cisco Unified Network Services provides the needed resources to enable service providers to deliver cloud-based services with agility. For More Information For more information about Cisco vwaas, visit http://www.cisco.com/go/waas For more information about Cisco VSG, visit http://www.cisco.com/go/vsg For more information about Cisco NAM, visit http://www.cisco/go/nam Printed in USA C11-642666-00 01/11 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 8 of 8