INTRODUCTIONAlthough multi-tenancy enables cloud service providers (CSPs) to offer customers the computing power they need at an appealing price, what happens under the hood is often a mystery. This is because multi-tenant environments often fall short in a number of areas, including:

• Built-in analytics to provide performance visibility

• Highly-elastic infrastructure to scale performance on demand

• Single point of control and management to simplify operations

• Security mechanisms to better protect applications

To address these issues, Avi Networks* developed a software-based Cloud Application Delivery Platform (CADP) that provides the visibility, high-availability, elastic scalability, application security, and single point of control needed by CSPs. The Avi Networks CADP combines the features of an application delivery controller (ADC), or advanced load balancer, with monitoring and analytics capabilities that allow CSPs to better understand their multi-tenant environment and offer rich, service-level agreement (SLA) based services to their customers. CSPs and end users can scale capacity up and down, only paying for the services they use.

Whereas many ADC solutions are appliance-based and designed for static, single-tenant environments, Avi Networks CADP is software-based and designed for multi-tenant private, public, and hybrid cloud, as shown in Figure 1. Avi Networks CADP running on Intel® Xeon® processors incorporates principles from network functions virtualization (NFV) and software-designed networking (SDN) to enable highly-elastic application delivery and a single point of control. As a result, the solution overcomes the challenges CSPs typically face when automating and integrating traditional ADCs into their multi-tenant cloud infrastructure.

Building Multi-tenant Application Delivery Solutions for Cloud Service Providers

Intel® Network BuildersSolution Brief

Avi Networks* Cloud Application Delivery Platform

Intel® Xeon® Processors

Avi Networks* applies NFV and SDN principles to improve the visibility, scalability, and controllability of cloud computing infrastructure based on Intel® Xeon® processors.

Giving CSPs more control over their multi-tenant

environments

MULTI-TENANCY CHALLENGES AND OPPORTUNITIESAs applications move to cloud-based infrastructures and mobile becomes the dominant endpoint, it is increasingly difficult to guarantee application performance and end-user experience. Consequently, large cloud service providers such as Amazon*, Facebook*, and Google* have changed out their fleets of proprietary ADC appliances. Instead, these web giants have internally developed analytics-driven, software-defined infrastructure services that enable them to efficiently and reliably deliver hyperscale applications on commodity hardware. However, most

CSPs do not have the engineering resources required to internally develop software for new application delivery architectures.1

Traditional ADC appliances lack end-to-end visibility into the end-user experience and cannot automatically scale capacity based on real-time application demands. As a result, CSPs are forgoing opportunities to offer their customers a higher level of service through appropriate performance monitoring, automatic scaling, and enforcement of SLAs at the tenant and the application level.

SOLUTION OVERVIEWAvi Networks Cloud Application Delivery Platform (CADP) is a software solution that utilizes real-time application visibility and end-user insights to optimize application delivery. It enables CSPs to offer rich application delivery services, such as elastic load balancing, application security, application acceleration, and real-time monitoring and analytics to tenant applications. The native integration with cloud management platforms, such as OpenStack*, ensures rapid deployment/provisioning and out-of-the-box automation.

Figure 1. Avi Networks* CADP in a Typical CSP Environment

2

The solution is built on the company’s HYDRA* architecture, which enables seamless scaling of network services within and across data centers and clouds, while maintaining a single point of management and control. The architecture separates the data, control, and management planes into individual system components, as shown in Figure 2:

• Avi Service Engines provide distributed data-plane services

• Avi Controller is the centralized policy and analytics engine

• Avi UI offers a rich user interface built on RESTful APIs

Avi Service Engines provide data-plane services for application delivery and also serve as distributed probes in the network, capturing hundreds of application metrics and transaction log data. They run on the same hypervisor as the applications they support and monitor.

Avi Controller acts as a central, multi-tenant, policy repository and provisions, configures, and scales Service Engines as needed. Additionally, it runs an

Figure 2. Main Components of the Avi Networks* Cloud Application Delivery Platform

analytics engine that provides real-time, highly-granular insights into application performance and end-user experience, without any application changes, server agents, or network taps.

Avi UI is a powerful web-based portal that enables CSPs to visualize, analyze, and control their end-to-end, user-to-application environment from a central location. Built-in support for multi-tenancy allows cloud providers to expose advanced functionality and monitoring capabilities directly to tenants without the need for building portals.

The Avi Networks “pay-as-you-use” model enables CSPs to charge tenants based on their usage of services, such as load balancing, application security, and acceleration (e.g., caching and compression). CSPs can customize services to create offerings on a per tenant basis. This model is essentially a zero-risk offering since CSPs do not have to remove existing load balancing services (no rip-and-replace), and they only pay for the Avi Networks services when tenants choose them over a legacy offering. Even more importantly, the built-in elasticity and auto-scaling of the Avi Networks’ CADP platform ensures compute resources in a CSP datacenter are only used as needed, resulting in significant reduction in the cost of service delivery.

Tenants can pick their overall capacity, from a free-tier to a terabit-class offering with thousands of applications. Capacity can be added and removed at run time

3

with a single click, allowing CSPs to dynamically respond to changing customer needs in real time.

ADDRESSING MULTI-TENANCY ISSUESUsing Avi Networks CADP, tenants can track SLAs for their business critical apps in a cloud environment, similar to what they are used to in their on-premises data centers. In addition, tenants benefit from user-to-application visibility and real-time analytics services, all of which is strong encouragement for customers thinking about moving their business-critical applications to the cloud. CSPs can offer these features to customers while maintaining a single point of control and management across all tenants.

Avi Networks CADP uniquely addresses other multi-tenancy issues unlike traditional, appliance-based ADCs. Examples include:

Built-in analytics to provide performance visibility

CADP has built-in analytics for measuring and visualizing application performance in real time. Avi Service Engines integrate data collectors for gathering end-to-end timing information, metrics, and logs for each user-to-application transaction. This information allows the Avi Controller to continuously monitor performance, which it correlates to server and network infrastructure logs.

Highly-elastic infrastructure to scale performance on demand

Avi Controller automatically adjusts ADC capacity for individual tenants in real time by scaling resources up and down based on the end-user and application insights derived by the inline analytics. The AutoScale feature allows a CSP to add tenants and applications, and increase throughput without worrying about capacity planning or having to add appliances. For example, Figure 3 shows how the Avi Networks model is consumption based, making it more cost-effective and scalable than appliance-based models.

Figure 3. Consumption-Based Model

4

Single point of control and management to simplify operations

Avi Controller is the single point of control, management, and integration for any number of tenants, applications, and users, allowing practically unlimited scalability for cloud environments such as OpenStack. Avi Controller itself is a multi-node, active-active cluster, which simplifies cloud integration and eliminates single points of failure.

Security mechanisms to better protect data

Avi Networks CADP offers high-performance SSL termination capabilities with perfect forward secrecy (PFS) and elliptic curve cryptography (ECC) to encrypt application traffic. All control-

plane data between Avi Controller and Avi Service Engines is encrypted using a secure shell tunnel. Within each tenant, L4-L7 role-based access control further limits the access of different users. Also, distributed denial-of-service (DDoS) mitigation protects against Internet attacks.

PLUG-AND-PLAY INTEGRATION WITH OPENSTACKAvi CADP runs natively on virtualized Intel Xeon processor-based servers within OpenStack and seamlessly deploys in both traditional networks and SDN environments. Avi Cloud Connector for OpenStack enables seamless integration with Nova, Keystone, Neutron, and LBaaS components, as shown in Figure 4, and offers:

Figure 4. Avi Cloud Connector for OpenStack*

• Automated provisioning of load balancing services

• Integrated multi-tenancy and role-based access control

• Elastic scaling based on application performance and end-user experience

• Real-time application monitoring and end-user transaction analytics

SDN AND NFV PRINCIPLES IN AVI NETWORKS CADPThe Avi Controller runs in the OpenStack administrator context and manages the Avi Service Engines in each of the tenant contexts to provide application delivery services. It also enforces strict control-plane and data-plane isolation to guarantee SLAs for each tenant.

Per SDN principles, the Avi Networks CADP separates the control and data planes:

Data-plane isolation: Each tenant gets a dedicated group of Avi Service Engines, which are auto-provisioned based on a tenant’s policies. This allows a tenant to scale performance automatically to match its SLAs without affecting the performance of other tenants and with complete resource isolation from other tenants.

Control-plane isolation: Each tenant has complete policy control over and visibility into its applications. Within each tenant, role-based access control further limits the access of different users.

5

Per NFV principles, the Avi Networks services are software-based, virtual network functions (VNFs), including load balancing, application acceleration, SSL termination, and real-time analytics functions.

HIGH-PERFORMANCE COMPUTING PLATFORMAvi Networks CADP runs on powerful Intel Xeon processors that deliver significant benefits in performance, power efficiency, virtualization, and security. Combining these benefits with a low total cost of ownership and Intel’s acclaimed product quality, these processors provide a compelling hardware foundation for cloud infrastructure.

Moore’s Law

Continuing Moore’s Law, Intel Xeon processors allow CSPs to take advantage of regular performance improvements, from generation to generation, without modifying their code base. Computing performance is expected to increase over time with Intel’s continued innovations in manufacturing process technology and processor microarchitecture, which offer software investment protection to the industry.

Security

Avi Networks uses Intel® Advanced Encryption Standard New Instructions (Intel® AES-NI) to implement some of the

complex and performance intensive steps of the AES algorithm. Intel AES-NI can be used to accelerate the performance of AES functions by 3 to 10 times over a software-only implementation.2,3

Packet Processing

Many equipment manufacturers are reducing the cost and complexity of packet-processing devices by using general-purpose processors instead of specialized processors and ASICs – the traditional approach. This transition is possible with the Data Plane Development Kit (DPDK), which was created by Intel and delivers significant data plane performance improvement3,4 on Intel® processors.

DPDK enables Intel processor cores to process packets continuously – unimpeded by the operating system, other applications, or interrupts – and thus, greatly increases performance.4 At the same time, the other available processor cores can run control plane and application software, allowing equipment manufacturers to consolidate multiple workloads onto a single system. DPDK is supported by a vibrant, open source community that provides free, BSD-licensed source code.

For more information about the DPDK, visit dpdk.org.

APPLICATION DELIVERY WITH INTEGRATED ANALYTICSThe complexity of multi-tenant infrastructure has many CSPs looking beyond traditional, appliance-based ADC solutions in order to get a higher level of visibility, scalability, and controllability. Changing the rules of the game, Avi Networks developed a software-based, L4-L7 solution, called Cloud Application Delivery Platform (CADP), which incorporates principles of SDN and NFV. Running on high-performance Intel Xeon processors, Avi Networks CADP overcomes major multi-tenant challenges by providing highly-elastic application delivery and a single point of control. As enterprises and CSPs take OpenStack from their pilot/lab environments into production deployments, Avi Networks CADP fills in critical gaps for application delivery, security, acceleration, and real-time visibility and analytics services.

For more information about Avi Networks CADP, go to https://avinetworks.com.

For more information about Intel® solutions for communications infrastructure, visit www.intel.com/go/commsinfrastructure.

For more information about NFV- and SDN-based solutions, visit https://networkbuilders.intel.com.

6

For more information about Avi Networks CADP, visit https://avinetworks.com.

DisclaimersIntel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely

secure. Check with your system manufacturer or retailer or learn more at https://avinetworks.com/.

Intel, the Intel logo, and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries.

*Other names and brands may be claimed as the property of others.

© 2015 Intel Corporation

1 Source: Avi Networks*, “Avi Networks Launches First Cloud Application Delivery Solution -- Brings Benefits of Hyperscale Architecture to Enterprises, at Any Scale,” http://www.marketwired.com/press-release/avi-networks-launches-first-cloud-application-delivery-solution-brings-benefits-hyperscale-1975635.htm.

2 Source: Intel web site, Intel® Advanced Encryption Standard New Instructions (Intel® AES-NI), Feb 2, 2012, https://software.intel.com/en-us/articles/intel-advanced-encryption-standard-instructions-aes-ni and https://software.intel.com/sites/default/files/article/165683/aes-wp-2012-09-22-v01.pdf.

3 Performance tests and ratings are measured using specific computer systems and/or components and reflect the approximate performance of Intel® products as measured by those tests. Any difference in system hardware or software design or configuration may affect actual performance. Buyers should consult other sources of information to evaluate the performance of systems or components they are considering purchasing. For more information on performance tests and on the performance of Intel products, visit Intel Performance Benchmark Limitations.

4 Performance estimates Performance estimates are based on L2/L3 packet forwarding measurements. See http://www.intel.com/content/dam/www/public/us/en/documents/solution-briefs/communications-packet-processing-brief.pdf.

7

Solution Provided By: