Transcript Presentation

VXLAN Fundamentals, Architecture &
Roadmap
1
Table of Contents
1. Data Center IP Fabric ‘Building a strong Foundation’
2. What is ‘Network Virtualization’?
3. VXLAN Overview
4. VXLAN Packet details
5. VXLAN Terminology
6. VXLAN Host Discovery
7. VXLAN BUM Traffic Handling
8. VXLAN Layer 2 & Layer 3 Terminologies
9. VXLAN Arista Architecture & Vision
10. VXLAN Roadmap
11. VXLAN Visbility
2
Data Center – ‘IP Fabric’
Building A Strong Foundation
3
Challenges with current network architecture
Legacy Data Center Model
Oversubscription
 Ports on devices are oversubscribed ~ 8:1
 Higher Oversubscription as traffic traverses
north ~ 20:1
North to South
Scalability
 Scales up and not scales out
 Dependent on specific hardware (mix &
match)
 Not scalable to 40GbE / 100GbE
Cost
 As multiple layers, it can get $$$
Mobility
 What happens if my “IP” changes?
 What happens if traffic pattern changes?
Layer 2
Domain
Layer 2
Domain
Layer 2
Domain
Layer 2
Domain
Multiple points of management,
rampant oversubscription, wasteful
cost model
Latency
 High latency
 Low predictability
Data Center ‘IP Fabric’
 Support for East/West 80:20 traffic
pattern
 Deploy L3 routing protocols between leaf
& spine i.e. BGP, OSPF, or ISIS
 Scale up to 64-way ECMP Spine designs
 Everything is only 3 hops away!
 All uplinks from ToR are Active/Active
 Provide network mobility via ‘Overlay
Network’
 Support 100’000s of host ports
 Non-blocking / Non-oversubscribed
architecture
Arista – Spine/Leaf “IP Fabric” Architecture
 
Spine Tier
IP Fabric
Leaf Tier
VTEP3
VTEP1
VTEP2
HYPERVISOR 1
A1
VTEP4
B1
HYPERVISOR 2
A2
B2
Bare Metal
Storage
Bare Metal
Servers
 Network core is an IP fabric laid out in a Leaf-Spine architecture running
ECMP between the two tiers
- Leaf switches - Arista 7150-x or 7050Q-x models are deployed at the TOR connecting
virtualized servers, bare-metal servers, storage arrays and other devices
- Spine switches – Arista 7500’s are deployed at the core
- Routing Protocol – Either EGP (BGP) or IGP (OSPF / ISIS) is run in the IP fabric
6
What is Network Virtualization?
7
What is Network Virtualization?
Network Virtualization is not the same as Server Virtualization!
8
Overlays v Underlays
Network virtualization: ability to separate, abstract and decouple the physical
topology from a ‘logical’ or ‘virtual’ topology by using encapsulated tunneling.
Overlay
Network
Physical
Infrastructure i.e.
Underlay Network
This logical network topology is often referred to as an ‘Overlay Network’.
VXLAN disassociates workloads from physical networks, allowing for
possible transition to cloud based providers
9
Types of ‘Overlay’ Technologies
Any Overlay technology uses Location & Identity separation
Location
Identity
Fabric Path
VXLAN
OTV
LISP
IS-IS
BGP, OSPF, IS-IS
BGP, OSPF, IS-IS
BGP, OSPF, IS-IS
Switch-ID
IP address
IP address
IP address
Client MAC
Client MAC
Client MAC
Client IP / Mac
Flooding
Flooding /
Dynamic learning
IS-IS
Mapping DB
Vendor Proprietary
Yes
Non
Yes
Non
Intra & / or Inter DC
Intra
Both
Both
Inter
Underlay Protocol
Location
Identity
Identity Learning
10
VXLAN Overview
11
Virtual Extensible Local Area Network (VXLAN)
 Ethernet in IP overlay network
 Tunnel between ESX hosts
• Entire L2 frame encapsulated in
• VMs do NOT see VXLAN ID
UDP
• 50 bytes of overhead
 IP multicast used for L2
broadcast/multicast, unknown
unicast
 Include 24 bit VXLAN Identifier
• 16 M logical networks
 Technology submitted to IETF
 VXLAN can cross Layer 3
for standardization
• With Arista, Vmware, Red Hat, Citrix,
Cisco, and Others
Outer
MAC
DA
Outer
MAC
SA
Outer
802.1Q
Outer
IP DA
Outer
IP SA
Outer
UDP
VXLAN Encapsulation
VXLAN ID
(24 bits)
Inner
MAC
DA
Inner
MAC
SA
Optional
Inner
802.1Q
Original
Ethernet
Payload
CRC
Original Ethernet Frame
12
Virtual eXtensible LAN: How does it
work?
VM-1
10.10.10.1/24
Layer 2 Domain between the VM
vWire- VNI 10
VTEP
VTEP
Subnet-A
SW VTEP
Encap/Decap
VXLAN VTEP
VM-2
10.10.10.2/24
Subnet-B
MAC&IP are UDP Encapsulated
HW VTEP
Encap/Decap
VXLAN Frames
Encapsulation at VTEP node is transparent to IP ECMP fabric
13
VXLAN Benefits
 Feature Benefits
- Eliminates current networking challenges in the way of on-demand, virtual
environment:
- VLAN Sprawl
- Single fault domains
- Scalability beyond 4096 segments
- Proprietary fabric solutions
- IP mobility
- Physical cluster size and locality
- Enables multi-tenancy at scale
- Decouples logical networks from physical infrastructure so that applications can
be deployed without worrying about physical rack location, IP address or VLAN
- Based on open and well known standards
14
VXLAN Use Cases
 Physical to Virtual internetworking
 Multi-hypervisor connectivity and integration
 Multi-tenant Cloud environments
 HA clusters across failure domains
 Dynamic growth
 Dynamic resource management
15
VXLAN Packet Details
16
VXLAN Packet
VXLAN is a MAC-in-IP encapsulation
17
VXLAN Header
VXLAN Header is a 8 Byte field comprising of:
(a)Flags (8 Bits)
(b)VxLAN Network Identifier (VNI) (24 Bits)
(c)Reserved (24 & 8 Bits) – Always set to zero.
Flags (8 Bits) – I flag is set to 1 for a valid VxLAN
Network ID (VNI). The remaining 7 bits (designated "R")
are reserved fields and set to zero.
VxLAN Network Identifier (VNI) (24 Bits) – Used for
identification of the individual VxLAN overlay network on
which the communicating VMs are situated. VMs in
different VxLAN overlay networks cannot communicate.
Reserved (24 & 8 Bits) – Always set to zero.
18
VXLAN Terminology
19
VXLAN Terminology – Physical Topology
 
Spine Tier
Hardware VTEP
IP Fabric
Leaf Tier
VTEP3
VTEP1
Software VTEP
VTEP2
HYPERVISOR 1
A1
VTEP4
B1
HYPERVISOR 2
A2
B2
Bare Metal
Storage
VTI
VXLAN Segments
VTI
Bare Metal
Servers
VXLAN Gateway
VXLAN
10001
VXLAN
10002
20
VXLAN Terminology – Logical Topology
External
Host
Data
Center
Network
VARP
VARP
Default
DefaultGateway:
Gateway:
10.100.1.1
10.100.1.1
VXLAN Segment
VTEP 1
VNI
VTEP 3
.1
VXLAN 10001
.2
.10
VTEP 4
.1
.1
10.100.2.0/24
VXLAN 10002
.11
B2
.3
.2
A1
Bare Metal
Storage
VXLAN Segment
VTEP 1
.1
10.100.1.0/24
B1
VARP
Default Gateway:
10.100.2.1
.10
A2
Bare Metal
Servers
21
VXLAN Terminology Explained
 VTEP: VXLAN Tunnel End Point
- VXLAN encapsulation and decapsulation happens at the VTEP
 VXLAN Gateway
- A device which bridges traffic from VXLAN and non-VXLAN environments.
- VXLAN gateways allow for physical and non virtualized devices to communicate with VXLAN
networks
- A VXLAN gateway can be either a hardware or software device
 VNI: Virtual Network Identifier
- a 24-bit number is also called the VXLAN segment ID. The system uses the VNI, along
with the VLAN ID, to identify the appropriate tunnel.
 VXLAN Header – is an 8-byte header that contains the 24-bit VNI value.
It lives in between the UDP header
and the inner MAC frame being carried over the VTI.
 VTI: VTEP Tunnel Interface - a switchport linked to a UDP socket that can be shared
between many
VLANs. Packets bridged through a vlan into the VTI are sent out the UDP socket with a VXLAN header including a
VNI. The socket is bound to a fixed local port, but is not connected to any particular destination port or IP address;
logically, we use sendto() (not send()) to transmit VXLAN-encapsulated frames on the socket. Packets arriving on the VTI
(via the UDP socket, based on their UDP destination port) are demultiplexed into a VLAN for bridging. A 24-bit VNI
within the packet determines which VLAN the packet is mapped to for bridging.
 VXLAN Segment - is a Layer 2 overlay network over which VMs communicate. Only VMs within the same
VXLAN segment can communicate with each other.
22
VXLAN Visibility
23
VXLAN Visibility - Arista’s vmTracer

Full physical to virtual visibility

Network audit to ensure
reachability

Automated provisioning

Workflow without finger pointing

Other awesome capabilities
24
Monitoring VXLANs with vmTracer
Virtualization
 Rapidly correlate vlan to VNI
switch5#:show vmtracer vxlan interface Ethernet48
Ethernet48: esx1.aristanetworks.com/ndsTest/dvuplink1
VM Name
VLAN
vWire
Network
Multicast
-------------------------------------------------------------------------------------------Exchange
5
Corp
172.20.20.0
239.20.20.0
Apache
6
web
182.10.0.0
220.10.10.0
MySQL
7
ERP
172.20.30.0
239.20.30.0
vmTracer
 view VNIs across the data center from the CLI
switch9#:show vmtracer vxlan all
7150s R1: Ethernet 48:esx1/vwTest/dvUplink 1
vWire:Corp -- VLAN:5
vWire:ERP -- VLAN:7
VTEP
VTEP
VTEP
VTEP
7150s R2: Ethernet 40:esx2/vwTest/dvUplink 1
vWire:Corp -- VLAN:5
vWire:web -- VLAN:6
VMware NSX
Hypervisor
Physical
25
Automate Learning of VNI State
NSX Controller
New VNI CalBears
Multicast Group - 224.0.14.13
VNI ID 650782
Interface Ethernet 24
VXLAN VTEP VNI CalBears
Interface Loopback0
VXLAN VTEP Gateway VNI Calbears
IP Address 204.181.40.1/24
<--Network
VMOski
VNI - CalBears
26
Where is my VM now?
spine0: show vmtracer vxlan
VNI-Name
VNI
#VTEPs
Subnet
Auburn
5096
204.181.40.0/24
foo
15893425
5
bar
65456
192.168.10.0/20
Learning
Mcast Group
4
Flood
Flood
spine0: show vmtracer vxlan vni Auburn
VNI Name:
Auburn
VNI Segment ID: leaf15096
VTEP
Switch
ESX1
ar24
ar22
ESX4
Type
Status
Port
Model
VMware
Up
ar16
eth15
Arista
Up/GW
ar24
loop0
Arista
Up/Up
ar22
eth2
VMware
Up
ar2
eth23
Inside
3 VNICs
7050S
204.181.40.1
7150S
1 MAC/IPs
7150S
4 VNICs
7050T
224.0.1.95
224.0.4.84
Flood
45
Status
Up
Up
128.218.56.0/24
224.5.1.92
Down
spine0
leaf2
Outside
Learning
Mcast Grp
PIM-RP
204.181.21.5
Flood
224.0.1.95 204.181.1.16
204.181.1.16
Flood
224.0.1.95 204.181.1.16
204.181.3.67
Flood
224.0.1.95 204.181.1.16
204.181.1.5
Flood
224.0.1.95 204.181.1.16
esx10
esx11
VNI ‘Test’: 224.0.0.12
Aubie
WarEagle
vshield
vm-tiger
27
Where is my VM now?
spine0: show vmtracer interface vxlan Auburn
VTEP: ESX1
Role: vSwitch Switch/Port: ar16.foo.com/eth15
Name
VNIC
Status
State
IP Address
Aubie
Network Interface 1
Up/Up
vMotion
204.181.40.2
WarEagle
Network Interface 2
Up/Up
VM-FT-A
204.181.40.3
BooBama
Network Interface 1
Up/Down
-204.181.40.5
VTEP: ar24
NAT/PAT
No
spine0
Role: Router
Switch/Port: ar24.foo.com/loopback0
Status
#ARPs
leaf1
Up/Up
45
IP Address
204.181.40.1
VTEP: ar22 Role: Port-VTEP Switch/Port: ar22.foo.com/eth2
FQDN
IP
MAC VLAN
isilon16.foo.com 204.181.40.190 00-00-45-ab-12-fe
5
Up/Up
128.218.10.x
leaf2
Status
128.218.11.x
esx1
esx11
VNI ‘Test’: 224.0.0.12
Aubie
WarEagle
vshield
vm-tiger
28
THANK YOU
29