VMworld 2013: vCloud Hybrid Service Jump Start Part Three of Five: vCloud Hybrid Service: Advanced...
-
Upload
vmworld -
Category
Technology
-
view
139 -
download
3
description
Transcript of VMworld 2013: vCloud Hybrid Service Jump Start Part Three of Five: vCloud Hybrid Service: Advanced...
vCloud Hybrid Service Jump Start Part Three of Five:
vCloud Hybrid Service:
Advanced Networking and Security
Ninad Desai, VMware
Greg Herzog, VMware
Jon Kim, Force 3
Gregory Stemberger, Force 3
PHC5488
#PHC5488
2
What’s in It for You?
You will leave with:
An understanding of the vCloud Hybrid Service networking building blocks
A strong networking foundation for building a complex Hybrid Cloud
An understanding of advanced networking use cases and security
3
Agenda
vCloud Hybrid Service Introduction
• Basic Stack and Constructs
Networking
• Key Components • Network Virtualization
• Edge Gateway
• Services Overview
• Advanced Use Cases • Complex Networking
• Sharepoint Networking
• Datacenter Extension
Security
• Application Firewall
• Application Security
4
vCloud Hybrid Service Networking is Easy and Powerful
Key Takeaways
• Building blocks you are used to – vSphere, VXLAN, vCNS, vCD
• Flexible and Powerful
• Supports all your most complex networking
• IPSEC VPN
• Stretched Applications
• Layer 2 Extension - BYOIP
• Advanced application security
5
Minimum size: 120GB vRAM 30GHz vCPU
Starts at: 6 TB
50 Mbps allocated 1 Gbps burstable 3 Public IPs
Your own private cloud instance
Physically isolated
vCloud Hybrid Service: Any Mixture Of Two Flavors
Starts at: 2 TB
10 Mbps allocated 50 Mbps burstable 2 Public IPs
Logically isolated
Guaranteed resource allocation
Dedicated Cloud Virtual Private Cloud
Minimum size: 20GB vRAM 5GHz vCPU
(burst to 10GHz)
6
Dedicated vCloud Stack per Dedicated Cloud
Fully Integrated vCloud Stack
vCloud Management and Automation
vCloud Hybrid Service Management Console
vCloud Infrastructure
vCloud Networking and Security
vCloud Director with vCloud Connector
vSphere / vCenter
Customer A
Physically
Isolated Servers Storage pool VPN and
Network pool
…
Dedicated Cloud
7
Hybrid Service Basic Networking Constructs
Organization Network (isolated) Organization Network (Customer Controlled)
8
Network Virtualization in vCloud Hybrid Service
vCloud Hybrid Service
Networking & Security
vCloud Hybrid Service
vSphere
VXLAN
Integrated Management Console
Edge Gateway
Secures the edge of the virtual datacenter and
delivers network services:
Firewall
NAT
Load Balancer
Site-to-Site IPSec VPN
Active/Standby High Availability
Stateful Session Failover
VXLAN
Foundation for elastic portable virtual
datacenters. Encapsulation allows
Isolation between Organization Networks
Bring-your-own private IPv4 layer 3
address space
vCloud Hybrid Service Networking
• Nine routable IP spaces
• Intuitive design replicates traditional networks
• Customizable to support production applications
VDC 1 VDC 2
9
Available Services
Firewall – Basic Session
NAT – Basic Session
DHCP – Basic Session
Load Balancer
VPN
10
Edge Gateway Services – Load Balancing
Pool Servers
Load Balanced
- Round Robin
- IP Hash
- URI
- Least Connected
Virtual Server –
- Virtual IP (Public IP)
- Front end traffic
- Assigned to a server pool
Can have multiple virtual servers
and pools
Edge gateway
Load balancer
11
Load Balancer – Pool Servers
Pool Servers
• HTTP/HTTPS/TCP
• Load Balancing Methods
• IP Hash
• Round Robin
• URI
• Least Connected
• Health Check
• Each with +TCP as mode
• Monitoring Ports
• Add Servers
• Ratio Weight
• Change Ports/Services per Server
12
Load Balancer – Virtual Servers
Virtual Servers
• Apply on outside network
• Server Pool
• Persistence Method
• HTTP – Cookie
• HTTPS – Session ID
13
IPSEC VPN Overview
vCNS 5.1 Edge/vCloud Hybrid Service features include IPSEC VPN
• Definition:
• Internet Protocol Security (IPsec) is a protocol suite for securing Internet
Protocol (IP) communications by authenticating and encrypting each IP
packet of a communication session
• Create a secured tunnel using the IPSEC VPN service from one physical/virtual
datacenter to another
IPSEC is a framework of open standards
“Protect the series of internet tubes with VPN!”
14
VPN Architecture Diagram
vSphere (On-Premise)
Sharepoint-Routed Network
(10.0.10.0/24)
vCHS Edge Gateway
LEP – 69.194.137.230
Peer ID – 10.0.1.150
Peer IP – 68.108.102.47
10.0.1.150
10.0.10.1
External Router
10.0.1.1
68.108.102.47
192.168.109.1
vCloud Hybrid Service
69.194.137.230
vSphere Edge Gateway
LEP – 10.0.1.150
Peer ID – 69.194.137.230
Peer IP – 69.194.137.230
VPN Traffic Virtual
Machine 1
Virtual
Machine 2
Sharepoint-Default Routed Network
(192.168.109/24)
IP Protocol ID 50 (ESP)
IP Protocol ID 51 (AH)
UDP Port 500 (IKE)
UDP Port 4500
15
Hybrid Service is Just Another Site – Networking & Security
US East Region
US West Region
The Same
Networking
Topology
Full network
virtualization at
layer 2 and layer 3
Layer 2
Extensions
Your Data Center vCloud Hybrid Service
The Same
Security Policies
Integrated L4-7
services for
Firewall/NAT,
IPSec VPN, Load
Balancers, VXLAN
gateways
Primary
Regional Office
Regional Office
16
Advanced Use Cases
Complex Networking
Stretched Application Networking Example
• Sharepoint
Datacenter Extension
• Keep your same IP and MAC address
Force 3 Use Case
17
Complex Networking
Flexibile and Powerful
Can replicate existing complex topology
Same constructs you are used to
Don’t have to figure it out – weird mappings etc.
• Problem translating standard enterprise networking to new models
• Virtual Gateways, Security Groups, Elastic IPs
10 interfaces and additional Gateways if necessary
Supports existing virtual appliances
18
vCloud Hybrid Service Advanced Networking
Web Servers
VM
App Servers DB Servers
Organization Network (DMZ) Org Net 1
VM VM Log Servers
RSA
Edge Gateway
10 Total Interfaces
9 For Customer Use
Static Routes between Zones
3rd Party Appliance
Customer Supplied
F5, RSA, Cisco
Organization Network (Test/Dev)
Organization Network (Isolated)
VM
Org Net 1 Organization Network (App)
VM VM VM VM VM VM
19
Sharepoint Networking
Stretched Application
Uses Layer 3 Tunnel – IPSEC
Data stays on premise
Load Balancing and additional demand is in the cloud
Internet access in cloud for scalability
No holes in firewall – no direct access to internet traffic
20
VPN Architecture Diagram
Sharepoint-Routed Network
(10.0.10.0/24)
vCHS Edge Gateway
LEP – 69.194.137.230
Peer ID – 10.0.1.150
Peer IP – 68.108.102.47
10.0.1.150
10.0.10.1
External Router
10.0.1.1
68.108.102.47
192.168.109.1
69.194.137.230
vSphere Edge Gateway
LEP – 10.0.1.150
Peer ID – 69.194.137.230
Peer IP – 69.194.137.230
VPN Traffic
Internet Traffic
Virtual
Machine 2
Sharepoint-Default Routed Network
(192.168.109/24)
IP Protocol ID 50 (ESP)
IP Protocol ID 51 (AH)
UDP Port 500 (IKE)
UDP Port 4500
Sharepoint
VM SQL
VM
Domain
Controller
VM
Domain
Controller
VM
Local Sharepoint Application
vSphere (On-Premise)
Remote Sharepoint Application
vCloud Hybrid Service
21
When Would You Use Stretch Deployed Networks? DCE
Application Dependency on IP Address
Application Dependency on MAC Address
• Licensing requirement
External Application Interdependencies
• Hard Coded IP Addresses
• Lack of DNS usage
Existing Security Rules
• Switch ACL’s
• Existing Firewalls
22
DCE Logical Architecture (vSphere Private Cloud)
23
Stretched Network Considerations
Stretched virtual machines use On Premise Network Gateway
• All Network traffic traverses VPN
Active Directory Sites and Services
• “Stretched” network is part of On Premise Site in AD
• DNS/AD calls for vCloud servers will traverse VPN
• Cannot split a network between sites
vApp Limitations
• 128 Virtual machines per vApp
• Single vApp container with power operations
24
Stretch Deploy (DCE) Architecture Diagram
Stretch1
Local Application
vCloud Director (On-Premise)
vCHS Edge Gateway
10.0.1.150
10.0.10.1
External Router
10.0.1.1
68.108.102.47
Sharepoint-Default Routed Network
(192.168.109/24)
192.168.109.1
Remote Application
vCloud Hybrid Service
69.194.137.230
vSphere Edge Gateway
SSLVPN
Traffic
Stretch2
vShield Edge
192.168.2.101 192.168.2.102
10.0.10.6 10.0.10.7
Stretch1
Stretch-Routed vAPP Network
(192.168.2.0/24)
192.168.2.101
vShield Edge Sharepoint-Routed Network
(10.0.10.0/24)
Stretch-Routed vAPP Network
(192.168.2.0/24)
SSLVPN – Port 443
25
Force 3 Use Case
Jon S. Kim, Security Practice Director, Force 3
Gregory Stemberger, Principal Network Security Architect, Force 3
26
Case Study – Force 3, Inc.
Building Upon vCloud Hybrid Networking Model
Privatization of the Public Cloud
Enabling Advanced and Networking Functions
Cloud Becomes a Virtual Extension of the Enterprise
www.force3.com
27
Case Study Architecture – Force 3, Inc.
28
Advanced Security
Application Security
• Infrastructure
• Firewall
• User access
29
Application Security – Infrastructure Best Practices
Application segmentation
• Use dedicated cloud
• Segmented compute
• Segmented Network NIC
SharePoint Web application
Dev / Test
VDC 2
VDC 1
VDC 3
• Separate VDCs per use case
• Separate connectivity per use case
• Direct connect
• IPsec
Internet
Direct
Connect
IPSec VPN Dedicate
cloud
30
Firewall for Three Tier Applications
VDC
Allow:
HTTP
HTTPS
SSH
Mgmt
Allow:
HTTP
HTTPS
App -access
Allow:
App-access
SSH
Mgmt
(HTTPS)
Edge Gateway - Firewall
Allow:
SQL
Mgmt
Web tier
Allow:
SQL
SSH
Allow:
App tier
SSH
Mgmt
(HTTPS)
NAT/LB
Web tier App tier DB
31
Configuring Firewall Rules
32
Application Security – Access Rights
Administration rights
• Clearly identify individuals,
and rights that the
individuals get
• An enterprise admin
can have more than
one type of right
• Rights help enforce
secure cloud usage
User rights
• End user rights for VM owners
• End user cannot do any admin activity
• Users have limited visibility to
cloud resources
33
vCloud Hybrid Service Networking is Easy and Powerful
You will leave with:
An understanding of the vCloud Hybrid Service networking building blocks
A strong networking foundation for building a complex Hybrid Cloud
An understanding of advanced networking use cases and security
Key Takeaways
• Building blocks you are used to – vSphere, VXLAN, vCNS, vCD
• Flexible and Powerful
• Supports all your complex networking
• IPSEC VPN
• Stretched Applications
• Layer 2 Extension - BYOIP
• Advanced application security
34
Call to Action/Resources
Keep up with the latest on vCloud Hybrid Service
• Facebook - https://www.facebook.com/vmwarevcloud
• Blog - http://blogs.vmware.com/vcloud/
• Twitter - @vcloud
1
Call to Action
Get more information about the service: http://vcloud.vmware.com
Hands on Labs
HOL HBD 1301 vCloud Hybrid Service – Jumpstart for vSphere Admins
HOL HBD 1302 vCloud Hybrid Service – Networking and Security
HOL HBD 1303 vCloud Hybrid Service – Manage Your Cloud
Breakout Sessions – PHCxxxx
vCloud Hybrid Service Jumpstart Series
PHC1001-Group Discussion- vCHS Networking with Greg Herzog
2
35
Q & A
THANK YOU
vCloud Hybrid Service Jump Start Part Three of Five:
vCloud Hybrid Service:
Advanced Networking and Security
Ninad Desai, VMware
Greg Herzog, VMware
Jon Kim, Force 3
Gregory Stemberger, Force 3
PHC5488
#PHC5488